Banking Law and Critical Infrastructure — Emergency Protocols in Spain

Below is a detailed legal framework for Spain, with emphasis on banks, payment institutions, critical infrastructure, cyber incidents, emergency response, and relevant case law. This is an academic/legal overview rather than legal advice.

1. The basic legal architecture

Spain does not regulate banking emergencies through one single “Banking Emergency Act.” Instead, several overlapping regimes operate together:

The important point is that a major banking cyberattack can simultaneously be a banking-regulatory event, a critical-infrastructure event, a cybersecurity incident, a payment-services event and potentially a criminal event.

2. Banking as critical infrastructure in Spain

Spain's critical-infrastructure regime is principally based on Law 8/2011 of 28 April on measures for the protection of critical infrastructures. The law establishes the institutional framework for protecting infrastructure whose disruption could seriously affect essential services and society.

The financial system is expressly included among Spain's strategic sectors for purposes of the cybersecurity/essential-services regime. Royal Decree-Law 12/2018 specifically included the sistema financiero among the sectors whose essential services and operators were to be identified.

This does not mean that every bank automatically qualifies as a “critical operator.” The legal system distinguishes between:

1. the strategic sector;
2. an essential service;
3. an operator of an essential service; and
4. a formally designated critical operator/critical infrastructure.

That distinction is important in an examination answer.

3. Law 8/2011 — duties of a critical operator

Under Law 8/2011, a designated critical operator has substantial security-planning obligations.

Among other things, the operator must prepare a Specific Protection Plan (Plan de Protección Específico) for each infrastructure classified as critical and designate appropriate security personnel. It must also cooperate with inspections and implement the security measures required by the competent authorities.

The law also requires security planning capable of addressing both prevention and reaction to deliberate attacks.

The broader structure is:

National level

→ National Critical Infrastructure Protection Strategy
→ National Critical Infrastructure Protection Plan
→ Sector Strategic Plans

Operator level

→ Operator Security Plan
→ Specific Protection Plan for each critical infrastructure

Government/security-force level

→ Operational Support Plan.

Law 8/2011 expressly contemplates Operator Security Plans and Specific Protection Plans as instruments for prevention, protection and reaction against deliberate attacks.

4. Royal Decree 704/2011 — emergency planning

Royal Decree 704/2011 develops Law 8/2011 and is particularly important for emergency protocols.

A. Operator Security Plan

The Operator Security Plan is the strategic document defining the operator's overall security policies.

It must contain a risk-analysis methodology designed to guarantee continuity of the services provided by the operator, including measures addressing both physical and logical threats.

For a bank, this logically encompasses risks such as:

• cyberattack;
• ransomware;
• destruction of data centres;
• telecommunications failure;
• physical attack;
• insider threat;
• denial-of-service attack;
• compromise of payment infrastructure;
• failure of critical third-party providers.

B. Specific Protection Plan

The Specific Protection Plan is more operational.

It identifies the concrete measures adopted for the security of the particular critical infrastructure, including information systems. It may contain:

• permanent security measures;
• temporary measures;
• graduated security measures;
• measures triggered by a particular threat;
• measures activated through the National Critical Infrastructure Protection Plan.

C. Operational Support Plan

The public authorities also have responsibilities.

An Operational Support Plan specifies the measures that public authorities, particularly the competent police authorities, will undertake to support the critical operator.

This creates an important legal principle:

Emergency preparedness is not solely the bank's responsibility; it involves coordinated public-private protection.

5. Cybersecurity: Royal Decree-Law 12/2018

Royal Decree-Law 12/2018 is another major pillar.

It was designed to protect networks and information systems used for essential services and establishes an incident-notification system.

For essential-service operators, the obligations include:

• risk assessment;
• appropriate security measures;
• incident management;
• notification of significant incidents;
• cooperation with competent authorities;
• participation in security/crisis-management mechanisms where required.

Importantly, outsourcing does not eliminate responsibility: security obligations apply even where relevant information systems are managed externally.

