Banking Law and Outsourcing Regulation in Spain

1. Introduction

Outsourcing has become an essential part of modern banking. Spanish banks increasingly depend on external providers for information technology, cloud computing, payment processing, cybersecurity, customer support, data storage, accounting, software development and other operational functions.

However, outsourcing a banking function does not normally outsource the bank's regulatory responsibility.

A Spanish credit institution remains responsible for complying with banking, operational-resilience, data-protection, consumer-protection and governance requirements even where an external company performs the relevant activity.

Spain's outsourcing framework operates within both Spanish banking law and European Union law. Important sources include:

Law 10/2014 on the regulation, supervision and solvency of credit institutions;

Royal Decree 84/2015;

the EU Capital Requirements framework;

European Banking Authority (EBA) Guidelines on outsourcing arrangements;

Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA);

the General Data Protection Regulation (GDPR);

Spanish Organic Law 3/2018 on data protection and digital rights;

payment-services legislation where payment functions are outsourced; and

supervisory requirements of the Bank of Spain and, for significant institutions, the European Central Bank under the Single Supervisory Mechanism.

The central principle is:

A bank may delegate the performance of a function, but it remains accountable for regulatory compliance and effective oversight of that function.

2. Meaning of Outsourcing

Outsourcing occurs where a regulated institution contracts with an external service provider to perform a process, service or activity that the institution would otherwise perform itself.

Examples include:

cloud infrastructure;

data centres;

cybersecurity monitoring;

software maintenance;

payment processing;

customer-service centres;

accounting operations;

document management;

mortgage administration;

fraud detection;

compliance-support technology;

human-resources systems; and

data analytics.

Not every purchase from an external supplier necessarily constitutes regulatory outsourcing.

For example, purchasing ordinary office equipment would generally be different from transferring continuous operation of a core banking IT platform to an external technology company.

The substance of the arrangement matters more than the terminology used in the contract.

3. Spanish Banking-Law Framework

Law 10/2014 provides an important statutory foundation for the regulation and supervision of Spanish credit institutions.

Banks must maintain appropriate:

governance arrangements;

organizational structures;

internal controls;

risk-management systems;

administrative procedures; and

supervisory arrangements.

Outsourcing cannot be used to circumvent these obligations.

A bank cannot simply argue:

"The external provider caused the problem, so the bank is not responsible."

From the regulatory perspective, the bank remains responsible for selecting, supervising and controlling its service providers.

4. EBA Guidelines on Outsourcing Arrangements

The EBA Guidelines are central to understanding outsourcing governance within European banking.

They establish detailed expectations regarding outsourcing by credit institutions and certain other regulated financial entities.

The framework covers issues including:

identification of outsourcing arrangements;

assessment of critical or important functions;

governance;

conflicts of interest;

risk assessment;

due diligence;

contractual requirements;

access and audit rights;

security;

data location;

sub-outsourcing;

termination;

exit strategies; and

outsourcing registers.

For Spanish banks, these principles form an important part of the supervisory framework.

5. Critical or Important Functions

One of the most significant concepts is the distinction between ordinary outsourcing and outsourcing involving a critical or important function.

A function can be critical or important where a defect or failure in its performance would materially impair matters such as:

continuing compliance with authorization requirements;

regulatory obligations;

financial performance;

soundness or continuity of banking services.

Examples may include significant portions of:

core banking infrastructure;

payment-processing systems;

transaction-monitoring systems;

customer-data infrastructure;

cybersecurity services; or

essential operational platforms.

The classification matters because critical or important outsourcing requires particularly strong governance and risk controls.

6. Board and Senior-Management Responsibility

The management body of a bank retains ultimate responsibility for the institution.

Outsourcing cannot transform the service provider into the bank's governing body.

Management must ensure that outsourcing does not create a situation in which the institution becomes an "empty shell" incapable of supervising its own operations.

Accordingly, the bank needs sufficient internal personnel, knowledge and resources to understand and oversee outsourced activities.

For example, outsourcing most IT operations does not justify eliminating all internal technological expertise.

Without sufficient internal expertise, the bank may become unable to determine whether its provider is operating safely.

7. Pre-Outsourcing Risk Assessment

Before entering an important outsourcing arrangement, the bank should conduct an appropriate risk assessment.

