1. Who Governs? - The Tri-Regulator Model

Spain has no single FCA-like regulator. Governance is split:

Plus AEFI - Spanish Fintech Association - not a regulator, but pushed the Sandbox law and self-regulation codes.

2. The Legal Architecture - 4 Layers

Layer 1: Spanish National Laws

a) Law 7/2020 of 13 November - Digital Transformation of Financial System
Created the Spanish Regulatory Sandbox.

• Allows testing of blockchain, AI, DLT products in real but controlled conditions for up to 12 months, under supervision of CNMV, Banco de España, DGSFP.
• No full licence needed to test, but must have exit plan, consumer protection, and supervisor monitoring.
• Spain was pioneering in Europe since 2021.

b) Law 6/2023 of 17 March - Securities Markets and Investment Services (LMV)

• Formally includes DLT-based financial instruments. Issuance, registration, transfer and storage of securities can be done via blockchain.
• Appoints CNMV as competent authority for MiCA.

c) Law 28/2022 - Startup Law (Ley de Startups)

• 15% corporate tax for startups, visa for talent, regulatory flexibility for fintechs.

d) Royal Decree-Law 5/2021 + Law 10/2010 AML

• Crypto service providers are obliged entities for AML. Must register with Banco de España (pre-MiCA) and with SEPBLAC.

Layer 2: EU Regulations Directly Applicable in Spain

1. MiCA - Markets in Crypto-Assets Regulation (EU) 2023/1114
Fully applied from 30 Dec 2024. Spanish transitional period ended 1 July 2026 - no extensions.

• 3 types of crypto: Other crypto-assets, Asset-Referenced Tokens (ART), E-Money Tokens (EMT)
• CASPs must get full authorisation from CNMV, meet governance, prudential capital, custody, conduct, whitepaper rules.
• By Nov 2026, ∼390 firms on ESMA MiCA register, 18 operate trading platforms.

2. DORA - Digital Operational Resilience Act (EU) 2022/2554
Applies from Jan 2025 to almost all financial entities + their ICT third-party providers (cloud, AI vendors).

• Board is personally responsible for ICT risk strategy. Cannot delegate to CTO.
• Mandatory incident reporting, resilience testing, third-party risk register, exit strategies from AWS, Google Cloud, Microsoft.
• This is the biggest governance change: Board must understand technology risk, not just credit risk.

3. DLT Pilot Regime (EU) 2022/858
Allows trading and settlement of tokenised securities on DLT market infrastructures in Spain under CNMV supervision.

4. EU AI Act (EU) 2024/1689) + Spanish AESIA
Spain created AESIA - Agencia Española de Supervisión de la Inteligencia Artificial in 2023 - first AI regulator in EU, based in A Coruña.

• AI for credit scoring, insurance pricing, robo-advice = High-Risk AI. Requires human oversight, bias audit, transparency, board accountability.
• Spain's Draft Law on Digitalisation and Modernisation of Financial Sector (Dec 2024) aligns Spanish law with AI Act + MiCA + DORA.

5. PSD2 / PSD3 + Open Banking + eIDAS

• PSD2 forced banks to open APIs. ING PSD2 Interface Case in Spain (2024) clarified banks cannot block fintech access.
• Digital Euro project led by Banco de España / ECB.

6. CNMV Circular 1/2022 on Crypto Advertising
First in EU: Any crypto ad in Spain must include risk warning, be balanced, and if influencer >100k followers, must notify CNMV 10 days before.

3. What is "Governance" for Emerging Tech?

For a Spanish fintech board, governance now means 5 new duties:

1. Algorithmic Governance: Board must approve AI model, understand training data, bias, explainability. Cannot say "the AI decided the loan denial."

2. ICT & Third-Party Governance (DORA): Board must approve ICT risk appetite, test cyber resilience, and have exit plan if cloud provider fails.

3. Token Governance: Who controls smart contract? Who can freeze / upgrade? MiCA requires whitepaper to disclose governance of token issuer.

4. Data Governance: GDPR + AEPD. Biometric data (iris scan) cannot be collected without explicit consent and DPIA.

5. Consumer Protection Governance: CNMV advertising rules, suitability test for robo-advice, disclosure of crypto risks.

Failure in any = Personal liability of directors under Spanish LMV Art 247 - CNMV can fine directors, disqualify them.

