Banking Law and Corporate Governance in Banking – Spain

Introduction

Corporate governance in Spanish banking law concerns the system by which banks and other credit institutions are directed, supervised, controlled, and held accountable. In an ordinary company, corporate governance mainly protects shareholders and ensures responsible management. In a bank, however, governance has a wider public importance because weaknesses in management can threaten depositors, creditors, investors, financial stability, and confidence in the banking system.

For this reason, Spanish banking governance combines ordinary company law with special prudential rules applying specifically to credit institutions. The central statute is Law 10/2014 of 26 June on the organisation, supervision and solvency of credit institutions (Ley 10/2014). It is supplemented by Royal Decree 84/2015, Banco de España regulations, EU prudential legislation, the Capital Requirements Directive framework, the Capital Requirements Regulation, European Banking Authority guidelines, and—in significant institutions—the supervisory powers exercised within the European Central Bank's Single Supervisory Mechanism.

Law 10/2014 expressly requires credit institutions to establish robust governance arrangements, including clear organisational structures, effective risk-management processes, internal controls, and remuneration systems compatible with sound risk management.

1. Legal and Regulatory Framework

A. Law 10/2014

Law 10/2014 constitutes the principal Spanish statutory framework governing the organisation, supervision, solvency, management and corporate governance of credit institutions.

Articles 28 onwards establish a special corporate-governance regime for banks.

Article 29 requires a credit institution to maintain:

a clear organisational structure;

well-defined and transparent lines of responsibility;

effective procedures for identifying, managing, monitoring and reporting risks;

adequate internal controls;

sound administrative and accounting arrangements; and

remuneration policies consistent with sound and effective risk management.

The governance mechanisms must be proportionate to the nature, scale and complexity of the institution's activities.

This proportionality principle means that a large internationally active banking group will normally be expected to maintain considerably more sophisticated governance, risk, audit and compliance systems than a small institution with relatively simple operations.

B. Royal Decree 84/2015

Royal Decree 84/2015 develops Law 10/2014 in matters including:

suitability of directors;

assessment of senior management;

key function holders;

governance procedures;

conflicts of interest;

remuneration;

supervisory notifications; and

continuing assessment of persons responsible for managing banks.

Credit institutions must have adequate internal systems for selecting and continuously evaluating board members, directors-general, internal-control officers and other key function holders. They must also notify Banco de España of proposed appointments to important management positions.

C. EU Banking Law

Spanish governance requirements must also be understood within EU banking law.

Important sources include:

the Capital Requirements Directive;

the Capital Requirements Regulation;

EBA Guidelines on Internal Governance;

EBA/ECB suitability standards;

the Single Supervisory Mechanism framework; and

rules concerning recovery and resolution of banks.

Spain's banking-governance framework is therefore not purely domestic. It operates within a European supervisory system involving Banco de España, the ECB and the European Banking Authority.

2. Responsibility of the Board of Directors

The board of directors is the central governance body of a Spanish bank.

Article 29 of Law 10/2014 makes the board responsible for establishing a governance system capable of ensuring the sound and prudent management of the institution.

The board must also monitor implementation of that governance framework, periodically evaluate its effectiveness and correct identified deficiencies.

Certain responsibilities are expressly treated as non-delegable.

They include:

Strategic Direction

The board determines and supervises:

business objectives;

long-term strategy;

risk strategy;

governance structure; and

important institutional policies.

The board therefore cannot simply leave the operation of the bank entirely to senior executives.

Internal Governance

The board must ensure that responsibilities inside the institution are clearly allocated.

There should be no uncertainty regarding who controls:

credit risk;

liquidity;

market risk;

operational risk;

regulatory compliance;

accounting;

cybersecurity;

internal audit; and

other significant functions.

Financial Reporting

The board must safeguard the integrity of accounting and financial-reporting systems.

This obligation is particularly important because inaccurate information concerning a bank's financial condition can harm depositors, investors and financial markets.

Supervision of Senior Management

Senior executives carry out daily management, but the board must effectively supervise them.

Corporate governance therefore requires genuine oversight rather than passive approval of management decisions.

3. Suitability and “Fit and Proper” Requirements

Bank directors cannot be appointed solely because they represent major shareholders or possess general business experience.

Spanish banking law imposes specific suitability requirements.

Article 24 of Law 10/2014 requires members of bank boards to possess:

commercial and professional good repute;

appropriate knowledge;

appropriate professional experience;

sufficient ability to exercise proper governance; and

sufficient time to perform their duties.

The board collectively must have adequate knowledge, skills and experience to understand the institution's activities and major risks.

This creates both an individual suitability test and a collective suitability test.

A director may therefore be personally qualified while the overall composition of the board remains inadequate because the board lacks expertise in areas such as risk management, banking, accounting, technology or regulation.