Relevant risks can include:

Operational risk: Could provider failure interrupt banking operations?

Cyber risk: Could the provider expose systems to cyberattack?

Concentration risk: Does the bank depend excessively on one provider?

Legal risk: Is the arrangement compatible with banking, privacy and contractual requirements?

Country risk: Will services or data be provided from another jurisdiction?

Compliance risk: Can the provider satisfy relevant regulatory obligations?

Reputational risk: Could provider misconduct damage customer confidence?

Exit risk: Can the bank realistically terminate and replace the provider?

Risk assessment should occur before outsourcing and continue during the contractual relationship.

8. Due Diligence on Service Providers

Before appointing an important provider, the institution should examine whether the provider is suitable.

Due diligence may consider:

financial stability;

technical capacity;

business reputation;

cybersecurity systems;

employee competence;

regulatory history;

business-continuity arrangements;

data-protection systems;

reliance on subcontractors; and

ability to comply with audit requirements.

A low price alone is not sufficient justification for selecting a provider.

A provider that is inexpensive but operationally fragile may create substantially greater long-term regulatory risk.

9. Outsourcing Contracts

The outsourcing agreement should clearly define the relationship between the bank and service provider.

For important arrangements, contracts commonly need to address matters such as:

precise description of services;

performance standards;

responsibilities of both parties;

data-processing arrangements;

confidentiality;

information security;

business continuity;

incident reporting;

access rights;

audit rights;

regulatory access;

subcontracting;

termination rights;

data return or deletion; and

transition assistance.

A vague commercial contract may therefore be inadequate for regulated banking outsourcing.

10. Access and Audit Rights

A bank must be capable of monitoring outsourced functions.

This normally requires adequate contractual rights to obtain information and conduct or arrange audits where appropriate.

Supervisory authorities must also be able to exercise their regulatory functions.

A provider cannot ordinarily be allowed to defeat effective supervision by arguing that its systems are confidential.

The outsourcing structure should therefore preserve necessary rights of access, information and inspection.

11. Cloud Outsourcing

Cloud services have become particularly important.

Banks may use:

public cloud;

private cloud;

hybrid cloud; or

multi-cloud environments.

Cloud outsourcing can provide scalability and efficiency but creates significant regulatory concerns.

These include:

data security;

system availability;

concentration risk;

geographical location of data;

subcontracting chains;

cyber incidents;

vendor lock-in; and

migration difficulties.

Cloud outsourcing therefore requires careful contractual and technical governance.

12. DORA and ICT Third-Party Risk

The Digital Operational Resilience Act substantially strengthens the European framework concerning ICT risk.

DORA has applied since 17 January 2025.

Spanish financial institutions within its scope must manage ICT third-party risk as part of their overall operational-resilience framework.

DORA addresses areas such as:

ICT risk management;

incident management and reporting;

digital operational resilience testing;

ICT third-party risk;

contractual arrangements; and

oversight of certain critical ICT third-party providers.

The important point is that technology outsourcing is no longer merely a procurement issue.

It is a core regulatory-resilience issue.

13. Concentration Risk

A significant modern problem is concentration among major technology providers.

Several banks may depend on the same cloud or software company.

A failure at that provider could therefore affect multiple financial institutions simultaneously.

Individual banks must consider both:

their own dependency on a provider; and

the systemic implications of concentrated service provision.

Banks should avoid becoming operationally trapped where changing providers would be prohibitively difficult.

14. Sub-Outsourcing

Service providers frequently subcontract parts of their obligations.

For example:

Bank → cloud provider → data-centre operator → cybersecurity provider.

This creates a chain of dependency.

Banks therefore need appropriate visibility over relevant subcontracting, especially where critical or important functions are involved.

Contracts may need to establish:

circumstances in which subcontracting is permitted;

notification requirements;

security requirements;

responsibilities throughout the chain; and

rights where material changes occur.

The original bank remains responsible for managing the regulatory risks arising from the outsourcing structure.

15. GDPR and Outsourced Banking Operations

Outsourcing frequently involves customer personal data.

GDPR therefore plays a major role.