Spanish CSIRT structure

The regime identifies, among others:

• CCN-CERT;
• INCIBE-CERT;
• ESPDEF-CERT.

For critical operators outside the public-administration sphere, INCIBE-CERT has an important role, with cooperation involving the CNPIC in incidents affecting critical operators.

6. DORA — the most important modern banking-resilience instrument

For modern banking law, DORA — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — is indispensable.

DORA establishes a financial-sector-specific regime for ICT risk and digital operational resilience.

It requires financial entities to maintain a sound, comprehensive and documented ICT-risk management framework. The framework must cover information assets, ICT assets, software, hardware, servers, data centres and relevant physical infrastructure.

Governance

The management body bears ultimate responsibility for ICT risk management.

DORA requires the management body to:

• approve the ICT-risk framework;
• supervise its implementation;
• maintain appropriate governance;
• establish responsibilities;
• ensure high levels of availability, authenticity, integrity and confidentiality.

This is a major development in banking law because cybersecurity is no longer merely an IT department issue.

It becomes a board-level legal and governance responsibility.

7. What should a Spanish bank's emergency protocol contain?

A legally robust banking emergency protocol should operate approximately as follows:

Stage 1 — Detection

Identify:

• cyberattack;
• payment anomaly;
• ransomware;
• system outage;
• physical attack;
• insider incident;
• third-party ICT failure.

Immediately preserve logs and evidence.

Stage 2 — Classification

Determine:

Is this merely an internal IT incident?

or

Does it affect a critical/important function?

or

Does it constitute a reportable regulatory incident?

or

Does it threaten essential financial services?

or

Does it constitute a criminal offence?

This classification determines the escalation path.

Stage 3 — Containment

Possible actions include:

• isolate compromised systems;
• disable compromised credentials;
• suspend suspicious transactions;
• segregate affected networks;
• activate backup systems;
• preserve forensic evidence;
• prevent lateral movement;
• protect payment-processing infrastructure.

DORA expressly contemplates resilience and continuity measures for ICT systems supporting critical or important functions, including mechanisms capable of isolating affected assets during cyberattacks.

Stage 4 — Continuity

The bank should activate:

• business-continuity procedures;
• disaster-recovery systems;
• alternative processing;
• backup communications;
• alternative data centres;
• manual procedures where appropriate;
• liquidity/payment-continuity arrangements.

The objective is not merely to restore IT but to maintain essential banking functions.

Stage 5 — Regulatory notification

Depending on the circumstances, notifications may involve:

• Banco de España;
• ECB/Single Supervisory Mechanism;
• competent cybersecurity authorities/CSIRT;
• CNPIC;
• data-protection authorities;
• law-enforcement authorities.

The exact reporting route depends upon the entity and nature of the incident.

Stage 6 — Customer protection

Where payment fraud is involved, the bank must separately assess its obligations under RDL 19/2018.

This is where Spanish case law has become particularly significant.

8. Payment fraud: RDL 19/2018

Royal Decree-Law 19/2018 establishes a special regime concerning unauthorised payment transactions.

The crucial legal question is often:

Was the transaction genuinely authorised by the customer, and, if not, was the customer guilty of fraud or gross negligence?

The banking institution cannot simply say:

“Our system shows that the customer's password/OTP was used, therefore the customer authorised the transaction.”

That proposition has been significantly weakened by recent Supreme Court jurisprudence.

9. Leading case: Spanish Supreme Court Judgment 571/2025

One of the most important recent authorities is:

Spanish Supreme Court, Civil Chamber, Judgment No. 571/2025, 9 April 2025, ECLI:ES:TS:2025:1671.

The case concerned SIM-phishing and fraudulent banking transactions.

The Supreme Court held, in substance, that where a customer denies authorising a payment transaction, the payment-service provider must establish that the transaction was:

1. authenticated;
2. accurately recorded;
3. properly accounted for; and
4. not affected by a technical failure or other deficiency in the service.

Crucially, the mere fact that the bank's system recorded the transaction does not itself prove that the customer authorised it or acted fraudulently/grossly negligently.

