Banking Law and Hybrid Workplace Compliance in Spain

1. Introduction

Hybrid workplace compliance in Spanish banking refers to the legal framework governing a working model in which bank employees divide their work between the bank's physical premises and remote locations.

For banks, hybrid working creates a special compliance problem because ordinary employment law operates alongside:

• banking confidentiality;
• customer-data protection;
• cybersecurity;
• operational resilience;
• financial-sector professional secrecy;
• working-time rules;
• occupational health and safety;
• collective bargaining;
• digital disconnection;
• employee monitoring;
• information-security requirements.

Spain does not have a separate statute called a "Hybrid Workplace Banking Act." Instead, hybrid banking workplaces are regulated through Spanish employment legislation, the sectoral banking collective agreement, data-protection and digital-rights legislation, EU financial regulation and the bank's internal compliance framework.

As of 2026, the Spanish banking collective agreement expressly regulates remote work and telework, including written individual agreements, reversibility, equipment, expenses and working-time registration.

2. Meaning of Hybrid Workplace in Banking

A hybrid banking workplace can be represented as:

Bank branch / office

↕

Employee

↕

Home / approved remote workplace

↕

Secure banking network

↕

Core banking systems

The employee may work:

• 2–3 days in the office;
• 2–3 days remotely;
• completely remotely for particular positions;
• remotely for certain functions and physically for others.

However, remote work does not mean that banking compliance becomes less strict.

For example, an employee working from home who accesses customer accounts is still subject to the bank's confidentiality, security and data-protection obligations.

3. Principal Legal Framework

The principal sources include:

Law 10/2021 applies to regular distance work and defines telework as distance work carried out exclusively or predominantly through computer, telecommunications or similar systems. Regular distance work generally means at least 30% of working time over a three-month reference period, subject to the statutory rules.

4. Voluntary Nature of Hybrid Work

One of the most important principles is voluntariness.

Law 10/2021 establishes distance work as a voluntary arrangement and requires a written agreement containing the relevant terms.

The banking collective agreement similarly provides that telework is voluntary for both the employee and the employer and should be documented through an individual telework agreement.

Therefore:

A bank generally cannot treat hybrid work as an informal arrangement.

The agreement should identify matters such as:

• percentage of remote work;
• working location;
• working schedule;
• equipment;
• expenses;
• availability;
• reversibility;
• data protection;
• security procedures;
• monitoring arrangements.

5. Banking Sector Collective Agreement

The XXV Collective Agreement for the Banking Sector is particularly important.

It recognises distance work and telework as forms of work organisation resulting from developments in information and communications technology. It also requires compliance with the Workers' Statute and Law 10/2021.

The agreement provides, among other things:

Written agreement

Regular telework should be documented.

Voluntary arrangement

Telework is voluntary for both parties.

Reversibility

The arrangement can generally be reversed under the conditions established by the agreement.

Equipment

Necessary work equipment must be supplied by the employer.

Working-time registration

Banks must maintain a daily working-time registration system.

The collective agreement requires the system to be objective, reliable and accessible.

6. Hybrid Workplace and Working-Time Compliance

A major compliance issue is the possibility that remote employees effectively work longer hours.

For example:

9:00–17:00 official working time

but:

17:00–19:00 emails

19:00–20:00 customer calls

This creates potential working-time and digital-disconnection problems.

The banking collective agreement expressly provides for daily working-time registration and requires the system to remain compatible with work-life reconciliation and telework arrangements.

7. Right to Digital Disconnection

Hybrid banking creates a major risk of employees remaining permanently connected.

Employees may receive:

• emails;
• Teams/Slack messages;
• WhatsApp-type communications;
• customer alerts;
• managerial instructions;
• cybersecurity notifications.

The banking sector's collective agreement expressly recognises the right to digital and labour disconnection and links it to protection of rest periods, holidays, personal and family privacy, and prevention of technological fatigue.

Practical rule

A bank should distinguish between:

urgent operational incident

and

ordinary work communication.

The existence of secure remote access does not automatically mean employees must remain available 24/7.

8. Equal Treatment of Remote and Office Employees

Law 10/2021 provides that remote workers should generally have the same employment rights as comparable office workers.