Where the bank acts as controller and an outsourcing provider processes personal data on the bank's behalf, Article 28 GDPR establishes important processor requirements.

The arrangement should address matters such as:

processing instructions;

confidentiality;

security;

subprocessors;

assistance with data-subject rights;

breach management;

deletion or return of data; and

audits.

The bank cannot eliminate its data-protection obligations simply by transferring customer information to a technology provider.

16. International Data Transfers

Outsourcing becomes more complicated where customer data is transferred outside the European Economic Area.

Banks must examine whether an appropriate GDPR transfer mechanism exists.

Depending upon the destination and circumstances, relevant mechanisms can include:

adequacy decisions;

standard contractual clauses; or

another legally recognized transfer mechanism.

Additional technical or organizational safeguards may also become important.

Therefore, the physical and legal location of outsourced data remains an important element of vendor risk management.

17. Business Continuity

Banks provide essential financial services.

An outsourcing failure cannot be allowed to make recovery impossible.

Banks therefore need business-continuity arrangements covering important outsourced functions.

Relevant planning can include:

backup systems;

alternative communication channels;

recovery procedures;

data backups;

emergency contacts;

provider recovery obligations;

internal crisis management; and

testing.

Business continuity must be practical rather than merely documented.

18. Exit Strategies

A bank should consider how it would leave an outsourcing arrangement before entering it.

This is particularly important for critical services.

An exit strategy may involve:

transferring the activity to another provider;

bringing the activity back in-house;

migrating data;

transferring software and technical documentation;

maintaining service during transition; and

securely deleting information from the former provider.

A contract may legally permit termination but still create operational lock-in if migration would take years.

Regulators therefore focus on practical exit capability.

19. Outsourcing Register

Institutions subject to the applicable outsourcing framework are expected to maintain appropriate information concerning their outsourcing arrangements.

A register assists both management and supervisors in understanding the institution's external dependencies.

It may record matters such as:

service provider;

outsourced function;

commencement date;

criticality;

relevant entities;

data considerations;

subcontracting;

jurisdiction; and

termination information.

DORA also establishes extensive information-register requirements concerning contractual arrangements involving ICT services.

Relevant Case Law

There is no single body of Spanish Supreme Court decisions exclusively called "bank outsourcing law." The legal framework is largely regulatory and heavily influenced by EU law.

The following decisions are therefore selected because they establish principles directly relevant to outsourced banking services, data processing, payment operations and institutional responsibility.

20. Wirtschaftsakademie Schleswig-Holstein – C-210/16

The Court of Justice of the European Union considered responsibility for personal-data processing where activities involved an external digital platform.

The Court adopted a substantive approach to determining responsibility rather than allowing an organization to avoid responsibility simply because another entity technically processed the information.

Relevance to Spanish banking outsourcing

A Spanish bank using an external digital provider must determine the parties' actual GDPR roles.

Calling another company a "service provider" does not automatically settle questions of controller or processor responsibility.

Principle: Regulatory responsibility depends upon the actual processing arrangements, not merely contractual labels.

21. Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW – C-40/17

The CJEU considered circumstances in which an organization could share responsibility for collection and transmission of personal data through third-party technology.

The decision reinforces the need to examine the actual operations performed by each participant.

Banking relevance

Spanish banks increasingly integrate:

analytics platforms;

authentication services;

cloud services;

fraud-detection systems; and

customer-interface technologies.

The bank must understand what data each external provider collects and why.

Principle: Using third-party technology does not automatically remove the institution's data-protection responsibilities.

22. Google Spain SL and Google Inc. v AEPD and Mario Costeja González – C-131/12

This landmark CJEU judgment arose from Spain and concerned data-protection responsibility in the digital environment.

Although not a banking-outsourcing dispute, it is important for outsourced banking because it demonstrated that European data-protection obligations can apply to sophisticated technological arrangements involving multiple corporate entities.

Banking relevance

Banks should not assume that complex international corporate or technological structures prevent EU data-protection law from applying.

Principle: Technological and corporate complexity does not itself eliminate regulatory responsibility.

23. Schrems II – Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, C-311/18

The CJEU invalidated the EU-US Privacy Shield and examined safeguards for international transfers based on standard contractual clauses.

