Banking Law and Regulatory Reporting Digitization in Spain

1. Introduction

Regulatory reporting digitization in Spanish banking means replacing manual, paper-based, and fragmented supervisory reporting with standardized electronic data, automated reporting systems, machine-readable formats, APIs, data warehouses, validation engines, and increasingly AI-assisted compliance tools.

Spain's system is particularly important because Spanish banks operate within both the national regulatory framework and the EU Banking Union. Consequently, a Spanish bank may have reporting obligations involving:

• Banco de España;
• European Central Bank (ECB);
• European Banking Authority (EBA);
• Single Resolution Board (SRB);
• SEPBLAC for AML/CFT matters;
• CNMV for relevant securities activities; and
• other Spanish and EU authorities.

Digitization therefore does not simply mean submitting the same paper form electronically. It increasingly means converting bank information into standardized, granular, machine-readable regulatory data capable of automated supervisory analysis.

2. Legal Framework

There is no single Spanish "Digital Regulatory Reporting Act." The framework comes from several overlapping sources.

Important legislation includes:

• Law 10/2014 on the organization, supervision and solvency of credit institutions;
• Royal Decree 84/2015, implementing important elements of Law 10/2014;
• Regulation (EU) No 575/2013 (CRR), as subsequently amended;
• the Capital Requirements Directive (CRD) framework;
• Regulation (EU) No 1024/2013, establishing the Single Supervisory Mechanism;
• ECB supervisory regulations and decisions;
• EBA Implementing Technical Standards on supervisory reporting;
• Law 11/2015 concerning recovery and resolution;
• EU resolution legislation;
• DORA, Regulation (EU) 2022/2554; and
• GDPR where regulatory data contain personal information.

The result is a layered system of:

Spanish law + EU banking law + ECB supervision + EBA technical standards.

3. Why Reporting Became Digital

Traditional regulatory reporting had several weaknesses.

Banks maintained separate systems for:

• accounting;
• credit risk;
• liquidity;
• market risk;
• customer information;
• collateral; and
• regulatory capital.

Employees then manually converted this information into regulatory returns.

This created risks of:

• inconsistent data;
• transcription errors;
• delayed reporting;
• duplicated information;
• incompatible definitions; and
• difficulty tracing reported numbers back to source systems.

Digital reporting attempts to create:

source data

↓

standardized definitions

↓

automated validation

↓

regulatory return

↓

supervisory database

↓

automated supervisory analysis.

4. Banco de España's Role

Banco de España has long required supervised institutions to submit extensive financial and supervisory information.

Digital reporting supports its functions concerning:

• prudential supervision;
• statistical reporting;
• monetary statistics;
• credit information;
• financial stability;
• accounting supervision; and
• risk analysis.

Spanish banks therefore require systems capable of producing information that satisfies both domestic and European requirements.

5. ECB and the Single Supervisory Mechanism

The creation of the Single Supervisory Mechanism (SSM) significantly transformed Spanish reporting.

Large Spanish banking groups classified as significant institutions are directly supervised by the ECB.

Reporting therefore increasingly flows through a European supervisory architecture:

Spanish bank

↓

Banco de España / supervisory reporting infrastructure

↓

ECB / European supervisory systems

This encourages harmonized definitions and standardized electronic formats across participating states.

6. EBA Supervisory Reporting

The European Banking Authority has played a central role in harmonizing regulatory reporting.

Major reporting categories include:

COREP

Common Reporting primarily concerns prudential information such as:

• own funds;
• capital requirements;
• credit risk;
• market risk;
• operational risk;
• leverage; and
• large exposures.

FINREP

Financial Reporting provides standardized financial information for relevant institutions.

It can cover:

• balance sheets;
• profit and loss;
• financial assets;
• impairment;
• non-performing exposures; and
• other financial information.

Digital standardization allows supervisors to compare institutions more effectively.

7. XBRL and Machine-Readable Reporting

One of the technological foundations of modern regulatory reporting is XBRL — eXtensible Business Reporting Language.

Instead of reporting:

"Capital = €5 billion"

as unstructured text, XBRL assigns standardized tags to the information.

This allows computers to identify:

• what the figure represents;
• its reporting period;
• currency;
• regulatory definition; and
• relationship with other data.

