Banking Law and Regulator Liability in Spain

1. Introduction

Regulator liability in Spanish banking law concerns the circumstances in which public authorities may incur legal responsibility for unlawful acts or omissions committed while supervising, regulating, restructuring, or resolving banks and other financial institutions.

The principal authorities potentially relevant include:

• Banco de España;
• European Central Bank (ECB) under the Single Supervisory Mechanism (SSM);
• FROB, Spain's resolution authority;
• Single Resolution Board (SRB) at EU level;
• CNMV where securities and investment-market matters overlap with banking;
• Spanish ministries and other public authorities exercising financial powers.

The central principle is important:

A bank's collapse, fraud, insolvency, or customer loss does not automatically make its regulator liable.

A claimant normally needs to establish an unlawful or legally attributable regulatory act or omission, actual compensable damage, and a sufficiently direct causal connection between the regulator's conduct and that damage.

Regulator liability therefore sits at the intersection of banking law, administrative law, EU law, State liability, financial supervision, and bank-resolution law.

2. Legal Framework in Spain

Several layers of law govern regulator liability.

Spanish Constitution

Article 106(2) provides the constitutional foundation for public-authority liability. Individuals may, under the conditions established by law, obtain compensation for damage suffered to their property and rights as a consequence of the functioning of public services, except in cases of force majeure.

Law 40/2015

Ley 40/2015, de Régimen Jurídico del Sector Público contains the general statutory regime governing patrimonial liability of Spanish public administrations.

Important concepts include:

• actual damage;
• economically assessable damage;
• individualized damage;
• causal connection;
• absence of a legal duty to bear the damage;
• exclusions concerning force majeure and certain unavoidable consequences.

Law 39/2015

Ley 39/2015, del Procedimiento Administrativo Común de las Administraciones Públicas governs relevant administrative procedures.

Law 10/2014

The Law on the organization, supervision and solvency of credit institutions establishes major elements of Spain's prudential banking framework.

Law 11/2015

Spain's bank recovery and resolution legislation implements important elements of the European resolution framework.

At EU level, the BRRD, SSM Regulation, Single Resolution Mechanism Regulation, and related legislation are particularly important.

3. Who Can Potentially Be Liable?

Regulatory responsibility depends on which institution actually possessed the relevant legal competence.

Banco de España

The Banco de España has important responsibilities involving:

• prudential supervision;
• monitoring regulated institutions;
• enforcement;
• financial stability;
• implementation of European supervisory arrangements.

However, after establishment of the SSM, significant supervisory responsibilities are exercised within an integrated ECB-national framework.

ECB

The ECB directly supervises significant institutions under the SSM and has specific powers concerning:

• authorization;
• qualifying holdings;
• prudential requirements;
• capital;
• governance;
• supervisory measures.

Liability involving ECB conduct is governed principally by EU law, not simply Spanish administrative-liability rules.

FROB

FROB performs important functions in bank resolution and restructuring.

Claims relating to resolution decisions therefore require consideration of the special bank-resolution framework.

SRB

For institutions falling within the Single Resolution Mechanism, the SRB can exercise major resolution responsibilities.

Claims concerning SRB measures normally fall within the EU judicial framework.

4. General Requirements for Spanish State Liability

A claimant generally cannot succeed merely by demonstrating financial loss.

Several requirements normally need to be established.

1. Actual damage

The loss must be real rather than purely hypothetical.

2. Economic assessment

The damage must generally be capable of economic valuation.

3. Individualization

The damage must affect an identifiable person or group rather than merely constitute a generalized economic disadvantage.

4. Unlawfulness of the injury

The claimant must generally demonstrate that the loss is one they had no legal duty to bear.

5. Causation

There must be a sufficiently direct causal connection between the functioning of the public authority and the damage.

Causation is often the most difficult element in banking-regulator cases.

