Banking Law and Self-Regulating Financial Ecosystems in Spain

1. Introduction

A self-regulating financial ecosystem is a financial environment in which banks, payment firms, fintech companies, trading venues, technology providers, industry associations, and sometimes decentralized networks establish technical standards, codes of conduct, governance mechanisms, or automated controls that supplement formal government regulation.

In Spain, however, self-regulation cannot replace public financial regulation. Banks and financial firms remain subject to binding Spanish and EU law and to public supervision by bodies such as:

• Banco de España;
• European Central Bank (ECB);
• CNMV (Comisión Nacional del Mercado de Valores);
• European Banking Authority (EBA); and
• other EU supervisory institutions within their respective competences.

Therefore, the Spanish model is better described as regulated self-regulation or co-regulation.

2. Meaning of self-regulation

Self-regulation can include:

• industry codes of conduct;
• banking standards;
• internal risk limits;
• fintech standards;
• payment-industry rules;
• cybersecurity standards;
• automated compliance controls;
• market rules;
• internal governance frameworks;
• professional standards;
• voluntary consumer-protection commitments.

For example, several banks could adopt a common technical standard for detecting fraudulent payment transactions.

That standard is privately developed.

But it cannot override:

Spanish banking legislation + EU regulations + ECB/Banco de España requirements.

3. Regulatory hierarchy

The Spanish system can be understood as:

EU legislation

↓

Spanish legislation

↓

ECB / Banco de España / CNMV supervision

↓

Regulatory technical standards and supervisory guidance

↓

Industry standards and codes

↓

Individual firm's internal rules

A private standard at the bottom cannot contradict a mandatory rule above it.

4. Principal Spanish banking legislation

A central statute is Law 10/2014 of 26 June on the organisation, supervision and solvency of credit institutions.

It regulates matters such as:

• authorization;
• prudential supervision;
• governance;
• solvency;
• significant holdings;
• sanctions;
• supervisory powers.

Spain's banking framework also operates within the EU's Capital Requirements Regulation and Capital Requirements Directive framework.

Consequently, a bank cannot use "self-regulation" to determine for itself whether statutory capital requirements apply.

5. Role of Banco de España

Banco de España performs important supervisory functions concerning Spanish financial institutions.

Its responsibilities include areas such as:

• prudential supervision where competent;
• banking conduct;
• payment services;
• financial stability;
• regulatory reporting;
• oversight functions.

Industry self-regulation can supplement these responsibilities.

It cannot eliminate them.

For example:

Bank's internal risk model says transaction is acceptable.

But:

Banco de España/ECB prudential requirement says additional controls are necessary.

The public regulatory requirement prevails.

6. Role of the ECB

For credit institutions participating in the euro-area banking system, the Single Supervisory Mechanism (SSM) is fundamental.

The ECB directly supervises significant credit institutions, while national competent authorities participate in the supervision of other institutions under the SSM architecture.

Thus:

Bank internal governance

↓

national supervision

↓

European supervisory architecture

Self-regulation exists within this public framework.

7. Role of the CNMV

The CNMV regulates and supervises Spanish securities markets and investment activities within its statutory competence.

Self-regulation is particularly relevant to:

• trading venues;
• investment services;
• market standards;
• disclosure;
• market conduct;
• securities infrastructure;
• investment products.

Market operators may create detailed rules governing participants.

However, those rules remain subject to mandatory securities legislation.

8. Forms of self-regulation

Self-regulation can take several forms.

A. Industry codes

Financial associations may establish standards for member institutions.

B. Internal banking policies

Banks create rules covering:

• lending;
• risk;
• compliance;
• cybersecurity;
• fraud;
• customer treatment.

C. Market rules

Trading venues establish operational requirements for participants.

D. Technology standards

Financial institutions establish common technical protocols.

E. Automated governance

Software can automatically enforce predefined financial rules.

Each form remains subordinate to applicable law.

9. Codes of conduct

Codes of conduct are a classic form of financial self-regulation.

A code might require:

• clear customer communication;
• responsible lending;
• transparent fees;
• complaint handling;
• conflict management;
• ethical sales practices.

A voluntary code does not automatically have the same status as legislation.

However, it can become legally important where:

• it forms part of a contract;
• legislation recognizes it;
• the institution publicly commits to it;
• customers reasonably rely on representations concerning it; or
• regulators consider compliance when evaluating governance.

10. Self-regulation and consumer protection

Self-regulation is particularly useful for developing standards more quickly than legislation.

However, it creates a risk:

the regulated industry designs rules primarily for itself.

