Banking Law and Vulnerable Adult Banking Safeguards in Spain

Jurisdiction: Spain

Vulnerable-adult banking safeguards in Spain concern the legal and operational protections that banks should apply when an adult customer may have difficulty protecting their financial interests because of disability, cognitive impairment, advanced age, dependency, communication barriers, financial exclusion, coercion, fraud, or other circumstances of vulnerability.

Spain does not regulate this subject through one standalone “Vulnerable Adult Banking Act.” Protection instead comes from a combination of the Spanish Constitution, Civil Code, banking and payment-services legislation, consumer law, disability law, data-protection rules, criminal law, and EU financial-services law.

A central principle is especially important: vulnerability does not automatically mean incapacity. Spanish law increasingly emphasizes autonomy, accessibility and support for the person's own decision-making rather than automatically replacing their decisions.

1. Constitutional foundation

The Spanish Constitution provides the broader foundation for protecting vulnerable banking customers.

Relevant constitutional principles include equality, dignity, protection against discrimination and protection of persons requiring particular social support.

Article 14 establishes equality before the law, while Article 49—following its 2024 reform—strengthens the constitutional approach to the rights, autonomy and social inclusion of persons with disabilities.

For banks, this means that disability or vulnerability should generally trigger reasonable accessibility and support, rather than automatic exclusion from financial services.

2. Law 8/2021 and supported decision-making

A major change occurred through Law 8/2021 of 2 June, reforming Spanish civil and procedural legislation concerning persons with disabilities.

The reform moved Spanish private law away from the traditional model of judicial modification of legal capacity toward a support-based decision-making system.

This has major banking consequences.

A bank should not simply conclude:

“This customer has a disability, therefore another person must make the decision.”

Instead, the question becomes whether the customer can exercise their legal capacity with appropriate assistance and whether a legally recognized support arrangement exists.

Support may involve voluntary arrangements, powers of attorney, guarda de hecho (de facto guardianship) or curatela, depending upon the circumstances.

3. The role of the bank

Banks are not courts and should not independently declare customers legally incapable.

Their role is principally to:

• authenticate customers;
• execute valid instructions;
• provide accessible information;
• recognize valid representation or support arrangements;
• detect unusual transactions and possible fraud;
• protect confidentiality;
• comply with payment-security requirements; and
• avoid unjustified discriminatory treatment.

This produces a difficult balance.

A bank that ignores obvious exploitation risks may expose a vulnerable customer to loss. But a bank that blocks every unusual decision by an elderly or disabled customer could improperly interfere with that customer's autonomy.

4. Accessible banking services

Accessibility is a central safeguard.

A vulnerable customer might require information in an accessible format, additional explanation, physical accessibility, accessible digital banking or assistance using banking channels.

The European Accessibility Act, implemented in Spain principally through Law 11/2023, has significantly strengthened accessibility requirements affecting various products and services, including relevant consumer banking services.

From 28 June 2025, important accessibility requirements under this framework became applicable.

Digital banking therefore increasingly needs to be designed so that accessibility is part of the service itself rather than merely an optional accommodation.

5. Consumer vulnerability

Spanish consumer law expressly recognizes the concept of a vulnerable consumer.

The consolidated General Law for the Defence of Consumers and Users, particularly following reforms including Royal Decree-Law 1/2021, recognizes that vulnerability may arise because of personal, economic, educational or social circumstances.

Importantly, vulnerability can be temporary or sector-specific.

A person may therefore be perfectly capable of making financial decisions while still being vulnerable in a particular banking context because the product, technology or communication method is exceptionally complex.

Banks should consequently avoid treating vulnerability as a fixed personal label.

6. Pre-contractual information

Protection becomes especially important when banks sell complex financial products.

A customer should receive sufficient information to understand matters such as:

principal → return → fees → duration → liquidity → major risks.

Where MiFID II applies to investment services, banks have additional suitability or appropriateness obligations depending upon the service being provided.

A bank cannot compensate for inadequate disclosure simply by obtaining a customer's signature.

Spanish and EU jurisprudence concerning financial products repeatedly demonstrates the importance of substantive information and informed consent.

7. Consumer credit safeguards

Where a vulnerable adult enters into consumer credit, mortgage or similar arrangements, the bank must comply with the applicable consumer-credit and mortgage-credit framework.

For residential mortgage lending, Law 5/2019 regulating real-estate credit contracts strengthened borrower protection considerably.

Relevant safeguards include standardized pre-contractual documentation, transparency requirements, creditworthiness assessment and enhanced pre-contractual procedures.

The notarial stage also provides an additional safeguard in covered mortgage transactions.

For a vulnerable borrower, these procedures can be particularly significant because they provide an independent opportunity for explanation before execution.

8. Payment fraud

Vulnerable adults may be particularly exposed to:

• impersonation scams;
• remote-access fraud;
• phishing;
• social engineering;
• fraudulent investment schemes; and
• manipulation by relatives or caregivers.