5. Why Causation Is Difficult in Banking Cases

A bank may fail because of multiple interacting factors:

• poor management;
• excessive lending;
• liquidity problems;
• fraud;
• economic recession;
• deposit withdrawals;
• market panic;
• declining asset values;
• inadequate capitalization;
• misconduct by directors.

Suppose the Banco de España could theoretically have intervened earlier.

That fact alone does not establish:

regulator delay → customer's entire financial loss.

The court would need to examine whether earlier lawful regulatory action would probably have prevented the particular damage claimed.

This makes regulatory-liability litigation significantly more complicated than ordinary negligence litigation.

6. Supervisory Discretion

Banking regulators exercise substantial technical discretion.

They must make judgments concerning:

• capital adequacy;
• liquidity;
• credit risk;
• governance;
• systemic risk;
• resolution;
• viability;
• supervisory intervention.

Courts can review regulatory decisions for legality, but they generally do not simply replace the regulator's technical assessment with their own economic judgment.

This distinction protects regulators from becoming automatic insurers against every banking failure.

7. Regulator Liability Versus Bank Liability

These must be distinguished carefully.

If a bank mis-sells a financial product, the primary claim may be against the bank itself.

If the regulator failed to detect the misconduct, a separate question arises:

Did the regulator breach a legally enforceable supervisory obligation in a manner sufficiently connected to the customer's loss?

The two claims are legally different.

A bank's liability does not automatically establish regulatory liability.

8. Case Law

Case 1 — Peter Paul and Others, C-222/02

Court: Court of Justice of the European Union

This is one of the most important European cases concerning banking-supervisor liability.

German depositors suffered losses following the collapse of a bank and argued that the supervisory authority had failed properly to exercise banking supervision.

The CJEU considered whether EU banking directives required supervisory authorities to protect individual depositors in a way giving them a direct damages claim.

Principle

The Court did not interpret the relevant EU banking directives as requiring a national liability regime allowing individual depositors to claim compensation from the supervisory authority merely because supervision had been inadequate.

Importance for Spain

The judgment is highly relevant to Spain because EU prudential supervision primarily protects broader objectives such as:

• financial-system stability;
• soundness of institutions;
• depositor protection at a systemic level.

It does not mean every supervisory rule automatically creates an individual damages entitlement against the regulator.

9. Case 2 — Francovich, Joined Cases C-6/90 and C-9/90

Court: CJEU

Francovich established the fundamental doctrine of Member State liability for breaches of EU law.

A Member State may be required to compensate individuals where the necessary conditions for EU-law State liability are satisfied.

The doctrine later developed around three major elements:

1. the infringed EU rule must confer rights on individuals;
2. the breach must be sufficiently serious;
3. there must be a direct causal link between the breach and the damage.

Banking relevance

If a Spanish authority seriously violates directly relevant EU banking legislation, EU-law State liability may become relevant in addition to domestic Spanish public-liability rules.

10. Case 3 — Brasserie du Pêcheur and Factortame III

Joined Cases C-46/93 and C-48/93

These judgments further developed Francovich liability.

Principle

State liability can arise for breaches attributable to different branches and authorities of the State where EU-law conditions are met.

A particularly important concept is the sufficiently serious breach.

Relevant considerations can include:

• clarity of the rule;
• degree of discretion available;
• whether the infringement was intentional or excusable;
• whether EU institutional conduct contributed to the error.

Banking application

Where a Spanish banking regulator operates under a broad discretionary mandate, establishing a sufficiently serious EU-law breach may be more difficult than where the regulator disregards a clear mandatory obligation.

11. Case 4 — Köbler, C-224/01

Court: CJEU

Köbler established that, in exceptional circumstances, Member State liability under EU law can extend to infringements attributable to a court of last instance.

Although this was not a banking-supervision case, it demonstrates the breadth of the EU State-liability principle.

Relevance

A banking dispute may pass through:

• administrative authorities;
• regulatory bodies;
• Spanish courts;
• EU courts.

EU-law liability principles are therefore not confined to traditional executive regulators.

