Banking & Finance in Spain

Spain's banking and finance sector operates under a layered regulatory architecture that combines European Union directives with domestic Spanish law, administered primarily by the Banco de España (Bank of Spain) and the Comisión Nacional del Mercado de Valores (National Securities Market Commission, CNMV). For international businesses, lenders, fintech operators and project finance participants, understanding this framework is not optional - it is the foundation of any viable market entry or transaction strategy. Failure to comply with licensing, anti-money laundering or consumer credit requirements can result in administrative sanctions, contract unenforceability and reputational damage that is difficult to reverse. This article covers the regulatory structure, key legal instruments, lending and project finance mechanics, fintech authorisation pathways, AML obligations, enforcement risks and practical strategies for managing legal exposure in Spain.

Spanish banking law rests on a combination of EU-level instruments and national implementing legislation. The primary domestic statute is the Ley 10/2014, de 26 de junio, de ordenación, supervisión y solvencia de entidades de crédito (Law 10/2014 on the organisation, supervision and solvency of credit institutions), which transposes the Capital Requirements Directive IV (CRD IV) into Spanish law. This law defines which entities qualify as credit institutions, sets out licensing requirements and establishes the supervisory powers of the Banco de España.

The Banco de España exercises prudential supervision over credit institutions incorporated in Spain, while the European Central Bank (ECB) directly supervises the largest Spanish banks under the Single Supervisory Mechanism (SSM). For mid-sized and smaller institutions, the Banco de España remains the primary interlocutor. The CNMV, by contrast, supervises securities markets, investment firms and collective investment schemes under the Ley del Mercado de Valores (Securities Market Law), most recently consolidated through Real Decreto Legislativo 4/2015.

A non-obvious risk for international groups is the dual-regulator structure. A transaction that involves both lending and securities issuance - such as a bond-backed project finance deal - may require simultaneous engagement with both the Banco de España and the CNMV. Failing to identify which regulator has primary jurisdiction over a specific product or activity is one of the most common mistakes made by international counsel unfamiliar with the Spanish market.

The Ley 5/2019, de 15 de marzo, reguladora de los contratos de crédito inmobiliario (Law 5/2019 on mortgage credit contracts) introduced significant consumer protection obligations for mortgage lenders, including mandatory pre-contractual information, a ten-day reflection period before signing, and notarial verification of the borrower's understanding. These requirements apply to both Spanish and foreign lenders operating in Spain and cannot be waived by contract.

Supervision is further supported by the Fondo de Garantía de Depósitos (Deposit Guarantee Fund), which protects depositors up to EUR 100,000 per institution under the framework of Directive 2014/49/EU as implemented by Real Decreto-ley 16/2011.

Any entity wishing to carry out credit institution activities in Spain - accepting deposits and granting credit on a professional basis - must obtain authorisation from the Banco de España. The authorisation process is governed by Law 10/2014 and its implementing regulation, Real Decreto 84/2015. The application requires a detailed business plan, evidence of minimum capital (EUR 5 million for most credit institutions, EUR 1 million for certain electronic money institutions), fit-and-proper assessments of directors and qualifying shareholders, and a governance framework demonstrating adequate internal controls.

The authorisation timeline in practice runs from six to twelve months from submission of a complete application. Incomplete applications are common and extend timelines significantly. A common mistake by international applicants is underestimating the depth of documentation required for the fit-and-proper assessment of senior management, particularly where directors have held positions in multiple jurisdictions.

Payment institutions and electronic money institutions operate under a separate regime governed by the Ley 21/2011, de 26 de julio, de dinero electrónico (Law 21/2011 on electronic money) and the Real Decreto-ley 19/2018, de 23 de noviembre, de servicios de pago (Royal Decree-Law 19/2018 on payment services), which transposes the Payment Services Directive 2 (PSD2). These entities must register with the Banco de España and comply with safeguarding requirements for client funds, but face a lower capital threshold and a somewhat lighter supervisory burden than full credit institutions.

Passporting under EU rules allows credit institutions and payment institutions authorised in another EU member state to operate in Spain through a branch or on a cross-border basis, subject to notification to the Banco de España. However, passporting does not exempt an entity from Spanish consumer protection law, AML obligations or local conduct-of-business rules. Many international groups discover this limitation only after launching operations, creating retroactive compliance exposure.

For entities that do not qualify for passporting and are incorporated outside the EU, establishing a branch in Spain requires separate authorisation from the Banco de España under Article 64 of Law 10/2014. The process is more demanding than for EU entities and requires, among other things, a reciprocity assessment and a designated representative in Spain.