Suitability is also continuing rather than merely tested at appointment.

Royal Decree 84/2015 requires continuing assessment of directors and key function holders.

4. Independence of the Board

Effective banking governance requires directors to exercise independent judgment.

Independence does not simply mean that directors are legally classified as independent directors. It also requires them to question management and objectively assess the institution's strategy and risk exposure.

The board must therefore avoid becoming dominated by:

the chief executive;

controlling shareholders;

major borrowers;

political interests;

related companies; or

individual executives.

Spanish law also addresses the concentration of authority at the top of a bank.

Under Article 29 of Law 10/2014, the chairman of the board generally cannot simultaneously act as chief executive unless the institution provides justification and receives the necessary authorisation from Banco de España.

This separation is intended to strengthen board oversight of executive management.

5. Risk Governance

Risk governance is one of the most important elements of Spanish banking corporate governance.

Article 37 of Law 10/2014 expressly states that the board is responsible for the risks assumed by the credit institution.

The board must approve and periodically review policies concerning:

identification of risks;

acceptance of risks;

management of risks;

monitoring of risks; and

reduction or mitigation of risks.

Relevant categories may include:

credit risk;

market risk;

liquidity risk;

interest-rate risk;

operational risk;

concentration risk;

legal risk;

compliance risk;

cyber risk;

environmental and climate-related financial risk; and

reputational risk.

The board must receive sufficient information to understand the institution's real risk position.

A governance system therefore fails if senior management hides, delays or oversimplifies material risk information.

6. Independent Risk-Management Function

Article 38 requires credit institutions to maintain an independent risk-management function appropriate to their size, scale and complexity.

The function should have:

sufficient authority;

appropriate organisational status;

adequate resources;

independence from business functions; and

access to the board of directors.

This is important because employees generating profits should not exercise unrestricted control over the measurement of the risks created by their own activities.

Large or complex institutions may additionally be required to establish a board-level risk committee.

7. Internal Control and the Three-Lines Structure

Modern banking governance generally separates operational activity from control functions.

A typical framework includes:

First line – Business management

Business units identify and manage risks generated through their activities.

Second line – Risk and compliance

Independent risk-management and compliance functions monitor whether activity remains within applicable laws, policies and risk limits.

Third line – Internal audit

Internal audit independently assesses whether governance, controls and risk-management systems actually function as intended.

The independence of these control functions is essential.

A compliance department that cannot challenge management would provide little meaningful regulatory protection.

8. Audit Committee

Banks normally require strong audit arrangements.

An audit committee helps the board oversee:

accounting systems;

financial statements;

internal controls;

external auditors;

internal audit;

financial disclosure; and

integrity of financial information.

Banks depend heavily upon confidence in reported capital, assets, liabilities, provisions and risk exposure.

Consequently, accounting oversight is an important part of prudential governance rather than merely a corporate reporting issue.

9. Nomination Committee

A nomination committee contributes to the selection and assessment of directors and senior managers.

Its responsibilities can include evaluating:

knowledge;

skills;

professional experience;

reputation;

independence;

conflicts of interest;

diversity;

time commitment; and

collective suitability of the board.

This prevents senior banking appointments from being treated merely as political, shareholder or executive appointments.

10. Remuneration Committee and Compensation Governance

Executive remuneration can create substantial prudential risk.

For example, a remuneration system heavily dependent on short-term profits may encourage management to increase lending or trading risk in order to obtain bonuses.

Spanish and EU rules therefore require remuneration structures to support sound and effective risk management.

Governance over remuneration can involve:

fixed and variable remuneration;

performance measurement;

deferral of variable compensation;

risk adjustment;

malus mechanisms;

clawback arrangements;

pension benefits; and

severance payments.

Public disclosure regarding director remuneration must also be accurate.

This point became particularly important in litigation concerning Banco Popular.

11. Conflicts of Interest

Banks face particularly complex conflicts of interest because they may simultaneously act as:

lenders;

investment-service providers;

securities issuers;

asset managers;

financial advisers;

shareholders;

intermediaries; and

counterparties.

Boards must therefore establish policies for identifying, preventing, managing and disclosing conflicts.

Particular attention is required where transactions involve:

directors;

executives;

controlling shareholders;

related companies; or

other connected persons.

Royal Decree 84/2015 specifically recognises the importance of conflicts of interest in transactions involving credit, guarantees and similar arrangements with senior officials.

12. Governance of Remuneration and Risk-Taking

Remuneration should not reward uncontrolled risk-taking.

A properly governed remuneration system should balance:

profitability;

risk;

capital;

liquidity;

compliance;

customer outcomes; and

longer-term sustainability.

Where performance subsequently proves to have been misstated or excessive risks produce losses, remuneration arrangements may permit reduction or recovery of variable compensation.

The fundamental principle is that managers should not receive large short-term rewards for decisions whose financial risks emerge only later.