Consequently, Spanish and EU consumer-protection law establishes mandatory minimum standards.

A bank cannot escape:

• transparency requirements;
• unfair-terms controls;
• mortgage protections;
• payment-services requirements;
• data-protection obligations

simply by adopting an industry code.

11. Responsible lending

Banks commonly maintain internal lending standards concerning:

• affordability;
• credit scoring;
• collateral;
• loan-to-value;
• income;
• repayment capacity.

These are partly self-regulatory.

However, mandatory rules concerning mortgage lending, consumer credit and prudential risk remain applicable.

Thus:

Internal lending policy > may be stricter than law

but

Internal lending policy < cannot lawfully reduce mandatory protection.

12. Payment ecosystems

Payment services provide a strong example of regulated ecosystems.

A transaction may involve:

Customer

↓

Bank

↓

Payment processor

↓

Card/payment network

↓

Merchant's bank

↓

Merchant

Each participant may apply private operational standards.

At the same time, the system is subject to EU and Spanish payment-services regulation.

Private network rules therefore operate inside a mandatory public-law framework.

13. Open banking

Open banking provides another example.

Banks, fintech firms and payment providers interact through APIs.

Technical standards may regulate:

• authentication;
• API access;
• data formats;
• transaction messages;
• security;
• error handling.

But these private technical arrangements must remain consistent with applicable payment-services, data-protection and cybersecurity rules.

The ecosystem can therefore be technologically decentralized while remaining legally regulated.

14. Fintech ecosystems

Spanish fintech firms can participate in ecosystems involving:

• banks;
• payment institutions;
• electronic-money institutions;
• crowdfunding platforms;
• investment firms;
• crypto-asset service providers;
• technology companies.

Self-regulatory standards may improve:

• interoperability;
• fraud detection;
• identity verification;
• cybersecurity;
• data sharing.

But regulatory classification still matters.

A company cannot avoid licensing requirements merely by calling itself a "technology platform."

15. Regulatory sandbox

Spain's Law 7/2020 on the digital transformation of the financial system created a financial regulatory sandbox.

The sandbox enables innovative projects to be tested under controlled conditions.

It represents supervised experimentation, not deregulation.

The model is:

Innovation

Regulatory oversight

Testing

Safeguards

rather than:

Innovation − law.

16. Blockchain and decentralized finance

Self-regulation becomes particularly interesting in blockchain ecosystems.

A decentralized protocol may contain automated rules determining:

• collateral;
• interest;
• liquidation;
• asset transfers;
• governance voting.

Participants might argue that the protocol "regulates itself."

Spanish and EU law do not automatically accept that technological automation removes legal responsibility.

Questions remain concerning:

• who provides the financial service;
• who controls the platform;
• who issues the asset;
• whether authorization is required;
• who owes duties to customers;
• AML obligations;
• consumer protection;
• operational responsibility.

17. MiCA

The EU Markets in Crypto-Assets Regulation (MiCA) substantially strengthens the public-law framework for crypto-asset markets.

It regulates areas such as:

• crypto-asset issuance;
• disclosure;
• crypto-asset service providers;
• governance;
• customer protection;
• prudential requirements.

Therefore, a Spanish crypto ecosystem cannot simply establish its own rules and claim regulatory independence.

Private governance operates within MiCA, where MiCA applies.

18. Artificial intelligence

Banks increasingly use AI for:

• fraud detection;
• credit assessment;
• AML monitoring;
• customer service;
• trading;
• compliance;
• risk modelling.

Internal AI governance is partly self-regulatory.

For example, a bank may establish:

Model Risk Committee → validation → bias testing → human oversight → deployment.

However, applicable EU law—including data protection and the EU AI regulatory framework—can impose mandatory requirements.

19. DORA and operational resilience

The Digital Operational Resilience Act (DORA) is particularly important for modern financial ecosystems.

DORA regulates ICT-related risk across much of the EU financial sector.

It addresses:

• ICT risk management;
• incident reporting;
• resilience testing;
• third-party ICT risk;
• contractual arrangements;
• critical ICT providers.

Therefore, private cybersecurity standards cannot substitute for mandatory DORA obligations.

20. Third-party technology providers

Modern banking ecosystems rely heavily on:

• cloud providers;
• data centres;
• software companies;
• AI vendors;
• payment processors;
• identity providers.

This creates a governance problem:

Bank outsources technology ≠ Bank outsources regulatory responsibility.

A Spanish bank remains responsible for complying with applicable legal obligations even when important operational functions are performed externally.

21. Competition law

Self-regulation can also create competition-law concerns.

