Banking Law and Regulatory Administration in Spain

1. Introduction

Regulatory administration in Spanish banking law means the system through which public authorities authorize, supervise, regulate, investigate, sanction, restructure and, where necessary, resolve banks and other financial institutions operating in Spain.

Spain's banking administration is no longer exclusively national. It operates within the European Banking Union and the wider EU financial-services framework. Consequently, regulatory authority is distributed among Spanish and EU institutions, principally:

• Banco de España (Bank of Spain);
• European Central Bank (ECB);
• Single Resolution Board (SRB);
• FROB (Spain's executive resolution authority);
• CNMV for securities and investment-market matters;
• SEPBLAC for AML/CFT functions; and
• EU bodies such as the European Banking Authority (EBA).

The central principle is:

Spanish banks operate under an integrated system of national administration and EU-level prudential supervision rather than under a single domestic banking regulator.

2. Main Sources of Spanish Banking Regulation

Important legislation includes:

Law 10/2014

Law 10/2014 on the organisation, supervision and solvency of credit institutions is a central Spanish banking statute.

It addresses areas including:

• authorization;
• prudential supervision;
• governance;
• qualifying holdings;
• capital and solvency;
• supervisory powers;
• enforcement; and
• sanctions.

Royal Decree 84/2015

Royal Decree 84/2015 develops significant parts of Law 10/2014.

Law 13/1994

The Law on the Autonomy of Banco de España establishes important aspects of the Bank of Spain's institutional position and functions.

EU legislation

Spanish banking administration also operates under directly applicable or implemented EU measures, including:

• Capital Requirements Regulation (CRR);
• Capital Requirements Directive (CRD);
• Single Supervisory Mechanism Regulation;
• BRRD;
• Single Resolution Mechanism Regulation;
• DORA; and
• relevant EBA regulatory standards.

3. Banco de España

Banco de España remains one of Spain's most important financial authorities.

Its responsibilities include areas concerning:

• supervision of relevant financial institutions;
• implementation of prudential rules;
• financial stability;
• regulatory reporting;
• inspections;
• payment systems;
• bank conduct and transparency within its competences;
• cooperation with the ECB and other authorities.

However, since the establishment of the Single Supervisory Mechanism, prudential supervision is divided between Banco de España and the ECB.

4. European Central Bank and the SSM

The Single Supervisory Mechanism (SSM) fundamentally changed banking administration in Spain.

The ECB directly supervises banks classified as significant institutions, working closely with national competent authorities.

Banco de España directly supervises many less-significant institutions under the ECB's overall SSM framework.

The structure can therefore be represented as:

ECB

↓
direct supervision of significant institutions

ECB + Banco de España

↓
Joint Supervisory Teams and supervisory cooperation

Banco de España

↓
direct supervision of less-significant institutions, subject to SSM oversight.

The ECB can also exercise important powers concerning banking authorizations and qualifying holdings.

5. Banking Authorization

A company cannot simply declare itself a bank and begin accepting deposits from the public.

Banking is a regulated activity.

An authorization assessment can examine:

• initial capital;
• business plan;
• shareholders;
• qualifying holdings;
• governance;
• directors and senior managers;
• organizational structure;
• internal controls;
• risk management;
• AML arrangements.

Under the SSM framework, banking authorization involves interaction between the national competent authority and the ECB.

6. Withdrawal of Authorization

Regulatory administration also includes the power to withdraw a banking licence where statutory conditions are met.

Possible circumstances can include serious situations involving:

• failure to satisfy authorization requirements;
• serious prudential breaches;
• prolonged inactivity;
• authorization obtained through false statements; or
• other statutory grounds.

Withdrawal is a major administrative measure because it can effectively terminate the institution's ability to conduct regulated banking business.

Accordingly, procedural safeguards and judicial review are particularly important.

7. Qualifying Holdings

Regulators monitor significant ownership in banks.

If an investor proposes to acquire or increase a qualifying holding in a Spanish credit institution, regulatory assessment can be required.

Authorities may examine:

• reputation of the proposed acquirer;
• financial soundness;
• proposed management;
• prudential consequences;
• group structure;
• money-laundering risks.

The purpose is to prevent unsuitable owners from controlling banking institutions.

8. Fit-and-Proper Supervision

Banking regulation is not limited to the bank's balance sheet.

Regulators also assess individuals responsible for managing institutions.

Relevant factors can include:

• professional experience;
• knowledge;
• competence;
• reputation;
• honesty and integrity;
• independence of mind;
• ability to devote sufficient time.

