Governance Quality Assessment of Banks - Spain

In Spain, governance quality is not measured by a proxy advisor's score or by "we have 50% independent directors."

It is measured by the supervisor, every year, in a formal process that can increase your capital requirement, block your dividend, remove your directors, and fine you.

This is the SREP - Supervisory Review and Evaluation Process.

If governance quality is low, the bank pays more capital. Governance is priced.

1. What is Governance Quality Assessment?

Definition: A structured, evidence-based evaluation by ECB / Banco de España of whether a bank's board, committees, risk culture, and internal controls are actually capable of governing the bank's risks - not just on paper.

It answers 4 questions:

1. Composition: Does the board have the right skills, diversity, independence?
2. Functioning: Does the board challenge management, or just rubber-stamp?
3. Risk Culture: Does the bank reward prudent risk-taking or short-term profit?
4. Controls: Do Risk, Compliance, Internal Audit have real power to say NO?

2. Legal Framework - Spain

A. EU Level - CRD / CRR

• Art 74 CRD + Art 97 CRD: Banks must have robust internal governance, SREP must assess it.
• EBA Guidelines on Internal Governance (EBA/GL/2017/11, now EBA/GL/2021/06) - Applies from 30 June 2018 in Spain, adopted by Banco de España Executive Commission. Specifies internal governance arrangements, processes and mechanisms that credit institutions must implement to ensure effective and prudent management.
• EBA/ESMA Joint Guidelines on Suitability (EBA/GL/2021/06) - Fit & Proper for board members and key function holders.
• EBA Guidelines on SREP (EBA/GL/2022/03) - Common SREP methodology.

B. ECB Level

• ECB Guide to Fit and Proper Assessments - Explains how ECB ensures consistency in assessing qualifications, skills, proper standing of board members (CEO, non-executive). Not legally binding, but practical tool updated regularly.
• ECB Draft Guide on Governance and Risk Culture (2024-2026 Priority) - New holistic approach. ECB said governance and risk culture is one of the prioritized vulnerabilities for 2024-2026. It uses holistic assessment of governance and risk culture components.
• ECB SREP Methodology - SREP is annual assessment of bank's risks, governance, capital and liquidity adequacy, through which supervisor sets bank-specific Pillar 2 Requirements (P2R) and Guidance (P2G).

C. Spanish National Level

• Law 10/2014 + Royal Decree 84/2015 + Banco de España Circular 2/2016 - Implements CRD in Spain. Requires: Risk Committee, Audit Committee, Nomination Committee, Remuneration Committee. At least 1/3 independent.
• Law 31/2014 + CNMV Good Governance Code for Listed Companies - 64 recommendations. CaixaBank, Santander, BBVA report compliance. CaixaBank in 2017 reported highest ISS QualityScore and compliance with most of 64 recommendations.
• Spanish Corporations Act Art 529 - Board self-assessment mandatory annually.

For Significant Institutions (Santander, BBVA, CaixaBank, Sabadell, Bankinter, Unicaja): ECB applies common SREP methodology, facilitating peer comparison.
For Less Significant Institutions: Banco de España applies ECB-approved methodology. SREP conclusions encompass governance score.

3. The SREP Governance Assessment - How It Works in Spain

SREP has 4 blocks. Governance is Block 2, but it affects all others.

Governance Score: 1 (Best) to 4 (Worst)

• Score 1-2: Good governance - No capital add-on
• Score 3: Weaknesses - Pillar 2 add-on + 10-20% capital surcharge, restriction on dividends
• Score 4: Serious failure - ECB can remove directors, impose business restrictions, trigger resolution

In Dec 2025, ECB streamlined SREP to better integrate Fit & Proper assessments into overall SREP governance assessments. As of 31 July 2026, banks must notify material new facts affecting suitability via SSM Portal.

4. The 5 Pillars of Governance Quality Assessment in Spain

Pillar 1: Fit & Proper - Individual + Collective Suitability

ECB assesses every board member at appointment AND throughout tenure.

Individual:

• Knowledge, Skills, Experience: Does CEO understand credit risk? Does Risk Committee Chair understand derivatives?
• Reputation / Proper Standing: No criminal record, no prior supervisory sanctions, no conflict of interest.
• Time Commitment: Can director attend 12 board meetings + 20 committee meetings? ECB rejects "over-boarding" - max 4 non-executive mandates.
• Independence of Mind: Can director challenge Chair? This is different from formal independence. Even executive can have independence of mind.

Collective:

• Board as a whole must cover: Banking, Risk, Audit, IT, Climate, Legal, ESG.
• ECB uses Skills Matrix. If board has no IT expert in 2025, governance score drops (DORA requirement).

Ongoing Duty: Board members must meet suitability at all times. If new facts emerge (e.g., criminal investigation, bankruptcy), bank must notify ECB. ECB can reassess and remove.

Pillar 2: Board Functioning & Effectiveness

ECB Joint Supervisory Teams (JSTs) attend board meetings, read minutes, interview directors.

They check:

• Does board receive information 5 days before meeting, or 1 hour before?
• Does board debate Risk Appetite, or just approve management proposal?
• Are dissents recorded? Silence = failure.
• Does board do annual self-assessment with external evaluator every 3 years? (CNMV Code)

Spanish example: Santander requires board 14-22 members, CaixaBank 12-20, BBVA has one-tier board system with single body performing management, control and oversight. ECB compares these structures - size alone is not quality.

