Banking Law and Constitutional Issues in Decentralized Finance in Spain

Introduction

Decentralized finance, commonly called DeFi, refers to financial arrangements built mainly on distributed-ledger or blockchain infrastructure in which activities such as exchanging crypto-assets, lending, borrowing, collateralisation and asset management may be performed through smart contracts rather than a conventional bank or other centralized intermediary.

In Spain, there is no separate constitutional category called “DeFi law.” Instead, DeFi sits at the intersection of Spanish constitutional law, EU financial regulation, banking law, securities regulation, anti-money-laundering rules, consumer protection, data protection and private law. The central legal difficulty is that financial regulation traditionally identifies a regulated institution—such as a bank, investment firm or payment provider—while genuinely decentralized protocols may operate without an obvious legal entity exercising equivalent control.

The constitutional question is therefore not whether blockchain technology is lawful in itself, but how public authorities can regulate decentralized financial activity while respecting constitutional rights, EU law and the constitutional allocation of financial powers.

1. Constitutional Foundation of Financial Regulation

The Spanish Constitution provides an important foundation for regulating financial markets.

Most importantly, Article 149.1.11 of the Spanish Constitution reserves to the State exclusive competence over the bases of credit, banking and insurance regulation. Spanish Constitutional Court jurisprudence treats this competence as connected with maintaining a coherent national monetary and financial policy.

In STC 96/1984, the Constitutional Court explained that regulation of credit must be understood within Spain's broader “economic constitution” and the requirement of economic unity throughout the State.

This doctrine becomes relevant to DeFi because decentralized lending, stablecoins, tokenized financial instruments and crypto-asset services can perform functions economically similar to regulated financial intermediation.

Consequently, decentralization does not automatically remove an activity from financial regulation.

The Constitutional Court has also recognized that the State's competence can encompass important executive measures where financial decisions affect broader monetary and financial policy. STC 178/1992, relying on earlier constitutional jurisprudence, emphasized that certain executive powers may fall within the State's basic competence because financial activities are interconnected throughout Spain.

2. EU Law and MiCA

Spain's DeFi framework cannot be understood independently from EU law.

The principal crypto-asset legislation is Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA). MiCA establishes rules relating to crypto-asset issuers, asset-referenced tokens, electronic-money tokens and crypto-asset service providers.

The Banco de España identifies MiCA and Regulation (EU) 2023/1113 concerning information accompanying transfers of funds and certain crypto-assets as central components of the European crypto-asset framework.

However, DeFi creates an important boundary problem. MiCA does not simply convert every decentralized protocol into a conventional regulated financial institution. Whether regulation applies can depend upon the actual organization of the project and whether identifiable persons provide regulated services.

Thus, calling something “decentralized” is not by itself decisive. Regulators can examine its economic and operational reality: who develops and controls the system, who receives fees, who can modify smart contracts, whether intermediaries provide interfaces or custody, and what financial service is actually being supplied.

Spain's CNMV has an important role in implementing the crypto-asset regulatory structure. Its MiCA guidance explains Spain's transition from the earlier national framework toward MiCA authorization. The Spanish transitional period for qualifying previously registered providers ended on 1 July 2026, subject to the circumstances described by the CNMV.

CNMV — MiCA and crypto-asset regulation

3. DeFi and Banking Regulation

One of the hardest questions is determining when a DeFi activity becomes economically equivalent to banking.

Traditional banking law regulates institutions because activities involving deposits, lending and financial intermediation can create systemic and consumer risks.

A DeFi lending protocol may allow users to provide crypto-assets to liquidity pools while borrowers obtain assets against collateral. Although this resembles financial intermediation economically, the legal architecture can be fundamentally different because smart contracts may execute transactions automatically.

Spanish and EU regulators therefore have to determine whether the activity constitutes:

• regulated banking or credit activity;
• investment or securities activity;
• crypto-asset services governed by MiCA;
• payment services;
• another regulated financial service; or
• an activity falling outside those categories.

