I. Statutory Recognition of Future Banking

Spain has no specific neobank law. Future banking is built on:

1. Ley 10/2014, de 26 de junio, de ordenación, supervisión y solvencia de entidades de crédito
All credit institutions, including digital banks, must comply with operational, solvency, data protection requirements. Ensures transparency, consumer rights, cybersecurity.

2. Ley 7/2020, de 13 de noviembre, para la transformación digital del sistema financiero
Introduced regulatory sandbox for fintech innovation and mandates GDPR compliance. 417 fintech entities resident in Spain as of June 2026 according to Banco de España Observatory.

3. Draft Law on Digitalisation and Modernisation of the Financial Sector 2025
Spanish Ministry of Economy requested ECB Opinion on 16 Dec 2025. Draft incorporates into Spanish law elements to ensure compliance with DORA Regulation (EU) 2022/2554. ECB opinion confirms draft modifies scope of DORA to include payment systems operators.

4. EU Framework directly applicable:

• PSD2 -> PSD3 / PSR: Open banking via secure APIs, will introduce changes in management of access permissions and measures to combat fraud. PSD3 will increase banks' liability for impersonation fraud (spoofing).
• DORA (EU) 2022/2554: Applicable since 17 Jan 2025 in Spain. Establishes mandatory standards for technological risk management, cybersecurity, ICT third-party management. No longer adaptation project, but permanent discipline.
• MiCA Regulation (EU) 2023/1114: Excludes CBDCs, so digital euro not subject to MiCA.
• Digital Euro Regulation Proposal COM(2023) 369: Legal tender status. People will open digital euro account at their bank, not at Banco de España. Basic services free of charge.

Banco de España Clientebancario Doctrine: Only banks authorised as credit institutions may use term "bank" or similar terms such as "neobank", "banking", "banker" in corporate name. Designation legally reserved. EMIs and payment institutions cannot.

II. Ethics Theory - 7 Digital Human Rights in Financial Ecosystems (Spanish Doctrine)

Spanish legal doctrine now recognizes:

1. Right to Financial Inclusion: No exclusion by algorithm. Ley 4/2022 + Real Decreto-Ley 19/2018.
2. Right to Algorithmic Transparency: Art 22 LOPDGDD - right not to be subject to purely automated decisions.
3. Right to Human Intervention: Art 23 Ley 15/2022 non-discrimination + AI Act Art 86.
4. Right to Digital Resilience: DORA - right to service continuity despite cyber attack.
5. Right to Data Portability & Open Finance: PSD2 Art 67 - control of payment data via APIs.
6. Right to Monetary Privacy: Digital euro design - offline low-value privacy vs AML. ECB confirms basic payments free, privacy-respecting.
7. Right to Sustainable Finance: Law 7/2021 climate law - right to know carbon footprint of portfolio.

Ethical principle for future banking in Spain: "Technology integration encompasses AI-powered algorithms, blockchain settlement, mobile-first platforms, and API-driven infrastructure but compliance remains paramount under MiFID II, PSD2, AML and Bank of Spain oversight"

III. Future Banking Models and Ethical Issues

A. Neobanks & BaaS: Fintechs offer 100% mobile experience by partnering with traditional bank which manages compliance, KYC. Ethics: deposit guarantee confusion - only authorised banks covered by FGD (100k€). Banco de España forces disclosure.

B. Open Banking to Open Finance: Spain ready for Financial Data Access Regulation (FIDA/IFAD). Ethics: real and effective implementation of European regulations, guarantee of consumer consent granular.

C. Digital Euro: Spain is early adopter. Banco de España confirmed July 2025 participation alongside ECB and 18 Eurosystem NCBs in digital euro pilot. 36 PSPs selected across euro area. ECB confirmed 23 July 2026 project on track for 2029 launch. Ethics:

• Will not be used for loans, will not generate interest
• Will not replace cash, but will reduce dependence on big tech (Visa, Mastercard) and boost competitiveness
• Risks: banking disintermediation, paralysis of private innovation

D. AI Autonomous Finance: See previous memo - classified under AI Act high-risk for credit.

IV. Case Laws - The Future Banking Jurisprudence

Case 1: STS 571/2025 of 9 April 2025 - LANDMARK - Phishing / SIM Swapping

Supreme Court decision will shift liability in digital fraud cases.

Ruling: Banks are liable for unauthorised transactions resulting from digital fraud, such as phishing or SIM swapping, unless they can demonstrate gross negligence on part of customer.

This reinforces quasi-objective liability framework established by Directive 2015/2366 (PSD2), shifting burden of proof to financial institutions to demonstrate transaction was authorised or customer grossly negligent. Foundation for all neobank fraud cases.

Confirmed by DAC Beachcroft analysis: liability shift to banks for digital fraud.

Case 2: STS 949/2026 of 18 June 2026 - IT Project Limitation Clauses

Spanish law has no specific IT Project Law. Governed by Civil Code + case law on obra y servicios. Supreme Court upheld limitation clauses in core banking system outsourcing - sets limit for DORA ICT provider liability. Relevant for future core banking migrations.

Case 3: Banco de España vs Fintechs - Use of term "Neobank" - 2023-2024

Doctrine from Portal Cliente Bancario: sanctioned several EMIs for using "neobank" without license. Only authorized credit institutions may use term "bank". Establishes ethical transparency - consumer must know if money covered by deposit guarantee.

Case 4: AEPD vs CaixaBank PS/00100/2019 €6M and BBVA PS/00070/2019 - Applied to Future Banking

AEPD fined for automated profiling for digital banking offers without consent. Extends to future: open banking data cannot be used for cross-selling without separate consent under GDPR Art 6 + LOPDGDD Art 96. These are now used to assess neobank data practices.

Case 5: SEPBLAC Fine Banco Santander €3.2M 2021 - Automated AML

Automated AML rules not calibrated for crypto transactions. Ethics for future banking: when you add crypto / blockchain rails, you must retrain AI monitoring. Now applied to DORA third-party risk.

Case 6: ECB Opinion CON/2025/xx of 16 Dec 2025 on Spanish Draft Law

ECB received request from Banco de España on behalf of Spanish Ministry of Economy for opinion on draft law on digitalisation and modernisation. ECB approved incorporation of DORA but warned about banking disintermediation risk of digital euro and need to guarantee real implementation of PSD3/PSR and FIDA.

V. Ethical Checklist for Future Bank in Spain (2026)

To launch a future bank:

1. License: Obtain EFC or bank license under Ley 10/2014 via Banco de España / ECB
2. Name: Do not use "bank" unless licensed - use "payments" or "EDE"
3. Sandbox: Apply under Ley 7/2020 to test AI/biometric/DLT
4. DORA: Implement ICT risk management, incident reporting, resilience testing since Jan 2025
5. PSD3 Ready: Implement confirmation of payee, spoofing detection, strong customer authentication
6. AI Act: Register high-risk credit models with AESIA
7. Digital Euro: Prepare interoperability - ECB wallet accessibility requirement under EU accessibility law
8. Sustainability: Report under Law 7/2021 and SFDR

Core Spanish ethical rule: In future banking, the burden of technological risk is on the bank, not the customer. Customer pays with data only if informed, and with liability only if grossly negligent.