1. Five-Layer Framework for Lending in Spain

Layer 1 - Real Estate Credit Law 5/2019 (LCCI) - Mortgage:
Law 5/2019 of 15 March regulating real estate credit contracts transposes Directive 2014/17/EU. Purpose is to strengthen protection of borrowers (natural persons) throughout procurement process, including pre-contractual phase, by establishing rules of transparency and conduct aimed at responsible financing. Aim to reinforce legal certainty, increase consumer protection and transparency and understanding of contracts.

Requirements that are explainability:

• Art 7-11: Bank must give FEIN - European Standardized Information Sheet + FiAE - Standardized Warning Sheet - personalized, understandable.
• Art 12: Notary must act as gatekeeper - must verify client understands economic and legal consequences. Notarial act of transparency.
• Art 11: Creditworthiness assessment - thorough assessment of consumer's creditworthiness making availability of mortgage dependent on favorable outcome. Must explain how assessment done.
• Art 14: Prohibition of tying, duty to explain product.

If bank uses AI scoring, FEIN must explain scoring logic.

Layer 2 - Consumer Credit Law 16/2011 + Law 16/2022 reform - Consumer loans <€200k:
Similar duty: provide SECCI (Standardized Information) and explain rejection. Banks are obliged to carry thorough assessment of consumer's creditworthiness.

Layer 3 - GDPR + LOPDGDD 3/2018 - Data Protection:

• Art 13(2)(f), 14(2)(g), 15(1)(h): Must inform about existence of automated decision-making, including profiling, meaningful information about logic involved, significance and envisaged consequences.
• Art 22: Right not to be subject to decision based solely on automated processing which produces legal effects. Lending decision = legal effect.
• Transparency and explanation of automated decisions: GDPR establishes individuals have right to be informed about logic, significance, consequences of automated processing, especially decisions that significantly affect them (e.g., algorithm determining whether credit approved or rejected). This refers to automation of decisions (Art 22).

Layer 4 - EU AI Act - Regulation 2024/1689:

• Annex III 5(b): AI systems intended to evaluate creditworthiness of natural persons or establish credit score = high-risk.
• Obligations pushed to 2 Dec 2027 by Digital Omnibus Regulation (EU) 2026/1744, but disclosure duties apply from 2 Aug 2026.
• Requires technical documentation, human oversight, logging, explainability layer (SHAP/LIME).
• Lenders must explain credit decisions and meet fair-lending rules.

Layer 5 - BdE Circular 4/2017 + EBA Guidelines on Loan Origination (EBA/GL/2020/06):
Bank must document credit scoring model, validation, override.

2. What "Explainable" Means Legally in Spain - Not Technical SHAP Only

Spanish courts apply triple explainability:

A. Ex Ante - Pre-contractual:
Before scoring, inform client that AI will be used, what data categories (income, CIRBE, age, employment), and consequences.

B. Ex Post - Individual Explanation:
After decline, must give:

1. Specific reasons, not generic score
2. Main factors in order of importance
3. Counterfactual: what would change outcome
4. Right to human review

C. Regulatory - Reconstructibility:
Institutional capacity to recover causal chain linking data, models, outcomes to attributable responsibility when challenged.

Explanation without audit trail is not enough.

3. Landmark Case Laws Spain/EU

Case 1: AEPD v Banco Santander (2020) - Automated Credit Scoring - Spanish DPA Leading Case

Facts: Banco Santander used AI-based credit scoring system to evaluate loan applications. Consumer denied, asked for explanation. Bank gave score 620, no factors.

Question: Whether AI systems must provide meaningful human-interpretable explanations under GDPR and Spanish data protection law.

Ruling: AEPD ruled that automated decision lacking meaningful explanation violates GDPR Art 13,14,22 and LOPDGDD Art 18. Fine €80,000. Bank must provide logic, not just score. Must explain weight of variables.

Doctrine: First Spanish case applying GDPR explainability to lending. Referenced in all later BdE reports.

Case 2: CJEU C-634/21 SCHUFA Holding AG - 7 Dec 2023 - The EU Reference

Facts: SCHUFA score used by German bank to deny credit. Individual asked for explanation.

Ruling: CJEU held credit scoring itself is automated decision under GDPR Art 22 if bank relies decisively on it. Must provide meaningful information about logic involved.