The classification matters because authorization, governance, prudential, disclosure and supervisory requirements differ substantially between categories.

4. Constitutional Principle of Legal Certainty

Article 9.3 of the Spanish Constitution protects legal certainty and prohibits arbitrary public action.

This principle has particular importance for DeFi.

Developers and users should be able to determine with reasonable predictability when activities trigger regulatory obligations. Problems arise when rules designed for centralized financial institutions are applied to decentralized protocols without clearly identifying the responsible regulated person.

For example, a protocol might involve developers, governance-token holders, validators, interface operators and liquidity providers.

Determining which participant legally constitutes the financial-service provider may therefore become crucial.

At the same time, legal certainty does not mean that innovative technology is immune from existing legislation merely because legislators did not originally contemplate its particular technical architecture.

5. Property Rights and Crypto-Assets

DeFi also raises constitutional property questions.

Article 33 of the Spanish Constitution recognizes the right to private property, subject to its social function and lawful limitations.

Crypto-assets possessing economic value may therefore engage property interests. Regulatory actions affecting possession, transfer, freezing or liquidation of digital assets must consequently have an adequate legal basis.

Nevertheless, Article 33 does not establish an unlimited right to conduct financial activities without regulation. Financial-market restrictions designed to protect investors, prevent financial crime or preserve financial stability can constitute legitimate regulatory measures where the applicable constitutional and EU requirements are satisfied.

6. Freedom of Enterprise

Another important provision is Article 38 of the Constitution, which recognizes freedom of enterprise within the market economy.

DeFi developers and businesses can rely upon entrepreneurial freedom when creating innovative financial services.

But freedom of enterprise operates within a regulated economic system.

Accordingly, Spain can impose authorization, transparency, consumer-protection, AML and prudential requirements when justified by legitimate public interests.

The constitutional issue becomes one of proportionality: regulation should pursue legitimate objectives without imposing unjustified restrictions exceeding what those objectives reasonably require.

7. Equality and Technological Neutrality

Article 14 of the Constitution, concerning equality before the law, can also become relevant.

Comparable financial activities should not receive irrationally different treatment merely because one operates through traditional databases while another employs distributed-ledger technology.

At the same time, equal treatment does not require identical regulation where the underlying risks differ.

For example, permissionless protocols may create distinctive cybersecurity, governance, market-manipulation or accountability risks. Different regulatory requirements may therefore be constitutionally defensible where objective differences justify them.

8. Privacy and DeFi

Blockchain systems generate another constitutional tension through privacy and data protection.

Article 18 of the Spanish Constitution protects privacy and related interests, while the GDPR supplies the principal European data-protection framework.

Public blockchains can preserve transaction information for long periods and make modification difficult. This can create tension with GDPR concepts such as data minimization, rectification and erasure.

A particularly difficult legal question concerns identifying the data controller where processing occurs through a decentralized network without a single organization exercising conventional centralized control.

Therefore, decentralization may redistribute responsibility rather than necessarily eliminate it.

9. Anti-Money-Laundering Regulation

DeFi also challenges anti-money-laundering regulation.

Spain's earlier crypto framework included Law 10/2010 on prevention of money laundering and terrorist financing. The CNMV explains that before MiCA applied, the Banco de España maintained a registration system covering specified virtual-currency exchange and electronic-wallet custody services.

The regulatory problem with DeFi is identifying the party capable of performing customer identification, transaction monitoring and reporting obligations.

This illustrates a recurring legal principle:

technical decentralization does not necessarily equal legal absence of responsibility.

10. Consumer and Investor Protection

DeFi can expose consumers to smart-contract failures, misleading token information, extreme volatility, governance weaknesses and unclear responsibility.

Spanish constitutional principles operate alongside EU consumer and investor-protection law.

Where a project markets financial products to consumers, authorities may investigate whether mandatory disclosure, unfair-commercial-practice or financial-services requirements apply.

The decentralized structure becomes especially difficult where no conventional intermediary exists against whom consumers can easily exercise contractual or statutory remedies.

