FINANCIAL MESSAGING SYSTEM (SWIFT) COMPLIANCE OBLIGATIONS FOR BANKS IN SPAIN

1. INTRODUCTION

The Society for Worldwide Interbank Financial Telecommunication (SWIFT) is an international financial messaging network that enables banks and financial institutions to exchange standardised payment instructions and other financial communications securely. Spanish banks rely on SWIFT for cross-border transfers, international trade finance, correspondent banking and interbank financial transactions.

Although SWIFT transmits financial messages rather than directly transferring or settling funds, its infrastructure creates important legal obligations concerning anti-money laundering (AML), counter-terrorist financing, data protection, cybersecurity, operational resilience and financial sanctions. Spanish banks must comply with Spanish legislation and applicable European Union regulations when using SWIFT services.

2. LEGAL AND REGULATORY FRAMEWORK

The principal legal instruments governing SWIFT-related compliance in Spain include:

Law 10/2010 on the Prevention of Money Laundering and Terrorist Financing: Establishes customer due diligence, transaction monitoring, suspicious transaction reporting and recordkeeping obligations.

Royal Decree 304/2014: Develops the implementing requirements of Spain's AML legislation.

EU Regulation 2023/1113: Establishes information requirements accompanying transfers of funds and certain crypto-assets.

General Data Protection Regulation (GDPR): Regulates the processing and international transfer of personal information contained in financial messages.

Royal Decree-Law 19/2018: Implements important provisions of the EU Payment Services Directive in Spain.

DORA Regulation (EU) 2022/2554: Establishes digital operational resilience requirements for financial entities, including ICT risk management and third-party oversight.

EU restrictive measures regulations: Require banks to implement applicable financial sanctions and asset-freezing obligations.

The Banco de España, SEPBLAC, the Spanish Data Protection Agency (AEPD), and relevant European supervisory authorities perform important supervisory functions.

3. PRINCIPAL SWIFT COMPLIANCE OBLIGATIONS

A. Anti-Money Laundering and Counter-Terrorist Financing

Spanish banks must examine SWIFT transactions to identify potentially suspicious financial activities. They must implement risk-based monitoring systems, identify customers and beneficial owners, understand business relationships and investigate unusual payment patterns.

Under Law 10/2010, suspicious transactions must be reported to SEPBLAC where the statutory conditions are satisfied. Banks must also retain relevant documentation and maintain internal AML controls.

B. Financial Sanctions Screening

Banks must screen SWIFT payment messages against applicable EU sanctions lists and other legally relevant restrictions. Screening should identify prohibited beneficiaries, sanctioned entities, restricted jurisdictions and transactions involving frozen assets.

Banks must establish procedures for blocking or freezing transactions where required by applicable law and reporting relevant information to competent authorities.

C. Data Protection and Confidentiality

SWIFT messages may contain names, account details, addresses, identification information and transaction histories. Consequently, GDPR compliance is essential.

Banks must establish a lawful basis for processing, ensure data minimisation, maintain appropriate security measures and assess international data transfers under GDPR Chapter V.

D. Cybersecurity and Operational Resilience

Under DORA, Spanish banks must maintain ICT risk-management frameworks, incident-response arrangements, business continuity procedures and appropriate oversight of technology service providers.

Banks should maintain access controls, authentication systems, encryption, transaction verification and security monitoring for SWIFT-related infrastructure.

E. Correspondent Banking Due Diligence

Banks must assess foreign correspondent institutions, their AML controls, geographical exposure and ownership structures. Enhanced scrutiny is particularly important where transactions involve high-risk jurisdictions or complex intermediary banking arrangements.

4. IMPORTANT CASE LAWS AND JUDICIAL AUTHORITIES

The following judgments provide relevant legal principles. They are not all direct SWIFT-specific decisions.

Jyske Bank Gibraltar Ltd v Administración del Estado (C-212/11): Direct AML-related authority. The CJEU examined AML reporting obligations imposed on financial institutions operating across borders. It is relevant to the relationship between national AML supervision and cross-border banking activities.

Safe Interenvíos SA v Liberbank SA and Others (C-235/14): Direct AML-related authority. The CJEU considered the application of AML requirements and the assessment of risks associated with financial transactions. Its principles are relevant to risk-based compliance and banking controls.

Schrems v Data Protection Commissioner (C-362/14): Analogous data-protection authority. The CJEU invalidated the EU-US Safe Harbour arrangement. The judgment demonstrates that international financial data transfers require legally adequate protection.

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (C-311/18): Analogous authority. The CJEU examined international personal-data transfers and standard contractual clauses. It is important where SWIFT-related information is transferred outside the European Economic Area.

Österreichische Post AG (C-300/21): Analogous GDPR authority. The CJEU clarified compensation requirements under Article 82 GDPR, including the need to establish damage and a causal connection. It is relevant to unlawful disclosure or processing of financial-message data.

Natsionalna agentsia za prihodite (C-340/21): Analogous cybersecurity authority. The CJEU examined personal-data security obligations following a cyberattack. It reinforces the importance of appropriate technical and organisational safeguards for banking information.

5. REGULATORY ENFORCEMENT AND LIABILITY

Failure to comply with SWIFT-related obligations can result in administrative penalties, regulatory investigations, civil liability and reputational damage.

Potential violations include inadequate AML monitoring, failure to freeze sanctioned transactions, unlawful disclosure of personal information, cybersecurity deficiencies and insufficient oversight of outsourced ICT services.

SEPBLAC may investigate AML compliance, while Banco de España exercises relevant banking supervisory powers. The AEPD supervises personal-data protection matters.

6. PRACTICAL COMPLIANCE REQUIREMENTS FOR SPANISH BANKS

Spanish banks should maintain:

Documented SWIFT security and governance policies.

Continuous AML and sanctions screening.

Customer identification and correspondent-bank due diligence.

Secure authentication and restricted system access.

Transaction audit trails and appropriate record retention.

GDPR-compliant international data-transfer arrangements.

DORA-compliant ICT risk and incident-management procedures.

Regular independent compliance audits and employee training.

Procedures for reporting suspicious transactions and regulatory incidents.

7. CONCLUSION

SWIFT compliance is an essential component of modern banking governance in Spain. Although SWIFT primarily provides financial messaging infrastructure, its use exposes banks to significant AML, sanctions, privacy and cybersecurity responsibilities. Spanish banks must integrate Law 10/2010, GDPR, DORA, EU financial-transfer regulations and applicable sanctions legislation into their operational frameworks. Judicial decisions concerning AML supervision, international data transfers and cybersecurity further clarify the legal responsibilities of financial institutions. Effective compliance protects customers, strengthens international banking relationships and supports the integrity of Spain's financial system.