Banking Law and Virtual Reality Financial Education in Spain

1. Introduction

Virtual Reality (VR) financial education means using immersive digital environments to teach people about banking, money management, borrowing, investing, fraud prevention and other financial matters.

A Spanish bank could, for example, create a VR application in which users practise preparing a household budget, compare mortgages, learn how interest works, identify payment fraud, or experience simulated investment decisions.

Spain does not currently have a single banking statute specifically dedicated to “VR financial education.” Instead, the legal position is determined by several overlapping Spanish and EU regimes covering banking conduct, consumer protection, financial advertising, investment services, data protection, artificial intelligence and digital operational resilience.

The key distinction is between:

pure financial education and regulated financial activity.

A VR simulation explaining what a mortgage is normally presents relatively limited regulatory difficulty. A VR environment recommending a particular mortgage, investment fund or financial instrument could trigger much more demanding regulatory obligations.

2. Main Spanish Banking Framework

Spanish banks using VR remain subject to the normal banking regulatory structure.

Important legislation includes:

• Law 10/2014 on the organisation, supervision and solvency of credit institutions;
• Royal Decree 84/2015, developing important aspects of the banking framework;
• Law 16/2011 on Consumer Credit Agreements;
• Law 5/2019 regulating Real Estate Credit Agreements;
• Spain's consumer-protection legislation;
• Law 34/2002 concerning information-society services and electronic commerce; and
• Law 10/2010 on prevention of money laundering and terrorist financing where regulated transactions or customer relationships are involved.

At EU level, relevant frameworks can include MiFID II, GDPR, the Digital Services Act where applicable, DORA and the EU Artificial Intelligence Act.

The exact rules therefore depend heavily upon what the VR system actually does.

3. Financial Education Versus Financial Advice

This is one of the most important legal distinctions.

Suppose a Spanish bank creates a virtual classroom explaining:

“Diversification can reduce concentration risk.”

That is ordinarily educational information.

Now suppose an avatar analyses the user's income, age, savings and objectives and says:

“Based on your circumstances, you should buy Investment Fund X.”

The second situation could amount to personalised investment advice, depending on the circumstances.

Once the service moves from general education into regulated investment recommendations, MiFID II and Spanish securities legislation become highly relevant.

The provider may need to examine matters such as the customer's knowledge, experience, financial situation, ability to bear losses and investment objectives.

Calling the application an “educational simulator” does not necessarily determine its legal status. Regulators and courts can examine its actual function.

4. VR Mortgage Education

VR could be particularly useful for mortgage education.

For example, a bank might create a virtual home-purchase exercise demonstrating:

• fixed versus variable interest;
• monthly instalments;
• interest-rate increases;
• early repayment;
• default consequences;
• mortgage fees; and
• total borrowing costs.

Where the simulation is connected with actual residential mortgage marketing or contracting, Law 5/2019 becomes particularly important.

Spanish mortgage law requires significant transparency and borrower protection.

A VR interface therefore cannot be used to make legally significant information less visible merely because disclosure is presented in an innovative environment.

5. Consumer Credit Education

The same reasoning applies to consumer credit.

Imagine a VR programme allowing a young consumer to compare:

€3,000 borrowed at different interest rates and repayment periods.

That can be valuable financial education.

However, if users can immediately select and conclude an actual credit agreement inside the environment, the platform moves beyond education into digital credit distribution.

Consumer-credit information, advertising, contractual disclosure and responsible-lending requirements may consequently apply.

A bank should therefore clearly distinguish between:

simulation → comparison → recommendation → application → contract.

Each stage can create progressively greater regulatory obligations.

6. Financial Advertising Inside VR

VR financial education can also become advertising.

A Spanish bank might create an educational virtual branch but repeatedly display its own:

• credit cards;
• investment funds;
• mortgages;
• insurance products; or
• personal loans.

Even where the experience is described as educational, promotional content may constitute financial advertising.

Spanish rules require financial advertising to be sufficiently clear, balanced and not misleading.

VR design must therefore avoid creating an immersive experience that exaggerates potential benefits while hiding risks in menus, distant virtual objects or difficult-to-read disclosures.

7. Gamification Risks

VR naturally encourages gamification.

Users might receive:

• points;
• virtual rewards;
• achievement badges;
• rankings;
• simulated profits; or
• challenges.

Gamification can improve education, but it becomes legally sensitive when it encourages users to undertake actual financial transactions.

For example, an investment simulator showing exaggerated rewards whenever a user selects a high-risk product could distort the person's understanding of financial risk.

