Banking Law and Future Governance of Financial Institutions in Spain

Introduction

The future governance of financial institutions in Spain concerns the legal and supervisory structures through which banks and other financial institutions are directed, controlled, monitored and held accountable. Modern financial governance extends beyond traditional company law. It includes board responsibility, risk management, internal controls, remuneration, suitability of directors, consumer protection, sustainability, digitalisation, cybersecurity and supervisory accountability.

Spain operates within the European Union's banking framework. Since November 2014, prudential supervision of Spanish credit institutions has operated through the Single Supervisory Mechanism (SSM), led by the European Central Bank (ECB) in cooperation with national authorities including the Banco de España.

The principal Spanish statute is Law 10/2014 of 26 June on the organisation, supervision and solvency of credit institutions, supplemented by Royal Decree 84/2015, Banco de España rules and EU banking legislation.

Legal and Regulatory Framework

1. Law 10/2014

Law 10/2014 establishes important corporate-governance requirements for Spanish credit institutions.

Article 29 requires institutions and consolidated banking groups to maintain robust governance arrangements including:

• clear organisational structures;
• transparent lines of responsibility;
• effective identification and management of risks;
• internal administrative and accounting controls; and
• remuneration arrangements compatible with sound risk management. 

The board bears responsibility for establishing a governance system capable of ensuring the sound and prudent management of the institution and preventing conflicts of interest.

2. Board Responsibility

Bank directors have responsibilities going considerably beyond maximizing short-term profitability.

Under Article 29, important non-delegable board responsibilities include supervision of the governance system, approval and monitoring of strategic objectives and risk strategy, protection of the integrity of accounting and financial information, supervision of disclosures and effective oversight of senior management.

This approach reflects the principle that failures of bank governance can create consequences extending beyond shareholders to depositors, customers and the financial system.

3. Fit-and-Proper Requirements

Directors of Spanish credit institutions must satisfy suitability requirements concerning professional reputation, knowledge, experience and ability to exercise sound governance. The overall board must collectively possess sufficient knowledge and experience to understand the institution's activities and principal risks.

Royal Decree 84/2015 further requires consideration of potential conflicts of interest and whether directors can devote sufficient time to their responsibilities. Institutions must maintain internal processes for continuously evaluating directors, senior executives and important control-function holders.

This area continues to develop at EU level. In February 2026, the EBA and ESMA consulted on revised suitability rules intended to harmonise assessments of management-body members and key function holders.

Future Governance Issues

Artificial Intelligence and Algorithmic Governance

Spanish financial institutions increasingly operate in an environment where automated systems can support credit decisions, fraud detection, customer services, compliance and risk management.

This creates important governance questions:

• Who is responsible for an automated decision?
• How should algorithms be audited?
• What level of human oversight is necessary?
• How should discriminatory or inaccurate outcomes be addressed?
• How should boards understand technological risks?

Future governance will therefore increasingly require technological expertise alongside conventional banking expertise.

Cybersecurity and Operational Resilience

Cybersecurity is becoming a board-level governance issue.

Financial institutions increasingly depend upon cloud infrastructure, payment networks, external software providers and interconnected information systems. Governance structures consequently need clear responsibility for cyber-risk management, business continuity and third-party risks.

Operational resilience will therefore form an increasingly important component of directors' responsibility for prudent management.

ESG and Sustainability Governance

Environmental and sustainability considerations are also becoming integrated into financial governance.

Boards increasingly need to consider how material environmental and transition risks affect:

• lending portfolios;
• investment decisions;
• credit risks;
• disclosures;
• long-term business strategies.

The important legal issue is not simply whether institutions pursue sustainability objectives, but whether material sustainability-related risks are properly incorporated into governance and risk-management processes.

Consumer-Oriented Governance

Spanish banking governance increasingly incorporates customer outcomes.

Article 29 of Law 10/2014 now expressly addresses product-governance procedures, remuneration connected with the marketing of banking products and practices involving linked or combined sales to retail customers.

Future governance therefore extends beyond prudential solvency toward institutional responsibility for how products are designed and distributed.

Important Case Laws

The following cases are particularly useful for understanding the evolution of financial-institution governance in Spain. Some are CJEU decisions arising directly from Spanish banking disputes, while others are comparative European authorities relevant to governance and institutional responsibility.

1. Aziz v Caixa d'Estalvis de Catalunya, Tarragona i Manresa (CJEU, C-415/11, 2013)

Facts: Mohamed Aziz challenged contractual terms connected with a Spanish mortgage and the effectiveness of Spain's mortgage-enforcement procedure.

Principle: EU consumer law requires effective mechanisms enabling courts to address unfair contractual terms.

Governance significance: Banks cannot treat consumer-contract compliance merely as a sales or litigation issue. Fair contract design and regulatory compliance should form part of institutional governance.

2. Banco Español de Crédito SA v Joaquín Calderón Camino (CJEU, C-618/10, 2012)

Facts: The dispute concerned a consumer credit contract containing a term imposing substantial default interest.

Principle: The CJEU strengthened judicial protection against unfair terms and addressed the responsibilities of national courts under EU consumer law.

Governance significance: Financial institutions need internal product and legal controls capable of preventing unfair contractual provisions before products reach customers.