It protects against disadvantages concerning:

• remuneration;
• employment stability;
• working time;
• training;
• professional promotion.

It also prohibits discrimination against distance workers and requires reasonable adjustments where appropriate.

Banking example

Suppose:

Office employee → leadership training

but:

Remote employee → excluded because "not physically present."

That could create an equality and career-development issue unless there is a legitimate, objective reason for the difference.

9. Equipment and Telework Expenses

Banks must address the costs and equipment associated with remote work.

The banking collective agreement provides for necessary equipment and regulates compensation of expenses.

The financial-credit-establishments collective agreement similarly provides employer equipment and a specified daily expense amount for qualifying telework.

Therefore, a bank should not simply say:

"You are working from home, so all costs are your responsibility."

The applicable statute, collective agreement and individual agreement must be examined.

10. Occupational Health and Safety

Hybrid work does not remove workplace-safety obligations.

Potential risks include:

• poor ergonomics;
• unsuitable desks;
• prolonged screen use;
• musculoskeletal problems;
• excessive working hours;
• technological stress;
• isolation.

The banking financial-credit-establishments agreement expressly provides for risk assessment of remote workers and mechanisms involving employees and prevention services.

11. Data Protection in Hybrid Banking

This is particularly important because bank employees routinely access confidential customer information.

A remote employee may have access to:

• bank-account information;
• identity documents;
• income information;
• credit records;
• transaction histories;
• investment information;
• customer communications.

Therefore, hybrid work should involve controls such as:

Access control

Employees should only access information necessary for their role.

Multi-factor authentication

Remote access should be strongly authenticated.

Encryption

Sensitive communications and devices should be appropriately protected.

Device management

Bank-owned computers should be centrally managed.

Screen privacy

Employees should prevent third parties from viewing customer information.

Secure networks

Remote access should use approved secure systems.

12. Employee Monitoring

Hybrid workplaces often require technological monitoring.

A bank may want to monitor:

• login times;
• access to customer accounts;
• security events;
• unusual downloads;
• system activity;
• remote-access sessions.

But monitoring must be legally proportionate.

The employer cannot automatically treat every technical activity as permission to conduct unlimited surveillance of employees.

The applicable employment, privacy and data-protection rules must be considered.

13. Banking Confidentiality

Hybrid working creates an additional professional-secrecy problem.

Imagine a bank employee works from home in a shared apartment.

A customer calls.

The employee discusses:

account balance + loan information + transaction history.

Another person in the room can hear the conversation.

That can create confidentiality and data-protection risks.

Therefore, banks should establish:

• private working-space requirements;
• headphone requirements;
• clean-desk policies;
• screen-lock requirements;
• document-destruction procedures;
• restrictions on printing;
• prohibition on storing customer information on personal devices.

14. Cybersecurity and DORA

For financial institutions, hybrid working is also an ICT-risk issue.

DORA strengthens the EU framework for digital operational resilience of financial entities and applies from 17 January 2025.

A hybrid banking workforce increases the number of:

• remote connections;
• endpoints;
• authentication events;
• home networks;
• cloud interactions;
• potential attack surfaces.

Therefore, a bank should incorporate hybrid-work arrangements into its operational-resilience framework.

Example

Employee's laptop

↓

home Wi-Fi

↓

VPN / secure connection

↓

bank infrastructure

↓

customer database

A weakness anywhere in this chain can create an operational or security incident.

15. Business Continuity

Hybrid work can also support business continuity.

For example:

Flood / fire / transport disruption / public emergency

↓

office unavailable

↓

employees work remotely

↓

banking operations continue.

But business continuity does not mean that every employee can automatically work from anywhere.

Banks need:

• approved remote locations;
• secure authentication;
• contingency equipment;
• backup communication;
• incident-management procedures;
• recovery plans.

16. Hybrid Workplace and Collective Bargaining

Collective bargaining is particularly important in banking.

The banking collective agreement provides that modifications concerning its telework framework require collective agreement under the conditions specified in the agreement.

This means hybrid-work policy is not necessarily a matter that management can change unilaterally without considering applicable collective rights.

17. Case Law

There is not yet a large body of Spanish banking case law specifically dealing with "hybrid workplace compliance" as a single legal category.

