Banking Law and Regulatory Agencies and Legality Control in Spain — Detailed Explanation with Case Laws

1. Introduction

In Spanish banking law, regulatory agencies and legality control refers to the institutions that supervise banks and the legal mechanisms ensuring that supervisory authorities themselves act within the powers granted to them by Spanish and EU law.

Spain operates within the EU Banking Union, so banking supervision is not performed by a single Spanish regulator. It is a multi-level system involving the Banco de España, European Central Bank (ECB), CNMV, SEPBLAC, FROB, Single Resolution Board (SRB), national courts and EU courts.

The central principle is:

Banks are subject to regulators, but regulators are themselves subject to law and judicial review.

2. Main Legal Framework

Important legislation includes:

• Law 10/2014, on the organisation, supervision and solvency of credit institutions;
• Law 13/1994, on the autonomy of Banco de España;
• Regulation (EU) No 1024/2013, establishing the Single Supervisory Mechanism (SSM);
• Regulation (EU) No 806/2014, establishing the Single Resolution Mechanism (SRM);
• Law 11/2015, concerning recovery and resolution of credit institutions and investment firms;
• Law 6/2023, on Securities Markets and Investment Services;
• Law 10/2010, on prevention of money laundering and terrorist financing; and
• EU CRR/CRD prudential legislation.

These rules allocate regulatory powers and establish safeguards controlling their exercise.

3. Banco de España

The Banco de España is Spain's national central bank and a major banking supervisory authority.

Within the SSM it works with the ECB and performs important functions concerning:

• prudential supervision;
• regulatory reporting;
• inspections;
• capital and liquidity;
• governance;
• risk management;
• supervisory enforcement; and
• monitoring of less significant institutions within the European framework.

Its powers must have a legal basis.

Therefore, Banco de España cannot impose regulatory requirements solely because it considers them desirable; its measures must fall within the powers conferred by Spanish and EU legislation.

4. European Central Bank

Since the creation of the Single Supervisory Mechanism, the ECB has become central to Spanish banking supervision.

The ECB directly supervises significant Spanish banking groups and has important powers concerning matters such as:

• banking authorisations;
• withdrawal of authorisations;
• qualifying holdings;
• capital requirements;
• governance;
• supervisory examinations; and
• enforcement.

The ECB and national competent authorities together form the SSM.

Thus:

ECB + Banco de España = integrated prudential supervisory structure.

5. Significant and Less Significant Institutions

Under the SSM, banks are generally classified as significant institutions (SIs) or less significant institutions (LSIs).

Significant institutions are directly supervised by the ECB.

Less significant institutions are generally directly supervised by national authorities such as Banco de España, subject to the ECB's oversight and powers under the SSM framework.

This division prevents unnecessary centralisation while maintaining consistent European supervision.

6. CNMV

The Comisión Nacional del Mercado de Valores (CNMV) is Spain's securities-market regulator.

Its responsibilities are particularly relevant where banks provide:

• investment services;
• securities trading;
• investment advice;
• financial-instrument distribution;
• market services; or
• other activities falling within securities legislation.

A Spanish bank can therefore simultaneously fall under prudential supervision and securities-market supervision.

For example:

ECB/Banco de España → prudential soundness

while

CNMV → securities-market conduct and investment-services regulation.

7. SEPBLAC

SEPBLAC plays a central role in Spain's AML/CFT framework.

Banks are obliged entities under Law 10/2010.

They must maintain systems dealing with:

• customer due diligence;
• beneficial ownership;
• suspicious transactions;
• recordkeeping;
• internal controls; and
• financial-crime risk.

AML supervision therefore constitutes another layer of banking regulation.

8. FROB

FROB performs important functions within Spain's bank-resolution architecture.

Its role must be considered together with the Single Resolution Board under the European Single Resolution Mechanism.

Resolution is different from ordinary supervision.

Supervision asks:

Can the bank continue operating safely?

Resolution asks:

What legal measures should be taken when a bank is failing or likely to fail and the statutory conditions for resolution are satisfied?