The Court emphasized the need for an adequate level of protection when personal data leaves the European regulatory environment.

Banking relevance

This case is particularly important where Spanish banks outsource:

cloud storage;

customer analytics;

cybersecurity;

software support; or

data processing

to providers operating internationally.

Banks must examine international data-transfer arrangements rather than assuming that signing a vendor contract automatically makes the transfer lawful.

Principle: International outsourcing requires substantive assessment of data-transfer safeguards.

24. Österreichische Post AG – C-300/21

The CJEU examined compensation under Article 82 GDPR.

The Court held that infringement of GDPR alone is not sufficient for compensation: damage and a causal connection must also be established.

Outsourcing relevance

Where an outsourced provider causes a data-protection breach, the legal consequences require careful analysis of:

the infringement;

actual damage;

causation; and

the respective responsibilities of participating organizations.

Principle: Outsourcing-related GDPR liability requires analysis of actual legal responsibility and the elements of the claimed remedy.

25. VB Pénzügyi Lízing Zrt v Ferenc Schneider – C-137/08

This CJEU decision concerns consumer-contract protection and unfair terms.

Although it was not specifically an outsourcing dispute, it is relevant because outsourcing customer-facing activities does not remove the underlying consumer-law protections applicable to financial services.

Spanish banking relevance

A bank outsourcing:

loan administration;

collections;

customer service; or

documentation

must still ensure that the customer relationship complies with applicable consumer-protection requirements.

Principle: Delegating customer-facing operations does not eliminate underlying consumer-law obligations.

26. Banco Español de Crédito SA v Joaquín Calderón Camino – C-618/10

This Spanish reference to the CJEU became an important judgment concerning unfair terms in consumer banking contracts.

The Court emphasized effective judicial protection against unfair contractual terms.

Outsourcing relevance

If a Spanish bank outsources debt servicing or collection, the provider cannot lawfully operate as though the consumer-protection framework has disappeared.

The bank should supervise customer-facing outsourcing to ensure that outsourced processes do not systematically enforce problematic contractual practices.

Principle: Outsourcing execution of a banking contract does not remove consumer-protection requirements.

27. Aziz v Caixa d'Estalvis de Catalunya, Tarragona i Manresa – C-415/11

This major Spanish banking case concerned mortgage enforcement and unfair consumer-contract terms.

The CJEU emphasized the need for effective protection under EU consumer law.

Outsourcing relevance

Mortgage administration, arrears management and collection activities are frequently capable of being outsourced.

Where this happens, the bank remains exposed to legal risk if the external servicer applies procedures inconsistent with mandatory consumer protections.

Principle: Outsourced servicing and enforcement processes remain subject to applicable consumer-law safeguards.

28. Outsourcing Case-Law Summary

These decisions should not be described as eight Spanish Supreme Court outsourcing judgments. Several are CJEU decisions interpreting EU law, including cases originating outside Spain. They are important because EU banking, consumer and data-protection rules form part of the legal environment governing Spanish banks.

29. Outsourcing and Regulatory Accountability

The most important legal distinction is between performance and responsibility.

A bank can transfer performance of an activity:

Bank → Outsourcing Provider

But regulatory accountability generally remains with the bank:

Bank → Supervisor

Therefore, if a provider causes:

a major operational outage;

loss of customer information;

unauthorized disclosure;

deficient customer service;

inadequate cybersecurity;

failure of a critical banking system; or

breach of regulatory requirements,

the bank cannot automatically avoid supervisory consequences by blaming its contractor.

The regulator can examine whether the bank properly selected, contracted with, monitored and controlled that provider.

30. Outsourcing Versus Delegation of Management

There are limits to what outsourcing can achieve.

A regulated bank must retain sufficient substance to remain genuinely capable of managing its business.

Functions can be outsourced, but the institution should not surrender effective control over its regulated operations.

This is sometimes described as preventing an empty-shell institution.

The bank should retain:

decision-making capacity;

regulatory expertise;

risk-management capability;

sufficient staff;

access to information; and

ability to supervise providers.

31. Outsourcing and Operational Resilience

Modern regulation increasingly asks not simply:

"Is the outsourcing contract legally valid?"

but also:

"Can the bank continue operating if the provider fails?"