12. Case 5 — Traghetti del Mediterraneo, C-173/03

The CJEU further examined restrictions imposed by national law on State liability for judicial breaches of EU law.

Principle

Domestic law cannot make EU-law State liability practically impossible where the conditions required by EU law have been fulfilled.

Banking significance

The case reinforces the broader proposition that Spanish procedural and liability rules must remain compatible with EU principles of:

• effectiveness;
• equivalence;
• judicial protection.

13. Case 6 — Landeskreditbank Baden-Württemberg v ECB, C-450/17 P

This case concerned the supervisory architecture of the Single Supervisory Mechanism.

Although not principally a damages action, it is important for determining regulatory responsibility.

Importance

Under the SSM, banking supervision cannot always be attributed exclusively to a national regulator.

Depending upon the institution and decision concerned, responsibility may lie with:

• ECB;
• national competent authority;
• or an integrated supervisory process.

Spanish relevance

Before bringing a claim concerning supervision of a Spanish bank, it is essential to identify which authority possessed the relevant supervisory competence at the relevant time.

14. Case 7 — Berlusconi and Fininvest, C-219/17

The CJEU examined the interaction between national authorities and the ECB in a composite SSM procedure concerning qualifying holdings.

Principle

Where the final legally binding decision belongs to the ECB, judicial review belongs within the EU judicial system.

Significance for regulator liability

This prevents a claimant from automatically treating every action by Banco de España during an SSM procedure as an independent final national regulatory act.

The institutional chain must first be identified.

15. Case 8 — Banco Popular Resolution Litigation

The Banco Popular Español resolution generated major litigation before EU courts concerning the SRB's resolution actions and related institutional decisions.

Banco Popular was placed into resolution in June 2017 and transferred to Banco Santander for €1 after the resolution measures.

Shareholders and creditors challenged different aspects of the process.

A major group of General Court judgments delivered in 2022—including cases such as T-481/17, Fundación Tatiana Pérez de Guzmán el Bueno and SFL v SRB—examined the legality of the resolution framework.

Importance

The litigation demonstrates that judicial review of bank-resolution authorities considers matters such as:

• valuation;
• proportionality;
• procedural rights;
• confidentiality;
• resolution conditions;
• institutional competence.

It also demonstrates why losses suffered by shareholders following bank resolution do not automatically establish regulatory liability.

16. Case 9 — Aeris Invest v SRB

Litigation brought by Aeris Invest concerning Banco Popular has addressed decisions and procedures connected with the resolution.

These proceedings illustrate the distinction between:

• challenging the legality of a regulatory decision;
• obtaining access to documents;
• challenging valuation;
• seeking damages.

Winning one type of procedural challenge does not necessarily establish a right to financial compensation.

17. Case 10 — Ledra Advertising, C-8/15 P to C-10/15 P

Although concerning Cyprus rather than Spain, Ledra Advertising is relevant to liability arising from European financial-crisis measures.

The CJEU considered whether EU institutions could potentially incur non-contractual liability in connection with financial-assistance measures.

Principle

Participation in financial-stability mechanisms does not place EU institutions completely outside judicial scrutiny.

However, compensation requires satisfaction of the demanding conditions governing EU non-contractual liability.

Spanish relevance

The principle matters where Spanish banking measures involve institutions such as:

• European Commission;
• ECB;
• SRB;
• other EU bodies.

18. Liability of the ECB

ECB liability is governed primarily by EU law.

Under Article 340 TFEU, the EU must, in accordance with the general principles common to Member States, make good damage caused by its institutions or servants in performing their duties.

A claimant normally needs to demonstrate:

• unlawful conduct;
• sufficiently serious breach of a rule intended to confer rights;
• actual damage;
• direct causal relationship.

Therefore:

ECB supervisory liability is possible in principle, but the legal threshold for damages is demanding.

19. Liability of the SRB

The SRB exercises extremely significant powers during bank resolution.