To receive a checklist on licensing requirements for credit institutions and payment service providers in Spain, send a request to info@vlo.com.

Spanish lending law distinguishes between commercial lending, consumer credit and mortgage credit, each governed by a distinct legal regime. Commercial lending between professional parties is largely governed by the Código de Comercio (Commercial Code) and the Código Civil (Civil Code), with significant contractual freedom. Consumer credit is regulated by the Ley 16/2011, de 24 de junio, de contratos de crédito al consumo (Law 16/2011 on consumer credit contracts), which implements the Consumer Credit Directive and imposes mandatory disclosure, annual percentage rate (APR) calculation and early repayment rights.

Syndicated lending in Spain typically follows Loan Market Association (LMA) documentation adapted for Spanish law. Key structural differences from English-law deals include the treatment of security interests, the enforceability of financial covenants and the interaction between contractual acceleration rights and Spanish insolvency law. Spanish courts have historically scrutinised cross-default clauses and material adverse change (MAC) provisions, and their enforceability cannot be assumed without careful drafting.

Security over Spanish assets takes several forms. A mortgage (hipoteca) over real property is the most common and most enforceable form of security, governed by the Ley Hipotecaria (Mortgage Law). A pledge (prenda) over movable assets, shares or receivables is governed by the Ley 5/2015, de 27 de abril, de fomento de la financiación empresarial (Law 5/2015 on promoting business financing), which introduced the financial pledge (prenda financiera) with enhanced enforcement rights. A non-obvious risk is that Spanish law does not recognise the floating charge as understood in English law. Security must attach to specifically identified assets, which requires careful structuring in asset-intensive transactions.

Enforcement of security in Spain can proceed through judicial or extrajudicial routes. Judicial enforcement of a mortgage follows the procedimiento de ejecución hipotecaria (mortgage enforcement procedure) under the Ley de Enjuiciamiento Civil (Civil Procedure Law, LEC). Extrajudicial enforcement through a notary is faster but requires the mortgage deed to include an express extrajudicial enforcement clause and a pre-agreed valuation. In practice, extrajudicial enforcement takes three to six months from initiation, while judicial enforcement can take twelve to thirty-six months depending on the court and any debtor challenges.

Practical scenario one: a foreign bank lends EUR 20 million to a Spanish real estate developer, secured by a mortgage over the development site. The developer defaults eighteen months into the loan. The lender initiates extrajudicial enforcement but the developer challenges the valuation in court, converting the process to judicial enforcement. The lender should have anticipated this risk and included a higher agreed valuation in the original mortgage deed, reducing the debtor's incentive to challenge.

Practical scenario two: a private equity fund provides a EUR 5 million mezzanine loan to a Spanish operating company, secured by a pledge over the shares of the borrower. The borrower enters insolvency proceedings. Under the Ley Concursal (Insolvency Law, as reformed by Real Decreto Legislativo 1/2020), the secured creditor may enforce the pledge outside the insolvency process if the pledge qualifies as a financial collateral arrangement under Law 5/2015. Failure to structure the pledge correctly at inception means the creditor loses this advantage and must participate in the insolvency process as a general secured creditor.

Project finance in Spain is used primarily in infrastructure, renewable energy, real estate development and public-private partnership (PPP) transactions. The legal framework draws on general contract and company law, sector-specific regulation and, for PPP transactions, the Ley 9/2017, de 8 de noviembre, de Contratos del Sector Público (Law 9/2017 on public sector contracts).

The standard project finance structure involves a special purpose vehicle (SPV) incorporated as a sociedad de responsabilidad limitada (SRL, limited liability company) or sociedad anónima (SA, public limited company) under the Ley de Sociedades de Capital (Capital Companies Law, Real Decreto Legislativo 1/2010). The SPV enters into a concession agreement or offtake contract with the public authority or off-taker, and raises debt from a syndicate of banks secured against the project assets, revenues and contracts.

A key legal risk in Spanish project finance is the interaction between the concession framework and the insolvency regime. Under Law 9/2017, a concession can be terminated by the public authority for reasons of public interest, with compensation to the concessionaire. However, the calculation of compensation is subject to administrative discretion and can be disputed. Lenders should ensure that the financing documentation includes step-in rights allowing them to cure defaults and assume control of the concession before termination is triggered.

