1. The Regulatory Framework

A. EU Level - Directly Applicable

1. DORA - Regulation (EU) 2022/2554 - Digital Operational Resilience Act
Fully applicable since 17 Jan 2025 in Spain. BdE is responsible for implementing DORA. Covers banks, payment institutions, e-money, investment firms, insurers, FMIs.

What it requires for Emergency Communication:

• Art 5-15 ICT Risk Management Framework: Board is ultimately responsible. Must have crisis communication plan, internal escalation, external stakeholder communication.
• Art 11-14 Response & Recovery: Dedicated crisis communication function, business continuity plans (BCP) and disaster recovery, with communication protocols to activate when critical functions are impacted.
• Art 17-23 Incident Reporting: Mandatory reporting of major ICT incidents to BdE/CNMV within 4h initial, 72h intermediate, 1-month final. Voluntary reporting of significant cyber-threats. BdE has specific electronic procedure that receives mandatory reports of major ICT incidents and major operational or security incidents related to payment services.
• Art 28-30 ICT Third-Party Risk: Bank must ensure its critical ICT providers have emergency communication obligations in contracts.
• Threat-Led Penetration Testing (TLPT) for significant institutions.

2. PSD2 Major Incident Reporting - RD-Law 19/2018 transposing PSD2 + EBA/GL/2017/10
BdE declared intent to comply with EBA Guidelines on major incident reporting under PSD2.
PSPs - comprising credit institutions and others - reported 26 major operational or security incidents in 2025 report cycle. Classification: incident with material adverse impact on integrity, availability, confidentiality, authenticity and/or continuity of payment services. Must notify BdE and users without undue delay.

B. Spanish National Level

3. Royal Decree-Law 8/2023
Applies DORA obligations to payment system operators, payment scheme operators, electronic payment arrangement operators, processors and other tech providers. Designates Banco de España as supervisor. This closes the gap for embedded processors used by banks.

4. Banco de España Circular 3/2020 on Outsourcing + Circular 2/2016
Requires banks to maintain:

• Internal Crisis Committee and Communication Board for emergencies
• Business Continuity Plans with recovery time objectives (RTO) and communication cascade
• Register of Information on ICT third parties - must be reported to BdE.

5. Law 10/2014 on Banking Regulation + Law 7/2020 Sandbox
Requires prudential supervision of operational risk and governance. BdE explicitly positions cyber incidents as leading threat to financial stability, noting severe operational disruption can trigger confidence loss and liquidity pressure.

2. What "Emergency Communication System" Must Contain for a Spanish Bank

Regulators audit 3 channels:

1. Internal Emergency Communication:

• 24/7 SOC to Board escalation in <1h
• Crisis communication plan with defined roles (CISO, COO, CRO, Comms)
• Backup communication systems independent from primary ICT (out-of-band)

2. Regulatory Communication:

• DORA: Initial notification to BdE within 4h from classification, intermediate 72h, final root-cause 1 month. Via BdE electronic procedure.
• PSD2: Major operational/security incident to BdE and to EBA via BdE.
• SEPBLAC, ECB/SSM (for significant banks), CNMV if market impact.
• Bank of Spain can end sandbox testing in cases of unprofessional conduct.

3. Client / Public Communication:

• PSD2 Art 96: Inform payment service users immediately on incident affecting their services, measures to mitigate.
• DORA Art 14: Communication to clients when incident has impact on them.
• Spanish General Law for Defence of Consumers + Circular 5/2012: Clear communication of unavailability, alternative channels.

3. Case Law - Spain

Spanish courts have shaped emergency communication through consumer protection and notification validity:

a) Nullity of Clauses Exonerating Banks for Communication Failures

STS 792/2009, Supreme Court, 1st Chamber, 16 Dec 2009 - Declared void 13 standard clauses between banks and customers. Clause 8: "Those which free the institution from responsibility for damage caused due to transmission failures during an online operation.".

Principle: Bank cannot contractually exclude liability for failure of its emergency / IT communication systems. If online banking fails during emergency, bank remains liable.

b) Duty to Inform in Digital Channels

STS 489/2015, 16 Sept (RJ 2015/5013) and STS 9 April 2025 (recent phishing line) + STS 571/2025 Ibercaja Phishing: Supreme Court holds that use of internet banking does not exempt bank from information duties as investment services entity, and unless bank proves client acted with intent or gross negligence, it must assume fraud loss. Applied to emergency comms: when fraud / outage occurs, bank must prove it activated emergency communication and warning systems.

c) Validity of Emergency Notifications

STS 1221/2025 (Rec 926/2024) of 1 Oct 2025, ECLI:ES:TS:2025:4269: Supreme Court reinforced principle that notification is valid only if act being communicated is clearly identified - date, content, legal nature, not just expediente number. Used against BdE and AEPD sanctions: If bank notifies client of account seizure or suspension during emergency, notification must be complete, else void.

STS 5/2026, 8 Jan: If individual moves and does not inform debtor bank, formal letters to previous address remain legally valid. Relevant for bank emergency contact obligations - client duty to update.

d) Data Protection Emergency Notification

STS 16 Oct 2024, Equifax Ibérica S.L.: Supreme Court confirmed €50k fine by AEPD for failing to properly notify individuals about inclusion in credit files. Parallel: Banks must notify data subjects without undue delay (72h to AEPD, without delay to individuals if high risk) under GDPR Art 33/34 - part of DORA communication.

e) Administrative Sanctions - BdE / Audiencia Nacional

Audiencia Nacional, Sala Contencioso-Administrativo, Case 0000104/2021, 23 Dec 2022: Confirmed BdE sanctioning power and AEPD enforcement coordination. Banks challenging BdE fines for operational incidents must go to Audiencia Nacional. BdE sanctions for ceasing to hold qualifying holding, failing to provide information during inspection, and pursuing restricted activities without authorization are common - they show BdE treats failure to maintain emergency reporting as very serious infringement.

4. Current Enforcement Trend

Since DORA go-live, BdE and CNMV started supervision under DORA. Key inspection findings 2025:

• Missing register of ICT third parties
• No documented crisis communication tests
• Overdue PSD2 incident reports

Penalty regime: DORA leaves sanctions to national law - Law 10/2014 provides fines up to 5% annual turnover, Law 6/2023 for CNMV entities, plus personal liability for directors.

Practical checklist for Spanish bank:

1. Crisis Communication Plan approved by Board, tested yearly with TLPT
2. 4h/72h/30d reporting workflow integrated in SIEM + BdE portal
3. Client notification templates pre-approved by Legal / Compliance (in Spanish + co-official languages where applicable)
4. Out-of-band communication (SMS, call center script) when primary channel down
5. Contractual clauses with ICT providers requiring emergency notification within 30 mins