Instead, Spanish courts have developed relevant principles through telework, working-time, employee-rights and banking employment disputes.

The following cases are particularly useful.

Case 1 – Tribunal Supremo, STS 164/2025 – Endesa Telework

4 March 2025

ECLI:ES:TS:2025:1043

This is one of the most important recent Spanish telework decisions.

The dispute concerned clauses in Endesa's individual telework agreement.

The Supreme Court upheld the invalidity of provisions concerning:

• inability to replace, move or accumulate certain telework days when an employee was required to attend the workplace;
• the treatment of telework expenses as already compensated by savings.

The case involved more than 4,700 employees covered by the arrangement.

Principle

An employer's telework agreement cannot simply contract around statutory protections concerning telework expenses and organisation.

Banking relevance

A bank's hybrid-work agreement should be checked against Law 10/2021 and the applicable banking collective agreement.

Case 2 – Tribunal Supremo, STS 1548/2024

27 February 2024

The case concerned employees who began teleworking during the COVID-19 emergency after an employer offered an additional €1 per teleworked hour.

The Supreme Court concluded that the temporary offer did not constitute a permanent acquired employment condition because it arose from exceptional pandemic circumstances and lacked the necessary permanent character.

Principle

An extraordinary telework arrangement created during an emergency does not necessarily become a permanent employment entitlement.

Banking relevance

A bank that introduces temporary hybrid-work allowances during an emergency should clearly identify:

• duration;
• legal basis;
• conditions;
• termination;
• whether the benefit is permanent.

Case 3 – Tribunal Supremo, telework and supply interruptions

The Spanish Supreme Court considered a dispute involving teleworkers and interruptions to electricity or network services.

The case addressed whether teleworkers should bear consequences for interruptions that would not impose equivalent disadvantages on office workers.

The judicial material reports the principle that teleworkers should not receive worse treatment merely because they work remotely; the analysis included issues such as interruptions and recording of certain pauses.

Banking relevance

Suppose a remote bank employee loses internet connectivity because of a technical problem.

The bank's policy should not automatically assume:

"No connection = employee's fault."

Responsibility depends upon the circumstances and applicable rules.

Case 4 – Tribunal Supremo, Tecnilógica Ecosistemas S.A.U.

24 September 2025

The Supreme Court rejected a collective claim seeking ergonomic chairs for all teleworkers.

The Court distinguished a general ergonomic risk from a specific risk assessment demonstrating that a particular preventive measure was required for every remote worker.

Principle

Remote-work health and safety measures should be based on an appropriate assessment of the actual risk rather than an automatic assumption that every worker must receive every possible piece of equipment.

Banking relevance

Banks should conduct proper remote-work risk assessments rather than relying solely on generic hybrid-work policies.

Case 5 – Caixabank, STS 1163/2025

2 December 2025

This case concerned a Caixabank collective dispute involving a paid leave arrangement for employees caring for a child with a disability.

The Supreme Court examined differences between employees working in branches with general schedules and those working under special schedules, including whether the difference constituted indirect sex discrimination or discrimination by association.

Principle

Different working-time arrangements in banking must be examined carefully against equality and non-discrimination requirements.

Hybrid-work relevance

A hybrid system must not unintentionally create:

• unequal family benefits;
• unequal access to leave;
• unequal career opportunities;
• discriminatory scheduling.

Case 6 – Caixabank, STS 442/2026

22 April 2026

The Supreme Court considered a Caixabank collective incentive system relating to the sale of third-party insurance and alarm products.

The Court upheld the system, finding that the incentive structure was known in advance and was not established to be uncertain, unattainable, unreasonable, arbitrary or disproportionate.

Hybrid-work relevance

Banks frequently use digital platforms to monitor sales and performance.

An employee working remotely may be assessed through:

• digital sales;
• customer contacts;
• online applications;
• product conversions.

The incentive structure must remain sufficiently clear and objectively administered.

Case 7 – Caixabank, STS 165/2026

17 February 2026

The Supreme Court examined two clauses in a Caixabank incentive plan.

The Court declared them invalid where one functioned as a disguised sanction and another left achievement of objectives excessively dependent on the employer's decision.

Principle

Employer discretion in performance-management systems has legal limits.