Renewable energy project finance in Spain has been particularly active following the expansion of the Régimen Retributivo Específico (Specific Remuneration Regime) for renewable energy installations under Real Decreto 413/2014 and its successors. This regime provides a regulated return on investment for qualifying installations, which lenders treat as a quasi-fixed revenue stream. A non-obvious risk is that the remuneration parameters are subject to periodic regulatory review, and changes can affect debt service coverage ratios. Lenders experienced in Spanish renewable energy transactions typically require regulatory change provisions in the financing documentation.

Environmental permitting is a critical path item in Spanish project finance. The Ley 21/2013, de 9 de diciembre, de evaluación ambiental (Law 21/2013 on environmental assessment) requires an environmental impact assessment (EIA) for major infrastructure and energy projects. The EIA process can take twelve to thirty-six months and is subject to challenge by third parties, including environmental groups and local authorities. Lenders should conduct thorough due diligence on permitting status before financial close and include permitting conditions precedent in the facility agreement.

To receive a checklist on legal due diligence for project finance transactions in Spain, send a request to info@vlo.com.

Spain has developed a structured approach to fintech regulation, combining EU-level frameworks with domestic instruments. The primary domestic statute is the Ley 7/2020, de 13 de noviembre, para la transformación digital del sistema financiero (Law 7/2020 on the digital transformation of the financial system), which established the Spanish regulatory sandbox for fintech companies. The sandbox allows innovative financial service providers to test products and services in a controlled environment under the supervision of the Banco de España, CNMV or Dirección General de Seguros y Fondos de Pensiones (Directorate General of Insurance and Pension Funds), depending on the activity.

The sandbox operates on a project-by-project basis. Applicants submit a detailed description of the innovative element, the regulatory framework that would normally apply, the proposed testing parameters and the safeguards for participants. The competent authority has three months to assess the application and may request additional information. Approved projects operate under a protocol agreement for a testing period of up to twelve months, extendable by six months. At the end of the testing period, the operator must either obtain full authorisation or cease the activity.

Crowdfunding platforms are regulated under the EU Crowdfunding Regulation (Regulation 2020/1503) as implemented in Spain, with the CNMV as the competent authority. Platforms must obtain authorisation from the CNMV, comply with investor protection requirements including investment limits for non-sophisticated investors, and publish standardised key investment information sheets. The maximum offer size under the EU framework is EUR 5 million per project per twelve-month period.

Buy-now-pay-later (BNPL) products occupy a regulatory grey area in Spain that is narrowing. Products that defer payment beyond ninety days or charge interest are likely to fall within the scope of Law 16/2011 on consumer credit, requiring the provider to be authorised as a credit institution or to partner with one. Providers that have launched BNPL products without conducting this analysis face retroactive compliance risk, including potential unenforceability of credit agreements.

Crypto-asset service providers (CASPs) operating in Spain must register with the Banco de España under the framework established by the Ley 10/2010, de 28 de abril, de prevención del blanqueo de capitales y de la financiación del terrorismo (Law 10/2010 on the prevention of money laundering and terrorist financing) for AML purposes. From the date of application of the EU Markets in Crypto-Assets Regulation (MiCA), CASPs will additionally require MiCA authorisation, with the CNMV as the competent authority for most categories. Spain was among the first EU member states to implement the CASP registration requirement, and the Banco de España has taken an active enforcement posture toward unregistered operators.

Practical scenario three: a UK-based fintech company wishes to offer a digital lending product to Spanish consumers following the end of passporting rights. The company must either establish a Spanish subsidiary and obtain authorisation as a credit institution or payment institution, or partner with an authorised Spanish entity under a white-label arrangement. The white-label route is faster - typically six to twelve months to implement - but requires careful structuring of the contractual relationship to ensure the fintech retains operational control while the licensed partner bears regulatory responsibility.

Anti-money laundering compliance is one of the most operationally demanding areas of Spanish financial regulation. The primary statute is Law 10/2010, supplemented by its implementing regulation, Real Decreto 304/2014. Spain has transposed the EU's Fourth and Fifth Anti-Money Laundering Directives, and the Sixth Directive is in the process of implementation.

The Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias (SEPBLAC) is the Spanish financial intelligence unit and AML supervisory authority for obligated entities. SEPBLAC has broad investigative and sanctioning powers and has demonstrated a willingness to impose significant administrative sanctions for AML failures.