Banks should therefore distinguish educational engagement from behavioural manipulation.

This becomes particularly important where inexperienced consumers are involved.

8. Data Protection and VR

VR can generate unusually extensive information about users.

Depending on the hardware and design, information might include account details, device identifiers, interaction patterns, voice information and potentially biometric or physiological information.

The General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights are therefore central.

Banks need a lawful basis for processing personal data and must comply with principles including:

purpose limitation, data minimisation, transparency, accuracy, storage limitation, integrity and confidentiality.

A financial-education programme should not collect extensive sensitive information merely because VR technology makes collection technically possible.

9. Profiling and Automated Decisions

Suppose a VR financial coach collects information about the user and automatically classifies the person as:

“conservative”, “moderate” or “high-risk”.

If those classifications merely alter educational exercises, the regulatory consequences may be relatively limited.

But suppose the classification determines whether the bank approves credit, changes pricing or recommends investments.

The system could then involve profiling or automated decision-making with considerably greater legal consequences under GDPR, banking law and potentially the EU AI Act.

Human oversight and explainability can therefore become important.

10. Artificial Intelligence and Virtual Advisers

Modern VR financial education may incorporate AI-powered avatars.

A virtual adviser might answer:

“What happens if mortgage rates increase?”

That can remain educational.

But an AI system that evaluates a particular user's finances and recommends a specific banking or investment product may enter regulated territory.

The EU AI Act introduces risk-based requirements for AI systems. Certain AI applications connected with assessments affecting access to essential private services, including particular creditworthiness-related systems, can attract especially demanding requirements.

Consequently, banks should classify the AI function rather than simply classify the overall VR application.

11. Cybersecurity and DORA

A VR platform connected with banking infrastructure can create cybersecurity risks.

Possible problems include account impersonation, stolen credentials, manipulated virtual interfaces, malicious software and fraudulent virtual advisers.

The Digital Operational Resilience Act (DORA) has strengthened ICT-risk requirements across EU financial entities.

Where relevant, banks need appropriate arrangements concerning:

• ICT risk management;
• incident management;
• resilience testing;
• third-party technology providers;
• continuity; and
• cybersecurity governance.

A VR environment connected directly to customer accounts therefore requires substantially stronger controls than an offline educational game.

12. Accessibility and Financial Inclusion

VR financial education should also be assessed from an accessibility perspective.

An immersive system should not become the only practical means of understanding an important banking product where some consumers cannot reasonably use VR technology.

People with disabilities, limited digital literacy or inadequate hardware may require alternative methods.

Digital innovation should therefore supplement financial inclusion rather than unintentionally create another barrier to banking services.

13. Important Case Laws

There are still relatively few reported Spanish cases specifically concerning VR-based banking education. It would therefore be misleading to describe ordinary banking judgments as “Spanish VR banking cases.”

However, established CJEU and Spanish banking jurisprudence provides principles that can directly govern products promoted, explained or contracted through future VR interfaces.

1. Banco Español de Crédito SA v Joaquín Calderón Camino, C-618/10 (2012)

This Spanish reference concerned unfair terms in consumer contracts.

The CJEU strengthened the responsibility of national courts to protect consumers from unfair contractual provisions.

VR relevance: A banking contract concluded through an immersive interface remains subject to consumer-protection law. Technological presentation cannot validate an otherwise unfair contractual term.

2. Aziz v Caixa d'Estalvis de Catalunya, Tarragona i Manresa, C-415/11 (2013)

The case concerned Spanish mortgage enforcement and unfair contractual terms.

The CJEU emphasized effective consumer protection against unfair provisions.

VR relevance: If mortgage education develops into mortgage distribution, consumers retain the same substantive protections whether the agreement originates at a branch, website, mobile application or VR environment.

3. Kásler and Káslerné Rábai, C-26/13 (2014)

The CJEU developed an important concept of contractual transparency.

Consumers must be placed in a position to understand relevant economic consequences rather than merely being shown grammatically understandable wording.

VR relevance: This principle is extremely important for immersive interfaces. A disclosure should not technically appear somewhere inside a virtual environment while its financial significance remains obscure.

4. Gutiérrez Naranjo and Others, Joined Cases C-154/15, C-307/15 and C-308/15 (2016)

These cases arose from Spanish mortgage floor clauses.

The Court reinforced the consequences flowing from unfair consumer terms and the effectiveness of EU consumer protection.

VR relevance: Innovative digital presentation cannot reduce remedies that consumers possess under mandatory law.