This supports automated validation and comparison.

8. Data Point Models and Taxonomies

European regulatory reporting increasingly relies upon structured taxonomies and data definitions.

The objective is to ensure that:

"Common Equity Tier 1 capital"

means substantially the same regulatory concept when reported by banks in Spain, France, Germany, Italy or another participating jurisdiction.

Without common definitions, digitization would merely accelerate inconsistent reporting.

Therefore, data standardization is as important as technology.

9. AnaCredit

A major example of granular digital reporting is the ECB's AnaCredit framework.

AnaCredit collects detailed information concerning individual bank credit exposures, particularly loans to legal entities within its scope.

Instead of receiving only aggregate information such as:

total corporate lending = €20 billion,

supervisors can obtain much more granular information concerning individual credit relationships.

This allows better analysis of:

• borrower concentration;
• credit deterioration;
• industry exposure;
• collateral;
• geographic risk; and
• systemic trends.

10. Spain's Central Credit Register

Spain also has an important credit-information infrastructure through the Central Credit Register (Central de Información de Riesgos — CIR) administered by Banco de España.

Financial institutions report qualifying credit-risk information.

This assists:

• prudential supervision;
• risk assessment;
• credit analysis; and
• monitoring of borrower indebtedness.

Digitization enables these records to be processed and updated on a much larger scale.

11. Legal Duty of Accuracy

Digitization does not reduce the institution's responsibility for the information submitted.

A bank remains responsible for ensuring that regulatory information is:

• complete;
• accurate;
• consistent;
• timely; and
• prepared according to applicable definitions.

An automated system that repeatedly submits incorrect figures may therefore create regulatory liability rather than eliminate it.

The governing principle is:

automation changes how compliance occurs, not who is responsible for compliance.

12. Data Lineage

Modern reporting requires data lineage.

This means the bank should be capable of tracing a regulatory figure back through its systems.

For example:

COREP figure

↓

regulatory calculation

↓

risk database

↓

loan database

↓

customer exposure

↓

original transaction.

If supervisors challenge the figure, the institution should be able to explain how it was produced.

13. Governance

Reporting digitization is therefore a governance issue, not merely an IT project.

A typical governance model involves:

Board / senior management

↓

Chief financial/risk functions

↓

Regulatory reporting

↓

Data governance

↓

IT infrastructure

↓

Internal audit

Responsibility cannot simply be delegated to software developers.

14. Case Law 1 — Banco Español de Crédito, C-618/10

Banco Español de Crédito SA v Joaquín Calderón Camino, CJEU Case C-618/10, arose from Spanish banking litigation.

It concerned unfair terms and consumer protection rather than digital reporting directly.

Principle

EU banking-related activity must comply with substantive consumer-protection requirements; procedural arrangements cannot make EU protections ineffective.

Reporting relevance

A digitized reporting or compliance system cannot treat legally problematic contractual positions as valid simply because they are recorded automatically.

Bad legal data processed faster remain bad legal data.

15. Case Law 2 — Aziz v Caixa d'Estalvis de Catalunya, C-415/11

The CJEU examined Spanish mortgage-enforcement procedures and EU unfair-terms law.

Principle

National procedures must permit effective protection of rights granted by EU consumer legislation.

Digital-reporting significance

Banks' databases must be capable of reflecting legally relevant developments such as:

• disputed loans;
• invalid contractual terms;
• court orders;
• restructuring; and
• suspended enforcement.

Regulatory datasets cannot blindly rely on the original contractual classification after the legal status of an exposure changes.

16. Case Law 3 — Google Spain v AEPD, C-131/12

Although not a banking case, Google Spain SL and Google Inc. v AEPD and Mario Costeja González is foundational for Spanish digital-data regulation.

Principle

Processing large quantities of electronically accessible personal data can trigger significant data-protection responsibilities.

Banking relevance

Digitized supervisory reporting can contain or connect with personal information.

Spanish banks therefore need to reconcile:

regulatory reporting obligations

with

GDPR and data-protection requirements.

Mandatory reporting may have a lawful regulatory basis, but the bank must still maintain appropriate data governance and security.

17. Case Law 4 — SCHUFA Holding, C-634/21

The CJEU examined automated credit scoring and GDPR Article 22.

