Banking Law and Digital Infrastructure Investment Banking in Spain

Introduction

Digital infrastructure has become central to investment banking in Spain. Banks finance data centres, fibre-optic networks, cloud platforms, cybersecurity systems, payment infrastructure, artificial-intelligence facilities and telecommunications networks. Investment banks also advise on mergers, acquisitions, project finance, bond issues, infrastructure funds and public-private partnerships involving digital assets.

The legal framework must therefore address two connected issues: first, the regulation of banks and investment services; and second, the ownership, financing, security and operational resilience of digital infrastructure. Spanish institutions operate within a combined Spanish and European Union framework supervised principally by the Banco de España, the Comisión Nacional del Mercado de Valores (CNMV), the European Central Bank and the European Securities and Markets Authority.

Legal and Regulatory Framework

The principal Spanish legislation is Law 6/2023 on Securities Markets and Investment Services. It regulates investment firms, market operators, trading platforms, financial instruments, public offerings, market abuse and investor protection. Investment banks providing underwriting, portfolio management, investment advice or arranging transactions must comply with authorisation, governance, capital, conduct and transparency requirements.

Credit institutions are primarily governed by Law 10/2014 on the organisation, supervision and solvency of credit institutions. It implements important provisions of the Capital Requirements Directive and works together with the Capital Requirements Regulation. Banks financing digital infrastructure must maintain adequate capital, liquidity, risk-management systems and internal controls.

Large transactions may also be subject to the Spanish Competition Act, merger-control rules and foreign-investment screening. A foreign acquisition of a Spanish digital-infrastructure company may require governmental approval where it affects strategic technologies, communications networks, data, cybersecurity or critical infrastructure.

Regulation (EU) 2022/2554, known as the Digital Operational Resilience Act (DORA), is especially important. It requires financial entities to manage information and communication technology risks, report serious incidents, test resilience, control outsourcing arrangements and monitor technology suppliers. Investment banks financing digital infrastructure must therefore examine not only the borrower’s financial position but also its cybersecurity, cloud dependencies, incident-response systems and business-continuity arrangements.

The General Data Protection Regulation and Spain’s Organic Law 3/2018 apply where infrastructure projects process personal data. The Network and Information Systems Security framework, the EU Cybersecurity Act and the European Critical Infrastructure framework may also apply. Artificial-intelligence systems used in credit assessment, fraud detection or market analysis may be affected by the EU Artificial Intelligence Act.

Digital securities and distributed-ledger financing may additionally fall under the EU Markets in Crypto-Assets Regulation, the Pilot Regime for market infrastructures based on distributed ledger technology and Spanish rules concerning electronic securities registration.

Key Issues and Principles

1. Due diligence and risk allocation

Investment banks must conduct legal, financial, technical and regulatory due diligence. Important questions include ownership of software and patents, rights to land and fibre routes, licences, spectrum permissions, construction approvals, data-protection compliance and resilience against cyberattacks.

Financing documents should allocate responsibility for delays, service interruptions, regulatory changes, cyber incidents and technology obsolescence. Security may include shares, receivables, bank accounts, equipment, contractual rights and intellectual-property assets.

2. Outsourcing and cloud concentration

Digital infrastructure frequently depends on cloud providers, data-centre operators and telecommunications suppliers. DORA requires financial institutions to maintain oversight of ICT outsourcing and to preserve access, audit, termination and recovery rights. Excessive dependence on one provider can create concentration risk and threaten the continuity of banking services.

3. Investor and market protection

When an investment bank structures bonds, infrastructure funds or securitisations, it must provide accurate information and avoid misleading representations. Conflicts of interest may arise where the bank advises the issuer, underwrites securities and sells them to investors. MiFID II conduct obligations require suitability, appropriateness, transparency and fair treatment.

4. Anti-money laundering and sanctions

Digital infrastructure transactions can involve complex ownership structures, foreign funds, tokenised assets and cross-border payments. Law 10/2010 on the prevention of money laundering requires customer identification, beneficial-owner verification, suspicious-transaction reporting and enhanced due diligence for high-risk relationships.

5. Public interest and critical infrastructure

The Spanish State may intervene where a transaction affects national security, essential communications, cloud capacity, sensitive data or strategic technologies. Financing agreements must therefore include change-in-control restrictions, regulatory-approval conditions and contingency arrangements.

Case Laws

1. Genil 48 SL v Bankinter, Case C-604/11 — The Court of Justice held that investment advice must satisfy MiFID requirements. The decision is relevant where Spanish banks advise clients on infrastructure bonds, derivatives or structured financing.
2. Banif Plus Bank v Csipai, Case C-472/11 — The Court strengthened consumer-protection obligations in financial contracts. It supports close scrutiny of transparency and unfair terms in investment-related agreements.
3. Kotnik v Slovenia, Case C-526/14 — The Court upheld the importance of burden-sharing and state-aid controls during banking restructuring. The principles are relevant when public support or resolution measures affect infrastructure-financing banks.
4. Ledra Advertising v European Commission and ECB, Joined Cases C-8/15 P to C-10/15 P — The Court confirmed that European institutions must respect fundamental rights when implementing financial-stability measures. Digital infrastructure investors may rely on legality, property and effective-remedy principles.
5. Trasta Komercbanka v ECB, Case C-663/17 P — The Court examined judicial protection following the withdrawal of a bank’s licence. It demonstrates that supervisory decisions affecting banking institutions must remain subject to effective judicial review.
6. Alpine Investments v Minister van Financiën, Case C-384/93 — The Court accepted restrictions on financial marketing where necessary to protect consumers and the integrity of financial markets. The reasoning is relevant to digital investment platforms and cross-border infrastructure fundraising.
7. Commission v Spain, Case C-274/14 — The Court criticised restrictions affecting the free movement of capital and establishment. The case illustrates that Spanish investment screening must be justified, proportionate and compatible with EU law.

Conclusion

Investment banking for digital infrastructure in Spain is governed by a dense framework combining banking supervision, securities regulation, cybersecurity, data protection, competition law, anti-money-laundering obligations and foreign-investment controls. Successful transactions require more than financial modelling. Banks must verify technological resilience, ownership rights, regulatory permissions, data governance and supplier dependence.

The central legal principle is that digital infrastructure is both an economic asset and a potential systemic dependency. Spanish investment banks must therefore structure financing so that innovation, investor protection, cybersecurity and financial stability operate together.