Resolution can result in:

• cancellation of shares;
• write-down of capital instruments;
• conversion of liabilities;
• transfer of assets;
• sale of business;
• other resolution measures.

Large financial losses can therefore occur.

But investor loss itself does not prove SRB wrongdoing.

The claimant must distinguish between:

lawful economic consequences of resolution

and

compensable damage caused by unlawful regulatory conduct.

20. The "No Creditor Worse Off" Principle

An important safeguard under the bank-resolution framework is the no creditor worse off (NCWO) principle.

Broadly, shareholders and creditors should not suffer greater losses in resolution than they would have suffered under the relevant ordinary insolvency counterfactual.

A post-resolution valuation can therefore become critical.

If a creditor has been treated worse than under the applicable insolvency counterfactual, compensation mechanisms under the resolution framework may become relevant.

This is different from ordinary tort-style regulator liability.

21. Failure to Supervise

One of the hardest cases involves an alleged omission.

Example:

A bank repeatedly violates prudential requirements.

Banco de España allegedly knows about the violations but does not intervene.

The bank later collapses.

Investors sue the State.

They would need to address questions such as:

1. Was there a mandatory supervisory duty?
2. Was that duty owed in a legally relevant sense?
3. Was the regulator's failure unlawful?
4. Would intervention probably have prevented the loss?
5. Was bank management itself responsible?
6. Were market conditions an independent cause?
7. Did investors knowingly assume relevant risks?

These questions make omission cases highly fact-specific.

22. Mis-Selling and Regulatory Failure

Suppose thousands of consumers purchase unsuitable financial products.

Potential defendants might include:

Bank

For:

• misleading information;
• unsuitable advice;
• contractual violations;
• unfair terms.

Directors or officers

Potentially for misconduct falling within applicable corporate or other liability regimes.

Supervisor

Only if the claimant can independently establish the conditions for public-authority liability.

Therefore, supervisory responsibility is not a substitute for claims against the financial institution responsible for the transaction.

23. Deposit Guarantee System

Another distinction must be made between regulator liability and depositor protection.

Spain participates in the European framework for deposit guarantees.

Eligible deposits are generally protected within the statutory guarantee system up to the applicable limit—commonly €100,000 per depositor per credit institution, subject to the governing rules and exceptions.

A depositor's statutory right under the deposit-guarantee framework is different from a damages claim alleging negligent banking supervision.

24. Regulatory Enforcement Does Not Guarantee Compensation

Suppose Banco de España fines a bank.

That administrative sanction does not automatically establish:

regulator owes compensation to every customer affected by the bank.

Likewise, the fact that a bank breached regulatory rules does not necessarily establish regulator liability.

Separate legal questions remain concerning:

• individual rights;
• causation;
• quantification;
• attribution;
• limitation periods.

25. Judicial Review Versus Damages

These are different remedies.

Judicial review

The claimant asks the court to determine that a regulatory decision is unlawful and potentially annul it.

Damages

The claimant seeks monetary compensation for loss.

A decision can potentially be unlawful without every affected person becoming entitled to damages.

For EU liability in particular, a claimant generally faces the additional requirement of establishing a sufficiently serious breach.

26. Professional and Technical Discretion

Regulators often operate under uncertainty.

For example, a supervisor may need to decide whether to:

• demand additional capital;
• restrict dividends;
• remove managers;
• impose liquidity measures;
• withdraw authorization;
• commence resolution procedures.

If every incorrect prediction generated automatic damages, regulators could become excessively defensive.

Liability rules therefore attempt to balance:

regulatory accountability

against

necessary supervisory discretion.

27. Confidentiality

Bank supervisors possess highly sensitive information concerning:

• liquidity;
• capital;
• stress tests;
• internal risk models;
• recovery plans;
• resolution planning.

Confidentiality rules can limit public disclosure.

This can create difficult litigation questions because claimants may argue that information should have been disclosed earlier.

However, disclosure itself may create:

• bank runs;
• market instability;
• depositor panic.

