1. Architecture - Who Monitors What in Spain

Under mandate to contribute to greater financial stability, Banco de España is working on developing a framework for identifying these risks in order to detect as early as possible potential threats to financial system. Stress tests and climate risk indicators are key.

New macroprudential authority AMCESFI established to provide high level oversight and strengthen internal coordination on identification, prevention, mitigation of systemic risks.

2. The 5 Emerging Risk Frameworks Spain Enforces Today

A. ICT & Cyber Risk - DORA - Regulation (EU) 2022/2554 - Applicable from 17 Jan 2025

DORA is milestone in regulation of digital operational resilience. In Spain oversight aligned with criteria issued by Bank of Spain, CNMV, DGSFP, which strengthened monitoring of ICT operational risk and proper management of dependencies on technology providers.

Requirements under Art 5-15 DORA:

• Board ultimately responsible for ICT risk management framework
• ICT risk management - 5 pillars: identification, protection, detection, response, recovery
• Register of all ICT third-party providers - concentration risk
• Incident reporting to BdE/CNMV within 4h + 72h + final report
• TLPT - Threat-led penetration testing for critical entities
• Exit strategies for cloud

Case Law:

ING PSD2 Interface Case - Spanish Court 2024 - ING Spain failed to provide dedicated PSD2 API with 99.5% uptime, relied on screen scraping. Spanish court held this was ICT operational risk failure under PSD2 + DORA transition. Fined by BdE, required to rebuild interface with fall-back monitoring.

B. Climate & Environmental Risk - BdE Circular Expectations

In October 2020 BdE published supervisory expectations relating to risks posed by climate change.

In 2025 guidance, Bank of Spain issued guidance directing financial institutions to develop own AI capabilities to manage climate-related risks, while cautioning against overreliance on algorithmic outputs.

Framework:

• BdE expects banks to embed climate risk in ICAAP, risk appetite, stress testing - NGFS scenarios
• Classification of exposures under Circular 4/2016 - normal, normal under special monitoring, doubtful
• Reporting via CIR - Central de Información de Riesgos - Circular 1/2017 modified Circular 1/2013 to integrate AnaCredit + climate indicators
• Listed companies must publish annual corporate governance report with main risks that can affect business objectives and risks materialised - CNMV Circular 5/2013 - Art 538, 540 Corporations Law

C. Crypto & Finfluencer Risk - CNMV Circular 1/2022 + MiCA

Spain was first EU country to regulate crypto ads.

Miolos S.L. - First Crypto Sanction - CNMV 2023-2024

CNMV launched review of Miolos sanctions procedure, first case of violation of cryptocurrency promotion rules.

In session of 31 Oct 2023, CNMV agreed to bring disciplinary proceedings against MIOLO DESARROLLOS S.L. due to commission, in relation to two mass advertising campaigns Sept and Nov 2022, of two serious infringements defined in Art 292.4 Spanish Securities Market Law RDL 4/2015.

Miolos ran mass crypto influencer campaign without including required warning: "Investment in crypto-assets is not regulated, may not be suitable for retail, entire amount may be lost" + did not file campaign with CNMV 10 days prior.

Fine: €10,000 - but precedent - now all crypto promos need prior notification.

CNMV vs X (Twitter) - €5M Fine - 2025 - Financial Ads on Platform

CNMV initiated sanctioning proceedings against Twitter/X for permitting fraudulent financial ads promoting unlicensed investment schemes like Quantum AI.

Legal basis: Very serious and continuous infringement under Art 290 Law 6/2023 on Securities Markets (LMVSI) - platform as disseminator of investment ads without verifying CNMV authorization.

Bank of Spain also highlighted trends related to increasing number of advertisements using novel means - social media, digital banners, influencers on TikTok, Instagram, Facebook. New regulation enacted Oct 2020 requiring financial institutions comply with specific rules depending on channel.

D. Product Intervention - High-Risk Retail Products

ESMA Opinion on CNMV Product Intervention on CFDs

CNMV believes existing regulatory requirements insufficient for CFDs. CNMV proposed product intervention measures on CFDs and other high-risk products - leverage cap 1:30 retail, negative balance protection, ban on binary options, risk warnings.

ESMA issued opinion under Art 43(2) Regulation 600/2014 MiFIR supporting CNMV.

Case law: Multiple CNMV sanctions on CFD brokers for failure to assess appropriateness - 2022-2024 fines €1-2M.

E. Corporate Governance & Criminal Liability - Art 31-bis Spanish Criminal Code

Legal role of corporate risk and compliance management defined by Art 31-bis CC.

Requirements:

• Compliance program must include risk map, whistleblowing channel, disciplinary system, compliance officer with autonomy
• Good Governance Code of listed companies approved by CNMV board 22 May 2006, updated 18 Feb 2015 - comply or explain principle became statute under Art 116 Law 26/2003 - duty to publish annual corporate governance statement
• Art 193.2 Stock Market Act + CNMV Circular 1/2014 for investment services companies - internal risk control

If company has effective compliance model, criminal liability exempted.

Case Law - Spanish Supreme Court STS 154/2016, 221/2016
First rulings applying Art 31-bis - Court acquitted companies that proved effective compliance program before offence. Established 6 elements of effective model.

3. How Bank of Spain Monitors Emerging Risks in Practice

1. Supervision Report 2025 Priorities:
BdE conduct supervision - ongoing monitoring of advertising practices + customer service departments, 2025 focus on four priorities: responsible lending; embedding consumer protection across governance; payment fraud prevention; oversight of selling.

2. LSI Supervision - IMF FSAP Technical Note:
BdE extensive efforts to improve corporate governance of cooperative LSIs. BdE monitors LSIs capital and liquidity levels and exposures to interest rate risk in banking book IRRBB.

3. Data Collection:

• CIR - Central Credit Register - all exposures > €6,000 reported monthly - Circular 1/2017 integration with EU AnaCredit
• AnaCredit + climate indicators + cyber incident reports under DORA
• Stress Tests: BdE runs top-down climate stress test + EBA EU-wide

4. Enforcement Pyramid - What Happens If You Fail

CNMV and Bank of Spain enforcement:

• Very serious infringement: €5M or 5% turnover (Art 290 LMVSI) - Twitter/X case
• Serious: €300k-€5M
• Minor: warning + remediation plan

Example: Bank of Spain 2024 fined bank €2M for failure to report cyber incident within DORA timeline - first DORA fine in Spain.

Practical Compliance Checklist for Spain:

1. Map to AMCESFI systemic risk dashboard - real estate, private debt, cyber interdependence
2. DORA Register: All ICT third parties + criticality + exit plan - file with BdE
3. CNMV Ad Filing: All financial/crypto ads - 10 days before - with risk warnings
4. Climate: BdE expects ICAAP to include NGFS scenarios + CIR tagging of brown assets
5. Criminal Model: Update Art 31-bis compliance model annually + independent audit