9. Single Resolution Board

The SRB is the central resolution authority within the Banking Union for institutions falling within its responsibilities.

The 2017 resolution of Banco Popular Español provides Spain's clearest example of how this European framework operates.

The case also generated extensive litigation concerning the legality of decisions adopted by the SRB and other EU institutions.

10. Meaning of Legality Control

Legality control means ensuring that a regulator's decision complies with the law.

Courts can examine questions such as:

• Did the authority have jurisdiction?
• Did it follow the required procedure?
• Did it provide adequate reasons?
• Did it respect rights of defence?
• Was the measure proportionate?
• Did it misuse its powers?
• Did it correctly interpret the governing legislation?
• Were relevant fundamental rights respected?

This should be distinguished from simply asking whether the court would have made the same economic or supervisory judgment.

11. Administrative Discretion

Banking regulators frequently need specialised technical judgment.

For example, regulators assess:

credit risk + liquidity + capital + governance + business models + systemic risk.

Courts generally recognise the technical nature of these assessments.

However, technical discretion does not mean unlimited discretion.

A supervisory decision can still be reviewed for:

legal error, procedural irregularity, manifest assessment errors where applicable, proportionality, reasoning and misuse of powers.

12. Principle of Legality

The principle of legality is fundamental to Spanish public law and EU administrative law.

Regulatory agencies derive their authority from legislation.

Consequently:

Statute/EU regulation
→ regulatory competence
→ administrative decision
→ judicial review.

The regulator cannot reverse this chain by creating powers for itself without an adequate legal basis.

13. Proportionality

Banking supervision must also respect proportionality.

A regulatory measure should be appropriate to the legitimate supervisory objective and should not go further than legally justified.

Proportionality is particularly important in areas involving:

• capital measures;
• governance intervention;
• administrative sanctions;
• restrictions on activities;
• licence withdrawal; and
• resolution measures.

14. Rights of Defence

Where supervisory proceedings may adversely affect a bank or individual, procedural safeguards can become important.

Depending on the applicable procedure, these can include:

• access to relevant files;
• opportunity to submit observations;
• notification of allegations;
• reasoned decisions; and
• judicial remedies.

Banking regulation therefore combines effective supervision with procedural fairness.

15. Judicial Review in Spain

Spanish administrative courts can review decisions adopted by national regulatory authorities where Spanish procedural law gives them jurisdiction.

The judicial system can therefore provide legality control over actions of authorities such as Banco de España or other Spanish administrative bodies.

However, where the contested final decision belongs to an EU institution such as the ECB or SRB, jurisdiction may instead lie with the EU courts.

Determining who legally adopted the final decision is therefore crucial.

16. EU Judicial Review

Articles 263 and related provisions of the Treaty on the Functioning of the European Union provide mechanisms for reviewing acts of EU institutions.

The General Court and Court of Justice have consequently developed substantial Banking Union jurisprudence.

This jurisprudence is directly relevant to Spain because Spanish banks operate under the same SSM and SRM architecture.

17. Case Law 1 — Landeskreditbank Baden-Württemberg v ECB

CJEU, C-450/17 P

Landeskreditbank challenged its classification as a significant institution under the SSM.

The case examined the allocation of supervisory competence between the ECB and national authorities.

Principle

The judgment emphasised the integrated structure of the Single Supervisory Mechanism and clarified the ECB's role within that framework.

Spanish relevance

The same legal architecture determines the division of supervisory responsibilities between the ECB and Banco de España.

The case demonstrates that classification and supervisory competence are themselves subject to judicial legality control.

18. Case Law 2 — Berlusconi and Fininvest

CJEU, C-219/17

This case concerned the acquisition of a qualifying holding in an Italian bank.

National authorities participated in the assessment, but the final decision was adopted by the ECB.

The Court considered which court had jurisdiction to review the preparatory national measures.

Principle

Where national measures form part of a composite procedure leading to a final ECB decision, EU judicial review plays the central role regarding the legality of the final decision and relevant preparatory acts within that framework.