Courts therefore have to balance transparency against legitimate supervisory confidentiality.

28. Main Liability Routes

29. Practical Example

Assume a Spanish bank develops severe liquidity problems.

Supervisors receive warning information six months before failure but do not immediately close the institution.

The bank eventually enters resolution and shareholders lose their investment.

The shareholders argue:

"The regulator knew the bank was weak, so the regulator must compensate us."

That argument alone is insufficient.

A court would need to determine:

• which regulator had competence;
• what information it possessed;
• what legal duties existed;
• whether intervention was mandatory or discretionary;
• whether the regulator breached those duties;
• what would have happened under lawful intervention;
• whether shareholders would have suffered losses anyway;
• whether there is a direct causal relationship.

If the bank was already economically insolvent, earlier intervention might actually have produced the same shareholder loss.

That would significantly affect causation and damages.

30. Key Principles From the Case Law

The jurisprudence supports several important propositions:

Principle 1 — Supervision does not guarantee investors against losses

Peter Paul is particularly important.

Principle 2 — EU-law breaches can generate State liability

Established by Francovich.

Principle 3 — The breach normally must be sufficiently serious

Developed by Brasserie du Pêcheur/Factortame.

Principle 4 — Identify the competent regulator

The SSM makes the distinction between ECB and national authorities essential.

Principle 5 — Annulment and compensation are separate questions

An unlawful decision does not automatically create damages liability.

Principle 6 — Causation is essential

A claimant must connect regulatory wrongdoing with the particular financial loss.

Principle 7 — Resolution losses are not automatically unlawful

Bank-resolution legislation deliberately permits losses to be imposed on shareholders and certain creditors under specified conditions.

31. Principal Cases

For research or examination purposes, the following cases are especially useful:

Peter Paul and Others v Germany, C-222/02
Banking supervision and depositor claims against supervisory authorities.

Francovich and Bonifaci, C-6/90 and C-9/90
Foundation of EU Member State liability.

Brasserie du Pêcheur and Factortame III, C-46/93 and C-48/93
Sufficiently serious breach and State liability.

Köbler, C-224/01
State liability and decisions of courts of last instance.

Traghetti del Mediterraneo, C-173/03
Limits on national restrictions concerning EU-law State liability.

Landeskreditbank Baden-Württemberg v ECB, C-450/17 P
Distribution of supervisory authority under the SSM.

Berlusconi and Fininvest, C-219/17
Composite ECB-national supervisory procedures and judicial review.

Ledra Advertising, C-8/15 P–C-10/15 P
EU institutional responsibility in financial-stability measures.

Fundación Tatiana Pérez de Guzmán el Bueno and SFL v SRB, T-481/17
Banco Popular resolution and review of SRB action.

Aeris Invest litigation concerning Banco Popular/SRB
Judicial review, disclosure and resolution-related rights.

32. Conclusion

Regulator liability in Spanish banking law exists, but it is not a system of automatic compensation whenever banking supervision fails to prevent financial losses.

Spanish constitutional and administrative law recognizes public-authority liability, while EU law provides additional liability principles where EU banking obligations are violated. At the same time, the integration of Spain into the Banking Union means that determining the responsible regulator can itself be a complex legal exercise involving the Banco de España, ECB, FROB or SRB.

The decisive questions are generally:

Who had the legal responsibility? → What duty applied? → Was the conduct unlawful? → Was the breach sufficiently serious where EU liability requires it? → Did it actually cause the claimed loss?

The Peter Paul judgment is especially important because it demonstrates that banking supervision designed to protect the financial system does not automatically give every depositor or investor an individual damages claim against the supervisor. Conversely, Francovich and Brasserie du Pêcheur establish that sufficiently serious violations of EU law can, where the required conditions are satisfied, generate State liability.

Accordingly, Spanish banking law attempts to preserve both regulatory accountability and supervisory independence, while ensuring that regulators do not become insurers against the ordinary commercial risks associated with banks and financial investments.