Banking Law and Digital Identity Agreements in Spain

Introduction

Digital identity agreements are contracts that allow banks to verify, authenticate, and rely on a customer’s identity through electronic means. They may involve electronic signatures, biometric verification, video identification, digital certificates, electronic seals, identity-wallet providers, telecommunications operators, fintech companies, cloud providers, or public identity systems. In Spain, these agreements are increasingly important because banking services are offered through mobile applications, websites, remote onboarding, and digital-payment platforms.

A digital identity agreement does not merely concern technology. It determines who is responsible if identity data are inaccurate, a signature is forged, biometric data are misused, a customer is impersonated, or a payment is executed without authority. Spanish banks must therefore combine contract law with banking regulation, anti-money-laundering duties, data-protection law, cybersecurity rules, and European electronic-identification standards.

Legal and Regulatory Framework

The main European framework is Regulation (EU) No. 910/2014, known as eIDAS. It establishes rules for electronic identification and trust services, including electronic signatures, seals, time stamps, electronic delivery services, and website authentication. A qualified electronic signature has the equivalent legal effect of a handwritten signature across the European Union. This is highly relevant when a Spanish bank enters into account agreements, loan documents, payment mandates, guarantees, or customer-consent forms electronically.

eIDAS has been amended by Regulation (EU) 2024/1183, which creates the European Digital Identity Framework. It provides for European Digital Identity Wallets through which individuals and businesses can store and share verified identity attributes. Banks may eventually become relying parties that accept wallet-based identification or attributes. Their agreements with wallet providers must define verification standards, liability allocation, data minimisation, technical interoperability, audit rights, and procedures for suspended or compromised credentials.

Law 6/2020 regulates certain aspects of electronic trust services in Spain and complements eIDAS. It supports the legal recognition of electronic identification and trust-service mechanisms. However, a bank should not assume that every form of electronic signature carries the same evidential strength. A simple click, one-time password, biometric confirmation, advanced signature, and qualified electronic signature may each have different technical and evidential value.

Law 10/2010 on prevention of money laundering and terrorist financing is equally important. Banks must identify and verify customers, beneficial owners, and representatives before establishing business relationships or carrying out specified transactions. Remote identification may be used where legally permitted and where the bank applies adequate procedures to prevent impersonation, forged documents, deepfakes, and account-mule activity. The bank remains responsible for satisfactory customer due diligence even if an external identity provider performs part of the verification process.

The General Data Protection Regulation and Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee regulate identity information. Biometric identifiers used for unique identification may be special-category personal data. Banks must have a valid legal basis, collect only necessary data, provide clear information, apply strong security, and ensure that automated decision-making does not unfairly exclude customers.

The Digital Operational Resilience Act also affects digital identity arrangements. Banks must manage ICT risks, report serious incidents, test resilience, and control critical third-party providers. Identity systems are especially sensitive because a compromise can enable unauthorised payments, account takeover, money laundering, and large-scale data theft.

Key Issues and Principles

Identity assurance must match risk. Opening a low-risk information account may require less assurance than granting credit, processing a high-value transfer, or changing an authorised signatory. Agreements should define assurance levels and require stronger authentication for high-risk actions.

The agreement must clearly allocate responsibility. A bank should specify whether the identity provider only transmits data, validates documents, issues credentials, or confirms a user’s authentication. It should also state who bears loss caused by inaccurate data, technology failure, breach of security, or delayed revocation of credentials.

Customer consent must be meaningful. Customers should understand what identity data are shared, with whom, for what purpose, and for how long. Consent cannot be hidden in broad terms and conditions where another lawful basis is required for essential banking compliance.

Biometric data requires special caution. Facial recognition, voice recognition, fingerprints, and behavioural biometrics can improve fraud prevention, but they can also create irreversible privacy risk. Banks should use privacy-by-design controls, encryption, strict retention periods, human review, and an alternative identification route where feasible.

Evidence and audit trails are essential. The bank should preserve the identity-verification record, consent notice, authentication data, IP or device information where lawful, time stamps, signature certificate details, and all changes to customer authority. These records are crucial in disputes about fraud or unauthorised transactions.

Case Laws

Planet49, C-673/17, Court of Justice of the European Union – consent must be active, informed, and specific. Digital identity agreements cannot rely on pre-ticked boxes or unclear consent language.

Wirtschaftsakademie Schleswig-Holstein, C-210/16 – parties can share responsibility for personal-data processing where they jointly influence the purpose and means of processing. A bank and identity-platform provider may therefore both carry data-protection responsibilities.

Fashion ID, C-40/17 – a party can be a joint controller for particular stages of data collection and transmission. This is relevant where bank applications share identity data with verification or analytics providers.

Schrems II, C-311/18 – transfers of personal data outside the European Economic Area require effective safeguards. Spanish banks using foreign identity-verification or cloud services must assess transfer risks.

Nowak, C-434/16 – information relating to an identifiable person may constitute personal data even where it is held in professional or evaluative records. Identity-verification files and fraud scores may therefore be subject to data-protection rights.

Google LLC v CNIL, C-507/17 – data-protection remedies must be considered in light of territorial scope and practical effectiveness. It is relevant to cross-border identity systems serving Spanish customers.

Conclusion

Digital identity agreements allow Spanish banks to provide faster and more accessible services, but they must be drafted as regulatory-risk agreements rather than ordinary software contracts. The strongest agreements define identity-assurance standards, data-protection roles, liability, audit access, cybersecurity duties, record retention, incident response, and customer remedies. A bank may outsource identity technology, but it cannot outsource its ultimate responsibility for lawful onboarding, customer protection, and financial-crime compliance.