Fit-and-proper supervision continues after appointment. Material new information can therefore lead to reassessment.

9. Prudential Supervision

Prudential supervision asks whether a bank remains financially safe and properly governed.

Important areas include:

Capital

Does the institution maintain required own funds?

Liquidity

Can it meet payment obligations?

Credit risk

Are lending exposures properly controlled?

Market risk

Can adverse market movements create excessive losses?

Operational risk

Can the bank continue operating despite technology or process failures?

Governance

Does management understand and control the institution's risks?

These issues are assessed through ongoing supervision.

10. SREP

A central administrative mechanism is the Supervisory Review and Evaluation Process (SREP).

Supervisors assess areas including:

• business model;
• governance;
• capital risks;
• liquidity risks.

The result can lead to supervisory requirements concerning additional capital, liquidity, governance or risk controls.

SREP therefore translates regulatory administration into institution-specific supervisory requirements.

11. On-Site Inspections

Authorities can conduct inspections of banking institutions.

An inspection can examine:

• loan files;
• accounting;
• governance;
• models;
• IT systems;
• internal controls;
• regulatory reporting;
• risk-management procedures.

Banks are expected to cooperate with lawful supervisory requests.

Supervision would be ineffective if authorities could only rely upon information voluntarily selected by the institution.

12. Information-Gathering Powers

Regulators can require extensive information.

Examples include:

• financial statements;
• capital data;
• liquidity reports;
• large-exposure information;
• governance documents;
• internal audit reports;
• risk information.

Providing inaccurate supervisory information can itself create serious regulatory consequences.

13. Administrative Sanctions

Spanish banking legislation provides for administrative sanctions where institutions or responsible persons commit regulatory infringements.

Depending on the violation, consequences can include:

• fines;
• public reprimands;
• restrictions;
• disqualification of managers;
• other administrative measures.

Sanctions must comply with general principles of administrative law, including legality, proportionality, procedural fairness and judicial review.

14. Principle of Legality

Administrative authorities cannot invent offences after the event.

Sanctions require an adequate legal basis.

This reflects the broader principle:

nulla poena sine lege

—no penalty without law.

In administrative sanctions, the prohibited conduct and applicable legal consequences must be sufficiently grounded in legislation.

15. Proportionality

A regulator should not impose sanctions mechanically.

Relevant considerations can include:

• seriousness;
• duration;
• financial consequences;
• degree of responsibility;
• cooperation;
• previous violations;
• impact on customers;
• benefit obtained.

A minor reporting error and deliberate concealment of major capital deficiencies should not necessarily receive identical regulatory treatment.

16. Right to Be Heard

Spanish and EU administrative law recognize procedural rights.

Before an adverse decision is adopted, the affected institution or individual will generally have procedural opportunities consistent with the applicable framework to understand and respond to relevant allegations.

This can involve:

• notification;
• access to relevant material;
• submissions;
• evidence;
• reasoned decisions.

The exact procedure depends on the type of supervisory or enforcement measure.

17. Judicial Review

Regulators do not possess unlimited power.

Administrative decisions can be challenged before competent courts.

Depending upon whether the decision is national or EU-level, review may occur through:

• Spanish administrative courts;
• Spain's Supreme Court;
• EU General Court; and
• Court of Justice of the European Union.

The Banking Union therefore creates a multi-level system of administrative and judicial accountability.

18. AML Administration

Spain's AML framework is principally established by Law 10/2010 on prevention of money laundering and terrorist financing.

SEPBLAC plays a central institutional role.

Banks must maintain systems involving:

• customer due diligence;
• beneficial-owner identification;
• transaction monitoring;
• suspicious-transaction reporting;
• record keeping;
• internal controls.

AML administration interacts with prudential supervision because serious financial-crime control weaknesses can also indicate governance and operational deficiencies.

19. Consumer-Facing Banking Administration

Banking administration also concerns customer treatment.

Regulatory requirements can address:

• transparency;
• account information;
• fees;
• mortgage lending;
• payment services;
• complaints;
• advertising.

A bank can therefore be financially solvent yet still breach regulatory rules concerning its treatment of customers.

Prudential regulation and conduct regulation pursue related but distinct objectives.

20. CNMV and Banks

Banks frequently provide securities and investment services.

When doing so, the regulatory picture can involve the CNMV, Spain's securities-market authority.

For example, a bank may offer:

• investment advice;
• securities execution;
• custody;
• investment products;
• financial instruments.