5. Andriciuc and Others, C-186/16 (2017)

This case concerned foreign-currency lending and whether consumers had sufficient information about financial consequences.

The Court emphasized meaningful transparency regarding economic risk.

VR relevance: VR could actually become a useful compliance mechanism. A simulation could demonstrate how exchange-rate or interest-rate changes affect repayments. But an attractive simulation cannot replace legally required disclosures.

6. Gómez del Moral Guasch v Bankia SA, C-125/18 (2020)

This Spanish mortgage case concerned the IRPH interest-rate benchmark and transparency under EU consumer law.

The judgment demonstrates the importance of allowing consumers to understand the operation and economic consequences of important pricing mechanisms.

VR relevance: A virtual mortgage simulator presenting benchmark-linked borrowing must not disguise how the reference mechanism affects the borrower's payments.

7. Orange România SA, C-61/19 (2020)

Although not a Spanish banking dispute, this GDPR judgment addressed consent and demonstrated the importance of genuine, informed and demonstrable consent.

VR relevance: A VR platform cannot assume that entering a virtual room, clicking through an immersive interface or accepting bundled conditions automatically provides valid GDPR consent where consent is the required legal basis.

8. SCHUFA Holding (Scoring), C-634/21 (2023)

This major GDPR judgment addressed automated credit scoring and Article 22 GDPR.

The Court considered circumstances in which automated scoring can amount to automated individual decision-making where the score plays a determining role in a decision.

VR relevance: If an AI financial-education avatar quietly generates a user score that materially determines subsequent credit decisions, the bank must consider the rules governing automated decision-making. The fact that scoring occurs inside an “educational” VR experience does not remove those protections.

14. Practical Example

Consider Banco X, a hypothetical Spanish bank.

It creates a VR environment called “My Financial Future.”

A user enters a virtual apartment and learns about budgeting. The programme demonstrates how a €200 monthly saving can accumulate over time.

This is primarily financial education.

Next, an AI avatar asks about the user's salary, savings, debts and investment objectives and recommends three specific investment funds.

The activity may now involve investment advice and MiFID requirements.

Next, the user enters a virtual house and receives a personalised mortgage offer.

Law 5/2019, consumer law, GDPR and banking-conduct requirements become increasingly important.

Finally, the system automatically analyses the user's financial behaviour and determines whether the bank will approve the mortgage.

Now automated decision-making, AI governance and creditworthiness requirements can also become relevant.

One VR application can therefore move through several different regulatory categories.

15. Compliance Model for Spanish Banks

A Spanish bank developing VR financial education should use a function-based compliance approach rather than assuming that the entire platform is merely educational.

The institution should determine:

First: Is the content genuinely educational?

Second: Does it advertise identifiable financial products?

Third: Does it make personalised recommendations?

Fourth: Can customers apply for or purchase products?

Fifth: Does the platform collect personal or biometric data?

Sixth: Does AI profile the customer?

Seventh: Does an automated system influence lending or investment decisions?

Eighth: Is the VR system connected with critical banking infrastructure?

The regulatory burden increases significantly as the platform moves down this chain.

16. Role of Banco de España and CNMV

The Banco de España is particularly relevant where VR applications concern banking products, lending and supervised credit institutions.

The CNMV becomes especially important where the environment involves investment services, financial instruments, securities or investment advertising.

The Spanish Data Protection Agency (AEPD) is relevant to GDPR and personal-data issues.

Accordingly, a sophisticated VR financial platform could simultaneously involve several regulators.

17. Legal Risks

The principal legal risks can be summarised as:

The decisive question is therefore what the technology does, rather than whether the bank calls it VR education.

18. Conclusion

Spanish law does not presently create a standalone regulatory category called “Virtual Reality Financial Education.” VR should instead be treated as a new delivery mechanism operating inside the existing Spanish and EU financial-law framework.

Simple educational simulations can help consumers understand budgeting, mortgages, interest rates, fraud and investment risk. But once VR platforms advertise actual products, collect extensive personal data, provide personalised investment recommendations, assess creditworthiness or permit financial transactions, substantially stronger legal obligations arise.

Cases such as Banco Español de Crédito*, Aziz, Kásler, Gutiérrez Naranjo, Andriciuc, Gómez del Moral Guasch, Orange România and *SCHUFA establish principles concerning consumer protection, meaningful transparency, data protection and automated decision-making that can be applied to VR-enabled banking.

The central principle for Spain is therefore:

Using virtual reality changes the interface of financial services, but it does not remove the legal protections governing the underlying banking activity.