13. Disclosure and Transparency

Corporate governance also requires transparency.

Banks must disclose specified information concerning their governance arrangements.

Law 10/2014 requires credit institutions to make relevant public governance information available and explain how governance obligations are complied with.

Transparency can cover matters such as:

governance structure;

board membership;

committee structure;

remuneration;

risk management;

capital;

ownership;

financial performance; and

material regulatory matters.

Incorrect disclosures can result in civil, administrative or—in sufficiently serious circumstances—criminal consequences.

14. Supervisory Role of Banco de España and the ECB

Governance is subject to prudential supervision.

Banco de España maintains an important role under the Spanish banking framework, while significant credit institutions within the Banking Union are directly supervised by the ECB under the Single Supervisory Mechanism.

Supervisors may examine:

board effectiveness;

suitability of directors;

internal controls;

risk-management arrangements;

remuneration;

business strategy;

organisational structure;

internal audit;

compliance functions; and

governance deficiencies.

Spanish legislation also gives Banco de España a role in checking whether senior officials satisfy statutory suitability requirements before registration.

Governance failures may therefore become prudential-supervision violations even where the bank remains technically solvent.

15. Accountability of Directors

Bank directors are not merely honorary members of the board.

They can face liability where their conduct violates:

corporate duties;

banking regulations;

securities laws;

disclosure obligations;

prudential requirements; or

criminal law.

Depending upon the circumstances, consequences can include:

regulatory sanctions;

disqualification;

removal from office;

civil liability;

compensation obligations; or

criminal liability.

The standard is particularly demanding because banking decisions may affect a large number of customers and the stability of the wider financial system.

Important Case Laws

1. Banco Popular Remuneration Case – Tribunal Supremo, 16 May 2023

This is especially relevant to banking corporate governance.

The dispute concerned misleading or omitted information in Banco Popular's annual reports for 2013–2015 regarding remuneration of executive directors, including long-term savings arrangements and termination payments.

The Spanish Supreme Court confirmed a €1 million sanction, imposed on Banco Santander as Banco Popular's successor.

Governance significance

The case demonstrates that director-remuneration disclosure is a substantive governance obligation.

It also establishes the importance of continuity of corporate regulatory responsibility. Following corporate succession or absorption, regulatory liability connected with the absorbed institution may in appropriate circumstances pass to its successor.

2. Caja de Ahorros de Castilla-La Mancha – STS 2892/2015, 2 July 2015

The Spanish Supreme Court considered disciplinary responsibility involving a member of the board of directors of Caja de Ahorros de Castilla-La Mancha.

The proceedings arose under the former Law 26/1988 concerning discipline and intervention of credit institutions.

Governance significance

The decision illustrates that membership of the governing body of a financial institution carries regulatory responsibilities.

A board member cannot necessarily avoid accountability merely by claiming that daily operations were performed by executives.

Modern Law 10/2014 strengthens this principle by expressly assigning important governance and risk responsibilities to boards.

3. Caja Madrid/Bankia “Tarjetas Black” Case – Audiencia Nacional, 23 February 2017

The case concerned corporate cards issued to directors and executives of Caja Madrid and subsequently Bankia.

The Audiencia Nacional convicted numerous former directors and executives for misappropriation relating to use of the cards.

Governance significance

The case illustrates major corporate-governance problems involving:

director remuneration;

expenses;

transparency;

internal control;

board accountability; and

conflicts between personal benefit and institutional interests.

It shows why remuneration and benefits provided to directors must be properly authorised, documented and controlled.

4. Bankia IPO Civil Cases – Spanish Supreme Court, January 2016

The Spanish Supreme Court rejected Bankia's appeals concerning claims arising from its 2011 public offering.

The Court concluded that serious inaccuracies in the prospectus had caused investors to enter transactions under an erroneous understanding of Bankia's financial condition.

Governance significance

Although principally a securities-disclosure case, it has major corporate-governance relevance.

The case demonstrates the importance of:

reliable financial reporting;

board supervision of disclosure;

accurate investor communications;

effective accounting controls; and

accountability when investors rely upon inaccurate information.

Financial reporting therefore constitutes a core board-governance responsibility.

5. Bankia SA v Unión Mutua Asistencial de Seguros, C-910/19, ECJ, 3 June 2021

The Court of Justice considered prospectus liability arising from Bankia's public offering.

It held that qualified investors may, under the applicable Prospectus Directive framework, bring an action for damages concerning information supplied in a prospectus even where the public offering included both retail and qualified investors.

Governance significance

The judgment emphasises the legal importance of accurate issuer disclosure.

Bank boards must ensure that public-market documentation provides reliable information because misleading disclosure can expose the institution to substantial liability.