3. Gutiérrez Naranjo and Others v Cajasur Banco SA and Others (CJEU, Joined Cases C-154/15, C-307/15 and C-308/15, 2016)

Facts: The litigation concerned Spanish mortgage "floor clauses" restricting reductions in variable interest rates.

Principle: The CJEU rejected a national limitation on the temporal restitutionary effects arising from findings that such terms were unfair.

Governance significance: Poor product governance can generate large-scale restitution, litigation and reputational consequences.

4. Andriciuc and Others v Banca Românească SA (CJEU, C-186/16, 2017)

Although originating outside Spain, this case is important for European banking governance.

Facts: Borrowers had taken loans denominated in foreign currency and faced significant exchange-rate exposure.

Principle: Contractual terms concerning the main subject matter must satisfy applicable transparency requirements, including enabling consumers to understand significant economic consequences.

Governance significance: Banks require effective systems governing product complexity, disclosure and customer risk communication.

5. Banco Santander SA v Demba and Bonet (CJEU, Joined Cases C-96/16 and C-94/17, 2018)

Facts: The proceedings concerned Spanish consumer lending and contractual provisions dealing with default interest.

Principle: The CJEU examined Spanish judicial rules concerning the assessment and consequences of unfair terms under EU consumer-protection law.

Governance significance: Credit institutions need governance mechanisms ensuring that loan documentation complies with consumer-law requirements.

6. Abanca Corporación Bancaria SA v García Salamanca and Bankia SA v Lau Mendoza and Rodríguez Ramírez (CJEU, Joined Cases C-70/17 and C-179/17, 2019)

Facts: The proceedings concerned accelerated repayment clauses in Spanish mortgage contracts.

Principle: The CJEU examined how national courts should deal with unfair contractual clauses within the framework of EU consumer protection.

Governance significance: Mortgage-product governance must consider not only pricing but also enforcement provisions and the consequences of customer default.

7. Banco Popular Resolution Litigation

The 2017 resolution of Banco Popular generated substantial litigation before EU courts involving shareholders and investors challenging aspects of the resolution process.

Governance significance: The litigation illustrates how severe deterioration in a bank can move governance questions beyond ordinary corporate management into prudential supervision, resolution planning and public-law accountability.

It also demonstrates why governance frameworks must incorporate crisis preparedness rather than concentrating solely on ordinary business operations.

8. Kotnik and Others (CJEU, C-526/14, 2016)

Although the proceedings originated in Slovenia rather than Spain, the judgment is relevant across the EU banking system.

Facts: The case concerned state support for banks and burden-sharing involving shareholders and subordinated creditors.

Principle: The CJEU examined EU state-aid requirements applicable to bank restructuring.

Governance significance: Governance failures producing severe financial distress may ultimately engage resolution, recapitalisation and state-aid rules rather than remaining matters solely for shareholders and directors.

Governance of Risk and Internal Controls

Future Spanish financial governance is increasingly based on the idea of continuous risk governance.

A financial institution should have clear responsibility across its board, senior management, risk-management function, compliance function and internal audit.

The Banco de España's supervisory model combines continuing supervision with information analysis, inspections, corrective requirements, recovery measures and disciplinary mechanisms.

This means governance is not simply an internal corporate matter. It is continuously connected with prudential supervision.

Remuneration Governance

Remuneration is particularly important because compensation structures can encourage excessive risk-taking.

Spanish governance rules therefore connect remuneration policies with prudent risk management.

Future remuneration frameworks will increasingly need to consider not only financial performance but also risk, compliance and appropriate customer outcomes.

Conflicts of Interest and Board Independence

Conflicts can arise through relationships with major shareholders, related companies, executives or other institutions.

Royal Decree 84/2015 specifically identifies personal, professional and economic relationships as relevant when assessing directors' ability to exercise sound governance.

Effective future governance therefore requires genuine independent judgment rather than merely formal compliance with board-composition requirements.

Supervisory Governance

Spain's banking-governance framework operates at both national and European levels.

The Banco de España identifies Law 10/2014, Royal Decree 84/2015, Banco de España Circular 2/2016, the EU Capital Requirements Regulation and other European measures as central parts of Spain's prudential framework.

Consequently, the future governance of Spanish financial institutions will continue to develop through interaction between Spanish legislation, ECB supervision, Banco de España supervision and EU regulatory standards.

Conclusion

The future governance of financial institutions in Spain is moving toward a broader model of institutional accountability. Traditional board governance remains essential, but governance now encompasses risk management, director suitability, internal controls, remuneration, consumer protection, digital technology, AI, cybersecurity, operational resilience and sustainability-related risks.

Law 10/2014 places the board at the centre of this system by making it responsible for sound and prudent governance, risk strategy, internal controls and supervision of senior management.

The cases of Aziz, Banco Español de Crédito, Gutiérrez Naranjo, Andriciuc, Banco Santander, Abanca, the Banco Popular litigation and Kotnik demonstrate different dimensions of modern financial governance—from consumer protection and contractual transparency to crisis management and institutional accountability. Future Spanish banking governance is therefore likely to become increasingly technology-aware, risk-focused and integrated with European supervisory standards.