Introduction

“Counterintelligence” in Spanish banking law does not mean that banks act as intelligence agencies. Rather, it describes lawful measures used to detect, prevent, contain and report threats such as terrorist financing, espionage-linked payments, sanctions evasion, insider compromise, cyber intrusion, foreign interference and misuse of banking infrastructure.

Spanish banks must protect the financial system while respecting banking secrecy, data-protection rules, constitutional privacy and due-process guarantees. The core legal balance is: strong risk detection is required, but indiscriminate surveillance of customers or staff is not lawful.

Legal and Regulatory Framework

1. Spanish Constitution and privacy

Article 18 of the Spanish Constitution protects personal and family privacy and the secrecy of communications. Financial information is highly sensitive because it can reveal a person’s relationships, movement, political activity, health spending, religion and economic position.

Accordingly, a bank cannot share account intelligence simply because a public authority is interested in it. It needs a lawful basis, a defined purpose and an authorised recipient.

2. AML and counter-terrorist-financing law

Spain’s principal framework is Law 10/2010 on the Prevention of Money Laundering and Terrorist Financing, together with Royal Decree 304/2014. Credit institutions are “obliged entities.” They must identify customers and beneficial owners, monitor relationships and transactions, apply enhanced due diligence where risk is higher, retain required records, establish internal controls and report suspicious transactions to SEPBLAC, Spain’s financial-intelligence unit. The statute is expressly designed to protect the integrity of the financial system from money laundering and terrorist financing. Law 10/2010

This is the banking system’s most important lawful intelligence channel. A bank’s suspicious-transaction report is not an accusation of guilt; it is a protected risk report for SEPBLAC’s analysis.

3. Financial intelligence and access to account information

SEPBLAC may analyse suspicious activity and exchange intelligence with competent authorities under statutory safeguards. Spain also maintains the Financial Ownership File, which permits designated authorities to access or request financial information for preventing, detecting, investigating or prosecuting serious crime. The use of intelligence remains subject to the specific statutory regime and purpose limitations. Organic Law 9/2022

4. National security, sanctions and critical resilience

The National Security Law and the framework governing the National Intelligence Centre (CNI) provide the State’s national-security architecture. Banks may be affected where terrorism, hostile-state activity, critical infrastructure, sanctions or a serious cyber incident is involved, but they are not generally free to conduct intelligence operations themselves.

EU and Spanish sanctions rules require screening, freezing and reporting where an asset freeze applies. Banks must also maintain resilient systems against cyber compromise. DORA, the EU Digital Operational Resilience Act, is especially relevant to counterintelligence risks because it requires financial entities to manage ICT risk, test resilience, control third-party technology risk and report major ICT incidents.

5. Data protection

The GDPR, Spain’s Organic Law 3/2018, and sector-specific rules constrain monitoring. Banks may process data where necessary for AML, fraud prevention, legal compliance, security or legitimate interests, but must apply necessity, proportionality, data minimisation, access control, retention limits and security safeguards.

A bank should not build a vague “national-security” customer profile, use intrusive employee monitoring without safeguards, or disclose intelligence to private actors without a legal basis.

Key Banking Counterintelligence Duties

A Spanish bank should operate a risk-based framework covering:

• customer and beneficial-owner verification;
• transaction monitoring for terrorist financing, sanctions evasion, mule accounts, laundering and unusual cross-border activity;
• screening against applicable sanctions and politically exposed-person risk;
• controls against insider threats, privileged-access abuse and social engineering;
• cyber-threat detection, incident escalation and evidence preservation;
• segregation of duties, audit trails and restricted access to sensitive intelligence;
• reporting to SEPBLAC and other competent authorities where law requires;
• staff training, whistleblowing channels and independent compliance review.

The key principle is “need to know.” Security, AML, fraud, legal and IT teams should not have unrestricted access to all customer intelligence merely because it may be useful.

Case Laws

1. Digital Rights Ireland, C‑293/12 and C‑594/12

The CJEU invalidated the EU Data Retention Directive because its broad retention of communications data seriously interfered with privacy and data-protection rights without sufficiently strict limits. The case matters to banks because security objectives do not justify blanket, uncontrolled retention or access to sensitive data.

2. Tele2 Sverige / Watson, C‑203/15 and C‑698/15

The Court held that EU law precludes general and indiscriminate retention of traffic and location data. Access must be limited to what is strictly necessary and subject to safeguards. For banks, automated monitoring must be targeted, risk-based and governed; “collect everything in case it becomes useful” is legally dangerous.

3. Ministerio Fiscal, C‑207/16

This Spanish reference concerned access to communications data in a criminal investigation. The CJEU stressed that the seriousness of the interference and the seriousness of the offence matter. It reinforces that authorities cannot obtain highly intrusive data through informal or disproportionate requests.

4. Privacy International, C‑623/17

The CJEU ruled that national-security objectives do not remove State access to communications data from EU-law safeguards. General and indiscriminate transmission of such data to security agencies exceeded what was strictly necessary. This is important for Spanish banks: a national-security label does not automatically legalise sweeping, routine disclosure of financial or communications-related data. Judgment

5. La Quadrature du Net, C‑511/18, C‑512/18 and C‑520/18

The Court accepted that genuine, serious national-security threats may justify exceptional measures, but only within strict conditions, temporal limits and effective review. Banks should therefore treat emergency requests as exceptional and document the legal basis, scope, authority and data supplied.

6. Prokuratuur, C‑746/18

The CJEU required prior review by a court or independent administrative body before access to retained communications data, except in genuine urgency. The principle is broader than telecoms: independent oversight is a central safeguard whenever sensitive intelligence is sought.

7. Big Brother Watch and Others v United Kingdom

The European Court of Human Rights held that bulk interception regimes require robust “end-to-end” safeguards, including independent authorisation, supervision, selection safeguards and review. It is persuasive for Spain when designing intelligence-sharing and cyber-monitoring systems.

8. Centrum för rättvisa v Sweden

The European Court of Human Rights accepted that strategic surveillance can pursue legitimate national-security aims, but only where the legal regime contains strong safeguards against abuse. The lesson for banks is not that mass surveillance is permitted; it is that exceptional monitoring requires a clear law, defined purpose, independent control and effective remedies.

Conclusion

Spanish banking counterintelligence is primarily a compliance, resilience and reporting function. Banks must detect financial threats, protect systems and cooperate with SEPBLAC and lawfully authorised authorities. At the same time, constitutional privacy, GDPR standards and EU/Convention case law prohibit indiscriminate monitoring and uncontrolled disclosure.

The legally sound model is risk-based monitoring, documented decision-making, narrowly limited data access, secure reporting, independent oversight and respect for customer and employee rights.