I. LEGAL BASIS FOR EMERGING RISK IDENTIFICATION

1. Banco de España Circular 4/2004 Annex IX - Credit classification and provisioning - amended April 30, 2013 to strengthen risk management and vigilance duties - requires early identification of forbearance, refinancing.

2. Law 10/2014 on organization, supervision and solvency + CRR2 / CRD6 (2024)
Directive reinforces treatment of certain risks - environmental, social and governance (ESG) - of institutions and aims for greater harmonisation.

3. Circular 4/2021 of 25 November 2021 - New reporting obligations to Bank of Spain on conduct matters - templates for confidential statements on market conduct, transparency, customer protection + complaints register - obligation to submit confidential financial statements on conduct.

4. Banco de España Supervisory Expectations Relating to Risks Posed by Climate Change and Environmental Degradation - Oct 23, 2020

In 2019 it conducted survey among representative sample of Spanish institutions to analyse whether ESG risks were being taken into consideration.

5. EBA Guidelines on ESG Risks - 2025 + Joint Guidelines JC_2025_78 applicable from Jan 1, 2027 - To ensure consistency, long-term considerations - how competent authorities should integrate ESG risks into supervisory stress testing. Approved by Banco de España Executive Commission on 18 May 2026 as its own.

II. THE 6 EMERGING RISKS BANKS MUST IDENTIFY NOW

1. Climate & Environmental Risks (C&E) - The #1 Emerging Obligation

Regulatory Obligation:

• AMCESFI (Spanish macroprudential authority - BdE + CNMV + DGSFP) publishes Biennial Report on Climate Change Risks to Spanish Financial System - Second report 2024.
• Commission Implementing Regulation (EU) 2024/3172 applicable Jan 1, 2025 - requires half-yearly disclosure of ESG risks + climate impacts.
• TCFD metrics + green bond reporting.

Identification Obligation:

• Materiality assessment of C&E risks - must conduct and document comprehensive assessment.
• RAF - Formal definition of risks assumed by banks must include climate.
• Supervisory priorities 2025-27 aim to enhance financial system's resilience.

Case Law / Enforcement:

ECB Sanction - ABANCA Corporación Bancaria SA - 10 Nov 2025 - ECB imposed periodic penalty payments EUR 187,650 following failure to comply with prior ECB supervisory decision requiring it to conduct and document comprehensive materiality assessment of climate-related and environmental risks. EU prudential framework requires credit institutions to embed ESG.

This is first Spanish bank fined specifically for failure to identify climate risk.

2. ICT & Third-Party Risk - DORA

Obligation: EBA Guidelines on Outsourcing (EBA/GL/2019/02) now integrated into DORA (EU Reg 2022/2554) effective Jan 17, 2025.

Financial entities remain responsible for identifying providers that support critical functions and ensuring compliance with contractual and governance requirements under Art 30(2). Before entering ICT outsourcing, must conduct risk-based assessment.

Case Law: Banco de España Circular 3/2020 sanctions - Spanish banks fined for non-compliance with ICT risk identification.

3. Conduct Risk & Consumer Protection - New Reporting

Circular 4/2021 obliges confidential reporting of:

• Complaints, transparency breaches, cross-selling mis-selling
• Banco de España supervision model comprises 4 main elements: effective and prudent regulation, including rules on access to activities.

External Evaluation May 30, 2024: Says BdE moved from predominantly corrective and legalistic supervisory approach to more forward-looking and risk-based one.

4. AML/CFT Emerging - Crypto & Private Banking

Order modifying Art 6 Royal Decree 304/2014 now says reliable identification includes both physical and digital version of DNI per RD 255/2025. Banks become data intermediaries but not identity owners. Must accept attribute attestations for risk scoring.

Enforcement: SEPBLAC sanctions - Constitutional Court Judgment 179/2023 upheld €1,056,000 sanction on Santander as successor to Banco Popular for AML violation found in 2017 inspection.

5. Credit Risk - SME Financial Information

Circular 6/2016 June 30, 2016 addressed to banks, specifying contents of document titled SME-Financial Information and risk classification methodology under Law 5/2015 on promotion of business financing.

Overriding purpose is to reduce, by leveraging information in hands of lending institutions, information asymmetry. Banks must provide SMEs with feedback on financial situation, quantitative variables, risk rating.

Failure = supervisory measure + obligation to provision.

6. Digital Identity & eIDAS 2.0 - 2027

Banks must read, verify and record MiDNI data as they do physical DNI. Failure to accept by Dec 2027 = infringement.

III. SUPERVISION REPORT 2025 - What ECB/BdE is Checking in 2025-27

From Supervision Report 2025:

• Formal definition of risks assumed by banks (RAF) - must include ESG, ICT, geopolitical
• Improvements needed in identification and management of non-climate emerging risks - cyber, AI, third-party
• O-SII identification per Circular 2/2016 Rule 14 + EBA guidelines - macroprudential buffer for systemic emerging risk

IV. ENFORCEMENT PHILOSOPHY - From Reaction to Prevention

Old Model (Franco regime to 2008): Supervision lodged in Ministry of Finance - weak, focused on enforcing oligopolistic interest rate agreements, regulatory capture. Shifted to Bank of Spain with Private Banking Inspection Service.

New Model (SSM + Conduct):

1. Identify emerging risk early (survey 2019 on ESG, survey 2024 on cyber)
2. Issue supervisory expectations (2020 climate expectations)
3. Require self-assessment + documentation
4. If not complied - ECB decision + periodic penalty (ABANCA case)
5. Public disclosure - half-yearly ESG reporting from 2025

Penalty Scale: Up to €5M or 10% turnover for failure to identify and manage emerging risks under Law 10/2014.

If you are a Spanish bank or branch of foreign bank, you must now submit:

• CIR - Risk Information Centre data via Circular 1/2020 - allows real estate lenders to improve decision-making
• Conduct confidential statements via Circular 4/2021
• Climate materiality assessment + RAF update + ESG disclosure per Reg 2024/3172