6. Bankia Criminal Proceedings – Audiencia Nacional, 29 September 2020

The Audiencia Nacional acquitted 34 individuals and entities prosecuted in connection with Bankia's flotation, including former directors and executives.

The Court emphasised that the flotation had been reviewed and approved by relevant supervisory authorities and found insufficient basis for the criminal offences alleged.

Governance significance

The case provides an important counterpoint to the Bankia civil litigation.

Poor outcomes or disputed financial information do not automatically establish criminal responsibility of directors.

Criminal liability requires proof of the elements of the relevant offence and sufficiently individualised conduct.

Thus:

regulatory failure, civil liability and criminal liability are legally distinct forms of accountability.

7. Banco Popular Resolution Litigation – C-410/20, ECJ, 5 May 2022 and Spanish Supreme Court Cases

Following the resolution of Banco Popular, shareholders sought remedies connected with shares acquired before the resolution.

The Court of Justice held that the EU Bank Recovery and Resolution Directive prevented certain prospectus-liability and contractual-nullity actions after the relevant shares had been completely written down in the resolution process.

The Spanish Supreme Court subsequently applied this doctrine in several Banco Popular cases, including judgments beginning with decisions such as STS 1135/2023 and related July 2023 judgments. The doctrine continued to be applied in later Supreme Court litigation.

Governance significance

The cases demonstrate that governance accountability in banks operates within the special European bank-resolution regime.

Ordinary shareholder remedies may sometimes be affected by overriding objectives of banking resolution, including:

maintaining financial stability;

ensuring effective resolution;

allocating losses according to the resolution framework; and

avoiding disruption of resolution decisions.

8. General Board Responsibility – STS 371/2012

Although this decision concerns company-law director responsibility rather than a banking-specific rule, it illustrates an important governance principle.

The Supreme Court held that where the governing body is a board of directors, failure to perform a statutory board obligation may be attributable to all members unless a director proves that he or she took appropriate measures to ensure compliance.

Banking relevance

This principle is especially important for bank directors because Law 10/2014 expressly assigns several non-delegable responsibilities to the board.

A bank director therefore cannot automatically defend regulatory failure by arguing:

“Another director or senior executive was responsible for that issue.”

Collective board membership itself carries important oversight responsibilities.

Key Principles Emerging from Spanish Banking Governance Law

Several important principles emerge from the statutory framework and case law.

1. Board responsibility is substantive

The board must actively direct and supervise the institution rather than simply approve management proposals.

2. Risk governance is a board responsibility

The board determines the institution's risk strategy and must understand major risks.

3. Delegation does not eliminate board accountability

Executives may manage daily operations, but important statutory responsibilities remain with directors.

4. Directors must remain suitable

Competence, reputation, independence and sufficient commitment are continuing regulatory requirements.

5. Control functions must be independent

Risk, compliance and internal audit must possess sufficient authority and resources to challenge business management.

6. Remuneration is a prudential issue

Compensation structures should discourage excessive risk-taking and must comply with transparency requirements.

7. Financial disclosure is a governance function

Boards must safeguard the reliability of accounting, financial reporting and public disclosures.

8. Conflicts must be controlled

Transactions involving directors, executives, shareholders and connected parties require careful governance.

9. Banks face enhanced governance standards

A bank cannot rely exclusively upon ordinary Spanish company law because its directors are also governed by specialised banking and prudential requirements.

10. Governance failures can produce multiple forms of liability

A single governance problem may potentially result in:

supervisory intervention;

administrative sanctions;

civil liability;

securities-law liability; or

criminal proceedings.

These consequences remain legally distinct and each requires its own legal basis.

Conclusion

Corporate governance in Spanish banking law is a central part of prudential regulation rather than merely an internal corporate matter.

Law 10/2014, Royal Decree 84/2015, Banco de España requirements and EU banking legislation create an extensive governance framework under which boards must maintain sound organisational structures, effective risk-management systems, independent control functions, proper remuneration policies, reliable financial reporting and adequate supervision of senior management. Banco de España identifies Law 10/2014, Royal Decree 84/2015 and Circular 2/2016 among the principal Spanish measures governing supervision and solvency of credit institutions.

The board is ultimately responsible for ensuring the sound and prudent management of the institution. Its responsibilities extend beyond shareholder interests because bank governance affects depositors, customers, investors and financial stability.

Cases concerning Banco Popular, Bankia, Caja Madrid and Caja de Ahorros de Castilla-La Mancha demonstrate the practical importance of these duties. They show that failures involving remuneration, financial reporting, internal controls, management oversight or regulatory compliance can trigger substantial legal consequences.

The modern Spanish approach can therefore be summarised as:

corporate governance + prudential supervision + risk management + individual suitability + transparency + board accountability = sound banking governance.

The fundamental objective is to prevent weak management and excessive risk-taking from developing into losses that threaten individual institutions or the stability of the wider Spanish and European banking system.