Obligated entities under Law 10/2010 include credit institutions, payment institutions, insurance companies, notaries, lawyers (in specific circumstances), real estate agents, accountants and certain other professional service providers. Each obligated entity must implement a risk-based AML programme covering:

• customer due diligence (CDD) and enhanced due diligence (EDD) for high-risk customers
• beneficial ownership identification and verification
• ongoing monitoring of business relationships
• suspicious transaction reporting to SEPBLAC
• internal controls, training and record-keeping

A common mistake by international groups entering Spain is assuming that a group-wide AML programme designed for another jurisdiction satisfies Spanish requirements. Law 10/2010 and Real Decreto 304/2014 contain specific requirements - including the mandatory appointment of a compliance officer (representante ante el SEPBLAC) and the preparation of a written risk assessment - that must be addressed in a Spain-specific compliance manual.

Beneficial ownership transparency is enforced through the Registro Mercantil (Companies Registry) and, for trusts and similar structures, through the Registro de Titularidades Reales (Beneficial Ownership Registry) established under the implementing legislation for the Fifth AML Directive. Failure to register beneficial ownership information or to keep it current is an administrative offence under Law 10/2010 and can result in sanctions against both the entity and its directors.

The cost of non-compliance is significant. SEPBLAC sanctions for serious AML failures can reach the higher of EUR 10 million or 10% of annual turnover for credit institutions. For other obligated entities, sanctions are lower but still material. Beyond financial penalties, SEPBLAC can impose operational restrictions, require the removal of directors and publish sanctions decisions - the last of these carrying reputational consequences that are difficult to quantify but often exceed the direct financial cost.

In practice, it is important to consider that SEPBLAC conducts thematic inspections targeting specific sectors or risk categories. Entities in sectors identified as high-risk - including real estate finance, crypto-asset services and correspondent banking - should expect heightened scrutiny and should ensure their AML programmes are current and well-documented before an inspection occurs.

The risk of inaction is concrete: an entity that delays implementing a compliant AML programme from market entry faces the possibility of SEPBLAC identifying historical deficiencies during a first inspection, resulting in sanctions that cover the entire period of non-compliance. Building a compliant programme from day one is materially less costly than remediation after the fact.

To receive a checklist on AML compliance obligations for financial institutions in Spain, send a request to info@vlo.com.

What are the main risks for a foreign lender operating in Spain without local legal counsel?

A foreign lender operating in Spain without local legal counsel faces several concrete risks. Spanish consumer protection law, mortgage regulation and insolvency law contain mandatory provisions that override contractual choices of foreign law in many circumstances. Security interests that are valid under English or New York law may not be enforceable in Spain if they have not been properly constituted under Spanish law. Additionally, AML obligations apply from the first transaction, and SEPBLAC does not treat unfamiliarity with Spanish law as a mitigating factor in enforcement proceedings. Engaging Spanish counsel before the first transaction - not after a problem arises - is the operationally sound approach.

How long does it take to enforce a loan security in Spain, and what does it cost?

Enforcement timelines in Spain depend heavily on the type of security and whether the debtor contests the process. Extrajudicial mortgage enforcement through a notary typically takes three to six months if uncontested. Judicial mortgage enforcement under the LEC takes twelve to thirty-six months, and contested proceedings can extend further. Share pledge enforcement under the financial collateral regime of Law 5/2015 can be completed in weeks if properly structured. Legal costs for enforcement proceedings start from the low thousands of EUR for straightforward matters and increase substantially with complexity and contested stages. Court fees (tasas judiciales) apply to certain proceedings and are calculated on the amount in dispute.

When should a fintech company use the Spanish regulatory sandbox rather than seeking direct authorisation?

The sandbox is most appropriate when the product or service does not fit cleanly within an existing regulatory category, or when the operator wants to test market viability before committing to the full authorisation process. It is not a substitute for authorisation - at the end of the testing period, the operator must obtain a licence or cease operations. Companies with a clear regulatory classification and a viable business model are generally better served by pursuing direct authorisation, which provides a permanent operating licence rather than a time-limited testing window. The sandbox is also not available for products that are straightforwardly regulated under existing law; the innovative element must be genuine and demonstrable.

Spain's banking and finance legal framework is sophisticated, multi-layered and actively enforced. International businesses that approach the Spanish market with documentation and compliance structures designed for other jurisdictions consistently encounter friction - from unenforceability of security interests to AML sanctions to licensing gaps. The cost of building a compliant structure from the outset is a fraction of the cost of remediation, enforcement defence or transaction failure. The key is to engage with the regulatory architecture early, map each activity to its applicable legal regime and build documentation that reflects Spanish law requirements rather than assuming convergence with other systems.

Our law firm Vetrov & Partners has experience supporting clients in Spain on banking, finance and regulatory matters. We can assist with licensing applications, transaction structuring, security documentation, AML programme development, fintech authorisation and enforcement proceedings. To receive a consultation, contact: info@vlo.com.