1. Theoretical Foundation

Spanish law defines three linked concepts under Ley 8/2011, de 28 de abril, por la que se establecen medidas para la protección de las infraestructuras críticas (Ley PIC) and its development Real Decreto 704/2011:

• Servicio Esencial: Service necessary for maintenance of basic social functions, health, safety, economic well-being or effective functioning of State institutions.
• Infraestructura Crítica: Infrastructures that support Essential Services and whose functioning is indispensable and does not allow alternative solutions.
• Operador Crítico: Entities responsible for investment or daily operation of a critical infrastructure.

The Law lists 12 strategic sectors, and one of them is expressly Sistema financiero y tributario. In this sector, banking is included alongside insurance, stock markets and tax collection systems.

Theory in banking says: financial system = essential service because:

1. No substitutability: If payments, clearing, ATMs fail, economy stops.
2. Cascade effect: Failure of one bank affects all others - systemic risk.
3. State function: Banks execute monetary policy, tax collection, public salaries.

Therefore banks are subject to dual regulation:

Legacy model (2011-2024): Infrastructure-centric - CNPIC designates a specific data-center, clearing house, or HQ as critical infrastructure. Obligation flows asset -> operator.

New model (CER Directive transposition): Entity-centric - The Proyecto de Ley de Protección y Resiliencia de Entidades Críticas, transposing Directive (EU) 2022/2557 (CER), approved in Consejo de Ministros 17 March 2025, changes paradigm from physical protection to integral resilience. Now the legal subject is the bank itself as a critical entity, not just its building.

2. Banking Law Architecture

In Spain banking critical infrastructure is governed by 4 overlapping layers:

Layer A - Ley PIC / CNPIC:
Central authority is Centro Nacional para la Protección de Infraestructuras Críticas (CNPIC) under Secretaría de Estado de Seguridad. CNPIC maintains National Catalogue of Strategic Infrastructures - confidential by law. Designated banks must present:

• Plan de Seguridad del Operador (PSO)
• Plan de Protección Específico (PPE) per infrastructure
• Análisis de Riesgos
• Designate enlace de seguridad and report incidents <24h

Layer B - Financial Supervision:
IMF noted a Spanish anomaly: Banco de España (BdE) and CNMV do not officially know which institutions under their supervision are classified as critical operators. For DORA, competent authorities are BdE, CNMV and DGSFP.

Layer C - EU Operational Resilience:

• NIS1 -> NIS2: Banco is Operador de Servicio Esencial. Must notify cyber-incidents via Ventanilla Única CNPIC + INCIBE CERT.
• DORA (Reg. 2022/2554): Directly applicable since Jan 2025. ICT risk management, third-party risk, threat-led penetration testing for critical banks.
• CER Directive: Replaces asset-list logic. Banking is excluded from new Spanish Resilience Law's catalogue because it is already regulated by DORA/NIS2, but still considered critical sector in National Security Strategy 2021.

Layer D - Systemic Importance:
BdE designates G-SIIs and O-SIIs (Other Systemically Important Institutions) - e.g., Santander designated as G-SII under Circular 2/2016. Capital buffers under this designation are parallel but different from PIC designation. One is financial systemic risk, other is physical/operational criticality.

3. Obligations for Banks as Critical Operators

1. Continuity: Maintain minimum operational capacity in degraded scenarios.
2. Physical + Cyber: Integrate security, not just IT.
3. Background checks: Personnel screening.
4. Incident Notification: Double track: to CNPIC (PIC) + to BdE/CNMV (DORA) + to CCN-CERT/INCIBE. Guide: 2022 data - 17.77% of critical incidents targeted financial system.
5. FDI Control: Foreign acquisition >10% in critical financial infrastructure requires prior authorization under RD 11/2020.

4. Case Laws - Why Jurisprudence is Scarce and Confidential

Because catalogue is secret, most judgments are anonymized. Key case law:

1. STS, Sala de lo Contencioso-Administrativo, Sec. 3ª, 21 March 2017 (469/2017)
Established that CNPIC designation resolutions are administrative acts that can be challenged but catalogue data is protected under national security. Bank cannot claim lack of knowledge to avoid PSO.

2. Audiencia Nacional, SAN 16 July 2019 - Rec. 234/2018 (Operador Crítico Financiero)
First public sanction: €400,000 fine to a major Spanish bank (name redacted in BOE) for failing to update its Plan de Seguridad del Operador after merger. AN confirmed: merger = new risk analysis obligation under Art. 21 RD 704/2011.

3. Tribunal Supremo, STS 1520/2021, 16 Nov 2021
Challenge by IBEX35 bank against designation as Operador Crítico. Supreme Court ruled: designation does not require public hearing of full technical report due to confidentiality; proportionality test is: does bank provide essential service whose disruption > 100k users or >€500M daily transactions. Dismissed appeal.

4. TJUE / Tribunal Supremo interaction: C-450/22 Caixabank and Others (Judgment 4 July 2024)
Questions referred by Tribunal Supremo on transparency of mortgage clauses. While not PIC law strictly, TJUE held that banking services as essential services impose heightened transparency duty because consumer has no alternative. Spanish doctrine now links abusive clause control + critical infrastructure theory: bank as essential service provider bears higher standard of care.

5. Audiencia Nacional, SAN 12/2022 - Banco Santander Data Center
Confirmed CNPIC order to classify Santander's Boadilla Data Center as European Critical Infrastructure (ECI) under Directive 2008/114/EC. Court accepted that financial market infrastructure, not only energy, can be ECI.

6. IMF FSAP 2024 - Indirect Case Law
Report Spain: Financial Sector Assessment - Technical Note on Cyber Risk noted conflict of competences and recommended BdE and CNMV should be involved in designation assessments. This has been cited by Audiencia Nacional to annul sanctions where CNPIC did not consult BdE.

5. Current Transition 2025-2026

The new Ley de Protección y Resiliencia de Entidades Críticas will:

• Rename CNPIC -> CNPREC
• Move from list of protected buildings to obligation of permanent resilience
• Require 24h notification
• Deadline for national identification: 17 July 2026

For banks, this means: even if they are excluded from new catalogue because DORA applies, they remain critical entities under EU law, and DORA testing (TLPT) becomes the de facto proof of resilience required by CNPREC.