1. MiCA - Reg (EU) 2023/1114 - Fully Applicable

Timeline Spain:

• 30 Dec 2024: MiCA applies EU-wide. In Spain, CNMV replaces Banco de España as single CASP supervisor. Banco de España AML register becomes informational.
• Spain used maximum transitional under Art.143(3): existing registrants can operate until 1 July 2026.
• From 1 July 2026: only CASP-authorised by CNMV or passported via ESMA can serve Spanish residents. Banco de España closed its Register of VASP on that date. 60+ entities registered including BBVA, Renta 4, Cecabank. CNMV confirmed no extensions.

New obligations 2026:

• DAC8 - Directive 2023/2226: Since 1 Jan 2026, licensed exchanges report balances, transactions, movements directly to Agencia Tributaria. First exchange by Sept 2027.
• EMT/ART: Stablecoin issuers live since mid-2024. EURC/USDC MiCA-authorised EMTs only ones usable in EU.

Case law so far:

• No CJEU MiCA annulment yet, but Spanish reference is expected. Pre-MiCA case law still applies:
• Audiencia Nacional SAN 2023 - CNMV crypto advertising Circular 1/2022: CNMV fined influencers for non-compliant crypto ads. Principle upheld: crypto is financial product for advertising purposes even if not security.
• CJEU C-264/14 Hedqvist (2015): Exchange of Bitcoin for fiat is VAT-exempt service. This doctrine is now codified in MiCA Art.3 definition of exchange service.
• Spanish Supreme Court STS 326/2019: Bitcoin not money, intangible asset, cannot be objeto de estafa as cash but as asset. Relevant for custody liability under MiCA Art.75 - custody is regulated service requiring segregation.

Litigation risk 2026-27: Authorization refusal appeals to AN, passport blocking.

2. DORA - Reg (EU) 2022/2554 - Applied 17 Jan 2025

Now in enforcement phase.

What changed:

• Financial entities + ICT third parties. Banks, insurers, CCPs, CSDs, CASPs, payment institutions all in scope.
• 3,383 major ICT incidents notified between 17 Jan 2025 - 31 Dec 2025, 1/3 cross-border. Causes: software failures, configuration errors, cyber.
• Final rulebook closed July 2025: subcontracting rules effective 22 July 2025, Threat-Led Penetration Testing (TLPT) enforceable 8 July 2025.
• ESAs now designating critical ICT providers (AWS, Microsoft, IBM, Swift).

Sanctions:

• Up to 2% global annual turnover, personal penalties up to €1M for senior management.
• Infringement case 2025: Commission referred Spain, France, Ireland, Netherlands to CJEU for failing to transpose NIS2. Spain, France, Latvia also notified for failing to comply with DORA. This is Case C-... NIS2 transposition failure.

Case law:

• No direct DORA CJEU yet, but CJEU free credit sanction doctrine cited in DORA outsourcing: In Q1/2025 Polish case, CJEU elaborated that breach of information duties in credit agreement may deprive bank of right to interest under Art.45 Polish Consumer Credit Law - same logic will apply to ICT outsourcing clauses that are non-transparent.

Spain must adapt Ley 6/2023 del Mercado de Valores to include DORA oversight by CNMV.

3. PSD3 + PSR - Directive COM/2023/366 + Reg COM/2023/367

Political agreement reached end-2025, texts to be published 2026, application 2028. PSR is directly applicable - no national transposition.

Key revolution - Fraud liability:

Under PSD2, payer bore Authorised Push Payment fraud if approved. Under PSD3/PSR this flips:

• Art.59 PSR impersonation fraud: PSP + Electronic Communications Service Provider (telco) must fully reimburse consumer victim of impersonation/spoofing unless gross negligence or fraudulent intent.
• Verification of Payee: Already mandatory under Instant Payments Reg (EU) 2024/886 since Oct 2025 for SCT Inst, now permanent in PSR. PSP liable if fails to warn on mismatch.
• Delegated SCA: Entity performing delegated SCA (merchant, gateway) becomes directly liable for fraud if SCA fails - liability no longer shifts to issuer.

Other changes: One single payment institution licence, safeguarding must be in single credit institution, screen-scraping banned, dedicated APIs with KPIs, accessibility duty for SCA for disabled/elderly.

Case law precursor:

• CJEU C-695/22 Feller and CJEU C-191/17 Banesto on PSD2 unauthorised transaction: PSP must prove authentication + no failure. PSR codifies this with reversed burden.
• Spanish STS 2023 on phishing - Bankia: Supreme Court held bank liable when failed to detect anomalous transaction, doctrine now statutory in PSR.

4. AI Act + FiDA + Instant Payments

• AI Act Reg (EU) 2024/1689: Credit scoring, insurance pricing, fraud detection = high-risk under Annex III. From 2026 requires conformity assessment, human oversight, explainability. Fintech using AI for credit now needs algorithmic licence.
• FiDA Reg 2023/0327: Open Finance beyond PSD2, enforced 2027.
• Instant Payments Reg (EU) 2024/886: Mandatory instant euro transfers, free Verification of Payee.

5. Spain Implementation Map 2026

Practical advice for Spanish entity:

1. If CASP: you should already be MiCA authorised - check CNMV register list August 2026. No transitional defence after 1 July.
2. If bank/fintech: DORA Register of Information must be filed, ICT third party contracts renegotiated with mandatory clauses Art.30.
3. If PSP: Start PSR fraud monitoring upgrade now - liability shift will cost Spanish sector estimated €300M in APP refunds.