That shift is especially important under DORA.

Banks need to understand dependencies between:

Bank → ICT Provider → Subcontractor → Infrastructure Provider

Failure at any point can affect banking services.

Operational resilience therefore requires mapping dependencies, testing recovery arrangements and maintaining credible contingency and exit strategies.

32. Practical Compliance Process

A Spanish bank considering an important outsourcing arrangement can conceptualize the regulatory process as:

Step 1 – Identify the activity

Determine precisely what will be outsourced.

Step 2 – Determine regulatory classification

Assess whether it constitutes outsourcing and whether the function is critical or important.

Step 3 – Risk assessment

Examine operational, cyber, legal, concentration, data and exit risks.

Step 4 – Provider due diligence

Assess the provider's competence, financial position, security and resilience.

Step 5 – Regulatory considerations

Determine whether notification, documentation or other supervisory requirements apply.

Step 6 – Contract

Include appropriate regulatory clauses.

Step 7 – Register

Record the arrangement in the relevant outsourcing/ICT information framework.

Step 8 – Monitoring

Continuously assess provider performance and risk.

Step 9 – Incident management

Establish procedures for failures and security incidents.

Step 10 – Exit

Maintain a credible strategy for terminating or transferring the arrangement.

33. Example

Suppose a Spanish bank outsources its mobile-banking infrastructure to a cloud provider.

The bank cannot merely sign a standard cloud contract.

It should consider:

whether the service supports a critical or important function;

operational-resilience requirements;

cybersecurity controls;

customer-data protection;

subcontractors;

geographical data locations;

incident reporting;

access and audit rights;

regulatory access;

concentration risk;

service availability;

business continuity;

termination rights; and

migration to another provider.

If the provider suffers a serious outage, supervisory analysis may therefore focus not only on the provider but also on whether the bank appropriately anticipated and controlled the risk.

34. Relationship Between EBA Outsourcing Rules and DORA

For ICT arrangements, the regulatory landscape has changed significantly since DORA became applicable in January 2025.

Historically, banks relied heavily on the EBA outsourcing framework for technology outsourcing.

DORA now provides a directly applicable EU framework specifically addressing ICT third-party risk for covered financial entities.

Accordingly, a Spanish bank should not treat older outsourcing policies as automatically sufficient.

The institution must map the interaction between:

Spanish banking legislation;

ECB/Bank of Spain supervision;

relevant EBA requirements;

DORA;

GDPR;

payment-services rules; and

sector-specific obligations.

The applicable requirements depend upon the nature of the institution and the outsourced service.

35. Supervisory Importance

Outsourcing is particularly important to supervisors because extensive reliance on external providers can weaken direct institutional control.

Supervisory attention therefore commonly focuses on:

governance;

critical-function identification;

ICT dependency;

concentration;

cybersecurity;

data protection;

provider monitoring;

subcontracting;

auditability;

business continuity; and

exit capability.

The objective is not to prohibit outsourcing.

Instead, the objective is to ensure that efficiency gains do not undermine financial stability, customer protection or effective supervision.

36. Conclusion

Spanish banking law permits extensive outsourcing, but outsourcing operates within a strict framework of continuing institutional responsibility.

A Spanish bank can outsource technology, payment support, cloud infrastructure, customer-service operations and many other activities. What it cannot normally outsource is its ultimate responsibility for operating in accordance with applicable banking regulation.

The regulatory framework therefore requires careful risk assessment, provider due diligence, contractual safeguards, monitoring, audit and access rights, data protection, operational resilience, subcontracting controls and credible exit planning.

The EBA outsourcing framework remains important to understanding governance of outsourcing arrangements, while DORA has become central to ICT third-party risk since 17 January 2025. GDPR adds another major layer whenever customer or employee personal data is processed by external providers.

The case law reinforces the same broad lesson. Google Spain, Schrems II, Wirtschaftsakademie and Fashion ID demonstrate that sophisticated technological structures do not automatically eliminate regulatory responsibility. Banco Español de Crédito and Aziz show that consumer safeguards continue to constrain banking activities even where operational functions are delegated.

Thus, the fundamental rule for Spanish banks can be summarized as:

The activity may be outsourced; regulatory accountability remains with the regulated institution.