Principle

Where an automated score plays a determining role in a decision significantly affecting a person, the processing may constitute automated decision-making within Article 22 GDPR.

Reporting relevance

Regulatory reporting increasingly draws information from automated credit-risk systems.

Banks therefore need to distinguish between:

• supervisory reporting;
• internal risk scoring; and
• automated customer decisions.

The fact that all three use the same database does not mean that they have the same legal basis or regulatory purpose.

18. Case Law 5 — SCHUFA, Joined Cases C-26/22 and C-64/22

These cases concerned the processing and retention of financial information connected with insolvency.

Principle

Financial-data retention must satisfy GDPR requirements concerning lawfulness, necessity and proportionality.

Digital-reporting significance

Banks cannot assume:

"Regulatory information should be stored forever."

Different regulatory datasets can have different legally prescribed retention periods.

Digital architecture therefore needs automated retention and deletion rules.

19. Case Law 6 — Bankia IPO Civil Litigation

Spanish Supreme Court litigation arising from Bankia's 2011 IPO addressed the significance of the financial information presented to investors.

The litigation became an important post-crisis example of the legal consequences of inaccurate or misleading financial presentation.

Reporting principle

Financial information is not merely technical data.

Its accuracy can affect:

• investors;
• supervisors;
• counterparties;
• markets; and
• customers.

Digitization relevance

Digitization makes reporting faster but cannot compensate for inaccurate source data.

The sequence remains:

incorrect source data → incorrect automated calculation → incorrect regulatory report.

20. Case Law 7 — Gutiérrez Naranjo, Joined Cases C-154/15, C-307/15 and C-308/15

These Spanish mortgage cases concerned unfair floor clauses and restitution.

Reporting relevance

Once a judicial decision changes the legal or economic consequences of a banking product, institutions may need to adjust:

• provisions;
• liabilities;
• customer records;
• accounting treatment; and
• regulatory reporting.

Digitized systems must therefore be adaptable to changes in case law.

21. Reporting and GDPR

Regulatory reporting sometimes involves data relating to:

• borrowers;
• guarantors;
• beneficial owners;
• directors;
• counterparties; and
• customers.

Banks must distinguish between:

Required supervisory processing

Processing mandated by banking regulation.

and

Secondary use

Using regulatory data for unrelated commercial purposes.

The fact that information was lawfully collected for regulatory purposes does not automatically authorize every subsequent use.

22. Regulatory Reporting and Cloud Computing

Banks increasingly use cloud infrastructure for:

• data warehouses;
• analytics;
• reporting engines;
• reconciliation;
• regulatory calculations; and
• storage.

Cloud services can improve scalability but create:

• outsourcing risk;
• cybersecurity risk;
• concentration risk;
• data-location issues;
• access risks; and
• business-continuity concerns.

This is why DORA has become highly significant.

23. DORA

Regulation (EU) 2022/2554 — the Digital Operational Resilience Act has applied since 17 January 2025.

It establishes requirements concerning:

• ICT risk management;
• ICT incidents;
• resilience testing;
• third-party ICT risk;
• contractual arrangements; and
• oversight of critical ICT providers.

A regulatory-reporting platform is therefore not merely a compliance tool.

Its failure may itself become an operational-resilience problem.

24. Automated Validation

Modern digital reporting platforms can perform validation before submission.

For example:

Reported assets

must equal

liabilities + equity

or:

individual exposure categories

must reconcile with

total exposure.

Automated validation can detect inconsistencies immediately.

But regulators can also use similar technology to identify anomalies across banks.

25. SupTech

The regulator's side of digitization is commonly called SupTech — Supervisory Technology.

The relationship is:

Bank RegTech

↓

machine-readable data

↓

Supervisor SupTech

↓

risk analytics

↓

supervisory action.

This allows regulators potentially to identify problems more quickly than traditional periodic manual inspections.

26. AI and Regulatory Reporting

Artificial intelligence may increasingly assist with:

• anomaly detection;
• data mapping;
• regulatory interpretation;
• error identification;
• reconciliation;
• reporting classification; and
• risk forecasting.

However, AI-generated regulatory reports create governance questions.