4. Landmark Case Laws - Spain + EU

CASE 1: STS 2109/2019 of 20 June 2019 - Spanish Supreme Court, Criminal Chamber - Bitcoin Fraud

First Supreme Court case on crypto in Spain.
Facts: Defendant promised to invest victims' money in Bitcoin, kept it.
Held: Bitcoin is an intangible asset, can be object of fraud under Spanish Criminal Code Art 248. Transfer of Bitcoin is transfer of value.
Governance Lesson: Crypto is not "unregulated magic internet money" - traditional fraud law applies. Boards of CASPs cannot hide behind technology.

CASE 2: Worldcoin v. AEPD (2024) - Biometric AI Finance

Facts: Worldcoin (founded by Sam Altman) scanned iris of Spaniards in malls in exchange for crypto tokens, claiming it was for "global identity and financial inclusion."
AEPD Action: On 6 March 2024, AEPD issued temporary order prohibiting Worldcoin from collecting data for 3 months, citing risk to minors and lack of informed consent.
Spanish Supreme Court, 11 March 2024: Denied Worldcoin's injunction request, prioritising "safeguarding of public interest" over company's business.
Governance Lesson: In Spain, data protection overrides fintech innovation. AEPD can stop a global project in 5 days. This is now the model for AI Act enforcement.

CASE 3: CNMV v. X (formerly Twitter) - €5 Million Fine (2025) - Largest Crypto Ad Penalty in Spain

Facts: X ran ads for "Quantum AI" - unregistered crypto service promising automated profits.
CNMV Held: X violated Spain's 2023 financial ad laws. Platform did not check whether advertiser was on CNMV warning list, did not include risk warnings.
Governance Lesson: Platforms are gatekeepers. Under CNMV Circular 1/2022, even social media / tech platforms have governance duty to vet financial ads. This extends MiCA conduct rules to Big Tech.

CASE 4: CNMV v. Miolos SL (2023) - First Crypto Advertising Case

First case filed by CNMV for crypto ad violations. Miolos ran 2 campaigns Sept-Nov 2022 without risk warnings.
Outcome: CNMV lawsuit established that CNMV can sue for ad violations even before MiCA fully applied. Set precedent for influencer liability.

CASE 5: Madeira Invest Club / Spanish Crypto Influencer Fraud (2023-2025)

CNMV issued warning in May 2023 that Madeira Invest Club lacked authorisation to operate as collective investment institution. Founder arrested for $300M fraud scheme, illegal campaign financing, money laundering.
Governance Lesson: Spanish courts treat unregistered crypto funds as illegal collective investment - promoters face criminal + administrative liability. CNMV warning list is now evidence of negligence if board ignores it.

CASE 6: Wizink + Vodafone-Lowi - Joint Liability in SIM Swapping (Spain)

Facts: Customer's SIM swapped by fraudster, bank account drained via 2FA SMS.
Spanish Courts Held: Both bank (Wizink) and telecom operator (Vodafone-Lowi) jointly liable. Bank failed to have strong customer authentication beyond SMS, telecom failed to verify identity.
Governance Lesson: Under PSD2 + DORA, banks cannot outsource authentication risk to telecoms. Board must ensure Strong Customer Authentication (SCA) - biometrics, app-based - not just SMS.

CASE 7: ING PSD2 Interface Case - Spanish Court 2024

ING tried to restrict fintech access to its API, arguing security.
Held: Under PSD2, banks must provide non-discriminatory access to licensed TPPs. Security cannot be used as anti-competitive excuse.
Governance Lesson: Open Banking is a governance obligation, not a favour.

CASE 8: EU Reference - CJEU on Robo-Advice & Suitability

EU courts have held that robo-advisors must perform same suitability test as human advisors under MiFID II. If AI recommends unsuitable product, firm is liable, not AI.

5. Spain's Governance Gaps Still Open

1. DeFi Gap: Decentralised Finance protocols have no legal entity - who is liable under MiCA? Spain is pushing for "DeFi governance" - if protocol is controlled by DAO, DAO members may be liable.
2. AI Black Box Gap: Credit scoring AI may be biased against immigrants / young borrowers. AESIA is testing audit tools in Sandbox.
3. Regulatory Fragmentation: CNMV vs Banco de España split creates confusion for stablecoins - ART is CNMV, EMT is Banco de España. Draft Law 2024 tries to fix this.
4. Enforcement Gap: CNMV can warn, but cannot shut down offshore crypto exchanges. It advises investors to go to ordinary courts.

Summary - The Spanish Model

Innovate in Sandbox, Operate under MiCA, Survive under DORA, Explain under AI Act.

Spain's message to boards: Technology does not remove governance - it increases it. If you use AI, blockchain, or cloud, your board must understand it, document it, test it, and be able to explain it to CNMV, Banco de España, AEPD and AESIA.