Hybrid banking relevance

A remote employee should not be subjected to an opaque algorithmic performance system where:

algorithm → target → bonus reduction

without adequate legal and contractual safeguards.

This is particularly relevant as banks increasingly use automated performance analytics.

Case 8 – STS 6135/2024

11 December 2024

The Supreme Court considered a dispute involving modification of working conditions and collective rights. The official consolidated Law 10/2021 materials identify this decision among relevant jurisprudence concerning the remote-work legislation.

Principle

Changes to working conditions may have a collective dimension and cannot always be treated as purely individual managerial decisions.

Banking relevance

A bank introducing a major change to its hybrid-work model should assess:

• collective bargaining obligations;
• employee-representation rights;
• contractual rights;
• whether the change constitutes a substantial modification.

18. Special Compliance Issues for Banks

Hybrid workplace compliance in banking can therefore be divided into eight areas.

1. Employment compliance

• written agreements;
• working time;
• remuneration;
• leave;
• equality.

2. Telework compliance

• voluntariness;
• reversibility;
• remote-work percentage;
• approved workplace.

3. Cybersecurity

• MFA;
• VPN;
• encryption;
• endpoint security;
• incident reporting.

4. Banking confidentiality

• customer information;
• account information;
• transaction data;
• internal banking information.

5. Data protection

• GDPR;
• employee monitoring;
• customer-data access;
• retention.

6. Occupational safety

• ergonomic risks;
• working environment;
• psychosocial risks;
• working-time fatigue.

7. Digital rights

• digital disconnection;
• privacy;
• employee communications.

8. Financial-sector resilience

• DORA;
• ICT risk;
• third-party providers;
• business continuity.

19. Example of a Compliant Hybrid Banking Model

A Spanish bank could establish:

Monday–Tuesday

→ Office

Wednesday–Friday

→ Approved remote workplace

The employee receives:

• bank laptop;
• secure authentication;
• VPN;
• MFA;
• encrypted communications;
• approved collaboration software.

The bank maintains:

• daily working-time registration;
• digital-disconnection policy;
• data-protection policy;
• cybersecurity monitoring;
• risk assessment;
• incident-response plan.

The employee:

• does not use personal devices for customer data;
• does not print confidential customer documents at home;
• locks the screen when away;
• works only through approved systems;
• reports security incidents immediately.

This combines employment compliance + banking compliance + cybersecurity + data protection.

20. Compliance Matrix

21. Important Legal Principle

The Spanish approach can be summarised as:

Hybrid work is an employment arrangement, but hybrid banking is also a financial-sector risk-management issue.

A normal company may mainly worry about employment law.

A bank must additionally worry about:

Employee → Device → Network → Bank System → Customer Data → Financial Transaction

Every link must be legally and technically controlled.

22. Conclusion

Hybrid workplace compliance in Spanish banking is governed by a combination of employment law, Law 10/2021 on remote work, the banking collective agreement, data-protection law, digital rights, occupational safety rules and financial-sector ICT-resilience requirements.

The banking collective agreement is particularly significant because it expressly regulates telework, written agreements, voluntariness, reversibility, equipment and working-time registration.

The case law demonstrates several important principles:

1. Telework agreements cannot override mandatory statutory protections — STS 164/2025. 
2. Temporary emergency telework benefits do not necessarily become permanent rights — STS 1548/2024. 
3. Remote employees should not automatically suffer disadvantages because of their remote status — Supreme Court telework jurisprudence. 
4. Health-and-safety measures should correspond to properly assessed risks — Tecnilógica Ecosistemas, 2025. 
5. Banking work-schedule arrangements must respect equality principles — Caixabank, STS 1163/2025. 
6. Bank performance and incentive systems must have legally acceptable, sufficiently defined criteria — Caixabank, STS 442/2026 and STS 165/2026. 
7. Major changes to working conditions can engage collective-rights protections — STS 6135/2024. 

Thus, the central compliance model for a Spanish hybrid bank is:

Labour Law + Telework Law + Banking Collective Agreement + Data Protection + Cybersecurity + DORA + Occupational Safety + Collective Rights.

These rules together create the legal framework within which Spanish banks can organise hybrid workplaces while protecting employees, customers, confidential banking information and the continuity of financial services.