Pillar 3: Risk Appetite Framework (RAF) + Risk Culture

This is the most important new pillar.

Board must approve RAF: "We will not lend >X% to real estate, we will not have NPA >Y, we will maintain LCR >120%."

ECB checks:

• Is RAF linked to strategy and remuneration? If trader gets bonus for exceeding RAF, culture is bad.
• Does Risk function have veto? Can CRO escalate to board without CEO approval?
• Is there a "speak-up" culture? Whistle-blower cases?

ECB Guide on Governance and Risk Culture (2024) says: Risk culture is not a poster on wall, it is what happens when no one is watching.

Pillar 4: Internal Controls - Three Lines of Defence

1. 1st Line: Business units own risk
2. 2nd Line: Risk + Compliance - independent, report to Risk Committee, not CEO
3. 3rd Line: Internal Audit - reports directly to Audit Committee, can audit CEO

If Internal Audit reports to CFO, governance score = 4.

Pillar 5: Remuneration Governance

Under CRD + EBA Guidelines on Sound Remuneration (applies from 31 Dec 2021), ECB checks:

• Variable pay capped at 100% of fixed (200% with shareholder approval)
• 40-60% deferred 4-5 years, with malus / clawback if risk materialises later
• No bonus if bank breaches RAF

This was created after 2008 when Spanish Cajas paid bonuses while collapsing.

5. Landmark Case Laws - Governance Quality Assessment in Action

CASE 1: Bankia / Cajas - The Failure That Created SREP Governance Assessment

Facts: Cajas boards were controlled by politicians, unions, Church. No fit & proper, no risk culture. Bankia board had no banking experts, approved IPO with false profits.

Outcome: Bankia needed €19B bailout. No supervisor had assessed governance quality before 2012.

Governance Lesson: This is why EBA GL 44 (2011) and later EBA/GL/2017/11 were created. Spain's cajas showed that internal-control mechanisms work for Independent Commercial banks, but Savings banks show weaker internal mechanisms - academic study of 10 largest Spanish banks confirmed this.

CASE 2: Banco Popular (2017) - Governance Score = 4

Facts: Popular's board had weak risk culture, hid NPA, no credible RAF, liquidity risk not governed.

ECB SREP Assessment: Popular had been given governance weaknesses in SREP 2015-2016, but board did not fix them. ECB declared it Failing or Likely to Fail on 6 June 2017, SRB resolved it, sold to Santander for €1.

Litigation: General Court 1 June 2022 dismissed 100+ cases. Held SRB acted lawfully.

Governance Lesson: SREP governance score is not academic. If you ignore SREP governance findings, you will be resolved.

CASE 3: Santander - Fit & Proper Challenge - Andrea Orcel Case (2019-2021)

Facts: Santander appointed Andrea Orcel as CEO in 2018, then withdrew offer due to pay dispute. Orcel sued Santander for €112M.

Spanish Courts: Madrid Court held Santander breached contract, awarded Orcel €51M (later reduced). ECB had approved Orcel as Fit & Proper, but board's governance failure in appointment process was exposed.

Governance Lesson: Fit & Proper is not just ECB approval. Board must have proper nomination process, contract governance, and remuneration governance. Failure = liability.

CASE 4: BBVA - Villarejo Case (2019-Present) - Reputation & Suitability

Facts: BBVA allegedly hired ex-police commissioner Villarejo for corporate espionage (2014-2018) to block Sacyr takeover.

ECB / CNMV Action: ECB opened Fit & Proper reassessment of BBVA board members. CNMV investigated. Spanish Audiencia Nacional charged BBVA as legal person.

Governance Lesson: Suitability is ongoing. Even if director was fit at appointment, if new facts emerge (criminal investigation), ECB can reassess. Reputation risk = Governance risk. BBVA's SREP governance score was downgraded.

CASE 5: CaixaBank - Bankia Merger Governance (2020-2021)

Facts: CaixaBank absorbed Bankia in Sept 2020. Board had to integrate two different risk cultures, two boards, 2,000 branches.

ECB Assessment: ECB praised CaixaBank governance - it had high ISS QualityScore, complied with most CNMV Code recommendations, had strong board self-assessment, and successfully managed merger without capital add-on.

Governance Lesson: Good governance quality is rewarded - lower Pillar 2, faster ECB approval for merger. This is positive example.

CASE 6: CJEU - Landeskreditbank Baden-Württemberg v. ECB (C-450/17, 2019)

Facts: German bank challenged ECB's power to assess its governance as Significant Institution.

CJEU Held: ECB is exclusively competent for prudential supervision, including governance assessment. NCAs like Banco de España are agents.

Application to Spain: Santander, BBVA cannot argue Banco de España should assess them, not ECB. Governance quality is assessed in Frankfurt, not Madrid.

6. How to Assess Governance Quality - Practical Checklist Used by ECB in Spain

When ECB JSTs assess a Spanish bank, they use this scorecard:

Summary - The Spanish Doctrine

Old Governance (Pre-2014): Governance Quality = Compliance Checklist (Do you have 50% independent? Yes = Pass)
New Governance (Post-2014, ECB SREP): Governance Quality = Effectiveness (Does your board actually govern? Prove it with minutes, dissents, RAF breaches, culture)

In Spain, governance quality is not a soft concept. It is a capital requirement. A bank with weak governance pays more capital, cannot pay dividends, and can lose its licence.