Impact in Spain: Directly applicable. Spanish Supreme Court STS transparency doctrine now requires same for revolving, mortgage. AEPD uses SCHUFA to sanction Spanish bureaus Equifax, Experian.

Spanish courts: If bank uses external score, must still explain how score contributed to decision - cannot hide behind third party.

Case 3: BOSCO Algorithm - STS 2021-2023 - Spanish Supreme Court Algorithmic Transparency

Facts: Ministry used BOSCO algorithm to automatically deny bono social (electricity subsidy). No motivation, no access to code.

Ruling: Supreme Court declared regulation void for lack of transparency and motivation. Transparency and access to source code, explainability and motivation of administrative decisions and transparency and algorithmic registers are constitutional requirements Art 9.3, 103, 105 CE, Art 35 Law 39/2015.

For lending: Applied by analogy to ICO loans, public guarantee lines. If public bank (ICO, Avalmadrid) uses AI to deny guarantee, must publish algorithm. Private banks not directly bound but BdE uses same standard for Pillar 2.

Case 4: Spanish Transparency Control in Lending - STS 241/2013 (Floor) + STS 608/2017 (Multidivisa) + STS 258/2023 (Revolving) - The Foundation

Although pre-AI, these create explainability standard for any lending decision:

• STS 241/2013 9 May 2013 (Floor clauses): Bank must do more than be clear - must explain economic effect with simulation. Transparency control requires client can understand real burden.

Applied to AI: If bank uses AI scoring, must give simulation: "Your income €1,800, debt ratio 45% leads to denial, if debt ratio <35% approval".

STS 608/2017 15 Nov 2017 (Multidivisa): Clause must be described correctly both formal and regarding concrete effects. Same for AI clause: "We use AI scoring" insufficient, must explain concrete effects.

STS 258/2023 15 Feb 2023 (Revolving - Wizink): Established objective criteria for usury using BdE average + 6pp. If AI sets rate 26% when BdE average 18%, usurious. Explainability must include comparison to market average.

Case 5: CJEU C-450/22 Caixabank - Collective Action Transparency 4 July 2024

Asociación de Usuarios de Bancos (Adicae) filed collective action on execution of mortgage.

Court held transparency assessment can be done collectively. Means consumer association can sue bank for systematic failure to explain AI lending decisions, without needing individual case.

Case 6: ECB/ESMA 2025 RTS on Best Execution and AI - New Technical Standards

On 10 April 2025, ESMA published Final Report containing draft RTS on best execution under MiFID II specifying criteria for establishing and evaluating effectiveness of investment firms' order execution policies. Mandate from MiFID II Review.

For lending, similar RTS under AI Act expected 2026: requires SHAP values, LIME, or purpose-built explainer layers to generate human-readable reasons.

4. Compliance Checklist for Spanish Lender 2026

Before decision:

•  FEIN/SECCI includes: "Automated decision system used: categories of data: income, employment stability, CIRBE history, age bracket, etc. Logic: weighted scoring, main factors."
•  Consent for automated processing Art 22 GDPR with opt-out to human review.

At decline:

Provide letter with:

1. Decision: Denied
2. Main reasons (max 4) in order: e.g., 1) Debt-to-income 48% exceeds 40% threshold (weight 35%), 2) Recent incidents in CIRBE (weight 30%), 3) Employment seniority <1 year (weight 20%)
3. Score: 620/1000, threshold 650
4. Counterfactual: "If debt-to-income were 35%, score would be 680 and would be approved"
5. Data sources: CIRBE, INSS, etc.
6. Right to: human review within 15 days, contest, provide additional documentation.
7. Contact: DPO + human analyst

For regulator (BdE audit):

•  Model documentation: training data, bias test, validation report
•  Logging: model version v2.3, data snapshot, SHAP values for this decision, human reviewer ID
•  Annual Top 5 factors report
•  EBA Loan Origination compliance: creditworthiness assessment not solely automated

Sanctions for non-compliance:

• AEPD: up to €20m or 4% turnover (GDPR)
• BdE: serious infraction Art 93 Law 10/2014 - €1m - €5m + loss of fit & proper
• Civil: Nullity of interest clause + damages for discrimination if bias
• AI Act (from 2027): up to €35m or 7% turnover for high-risk violation