Such activities can trigger securities-market requirements in addition to ordinary banking supervision.

Thus:

one financial institution can simultaneously fall within several regulatory regimes.

21. Recovery and Resolution Administration

When a bank becomes seriously distressed, ordinary supervision can transition toward recovery and resolution.

Important authorities include:

• ECB;
• SRB;
• Banco de España;
• FROB.

Spain's Law 11/2015 provides an important domestic component of this framework.

Potential resolution tools include:

• sale of business;
• bridge institution;
• asset separation;
• bail-in.

Banco Popular's 2017 resolution is the most important Spanish example of the EU resolution regime in practice.

22. Administrative Cooperation

Modern banks operate across borders.

Spanish regulators therefore cooperate with:

• ECB;
• EBA;
• SRB;
• other EU national supervisors;
• international authorities.

Supervisory cooperation can involve:

• information exchange;
• joint supervision;
• resolution planning;
• crisis management;
• regulatory colleges.

Confidentiality rules continue to apply to supervisory information.

23. Digital Banking Administration

Spanish banking regulation increasingly covers:

• cloud computing;
• artificial intelligence;
• mobile banking;
• cyber risk;
• digital identification;
• outsourcing;
• operational resilience.

DORA—Regulation (EU) 2022/2554 is particularly important for ICT risk and digital operational resilience.

Banks cannot outsource regulatory responsibility simply by outsourcing technology.

If Bank X uses Cloud Company Y:

technology operation → outsourced

but

regulatory accountability → remains with the regulated financial institution under the applicable framework.

Important Case Law

24. Landeskreditbank Baden-Württemberg v ECB, C-450/17 P (2019)

This is a foundational SSM case.

A German bank challenged its classification as a significant institution under the Single Supervisory Mechanism.

Principle

The CJEU confirmed the central supervisory competence allocated to the ECB under the SSM framework.

Spanish significance

The judgment is directly relevant to Spain because the same SSM architecture governs Spanish credit institutions.

It demonstrates that Banco de España's supervisory functions must be understood within the broader ECB-centered system.

25. Berlusconi and Fininvest, C-219/17 (2018)

This major case concerned an acquisition of a qualifying holding and the relationship between national preparatory measures and a final ECB decision.

Principle

Where EU law gives the ECB final decision-making authority, judicial review of the final decision belongs within the EU judicial system.

Spanish significance

A qualifying-holding procedure concerning a Spanish bank can similarly involve:

national authority investigation/proposal

→ ECB final decision

→ EU judicial review.

The case is therefore fundamental for understanding administrative responsibility within the Banking Union.

26. Crédit Agricole v ECB, Joined Cases T-133/16 to T-136/16

The General Court considered ECB supervisory decisions concerning bank governance.

Importance

The cases demonstrate that the ECB can exercise direct administrative authority over governance arrangements of supervised institutions.

For Spanish banks, governance is therefore not simply an internal corporate matter.

It is also a prudential supervisory concern.

27. UBS Europe and Others v ECB, T-3/17 and related SSM litigation

EU banking litigation concerning supervisory measures illustrates the need for ECB decisions to remain within the powers granted by banking legislation and to satisfy EU administrative-law requirements.

Relevance

Even powerful banking supervisors remain subject to:

• statutory competence;
• procedural requirements;
• reasoned decision-making;
• proportionality;
• judicial review.

These principles apply throughout the SSM, including Spain.

28. ECB v Espírito Santo Financial (Portugal), C-396/19 P

This litigation involved access to ECB documents connected with banking supervision.

Importance

Banking administration requires confidentiality because regulators possess sensitive information about:

• capital;
• liquidity;
• customers;
• recovery planning;
• internal weaknesses.

At the same time, EU law establishes mechanisms governing transparency and judicial accountability.

Spanish relevance

Information concerning Spanish supervised banks can therefore fall within strict EU professional-secrecy and document-access rules.

29. Baumeister, C-15/16 (2018)

This CJEU judgment concerned professional secrecy in financial supervision.

Principle

Not every piece of information held by a financial regulator automatically remains confidential forever merely because the regulator possesses it. The applicable legal conditions must be assessed.

Spanish significance

The case helps define the balance between:

supervisory confidentiality

and

transparency/access rights.

This is important for Banco de España, CNMV and European supervisory administration.

30. Trasta Komercbanka v ECB, C-663/17 P and related cases

This important litigation arose from the withdrawal of a bank's authorization.

Importance

The case examined:

• licence withdrawal;
• standing;
• shareholder rights;
• judicial protection;
• representation of a bank after regulatory intervention.

