1. The Regulatory Framework

Core Laws:

• Ley 7/2020, 13 Nov - Digital Transformation of Financial System: Creates financial regulatory sandbox. Supervised by Secretaría del Tesoro + Banco de España + CNMV + DGSFP. Calls for projects every 6 months (cohorts). 67 projects applied in 1st cohort alone. Requires: genuine innovation, readiness for testing, benefit to users, compliance plan.
• Ley 6/2023 LMV - Securities Markets: Transposes EU, makes CNMV competent for MiCA.
• MiCA Regulation - Fully applicable 30 Dec 2024 in Spain: CNMV authorizes CASPs, Banco de España supervises ART/EMT stablecoin issuers. Transition ended 30 June 2026.
• EU AI Act 2024/1689 + AESIA: Spanish Agency for Supervision of AI in A Coruña is national AI authority. Banco de España governs AI credit scoring.
• Law Creating Autoridad de Defensa del Cliente Financiero - 2025: Sent by Council of Ministers March 2025 to Parliament. Independent out-of-court dispute resolution body for financial customers, replacing fragmented system.

Supervisors: Banco de España - prudential + payment institutions, CNMV - investment + crypto advertising, AESIA - AI, AEPD - data.

2. Four Ethical Pillars Spanish Law Enforces

1. Transparency as Duty, not Marketing: From STS 241/2013 doctrine.
2. Consent Granularity: GDPR + LOPDGDD. Intra-group sharing needs separate consent.
3. No Regulatory Arbitrage via Tech: Law 5/2015 Crowdfunding requires CNMV authorization with BdE involvement - you cannot call it "tech platform" to avoid license.
4. Responsible Innovation: Sandbox is not free pass - you test under real-world conditions with supervisor observing.

3. Detailed Case Laws - The Enforcement Record

A. Data Ethics - The Biggest GDPR Fines in Spanish Finance

1. AEPD vs CaixaBank S.A. - PS/00100/2019 - €6M - 13 Jan 2021
Largest AEPD fine at the time. AEPD found:

• €4M for processing client data without valid legal basis
• €2M for failure of transparency under Art 13/14 GDPR
• Unlawful intra-group transfers to build commercial profiles
  Ethical rule: Even if you are a bank group, you cannot feed data from CaixaBank to CaixaBank Payments for autonomous profiling without specific consent.

2. AEPD vs BBVA - €5M - Dec 2020
Similar grounds: BBVA infringed Art 13/14 GDPR. Processed data for AML profiling and sent SMS without informing legal basis. 11M euros combined with CaixaBank represented 70% of all AEPD fines since 2018. Shows AEPD shifted from warnings to record fines in banking.

3. AEPD vs CaixaBank Payments & Consumer EFC - €3M - 2022/23
Lack of specific and informed consent for commercial profiling. Fintech lesson: payment initiation data cannot be reused for credit upsell.

B. Fintech-Specific Cases

4. ING PSD2 Interface Case - Spanish Court 2024 - €101,000
Court ordered ING to pay after finding it used standardized friction to block Third Party Providers access under PSD2. Violated principle of open banking non-discrimination.
Ethical principle: Ethics of interoperability - you cannot degrade API to keep customers captive.

5. Bit2Me vs CNMV - Advertencias: Otras Entidades List (2021-2025)
Bit2Me, first Spanish crypto unicorn, placed on CNMV warning list as entity not authorized for investment services. It had Banco de España VASP registration since Feb 2022 for AML only, not MiFID. Removed Jan 2025 after MiCA authorization process.
Ethical rule: VASP registration ≠ investment license. Dual regime confusion is itself sanctionable as misleading.

6. MONEI - Digital Euro Sandbox - Bank of Spain Green Light Jan 2023
Spanish fintech MONEI approved to test digital euro / EURM stablecoin in sandbox. Case study of ethical sandbox use: transparent testing of e-money token under BdE control, showcased as model project.
Positive precedent: Shows sandbox can grant legitimacy.

7. CNMV Circular 1/2022 - Crypto Advertising Regime
Before MiCA, CNMV imposed strict rules on crypto ads as investment. Required prior notification for mass campaigns >100k audience, warnings: "investment in cryptoassets is not regulated...". Enforced against influencers. Now absorbed into MiCA Art 66.

8. CNMV vs X (Twitter) - €5M Fine 2025 - Finfluencer Enforcement
CNMV fined platform for crypto ads without risk warnings. Extends ethics to distributors.

C. Consumer Protection Roots - Mortgage Transparency

9. STS 241/2013, 9 May 2013 - Cláusulas Suelo + CJEU C-154/15 Gutiérrez Naranjo 2016
Supreme Court declared floor clauses unfair if lacking transparency. CJEU made retroactivity full - banks must repay from start. This case law is now directly applied to fintech lending - if your loan app's TAE algorithm is not understandable, clause is void under Directive 93/13/EEC.

Tribunal Supremo Judgment 4203/2025 clarified autonomy of early termination clauses under Art 1255 Civil Code - but must still pass transparency test.

10. Provincial Court of Barcelona 2123/2021 - Unlawfulness of conversion of public administrations' money into cryptocurrencies
Court held public money converted into crypto lacks traceability and cannot be considered electronic money under Law 21/2011. Ethical limit on autonomous treasury management.

4. How to Build an Ethical Fintech in Spain Today

To pass sandbox:

1. License First: Determine if you are Entidad de Pago, EDE, EFC, or CASP under MiCA. CNMV + BdE dual check.
2. Sandbox Application: Demonstrate under Law 7/2020 Art 4: (a) innovation (b) readiness (c) benefit (d) no alternative (e) compliance plan
3. AEPD DPIA: Before autonomous decision, DPIA + AEPD prior consultation if high-risk.
4. CNMV Ad Compliance: All crypto/fintech ads > specific thresholds must be notified 10 days prior.
5. Financial Customer Authority: Design complaint handling for new Authority - 90-day resolution target.

If you fail, penalties stack: AEPD GDPR (up to 4% turnover) + CNMV MiCA (up to €12.5M or 5% turnover) + Banco de España + new Financial Customer Ombudsman can order redress.