Why this case matters for critical infrastructure

This judgment changes the way banks should think about emergency response.

An incident response cannot stop at:

“The authentication mechanism worked.”

The bank must investigate whether there was a deficiency in the service itself.

The Supreme Court's approach treats “deficiency of service” broadly enough to encompass inadequate diligence or malpractice in the provision of the payment service.

Therefore, after a major cyberattack, a bank should investigate:

• authentication logs;
• IP addresses;
• device fingerprints;
• SIM changes;
• behavioural anomalies;
• geolocation;
• transaction patterns;
• timing;
• unusual beneficiaries;
• multiple simultaneous sessions;
• account takeover indicators;
• alerts generated or not generated;
• whether transactions should have been blocked.

10. Earlier Supreme Court authority — STS 834/2012

Another useful case is Spanish Supreme Court Judgment 834/2012, 25 October 2012.

It dealt with phishing and online banking credentials and recognised the conduct as computer-related fraud under the Spanish Criminal Code framework. The case also dealt with the civil liability associated with persons used to move fraudulent funds (“money mules”).

Legal significance

The case demonstrates the criminal-law dimension of banking cyberattacks:

phishing → acquisition of banking credentials → unauthorised access/transactions → transfer of funds → potential criminal liability

Thus, the same incident may generate:

• regulatory liability;
• contractual/civil liability;
• criminal liability;
• cybersecurity obligations.

11. Recent appellate case: Bankinter — phishing/vishing/smishing

A particularly useful 2026 example is Audiencia Provincial de Barcelona, Judgment 471/2026, 17 June 2026.

The case involved a combined vishing + smishing attack.

The court considered factors including:

• fraudulent SMS;
• telephone impersonation of the bank;
• apparently genuine bank domains;
• unusual transactions;
• foreign IP activity;
• the bank's ability to detect abnormal behaviour;
• the absence of gross negligence by the customer.

The court concluded that the bank's security mechanisms had weaknesses and that the customer's conduct did not amount to gross negligence in the circumstances.

This is particularly relevant to emergency protocols because it illustrates that transaction-monitoring systems themselves can become part of the legal liability analysis.

12. Another example — Unicaja

In Audiencia Provincial, Civil Judgment 1428/2024, involving Unicaja, the court applied the RDL 19/2018 framework to phishing-related transactions.

The court treated the payment provider's responsibility as effectively quasi-objective, subject to the statutory exceptions, including proof of fraud or gross negligence by the customer and proof concerning authentication/service performance.

This reinforces the importance of the bank's burden of proof.

13. Critical distinction: infrastructure emergency vs customer fraud

This distinction is important in an examination.

Scenario A — Major ransomware attack

Suppose a ransomware attack disables:

• online banking;
• ATM infrastructure;
• payment processing;
• internal authentication.

The primary legal problem is:

critical infrastructure + ICT resilience + incident management + business continuity.

DORA and the critical-infrastructure/cybersecurity framework become central.

Scenario B — Customer loses €20,000 through phishing

The central issue becomes:

unauthorised payment + authentication + gross negligence + bank's duty to reimburse.

RDL 19/2018 and Supreme Court Judgment 571/2025 become central.

Scenario C — Cyberattack disables a critical payment system

Now the two regimes overlap.

The bank may simultaneously face:

DORA

↓

ICT incident management

↓

RDL 12/2018 / critical-infrastructure regime

↓

essential-service continuity

↓

RDL 19/2018

↓

customer/payment liability

↓

Criminal Code

↓

criminal investigation

This overlap is one of the most important features of Spanish banking emergency law.

14. Emergency command structure

A sophisticated Spanish banking emergency framework can therefore be represented as:

BOARD / MANAGEMENT BODY
↓
ICT Risk & Operational Resilience Governance
↓
Crisis Management Team
↓
CISO / IT Security
↓
Legal & Compliance
↓
Risk Management
↓
Business Continuity
↓
Fraud/AML
↓
Communications
↓
Law Enforcement / CSIRT / Supervisory Authorities

For a formally designated critical operator, the structure additionally interfaces with:

CNPIC / Ministry of Interior / competent police authorities

and the relevant Operational Support Plan.