If AI incorrectly classifies €500 million of exposure, the bank generally cannot defend the incorrect return simply by saying:

"The algorithm made the mistake."

Appropriate human oversight, validation and auditability remain essential.

27. EU AI Act

The EU AI Act, Regulation (EU) 2024/1689, adds another layer to Europe's digital financial framework.

Not every regulatory-reporting system is automatically a high-risk AI system.

The legal treatment depends on:

• the technology used;
• its intended purpose;
• its deployment; and
• the applicable AI Act classification.

Spanish banks therefore need an inventory of AI systems rather than treating all automation as legally identical.

28. Cybersecurity

Digitized reporting concentrates valuable financial information.

A compromised reporting system could expose:

• bank balance-sheet data;
• customer exposures;
• liquidity information;
• risk concentrations;
• borrower information; and
• supervisory communications.

Cybersecurity therefore becomes part of regulatory-reporting compliance.

A bank must protect:

confidentiality + integrity + availability of reporting information.

29. Corrections and Resubmissions

Errors are inevitable in complex reporting environments.

A strong regulatory-reporting framework therefore needs procedures for:

1. identifying errors;
2. assessing materiality;
3. notifying appropriate internal functions;
4. correcting source data;
5. recalculating reports;
6. resubmitting where required; and
7. documenting why the error occurred.

Simply correcting the final spreadsheet without fixing the underlying system creates recurring compliance risk.

30. Major Legal Risks

31. Important Case-Law Authorities

For research on Spain's digitized banking-reporting environment, at least the following authorities are useful:

1. Banco Español de Crédito, C-618/10 — substantive consumer protection in banking.
2. Aziz v Caixa d'Estalvis de Catalunya, C-415/11 — effective judicial protection in mortgage banking.
3. Google Spain v AEPD, C-131/12 — digital personal-data processing and data rights.
4. SCHUFA Holding, C-634/21 — automated financial scoring and Article 22 GDPR.
5. SCHUFA, Joined Cases C-26/22 and C-64/22 — retention and processing of financial information.
6. Gutiérrez Naranjo, Joined Cases C-154/15, C-307/15 and C-308/15 — judicial decisions affecting banking liabilities and financial records.
7. Spanish Supreme Court Bankia IPO litigation (2016) — importance of accurate financial information.

These judgments are not all regulatory-reporting cases in the narrow sense. They establish surrounding principles concerning data processing, financial accuracy, consumer rights and automated decision-making that digitized banking systems in Spain must respect.

32. Evolution of the Spanish System

The development can be summarized as:

Paper returns

↓

Electronic submissions

↓

Standardized templates

↓

COREP / FINREP

↓

XBRL and common taxonomies

↓

Granular datasets such as AnaCredit

↓

Automated validation and RegTech

↓

Cloud-based reporting

↓

SupTech and advanced analytics

↓

AI-assisted reporting and supervision

The trend is therefore toward more granular, standardized, automated and near-real-time supervisory information.

33. Conclusion

Regulatory reporting digitization has fundamentally changed Spanish banking supervision. What was once mainly a periodic exercise in completing regulatory forms has evolved into a continuous data-governance and technology function.

The modern architecture is:

Bank transactions

↓

Core banking systems

↓

Data warehouse

↓

Regulatory calculations

↓

Automated validation

↓

COREP / FINREP / granular reporting

↓

Banco de España / ECB / EBA supervisory architecture

↓

digital supervisory analysis

The core legal principle remains straightforward:

Digitalization automates the reporting process but does not automate away the bank's responsibility.

Spanish banks remain responsible for the accuracy, completeness, timeliness, security, traceability and regulatory meaning of the information they submit.

Accordingly, modern compliance requires much more than reporting software. It requires integrated data governance, internal controls, regulatory interpretation, cybersecurity, DORA compliance, GDPR safeguards, auditability, model governance and senior-management accountability.

The major case-law authorities—particularly Google Spain, SCHUFA, Banco Español de Crédito, Aziz, Gutiérrez Naranjo and the Bankia litigation—also demonstrate a broader principle: as Spanish banking becomes increasingly data-driven, technological efficiency must remain subordinate to substantive requirements concerning accuracy, accountability, consumer protection and fundamental data rights.