Spain's payment-services framework, deriving substantially from PSD2 and implemented through Royal Decree-Law 19/2018, establishes important rules concerning authorization and unauthorized payment transactions.

A bank should maintain effective authentication and fraud-detection mechanisms.

However, vulnerability does not automatically mean that the bank must reimburse every fraudulent payment. Liability depends upon matters such as authorization, authentication, customer conduct and the statutory allocation of payment-fraud risk.

9. Financial abuse by relatives or caregivers

One of the most difficult situations involves transactions technically initiated by the customer but resulting from coercion or exploitation.

For example, an elderly customer might suddenly transfer most savings to a newly introduced beneficiary.

The transaction is not necessarily unlawful. Adults retain the right to make gifts and financially unwise decisions.

But circumstances such as abrupt behavioral changes, repeated unusual withdrawals or a third party controlling all communications can constitute warning indicators.

The bank should use proportionate procedures rather than automatically assuming exploitation.

10. Powers of attorney

Vulnerable customers frequently use powers of attorney to allow trusted persons to conduct banking activities.

Banks should verify:

1. the existence of the power;
2. the identity of the representative;
3. whether the power remains effective;
4. its precise scope; and
5. whether the proposed transaction falls within that authority.

A general power should not automatically be interpreted as authorizing every conceivable financial transaction.

Law 8/2021 also strengthened the importance of preventive and voluntary support arrangements, making carefully drafted powers particularly significant.

11. Curatela and judicial support

Under the post-2021 system, curatela is an important formal support mechanism.

The judicial decision determines its scope.

Banks should therefore examine the actual judicial measure rather than assuming that every curator possesses unrestricted authority.

Some measures may be primarily assistive. Representative powers are exceptional and should operate according to the terms established by law and the relevant judicial decision.

12. Guarda de hecho

Spanish law also recognizes guarda de hecho, broadly understood as de facto support provided without a formal judicial appointment.

This can create practical challenges for banks.

A family member who routinely assists a vulnerable adult does not automatically have unrestricted authority to withdraw money, borrow or dispose of investments.

Where representative action is required, the bank must consider the Civil Code's requirements and whether judicial authorization is necessary.

13. Confidentiality and data protection

Protecting a vulnerable customer does not eliminate banking confidentiality or privacy.

Banks operate under the GDPR and Spain's Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights.

A bank generally cannot disclose a customer's financial information to a relative merely because that relative claims the customer is vulnerable.

The institution needs an appropriate legal basis, valid authorization, legally recognized representation or another lawful justification.

This is important because excessive disclosure can itself harm vulnerable customers.

14. Artificial intelligence and automated fraud controls

Banks increasingly use algorithms to detect anomalous transactions.

For vulnerable-customer protection, these systems can identify unusual withdrawals, new beneficiaries or abrupt changes in transaction patterns.

However:

anomaly ≠ incapacity
age ≠ incapacity
disability ≠ fraud.

Automated systems therefore need appropriate human oversight.

Banks must also consider GDPR requirements and, where applicable, the EU AI regulatory framework when deploying automated decision systems.

15. Branch closures and digital exclusion

Digital transformation creates another vulnerability issue.

Older customers and persons with certain disabilities may experience difficulty when banking services move entirely online.

Spanish policy has therefore increasingly emphasized financial inclusion and accessibility.

A bank should seek to provide workable access channels rather than designing essential services in a manner that effectively excludes significant groups of customers.

Important Case Law

Unlike highly specialized subjects where direct cases may be scarce, Spain has substantial Spanish and EU jurisprudence relevant to banking transparency, vulnerable consumers, capacity, mortgage protection and financial-product disclosure.

1. CJEU, Banco Español de Crédito SA v Joaquín Calderón Camino, C-618/10 (2012)

The Court of Justice considered unfair terms in consumer contracts and emphasized effective judicial protection under EU consumer law.

Relevance

A vulnerable banking customer is still entitled to the full protections of EU unfair-contract-terms legislation. Courts must be capable of addressing unfair contractual provisions effectively.

2. CJEU, Aziz v Caixa d'Estalvis de Catalunya, C-415/11 (2013)

This landmark Spanish reference concerned mortgage enforcement and unfair contractual terms.

The CJEU held that Spanish procedural arrangements could not undermine effective protection provided by Directive 93/13/EEC on unfair terms in consumer contracts.

Relevance

Procedural efficiency cannot override effective consumer protection, an especially important principle where borrowers are economically or socially vulnerable.

3. CJEU, Kásler and Káslerné Rábai, C-26/13 (2014)

Although originating outside Spain, this judgment has profoundly influenced European banking transparency law.

The Court explained that transparency requires more than grammatical intelligibility. Consumers should be capable of understanding the economic consequences of relevant contractual mechanisms.