Suppose several major banks jointly establish an industry rule excluding certain fintech competitors.

Although presented as "self-regulation," the arrangement could potentially raise issues under:

• Article 101 TFEU;
• Spanish competition law;
• rules governing anticompetitive agreements.

Self-regulation therefore cannot become a mechanism for market exclusion or cartel behaviour.

22. Data protection

Financial ecosystems exchange large quantities of personal data.

The GDPR and Spanish data-protection law therefore remain central.

Industry participants cannot simply agree among themselves that customer data may be freely exchanged.

They must establish:

• lawful processing basis;
• transparency;
• purpose limitation;
• data minimization;
• security;
• retention controls;
• data-subject rights.

23. AML self-regulation

Banks often develop internal AML models stricter than minimum legal requirements.

They may establish:

• risk scoring;
• enhanced due diligence;
• transaction thresholds;
• suspicious-activity detection;
• customer segmentation.

But AML is not fundamentally voluntary.

Spain's Law 10/2010 on prevention of money laundering and terrorist financing imposes mandatory obligations.

Internal systems supplement those obligations.

24. Internal risk appetite

One important form of self-regulation is a bank's risk appetite framework.

A bank may establish:

Maximum commercial-real-estate exposure = 15% of portfolio.

This can be stricter than the regulatory minimum.

That is normally permissible.

But a bank cannot say:

Internal policy permits 25%, therefore a statutory 20% limit does not apply.

Mandatory law prevails.

25. Smart contracts

A smart contract can automatically execute financial conditions.

Example:

Collateral falls below threshold

↓

Smart contract requests additional collateral

↓

Failure to provide collateral

↓

Automated liquidation

Technologically, this looks self-enforcing.

Legally, however, questions remain:

• Was there a valid contract?
• Was the liquidation lawful?
• Were consumer protections respected?
• Was there a coding error?
• Can the transaction be reversed?
• Who is liable for defective code?

Therefore:

Code execution ≠ final legal determination.

26. Benefits of self-regulation

Properly designed self-regulation can provide:

Speed

Industry standards can evolve faster than legislation.

Expertise

Financial institutions understand technical operational risks.

Flexibility

Standards can adapt to new products.

Innovation

New technology can be tested more efficiently.

International compatibility

Industry standards can facilitate cross-border transactions.

Risk prevention

Firms can establish controls stricter than statutory minimums.

27. Risks of self-regulation

The main risks include:

Regulatory capture

Industry participants may influence standards for their own benefit.

Conflicts of interest

Institutions may prefer weaker standards.

Fragmentation

Different institutions may adopt inconsistent requirements.

Lack of enforcement

Voluntary rules may be ignored.

Consumer harm

Customers may have little influence over private rule-making.

Competition problems

Incumbents may design standards that disadvantage competitors.

This explains why Spain generally combines private governance with public supervision.

28. Case law

There is no single Spanish Supreme Court doctrine called "self-regulating financial ecosystems."

The concept combines several legal fields.

Accordingly, useful case law concerns the limits of private financial rules, banking supervision, consumer protection, fintech regulation and EU financial governance.

29. Banco Español de Crédito SA v Camino — Case C-618/10

This is a major CJEU consumer-banking judgment arising from Spain.

The dispute concerned an allegedly unfair contractual term in a consumer credit agreement.

The CJEU emphasized the importance of effective judicial protection under EU unfair-contract-terms legislation.

Relevance

Banks cannot rely exclusively on privately drafted contractual rules.

Mandatory EU consumer law can override or invalidate contractual arrangements.

For self-regulation:

Private financial rules remain subordinate to mandatory consumer law.

30. Aziz v Caixa d'Estalvis de Catalunya — Case C-415/11

This important CJEU case arose from Spanish mortgage enforcement.

The Court considered whether Spanish procedural arrangements provided effective protection against unfair contractual terms.

Relevance

The case demonstrates that:

• banking contracts;
• industry practices;
• enforcement procedures

remain subject to EU consumer-protection standards.

A financial ecosystem therefore cannot "self-regulate" away mandatory customer rights.

31. Gutiérrez Naranjo — Joined Cases C-154/15, C-307/15 and C-308/15

These cases concerned Spanish mortgage floor clauses.

The CJEU rejected restrictions that would have significantly limited the financial consequences of finding contractual terms unfair.

Relevance

Private banking practices remain subject to substantive EU consumer-law control.

Large-scale industry adoption of a contractual practice does not make that practice legally immune.

