Banking Law and Digital Inheritance of Financial Assets in Spain

Introduction

Digital inheritance of financial assets concerns the transfer, administration and recovery of a deceased person’s bank accounts, securities, electronic money, crypto-assets and other digitally held financial rights. In Spain, digital assets are not governed by one comprehensive inheritance statute. Their succession is determined through the Spanish Civil Code, banking-contract law, securities regulation, data-protection rules, anti-money-laundering legislation and, where applicable, European Union digital-finance legislation.

The central legal problem is that heirs may inherit the economic value of an asset but lack the passwords, private keys, authentication device or information required to control it. Banks and platforms must therefore balance succession rights against confidentiality, cybersecurity and the prohibition on unauthorised access.

Legal and Regulatory Framework

Under Articles 659 and 661 of the Spanish Civil Code, inheritance includes the property, rights and obligations of the deceased, except those that are personal or legally extinguished by death. A credit balance in a Spanish bank account, shares held through an investment intermediary, payment-account funds and contractual claims against a financial institution generally form part of the estate.

The heirs must normally prove:

• the death of the account holder;
• their status as heirs or legatees;
• acceptance of the inheritance;
• the distribution or adjudication of the relevant asset;
• payment or settlement of applicable inheritance tax; and
• authority to operate the account.

Banks may require a death certificate, a certificate from the General Registry of Last Wills, the will or declaration of intestate heirs, the deed of acceptance and partition of inheritance, and tax documentation. The bank should not release funds merely because a person claims to be a relative.

Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights contains a specific rule on digital testamentary directions. Article 96 recognises the rights of persons linked to a deceased individual, heirs and designated persons to manage digital-content accounts and request access, modification or deletion, subject to the deceased person’s instructions and other applicable laws.

However, access to digital content does not automatically confer ownership of financial assets. An heir may be authorised to request information concerning a bank account without being authorised to transfer funds. Banking secrecy, contractual confidentiality and data-minimisation principles continue to apply.

For payment accounts, Royal Legislative Decree 19/2018, implementing PSD2, governs authentication, payment services and liability for unauthorised transactions. A bank may suspend digital access after learning of the customer’s death and should require estate documentation before enabling transactions by heirs or an executor.

Securities and investment assets are governed by the Spanish Securities Markets framework and the rules of the Comisión Nacional del Mercado de Valores. Shares, bonds, investment-fund units and derivatives are usually transferred through the relevant financial intermediary after the succession documents have been verified.

Crypto-assets present additional difficulties. Regulation (EU) 2023/1114, known as MiCA, regulates certain crypto-asset issuers and service providers. It does not create a complete inheritance code. Crypto-assets therefore remain subject to general succession law, the platform contract, custody arrangements and the practical ability of heirs to obtain the wallet or private key.

Digital Custody and Private Keys

The legal owner of a crypto-asset may be unable to transmit it if the private key is lost. Spanish inheritance law may recognise the asset as part of the estate, but a court order cannot always reconstruct an inaccessible cryptographic key.

Where assets are held by a regulated custodian, heirs may claim against the custodian according to the custody agreement. Where the deceased used a self-custody wallet, the estate may inherit the asset but still be unable to exercise effective control.

Banks and digital platforms should establish procedures for:

• recording a trusted contact or executor;
• preserving account and transaction records;
• verifying succession documents;
• separating account access from payment authority;
• preventing unauthorised post-death transactions; and
• maintaining audit trails for every disclosure or transfer.

A testamentary document should never contain an unprotected private key or complete password in a publicly accessible will. The person may instead use a secure digital-inheritance arrangement, sealed instructions, a regulated custodian or a trusted executor.

Rights, Liability and Enforcement

Heirs may request information necessary to identify estate assets, but the bank may lawfully withhold information unrelated to the deceased’s financial relationship or affecting third-party confidentiality. Joint accounts require particular care because the surviving holder may possess independent rights, while the deceased’s share may still enter the estate.

If a bank releases assets to the wrong person, it may face contractual liability, negligence claims and regulatory consequences. Conversely, if a bank refuses a properly documented inheritance request without sufficient justification, the heirs may pursue a complaint before the bank’s customer-service department, the Bank of Spain or the competent courts.

Data protection also continues after death where the information concerns living persons, joint holders, beneficiaries or counterparties. Financial institutions must therefore disclose only information that is necessary and proportionate.

Case Laws

In Google Spain SL v AEPD and Mario Costeja González, Case C-131/12, the Court of Justice recognised the importance of controlling personal information after it has been made available online. The decision is relevant to requests by heirs to remove or manage a deceased person’s digital presence, although financial ownership must still be determined under inheritance law.

In Lindqvist, Case C-101/01, the Court treated information identifying individuals online as personal data. This supports the principle that account histories, digital profiles and identity credentials require controlled disclosure after death.

In Nowak v Data Protection Commissioner, Case C-434/16, the Court adopted a broad understanding of personal data. Financial institutions should therefore treat digital identity records, authentication logs and account-related information as protected information rather than ordinary administrative material.

In Schrems II, Case C-311/18, the Court required adequate safeguards for international transfers of personal data. This is important when a Spanish bank or crypto platform stores estate records with a non-EU cloud or technology provider.

In Österreichische Post, Case C-154/21, the Court confirmed that unlawful processing may create a right to compensation where legally recognised damage exists. Improper disclosure of inheritance and account information may therefore expose a financial institution to liability.

In Hedqvist, Case C-264/14, the Court considered Bitcoin as an asset connected with financial transactions for VAT purposes. Although the case did not decide inheritance, it confirms the legal importance of classifying and analysing crypto-assets within financial regulation.

In Meta Platforms v Bundeskartellamt, Case C-252/21, the Court restricted indiscriminate combination of personal data. Banks and platforms should not merge inheritance information with unrelated behavioural or commercial profiles without a lawful basis.

Conclusion

Spanish law generally allows financial assets held digitally to pass to heirs, but access and control depend on the nature of the asset. Bank balances and securities can usually be transferred through formal succession procedures. Crypto-assets and self-custodied wallets create the greatest risk because inheritance of ownership does not guarantee access to the private key.

A legally sound system requires clear wills, secure key-management arrangements, documented executor powers, careful bank verification and privacy-preserving disclosure. Digital inheritance planning should therefore address both the legal title to the asset and the technical means required to control it.