Banking Law and Digital Identity Banking Frameworks in Spain

Introduction

Digital identity is the process by which a person, company or authorised representative proves who they are in an electronic environment. In banking, it is used for account opening, online access, payment approval, electronic signatures, anti-money-laundering checks and fraud prevention. Spain’s digital identity framework combines European Union law, Spanish banking supervision, data-protection rules and financial-crime controls.

The core legal challenge is balance. Banks must identify customers accurately and prevent identity fraud, but they must also protect privacy, avoid unnecessary data collection and ensure that people who cannot use advanced technology are not excluded from financial services.

Legal and Regulatory Framework

The European eIDAS framework regulates electronic identification and trust services across the European Union. Regulation (EU) 2024/1183, commonly called eIDAS 2, created the European Digital Identity Framework. It requires Member States, including Spain, to make at least one European Digital Identity Wallet available to citizens, residents and businesses that request it.

The wallet is intended to allow users to prove identity and share verified attributes, such as age, address, professional qualification or a legal-representative status. A person should be able to disclose only the information needed for a particular service. For example, a bank may need confirmation that a customer is over eighteen, but it may not need every personal detail stored in the wallet.

Spanish Law 6/2020 regulates certain aspects of electronic trust services in Spain. It supports the legal recognition of electronic signatures, seals, timestamps, electronic delivery services and other mechanisms that establish authenticity and integrity in digital transactions. A qualified electronic signature has legal effect comparable to a handwritten signature.

Banks must also comply with Royal Decree-Law 19/2018 on payment services. It requires strong customer authentication for electronic payment transactions, subject to limited exemptions. Strong authentication normally uses at least two independent factors, such as knowledge, possession and inherence. A password alone may not be enough for a high-risk transaction.

Law 10/2010 on the prevention of money laundering and terrorist financing requires banks to identify and verify customers, beneficial owners and persons acting on behalf of companies. Remote onboarding is possible, but the bank must apply reliable measures and risk-sensitive controls. Digital identity does not remove the bank’s duty to understand the customer’s business, source of funds and expected transaction activity.

The General Data Protection Regulation and Spain’s Organic Law 3/2018 on data protection apply to biometric data, identity documents, device data, transaction records and authentication logs. Biometric information, such as facial recognition or fingerprints, is particularly sensitive and requires a clear legal basis, security safeguards and strict necessity.

Digital Identity in Banking Practice

Digital identity allows banks to open accounts remotely, approve payments, sign loan agreements and verify customers without requiring a branch visit. It can reduce costs, improve access for rural or disabled customers and help detect fraud. However, it also creates risks of deepfakes, stolen credentials, synthetic identities and unauthorised account access.

A bank should use layered verification. This may include checking an official identity document, verifying its authenticity, confirming a live facial image, checking official databases where permitted, assessing device and behavioural signals and applying transaction monitoring after the account is opened.

Identity proofing and authentication must be kept separate. Identity proofing answers the question: “Who is this customer?” Authentication answers: “Is the person now using the account really the authorised customer?” A bank may correctly identify a person at onboarding but still face fraud if later login controls are weak.

The European Digital Identity Wallet may simplify cross-border banking because a Spanish bank could rely on verified credentials issued in another Member State. However, the wallet’s use is voluntary for individuals. Banks must continue to offer reasonable alternatives to customers who do not have, cannot access or choose not to use a digital wallet.

Governance, Risk and Consumer Protection

Banks should maintain a written digital-identity policy approved by senior management. The policy should define acceptable identity documents, remote-verification standards, biometric safeguards, fraud-escalation procedures and retention periods for identification evidence.

Artificial intelligence may assist with document verification, liveness detection and fraud scoring, but it should not operate without human oversight. A false rejection may unfairly prevent a person from opening an account, while a false acceptance may enable fraud or money laundering. Banks should test systems for accuracy, bias and vulnerability to manipulated images or recordings.

Customers should receive clear information about what data is collected, why it is needed, how long it is retained and how they can challenge an incorrect decision. They should also have an accessible complaint route where they cannot complete digital identification because of disability, age, technical failure or a disputed biometric result.

Case Laws

In Digital Rights Ireland, Joined Cases C-293/12 and C-594/12, the Court of Justice of the European Union held that broad data-retention measures must meet strict proportionality requirements. The decision supports limits on banks’ retention of identity and authentication data.

In Schrems II, Case C-311/18, the Court required adequate safeguards for personal-data transfers outside the European Economic Area. This is important where Spanish banks use foreign cloud providers or identity-verification platforms.

In Breyer, Case C-582/14, the Court confirmed that dynamic IP addresses may constitute personal data where identification is reasonably possible. Banks must therefore protect login and device records as personal data.

In Nowak, Case C-434/16, the Court held that information connected with an identifiable person can be personal data. The case is relevant to identity-check records, verification reports and fraud-risk assessments.

In Orange Romania, Case C-61/19, the Court stressed that consent must be freely given, specific and informed. A bank should not obtain broad identity-data permissions through pre-ticked boxes or unclear contract terms.

In La Quadrature du Net, Joined Cases C-511/18, C-512/18 and C-520/18, the Court emphasised that access to sensitive communications data requires safeguards and proportionality. The principle supports careful limits on access to customers’ identity and transaction information.

Conclusion

Spain’s digital identity banking framework is built on eIDAS 2, electronic trust-service rules, payment authentication, AML/CFT duties and data-protection law. The European Digital Identity Wallet may make banking onboarding and cross-border verification more efficient, but it does not replace the bank’s legal responsibility to verify customers and prevent fraud.

A sound framework must be secure, voluntary, privacy-respecting and inclusive. Banks should use strong digital controls while always providing fair alternatives for customers who cannot or do not wish to rely entirely on digital identity tools.