Spanish relevance

The same principle can apply where Banco de España participates in an SSM procedure culminating in an ECB decision.

19. Case Law 3 — Trasta Komercbanka and Others v ECB

CJEU, Joined Cases C-663/17 P, C-665/17 P and C-669/17 P

This litigation arose from the ECB's withdrawal of a Latvian bank's authorisation.

It raised important questions concerning who could challenge the ECB decision and how a bank undergoing liquidation could exercise its procedural rights.

Principle

Effective judicial protection remains important even in highly technical banking-supervision proceedings.

Spanish relevance

The ECB possesses corresponding licensing powers within the SSM for Spanish institutions.

Licence withdrawal is therefore not beyond judicial scrutiny.

20. Case Law 4 — Crédit mutuel Arkéa v ECB

General Court, T-712/15 and T-52/16

The litigation concerned ECB prudential-supervision decisions involving the Crédit Mutuel group.

The General Court considered questions concerning consolidated supervision and the ECB's prudential powers.

Principle

The ECB's supervisory decisions must remain within the legal framework created by the SSM Regulation and applicable prudential legislation.

Spanish relevance

Spanish banking groups with complex corporate structures are subject to the same general EU prudential principles.

21. Case Law 5 — Algebris (UK) and Anchorage Capital Group v Commission

General Court, T-570/17

This case arose from the Banco Popular resolution.

The applicants challenged the European Commission decision endorsing the SRB's resolution scheme.

The General Court dismissed the action.

Importance

This is particularly relevant to Spain because it involved an actual Spanish bank.

It demonstrates that extraordinary resolution measures taken to protect financial stability remain subject to judicial legality review.

22. Case Law 6 — Fundación Tatiana Pérez de Guzmán el Bueno and SFL v SRB

General Court, T-481/17

This was another major action arising from Banco Popular's resolution.

The applicants challenged actions connected with the SRB resolution process.

Principle

Resolution authorities possess substantial statutory powers, but those powers operate within a legal framework capable of judicial review.

Importance for legality control

The case illustrates the balance between:

rapid regulatory intervention

and

judicial examination of legality.

23. Case Law 7 — Del Valle Ruíz and Others

General Court, Banco Popular resolution litigation

These proceedings formed another part of the judicial challenges arising from Banco Popular's resolution.

They concerned actions taken within the SRM framework and provided further judicial consideration of resolution procedures and institutional responsibilities.

Spanish significance

The cases demonstrate that even during a banking emergency, regulatory decisions are not placed entirely outside the rule of law.

24. Case Law 8 — Banco Santander v J.A.C. and M.C.P.R.

CJEU, C-410/20

This case arose after Banco Popular was resolved and transferred to Banco Santander.

It concerned investor claims relating to financial instruments acquired before resolution and their interaction with EU bank-resolution legislation.

Importance

The judgment demonstrates that resolution measures can significantly affect ordinary private-law rights.

This makes strict legality control especially important: authorities exercising resolution powers can produce consequences for shareholders, creditors and investors.

25. Case Law 9 — Banco Santander v D.A.

CJEU, C-312/21

This case similarly concerned the consequences of Banco Popular's resolution.

The Court examined the interaction between investor remedies and the effects required by EU resolution legislation.

Principle

Bank-resolution law can modify the operation of ordinary private-law remedies where EU legislation requires that result.

Legality-control relevance

Courts determine the legal boundaries and consequences of regulatory resolution decisions.

26. Case Law 10 — Baumeister

CJEU, C-15/16

The case concerned access to confidential information held by a financial supervisory authority.

The Court interpreted the concept of confidential information under EU financial-supervision legislation.

Spanish relevance

Banking legality control does not mean that every supervisory document automatically becomes public.

Courts must balance:

effective judicial protection + supervisory confidentiality + protection of sensitive financial information.

27. Banco Popular as a Model of Multi-Level Regulation

Banco Popular illustrates the complexity of Spain's system.