15. Emergency powers and proportionality

Spanish critical-infrastructure law does not simply authorise unlimited governmental intervention.

Measures should be connected to:

• the identified risk;
• continuity of essential services;
• proportionality;
• protection of national/public security;
• coordination between authorities;
• confidentiality of sensitive infrastructure information.

The regulatory architecture therefore attempts to reconcile security with operational continuity and confidentiality.

For example, Operator Security Plans and Specific Protection Plans are subject to special confidentiality/classification arrangements.

16. DORA and outsourcing

This is especially important because modern banks rely heavily on:

• cloud providers;
• payment processors;
• telecom providers;
• cybersecurity vendors;
• data-centre operators;
• software providers.

DORA does not permit a financial institution simply to escape responsibility by outsourcing ICT functions.

The institution remains responsible for compliance with ICT-risk-management requirements even where certain compliance functions are outsourced.

Therefore:

Outsourcing operational infrastructure does not outsource regulatory responsibility.

This is a major issue for banking critical infrastructure.

17. Case-law principles you should remember

For an examination or research paper, the jurisprudence can be reduced to the following propositions:

Principle 1 — Authentication ≠ authorisation

The fact that a bank's system successfully authenticates a transaction does not necessarily prove that the customer actually authorised it.

STS 571/2025.

Principle 2 — Bank bears an important evidentiary burden

Where the customer disputes a payment, the provider must establish the relevant authentication, recording and absence of service deficiency and must prove fraud/gross negligence where it relies on that defence.

Principle 3 — Cybersecurity deficiencies can create civil liability

A bank's inadequate security controls, monitoring or fraud-detection mechanisms may become relevant to its liability.

STS 571/2025 and subsequent appellate jurisprudence.

Principle 4 — Phishing is also a criminal-law issue

STS 834/2012 demonstrates the criminal treatment of phishing and computer-related banking fraud.

Principle 5 — Critical-infrastructure protection requires continuity planning

Law 8/2011 and RD 704/2011 require structured security and protection planning, including operational support from public authorities.

18. Exam-style conclusion

Spain employs a multi-layered model of banking emergency law. The financial system is recognised within the country's strategic/essential-services framework, while designated critical operators are subject to the Law 8/2011 and Royal Decree 704/2011 security-planning regime. Cybersecurity obligations are supplemented by Royal Decree-Law 12/2018, while DORA now provides the specialised EU framework for digital operational resilience in financial entities.

The central legal concept is resilience rather than merely prevention: banks must be able to detect, contain, report, recover from and continue essential operations during serious ICT or physical disruptions.

Recent Spanish jurisprudence, particularly STS 571/2025, adds an important customer-protection dimension. A bank cannot establish customer authorisation merely by showing that its authentication mechanism was used. Where an unauthorised transaction is alleged, the bank may have to demonstrate that its systems operated without technical or service deficiencies and that any reliance on customer negligence satisfies the statutory standard of fraud or gross negligence.

Thus, in Spain, banking emergency law sits at the intersection of critical-infrastructure protection, cybersecurity, financial supervision, payment law, civil liability and criminal law.

Key authorities to cite

• Law 8/2011, 28 April — Protection of Critical Infrastructures. 
• Royal Decree 704/2011, 20 May — Regulation of Critical Infrastructure Protection. 
• Royal Decree-Law 12/2018, 7 September — Security of Networks and Information Systems. 
• Royal Decree-Law 19/2018, 23 November — Payment Services and other urgent financial measures.
• Regulation (EU) 2022/2554 (DORA) — Digital Operational Resilience for the Financial Sector. 
• STS 834/2012, 25 October — phishing/computer fraud. 
• STS 571/2025, 9 April — SIM-phishing, unauthorised payments and bank liability, ECLI:ES:TS:2025:1671. 
• Audiencia Provincial de Barcelona 471/2026, 17 June 2026 — vishing/smishing and bank security deficiencies