1. National Critical Infrastructure Regime

Ley 8/2011, de 28 de abril, por la que se establecen medidas para la protección de las infraestructuras críticas.

Art. 2 defines critical infrastructure, Art. 4 creates the Catálogo Nacional de Infraestructuras Estratégicas - which is confidential.

Banking and Financial Market infrastructure is explicitly listed as a critical sector:

critical infrastructures, both physical and virtual, including energy, transport, water, health, communications, media, data processing or storage, aerospace, defence, electoral or financial infrastructure, sensitive facilities

Consequences:

• Operators designated as Critical Operators must create Operator Security Plan and Specific Protection Plan.
• Banking operators like BME / Iberclear, SWIFT hubs in Spain, major banks' data processing centers are in catalogue.
• IMF FSAP 2024 noted that neither Banco de España nor CNMV were formally involved in critical infrastructure designation, though they should be.

This law does NOT directly restrict ownership, but it triggers the second regime.

2. Foreign Direct Investment Screening - The Real Ownership Restriction

Law 19/2003, Art. 7 bis, as amended by RDL 8/2020, 11/2020, 34/2020 and RD 571/2023 transposing EU Regulation 2019/452.

You need prior authorization from Council of Ministers (after Junta de Inversiones Exteriores report) if you have:

A) FDI definition:

• Investor is non-EU/EFTA resident, OR EU/EFTA resident with >25% beneficial ownership by non-EU/EFTA
• AND acquires >=10% of capital of Spanish company OR control per Art. 7.2 Ley 15/2007 (Spanish Antitrust Act)

B) And one of two conditions:

Sector-based trigger: Target active in strategic sectors. List is numerus clausus:
a) Critical infrastructures (as above)
b) Critical and dual-use technologies
c) Key technologies for industrial leadership
d) Supply of fundamental inputs - energy, strategic connectivity, raw materials
e) Sectors with access to sensitive information (personal data, official databases not public, GDPR Art 35(3) assessment)
f) Media

The challenge is the list of critical infrastructures in Spain is confidential, so every target must be analysed.

Investor-based trigger - regardless of sector:
a) Controlled by third-country government
b) Has made investments in sectors affecting security/public order in another Member State
c) Serious risk of criminal activity - proxy: administrative/judicial sanctions in last 3 years on AML, environment, tax, data protection

Thresholds & Procedure after RD 571/2023:

• < €1M: exempt
• €1M - €5M: simplified procedure by Directorate General for International Trade and Investment

€5M: Council of Ministers, 6 months negative silence (deemed denied if no decision)

• Temporary EU-investor regime: From RDL 9/2024, until 31 Dec 2026, EU/EFTA residents investing in listed companies or >€500M unlisted deals in strategic sectors also subject to screening

Sanction for gun-jumping: Transaction is void and without legal effect + fine from €30,000 up to value of investment. MINECO analysed ∼264 investments since 2020, only 1 prohibited, ∼24 with remedies until 2023, but now imposing fines.

3. Banking Prudential Ownership Restrictions

Independent of FDI, Ley 10/2014 de ordenación, supervisión y solvencia de entidades de crédito (transposing CRD IV) governs qualifying holdings.

Qualifying holding = 10% or more of capital or voting rights, or possibility to exercise significant influence. This aligns with ECB Guide.

Prior non-opposition needed to cross: 10%, 20%, 30%, 50% thresholds, or control.

• For Significant Institutions (Santander, BBVA, CaixaBank, Sabadell, Bankinter, Unicaja under SSM): proposal drafted by Banco de España, decision by ECB.
• For Less Significant Institutions, payment institutions, e-money institutions: Banco de España. For investment firms/asset managers: CNMV.

ECB assessment criteria: reputation of acquirer, fit & proper of directors, financial soundness, compliance of target with prudential requirements, AML risk. ECB published final guide to make this predictable.

4. Case Law

A. CJEU Golden Shares - The Foundation:

Spain had broad discretionary powers to block energy and banking mergers. CJEU struck them down as unjustified restrictions on free movement of capital (Art. 63 TFEU) and establishment (Art. 49):

• C-207/07 Commission v Spain ECR I-111: Spanish law requiring prior approval by national energy regulator (CNE) of acquisitions in energy companies - including when banks owned them - breached EU law. Court held prior approval system not proportionate.[2008]
• C-274/06 Commission v Spain and C-338/06 Commission v Spain - Same logic applied to strategic sectors. Tribunal: derogation from ordinary company law ensuring public authorities' participation beyond shareholder status violates EU law.
• These cases are why Spain cannot have a general "critical infrastructure veto" - it must use the EU Regulation 2019/452 proportionate screening.

B. BBVA v Sabadell (2024-2025) - The leading current banking case:

Facts: BBVA launched hostile takeover for Banco Sabadell (€12bn). CNMC conditionally approved April 2025, but Spanish Government imposed additional operational restrictions - most notably 3-year (potentially 5-year) legal separation, no merger, protection of jobs/SMEs.

• Spanish law Art. 26 Ley 10/2014: government could not prevent BBVA from acquiring Sabadell's shares but held final authority over whether a merger proceeded, citing protection of general interest.
• European Commission Pilot procedure (June 2025): Commission deemed Madrid's broad discretionary powers as unjustified restrictions on freedom of capital movement, invoking Art. 21(4) EU Merger Regulation. Commission argues golden power should be reserved for "narrower risks like critical infrastructure control". This is now pending - first time EU challenges Spain under CRD VI banking union rules.

This case will define how far Spain can invoke critical infrastructure/financial stability to condition bank mergers.

C. Spanish National Case Law:

• STS 26 May 2020 (Banco Popular resolution): Supreme Court upheld that shareholders losing 100% in resolution is not expropriation, as financial stability (critical infrastructure) overrides property rights under BRRD.
• AN Audiencia Nacional cases on FDI: Multiple 2022-2023 judgments confirming MINECO can impose conditions e.g., excluding certain activities from transaction that affect critical sector.

Practical takeaway for banking investors in Spain:

1. If non-EU/EFTA acquiring ≥10% of Spanish bank or its critical IT subsidiary: you need TWO approvals - FDI (Council of Ministers) + Prudential (ECB/Banco de España).
2. If EU acquiring same: only prudential approval, unless until 31 Dec 2026 and target is listed or >€500M and active in critical infrastructure - then also FDI.
3. Filing order: FDI first, as nullity risk is absolute. ECB will ask if FDI filed.
4. Expect 3-6 months, broad information requests on ultimate beneficial ownership, market shares in critical inputs.