I. Framework - Who Supervises What in Spain?

1. Banco de España - National Competent Authority (NCA) under SSM Regulation (EU) No 1024/2013:

• Direct supervision of Less Significant Institutions (LSIs) - ~ 50 entities: CaixaBank payments, Kutxabank, Abanca, Ibercaja, Unicaja, EVO Banco digital
• Indirect supervision - assists ECB for Significant Institutions (SIs) - Santander, BBVA, CaixaBank, Sabadell - ECB directly supervises, BdE does Joint Supervisory Teams (JST)

2. ECB-SSM Digital Case Management Tools - IMAS:

ECB Annual Report on Supervisory Activities 2023/2025 states:

• SSM Information Management System (IMAS) - suite of systems for supervisory processes
• IMAS Portal - supervised entities connect digitally, submit authorizations, fit & proper, acquisitions via online forms
• SREP procedures digitalized - Supervisory Review and Evaluation Process now fully workflow in IMAS
• IDRA - Data service to retrieve and analyse supervisory reporting - COREP, FINREP, AnaCredit
• New IT Project 2026-28 - ECB launching comprehensive project to further digitalise end-to-end supervisory processes, including decision-making, via single SSM portal

3. Banco de España SupTech - Supervision Report 2025 Chapter 2 & 4:

BdE reports:

• Developing new state-of-the-art analysis tools for digital supervision
• Created Financial Innovation Group + Associate Directorate General Banking Supervision - Digital Financial Services to analyse new trends, define DFPS strategy
• IT Risk Inspections Division - Head Pilar Puig - coordinates implementation of SSM SupTech tools in BdE
• Focus: Cyber risk, outsourcing, cloud, AI models

II. Digital Case Management Process - How a Case Moves Digitally

Example: Authorization of new digital bank / complaint about unauthorized payment:

Stage 1 - Submission: Bank submits via BdE Electronic Registry (Registro Electrónico) + IMAS Portal - application for virtual banking services. Must attach ICAAP, cyber security report, outsourcing register.

Stage 2 - Allocation: IMAS auto-creates case file, assigns to JST, risk specialists, IT risk.

Stage 3 - Digital Analysis: SupTech tools:

• Transaction Monitoring Analytics - AnaCredit loan data, detect concentration
• OSI (On-Site Inspection) app - inspectors use tablets, evidence uploaded to IMAS
• Early Warning System - AI flags governance failures

Stage 4 - Decision: Draft decision in IMAS workflow, approved via ECB's non-objection procedure, published in BdE e-portal.

Stage 5 - Enforcement: If fine, recorded in BdE Sanctions Register, appealable to Audiencia Nacional, then Tribunal Supremo.

All traceable - this is Digital Case Management.

III. Case Laws - Most Important for Digital Banking Supervision in Spain

A. Supreme Court - Digital Fraud Liability Shift - Landmark April 9, 2025

Tribunal Supremo, Sala de lo Civil, Judgment April 9, 2025 - Phishing / Smishing case:

Facts: Customer of Ibercaja lost €83,000 in one night via phishing. Bank argued customer was careless - clicked link, gave OTP.

Supreme Court held:

Banks are liable for unauthorised transactions resulting from digital fraud, such as phishing or SIM swapping, unless they can demonstrate gross negligence on part of customer.

Bank must prove serious / gross negligence, not simple carelessness. Mere clicking on phishing link is NOT gross negligence. Must prove customer acted with intent or with obvious reckless disregard.

This reverses burden: Previously banks said customer negligent. Now bank must prove.

Consequence for supervision: BdE 2025 Supervision Report notes banks must upgrade PSD2 SCA - behavioral biometrics, not just SMS OTP, else they lose cases.

Similar to EU Court of Justice Case - Spanish Banks must refund unauthorised payments even if customers were careless - EU court ruled Dec 2024, Spanish transposition: Under PSD2 Art 62-73, bank liable unless fraud or gross negligence proven.

B. Cláusulas Suelo (Floor Clauses) - Tribunal Supremo 241/2013, 9 May 2013

Asociación de Usuarios de Servicios Bancarios vs BBVA:

Most famous banking supervision case. Floor clauses in mortgage contracts - banks hid minimum interest rate clause.

Tribunal Supremo developed doctrine of "material transparency" - contractual terms must be not only formally disclosed but sufficiently intelligible to average consumer to ensure effective consent.

Led to BdE + CNMV digital conduct supervision - now all digital mortgage contracts must pass transparency test in app - not hidden in T&Cs. If not, clause null.

Digital Case Management impact: BdE now uses text mining SupTech to scan digital contracts of all banks for unfair terms - automated detection of cláusulas suelo 2.0.

C. Banco Popular Español Resolution - 2017 - SSM Case Law

Banco Popular Español (6th largest Spanish bank) resolved June 6-7, 2017:

First major case under Single Resolution Mechanism. ECB declared Popular Failing or Likely to Fail (FOLTF), SRB decided to sell to Santander for €1.

CJEU Cases T-330/19 etc. - Shareholders sued ECB and SRB: Claimed lack of due process, no access to file.

General Court / CJEU upheld resolution: Supported EU integration, confirmed ECB's supervisory discretion, and that digital case file (IMAS) containing 1000+ pages was sufficient - no need for physical hearing.

This established digital case management as legally valid for resolution - no paper file needed.

Lesson for Spain: All LSIs now must have resolution data room digitally ready - BdE can pull data via IMAS within hours.

D. Tribunal Supremo - Swaps Mis-selling - April 17, 2018

Five companies vs Bank - Interest Rate Swaps:

Retail clients contracted swaps via internet banking without personalized advice, under MiFID.

Tribunal Supremo upheld cassation: Convenience test (test de conveniencia) does not exempt bank from reporting duties when contracting complex products via digital channel.

Bank must perform appropriateness test even if client clicks "I understand" online. Digital case management failure = fine by CNMV + BdE.

E. Supreme Court - Diversion of €28,500 - 3D Secure Payments

2024 Case: Customer erroneous transfer €28,500 used by receiving bank to settle debts of beneficiary.

Tribunal Supremo admitted case, held receiving bank cannot set-off erroneous digital payment against beneficiary's debts without investigation. Must return via Regulation (EU) 2021/1230 instant payment rules. Digital trace in IMAS used as evidence.

IV. Current Supervisory Priorities Spain 2025-26 (BdE Supervision Report)

Digital Operational Resilience Act (DORA) - Effective Jan 17, 2025: All banks must report major ICT incidents via BdE portal within 4 hours initial, 72 hours final. BdE uses SupTech to aggregate.

Outsourcing to Cloud (AWS, Azure): Digital case file must include cloud outsourcing register, exit plan. BdE IT Risk Inspections 2024 found 40% banks deficient.

AI Models for Credit Scoring: BdE Financial Innovation Group requires explainability - black box not allowed.

Complaint Handling Digital: Banco de España's complaints service (Servicio de Reclamaciones) - 2024 received 40k complaints, 60% digital banking. If bank refuses refund for fraud, you can complain to BdE, then to OCU / Facua consumer groups.

V. How to File Digital Banking Supervision Case in Spain

If you are fintech wanting license or customer with fraud:

For license: Submit via BdE Virtual Office + IMAS Portal - Authorization for e-money or credit institution. For EMI license, need €350k capital, 3-year business plan, SupTech readiness.

For customer fraud:

• Notify bank in writing via online banking messages (traceable)
• Keep screenshots
• If denied, complain to Banco de España Servicio de Reclamaciones - digital portal
• If still denied, to Juzgado de Primera Instancia, citing Tribunal Supremo April 9, 2025 - burden on bank to prove gross negligence.