Spanish relevance

Withdrawal of authorization is one of the most severe administrative actions that can affect a Spanish credit institution.

The case demonstrates the importance of effective judicial protection even where supervisors intervene because of serious regulatory problems.

31. Pilatus Bank v ECB, T-27/19 and related proceedings

The Pilatus Bank litigation concerned ECB supervisory action and withdrawal of banking authorization.

Importance

It illustrates the interaction among:

• AML concerns;
• prudential supervision;
• licence withdrawal;
• procedural rights;
• judicial review.

Spanish relevance

Serious governance or financial-crime concerns can have consequences extending beyond AML enforcement and potentially affect prudential authorization.

32. Banco Santander v J.A.C. and M.C.P.R., C-410/20

This case emerged from the resolution of Banco Popular Español.

The CJEU examined the interaction between investor claims and the EU bank-resolution framework.

Importance

Administrative resolution decisions can fundamentally alter shareholder and creditor rights.

National private-law remedies cannot automatically be applied in a manner that undermines binding EU resolution measures.

Spanish significance

The case demonstrates the depth of EU administrative authority over a failing Spanish bank.

33. Banco Popular Resolution Litigation

The Banco Popular resolution generated extensive General Court litigation, including cases involving:

• Aeris Invest;
• Algebris;
• Anchorage Capital;
• former shareholders; and
• subordinated creditors.

The litigation addressed questions concerning:

• SRB powers;
• Commission involvement;
• valuation;
• procedural rights;
• transparency;
• property rights;
• compensation;
• No Creditor Worse Off assessments.

It provides perhaps the clearest practical demonstration of how Spanish banking administration has become integrated into EU institutions.

34. Administrative Structure in Practice

Consider a hypothetical Banco Hispania, a significant Spanish bank.

Normal operation

ECB directly supervises prudential matters through the SSM.

Banco de España participates in supervision.

Securities activity

CNMV requirements may apply to investment services.

AML

Law 10/2010 and SEPBLAC requirements apply.

Cybersecurity

DORA obligations apply.

Serious deterioration

Recovery measures and enhanced supervision begin.

Failure

ECB/SRB/FROB mechanisms may become relevant.

Litigation

Depending upon the decision being challenged, Spanish or EU courts provide judicial review.

This demonstrates that Spanish banking administration is multi-authority and multi-level.

35. Supervisory Independence and Accountability

Financial supervisors require sufficient independence to make technically difficult decisions without improper interference.

However, independence does not mean absence of accountability.

Accountability mechanisms include:

• statutory limits;
• procedural obligations;
• reason-giving;
• parliamentary/institutional oversight;
• judicial review;
• EU institutional controls.

The system therefore attempts to balance:

regulatory independence

with

rule-of-law accountability.

36. Main Administrative Powers

37. Key Legal Principles

Spanish banking regulatory administration can be understood through several core principles.

Legality: regulators must act under powers conferred by law.

Proportionality: supervisory intervention should correspond to the seriousness and risk of the problem.

Due process: institutions and individuals receive applicable procedural protections.

Prudential protection: regulators protect financial stability and depositors.

European integration: national administration operates within the SSM and Banking Union.

Professional secrecy: confidential supervisory information receives legal protection.

Judicial protection: supervisory decisions can be reviewed by competent courts.

Regulatory accountability: banks cannot outsource responsibility for regulated activities.

Conclusion

Banking regulatory administration in Spain is a multi-layered system combining Spanish administrative law with the European Banking Union. Its central domestic statute is Law 10/2014, supplemented by Royal Decree 84/2015, the Banco de España framework, AML legislation and Spain's recovery-and-resolution regime. At EU level, the SSM Regulation, CRR/CRD, BRRD, SRMR and DORA substantially shape regulatory administration.

The institutional structure can broadly be summarized as:

ECB + Banco de España + SRB/FROB + CNMV + SEPBLAC + EU regulatory framework = Spain's modern banking regulatory administration.

Cases such as Landeskreditbank, Berlusconi and Fininvest, Crédit Agricole, Baumeister, Trasta Komercbanka, Pilatus Bank and the extensive Banco Popular litigation demonstrate that banking regulators possess substantial powers over authorization, ownership, governance, supervision and resolution.

At the same time, those powers are constrained by statutory competence, proportionality, procedural rights, confidentiality rules and judicial review. Spanish banking regulation therefore combines intensive financial supervision with the broader principles of EU and Spanish administrative law.