Important Case Law

There is still comparatively limited Spanish Constitutional Court jurisprudence dealing directly with DeFi. Consequently, analysis must distinguish genuine DeFi/crypto decisions from older constitutional banking cases whose principles can be applied by analogy.

1. STC 1/1982, 28 January 1982

This foundational Constitutional Court judgment developed the constitutional allocation of authority over credit and banking.

It established principles concerning State competence over the basic regulation of financial institutions.

Its significance for DeFi lies in demonstrating that activities affecting the financial system can fall within the State's constitutional economic and banking powers even where regional interests also exist. Later Constitutional Court jurisprudence repeatedly relies upon this framework.

2. STC 96/1984, 19 October 1984

This is particularly important for the Spanish concept of the economic constitution.

The Court connected credit regulation with economic unity and confirmed the State's constitutional responsibility for establishing the basic framework governing credit and banking.

Applied to DeFi, the principle supports national regulation where decentralized financial services have consequences extending beyond individual autonomous communities.

3. STC 178/1992

The Constitutional Court recognized that State competence concerning the basic regulation of credit may extend to certain executive powers where decisions have wider implications for monetary and financial policy.

The judgment also recognized the significance of the Banco de España's technical specialization within financial supervision.

The principle is relevant where supervision of crypto-related financial activity requires centralized technical oversight.

4. STC 96/1996

This case concerned challenges involving Spain's legislation on discipline and intervention of credit institutions.

It examined the constitutional distribution of powers concerning credit, banking and financial supervision.

For DeFi, the broader lesson is that constitutional financial regulation extends beyond merely defining institutions; it can encompass their activities, supervision and enforcement.

5. STC 37/1997

This decision further developed Article 149.1.11 jurisprudence. Constitutional Court materials summarize the doctrine as permitting State basic banking powers to protect matters including solvency, transparency, financial-system stability and effective functioning of the monetary and credit system.

These objectives are directly relevant when assessing regulation of stablecoins, decentralized lending and other crypto-financial structures capable of creating broader financial risks.

6. CJEU, Skatteverket v David Hedqvist, C-264/14 (2015)

Although this was not a Spanish case and predates modern DeFi, it is an important EU crypto judgment binding on the interpretation of EU law applicable throughout Member States.

The Court examined Bitcoin exchange transactions and concluded that exchanges between traditional currency and Bitcoin constituted transactions exempt from VAT under the relevant provisions of the VAT Directive.

Its broader importance is that crypto-assets cannot simply be ignored because they lack conventional monetary form; courts must classify their economic and legal function under existing EU legislation.

Constitutional Balance

The constitutional challenge presented by DeFi can ultimately be expressed as a balance between several interests:

Innovation and freedom of enterprise under Article 38 must coexist with financial stability and banking supervision supported by Article 149.1.11.

Property interests under Article 33 must coexist with lawful financial regulation.

Privacy interests under Article 18 must operate alongside AML and financial-transparency obligations.

Finally, legal certainty under Article 9.3 requires sufficiently predictable rules identifying when decentralized activities become regulated financial services.

Conclusion

Decentralized finance does not operate outside Spanish constitutional or banking law simply because transactions occur through smart contracts instead of traditional banks. Spain's constitutional framework gives the State substantial authority over the foundations of credit, banking and financial stability, while much of the substantive crypto regulatory framework now originates at EU level through MiCA and related legislation.

The principal unresolved challenge is regulatory attribution. Traditional banking regulation asks which institution provides the financial service; DeFi can require regulators first to determine whether any identifiable person actually controls or provides that service.

Spanish Constitutional Court decisions such as STC 1/1982, STC 96/1984, STC 178/1992, STC 96/1996 and STC 37/1997 do not decide DeFi disputes directly, but they establish the constitutional foundations governing financial regulation, economic unity and supervisory authority. Combined with EU crypto jurisprudence such as Hedqvist (C-264/14) and the MiCA framework, they provide the legal principles through which future Spanish DeFi disputes are likely to be analysed.