Relevance

For vulnerable customers, simply presenting technically correct wording may not provide meaningful transparency.

4. CJEU, Gutiérrez Naranjo and Others, Joined Cases C-154/15, C-307/15 and C-308/15 (2016)

These Spanish mortgage cases concerned unfair mortgage floor clauses (cláusulas suelo).

The CJEU rejected temporal limitations that improperly restricted restitution arising from findings that contractual terms were unfair.

Relevance

Effective consumer protection includes meaningful remedies, not merely formal recognition that a contractual term was unfair.

5. CJEU, Andriciuc and Others, C-186/16 (2017)

The case involved foreign-currency credit.

The Court emphasized that consumers should receive sufficient information to make prudent and well-informed decisions and understand potentially significant economic consequences.

Relevance

This principle is particularly significant where a customer has difficulty understanding complex financial risks.

6. CJEU, Abanca Corporación Bancaria and Bankia, Joined Cases C-70/17 and C-179/17 (2019)

These references from Spain concerned mortgage acceleration clauses and the consequences of unfair contractual terms.

Relevance

The judgment illustrates the interaction between Spanish mortgage enforcement and the EU requirement for effective consumer protection.

7. CJEU, Gómez del Moral Guasch v Bankia, C-125/18 (2020)

The dispute concerned a Spanish mortgage linked to the IRPH interest-rate index.

The Court examined transparency requirements and whether consumers had been placed in a position to understand the operation and economic implications of the relevant contractual term.

Relevance

Banks cannot treat formal inclusion of financial terminology as necessarily establishing genuine transparency.

8. CJEU, Caixabank and Banco Bilbao Vizcaya Argentaria, Joined Cases C-224/19 and C-259/19 (2020)

These cases concerned mortgage-related contractual costs and unfair terms.

Relevance

The decisions reinforce the broader EU framework protecting consumers from unfair allocation of financial burdens in standardized banking contracts.

9. Spanish Supreme Court — Mortgage Floor Clause Judgment, STS 241/2013, 9 May 2013

Spain's Supreme Court delivered a landmark judgment concerning mortgage floor clauses.

The Court developed the important concept of transparency control in consumer contracts.

A clause could therefore face scrutiny even where its wording appeared formally understandable if the consumer was not placed in a proper position to appreciate its economic significance.

Vulnerable-adult significance

Meaningful understanding matters. This principle is especially relevant when dealing with customers who may require additional explanation or accessible communication.

10. Spanish Supreme Court jurisprudence on complex financial products

The Spanish Supreme Court has also developed extensive jurisprudence involving swaps, structured products, preference shares and other complex financial instruments.

A recurring issue is whether the customer received adequate information about the nature and risks of the product and whether defects in consent occurred.

Relevance

Where the customer is vulnerable, banks should pay particular attention to evidence showing that information was understandable and that legally required suitability or appropriateness procedures were properly performed.

Practical Banking Scenario

Consider an 82-year-old customer who normally makes transactions below €1,000.

Suddenly the customer asks to transfer €90,000 to a newly created beneficiary, while another person remains beside them and answers most questions.

The customer's age alone is not sufficient reason to refuse the transaction.

A proportionate bank response would instead involve verifying identity and authorization, communicating directly with the customer where appropriate, applying fraud controls, determining whether legally recognized support arrangements exist and investigating unusual circumstances consistently with applicable law.

If the customer understands the transaction and possesses authority to make it, the bank must respect their autonomy.

The objective is therefore:

protect without unnecessarily taking control away from the customer.

Recommended Compliance Framework for Spanish Banks

A strong vulnerable-customer framework should contain five interconnected layers.

1. Identification: recognize situational vulnerability without stereotyping customers.

2. Accessibility: provide understandable and accessible information and banking channels.

3. Decision support: recognize valid powers, curatela, voluntary measures and other legally recognized support structures.

4. Financial-abuse controls: identify suspicious changes in transaction patterns while preserving customer autonomy.

5. Documentation: maintain evidence explaining why transactions were approved, delayed or subjected to additional verification.

Conclusion

Spain's vulnerable-adult banking safeguards have changed substantially, particularly following Law 8/2021. The modern approach is not based upon assuming that disability, old age or dependency eliminates an individual's capacity to manage money. It emphasizes legal capacity, supported decision-making, accessibility, consumer protection and respect for individual autonomy.

Banks nevertheless have important protective responsibilities. Consumer-contract transparency, payment security, fraud controls, proper recognition of representatives, data protection and accessible services all form part of the framework.

The leading Spanish and EU cases—from STS 241/2013 and Aziz through Gutiérrez Naranjo, Abanca and Gómez del Moral Guasch—also demonstrate a broader principle particularly important for vulnerable customers: formal compliance is not always enough. Effective banking protection frequently requires genuine transparency, meaningful understanding and practical access to legal remedies.