32. Banco Primus SA v Jesús Gutiérrez García — Case C-421/14

The CJEU again addressed unfair terms in Spanish mortgage lending.

Relevance

This judgment reinforces the principle that national courts must be capable of reviewing financial contractual arrangements under mandatory EU consumer law.

For self-regulatory ecosystems, contractual autonomy therefore has clear legal boundaries.

33. Bankia SA v Marí Merino — Case C-109/17

The CJEU considered issues arising in the Spanish financial and consumer-protection context.

Relevance

The broader lesson is that banking arrangements and enforcement mechanisms remain subject to mandatory European legal safeguards even where national or private financial arrangements operate differently.

34. Landeskreditbank Baden-Württemberg v ECB — Case C-450/17 P

This case concerned the structure of banking supervision under the Single Supervisory Mechanism.

The CJEU examined the relationship between national supervision and ECB supervisory competence.

Relevance to Spain

This is highly relevant to understanding why Spanish banking cannot become genuinely self-regulating.

Banks operate within a supranational supervisory system in which public authorities retain ultimate prudential authority.

It is an EU precedent, not specifically a Spanish banking dispute.

35. Berlusconi and Fininvest v Banca d'Italia and ECB — Case C-219/17

The CJEU considered the judicial review of a supervisory procedure involving national authorities and the ECB.

Relevance

The judgment demonstrates the deeply integrated character of EU banking supervision.

A modern financial ecosystem may involve private governance, but regulatory decisions remain embedded in legally reviewable public supervisory structures.

36. What the cases collectively demonstrate

The jurisprudence establishes several important themes:

These cases do not directly adjudicate something formally called a "self-regulating financial ecosystem." They establish legal principles that constrain such ecosystems.

37. Liability within a self-regulating ecosystem

Suppose:

Bank A

↓

Fintech B

↓

Cloud Provider C

↓

AI Vendor D

↓

Customer

If the customer suffers a loss, responsibility cannot automatically be avoided by saying:

"The ecosystem operates automatically."

Legal analysis must determine:

1. who provided the regulated service;
2. who contracted with the customer;
3. who controlled the relevant process;
4. who violated a regulatory duty;
5. whether outsourcing was lawful;
6. whether adequate supervision existed;
7. whether the loss was caused by the breach.

38. Self-regulation versus public regulation

The two systems can coexist.

The key principle is:

Self-regulation can supplement mandatory law, but cannot lawfully displace it.

39. Practical compliance model for Spanish banks

A Spanish bank participating in an innovative financial ecosystem should examine:

1. Licensing — Is each regulated activity properly authorized?
2. Governance — Who is legally responsible?
3. Capital — Are prudential requirements satisfied?
4. Consumer protection — Are mandatory customer rights preserved?
5. AML — Who performs customer due diligence?
6. Data — Is GDPR compliance maintained?
7. Technology — Are DORA requirements satisfied?
8. Outsourcing — Does the bank retain adequate control?
9. Competition — Do industry rules restrict competitors?
10. AI — Are automated decisions legally controlled?
11. Cybersecurity — Are resilience measures adequate?
12. Auditability — Can automated decisions be reconstructed?
13. Complaints — Can customers challenge outcomes?
14. Regulatory reporting — Can authorities obtain required information?

40. Future development

Spain's financial system is increasingly likely to involve interconnected ecosystems combining:

Traditional banks

Fintech

AI

Cloud infrastructure

Open banking

Digital identity

Crypto-assets/tokenization

Automated compliance

This does not necessarily mean less regulation.

In many cases, technological decentralization produces greater demand for regulatory coordination, because responsibility becomes distributed among multiple institutions.

Conclusion

Self-regulating financial ecosystems in Spain operate within, rather than outside, the formal banking-law system. Banks, fintech companies, payment providers, trading platforms and technology firms can develop private standards, automated controls, codes of conduct and technical governance arrangements. However, these mechanisms remain subordinate to Spanish and EU banking, securities, consumer, AML, data-protection, operational-resilience and competition rules.

The Spanish approach is therefore best characterized as regulated self-regulation or co-regulation:

Private innovation + internal governance + industry standards + mandatory public supervision.

The case law reinforces this structure. Banco Español de Crédito, Aziz, Gutiérrez Naranjo,* and *Banco Primus demonstrate that private banking arrangements cannot override mandatory consumer protections, while Landeskreditbank and Berlusconi/Fininvest illustrate the strength of the EU's public prudential-supervision architecture.

The fundamental legal principle is simple: a financial ecosystem may regulate many aspects of its own operation, but it cannot decide for itself whether binding Spanish and EU banking law applies.