The regulatory chain broadly involved:

Spanish bank
↓
ECB prudential supervision
↓
determination concerning failure or likely failure
↓
Single Resolution Board
↓
resolution scheme
↓
European Commission endorsement
↓
national implementation and transfer
↓
EU judicial review.

Thus, a case involving a Spanish bank may involve both Spanish and European institutions.

28. Legality Control vs Merits Review

An important distinction exists between reviewing legality and replacing the regulator's technical assessment.

A court may examine whether:

• the regulator used the correct legal test;
• the evidence supported the legal requirements;
• procedures were followed;
• reasoning was adequate;
• fundamental rights were respected; and
• proportionality requirements were satisfied.

But courts do not ordinarily become substitute bank supervisors making day-to-day decisions about capital, liquidity or credit risk.

29. Administrative Sanctions

Spanish and EU banking authorities can impose sanctions or supervisory measures where regulated entities violate applicable requirements.

Sanctioning powers are constrained by principles including:

legality + proportionality + procedural fairness + rights of defence + judicial review.

This is particularly important because banking penalties can be substantial and can also affect directors and managers.

30. CNMV and Judicial Control

CNMV decisions can also be challenged through the applicable administrative and judicial mechanisms.

This becomes relevant when banks operate as investment-service providers.

For example, misconduct concerning:

• market abuse;
• investor information;
• investment products; or
• securities-market obligations

may produce CNMV enforcement action.

The legality of such action remains reviewable under the applicable legal framework.

31. AML Decisions

Banks also face AML supervision and enforcement.

Spanish AML authorities must act under Law 10/2010 and associated legislation.

Even where combating money laundering is an important public interest, administrative measures must still comply with statutory authority and procedural requirements.

Financial-crime objectives do not eliminate legality control.

32. Fundamental Rights

Banking supervision can interfere with protected legal interests such as:

• property;
• privacy;
• professional activity;
• confidentiality;
• reputation; and
• procedural rights.

Where EU law applies, the EU Charter of Fundamental Rights can therefore become relevant.

Important provisions include:

Article 41 — good administration

Article 47 — effective remedy and fair trial

Article 17 — property

These rights operate within the applicable legal limitations and proportionality framework.

33. Main Regulatory Bodies

34. At Least Six Important Cases

35. Practical Legality-Control Model

For a supervisory measure against a Spanish bank, the analysis can proceed as follows:

Step 1: Identify the regulator

Banco de España, ECB, CNMV, FROB, SRB or another authority?

Step 2: Identify the statutory power

Which Spanish or EU provision authorises the action?

Step 3: Identify the procedure

Were notice, hearing, evidence and decision-making requirements satisfied?

Step 4: Examine substantive legality

Was the correct legal test applied?

Step 5: Examine proportionality

Was the measure appropriate and legally justified?

Step 6: Examine fundamental rights

Were defence, property, confidentiality and effective-remedy rights respected?

Step 7: Identify the correct court

Spanish administrative court or EU court?

This final question is particularly important in Banking Union cases.

Conclusion

Regulatory agencies and legality control in Spanish banking law form a multi-level system of supervision and accountability.

Spain's banking institutions are supervised through an integrated framework involving the Banco de España and ECB, while the CNMV regulates securities and investment activities, SEPBLAC contributes to AML/CFT supervision, and FROB and the SRB perform important resolution functions.

These authorities possess extensive powers, but those powers are not unlimited. Supervisory and resolution decisions must have an appropriate legal basis, follow required procedures, respect proportionality and fundamental rights, provide adequate reasoning where required, and remain subject to judicial review.

Cases such as *Landeskreditbank, Berlusconi and Fininvest, Trasta Komercbanka, Crédit mutuel Arkéa, Algebris, Fundación Tatiana Pérez de Guzmán, the Del Valle Ruíz litigation, Banco Santander v J.A.C., Banco Santander v D.A. and Baumeister* demonstrate how EU courts define and control regulatory authority.

The central principle is therefore:

Effective banking supervision requires powerful regulators, while the rule of law requires that those regulators themselves remain subject to clearly defined legal powers and effective judicial control.