Banking Law and Innovation Society Finance — Spain

1. Introduction

Banking Law and Innovation Society Finance in Spain concerns the legal framework through which banks and other regulated financial institutions finance an increasingly digital, technology-driven and innovation-based society.

“Innovation society finance” is not a separate formal category of Spanish banking law. It is better understood as the intersection of banking regulation with:

fintech;

digital banking;

innovative payment services;

financing of start-ups and technology businesses;

crowdfunding and alternative finance;

artificial intelligence and automated financial services;

financial inclusion;

regulatory technology (RegTech);

open banking;

digital identification;

data-driven lending;

sustainable innovation;

cybersecurity; and

financial regulatory sandboxes.

Spain's framework combines national legislation with European Union banking and financial-services law. An especially important Spanish statute is Law 7/2020 of 13 November on the Digital Transformation of the Financial System, which created a controlled testing environment—the Spanish financial regulatory sandbox—for technology-based financial innovation.

2. Meaning of Innovation Society Finance

An innovation society is an economy in which technology, research, entrepreneurship and digital infrastructure increasingly influence how individuals and businesses operate.

Financial institutions play an important role because innovative businesses require:

Capital + Payment infrastructure + Credit + Investment + Risk management + Financial technology.

Traditional banking models usually involve customers dealing directly with banks for deposits, loans and payments.

An innovation-oriented financial system can additionally involve:

mobile banking applications;

digital-only financial services;

automated lending;

cloud infrastructure;

electronic identification;

APIs;

digital payment systems;

machine-learning risk models;

fintech partnerships; and

online investment platforms.

Banking law therefore has to accommodate innovation without abandoning financial stability and customer protection.

3. Basic Spanish Banking Framework

The starting point remains Law 10/2014 of 26 June on the Regulation, Supervision and Solvency of Credit Institutions.

Under Article 1, credit institutions include authorized businesses whose activities consist of receiving deposits or other repayable funds from the public and granting credit for their own account. Banks, savings banks, credit cooperatives and the Instituto de Crédito Oficial fall within the statutory framework.

Article 2 expressly recognizes that Spanish credit institutions are governed not only by Law 10/2014 but also by relevant Spanish and European Union banking rules.

This is important for financial innovation because technology does not automatically remove an activity from banking regulation.

A company cannot avoid rules governing a regulated financial activity merely by performing that activity through an app, algorithm or other technological platform.

4. Reserved Banking Activities

Article 3 of Law 10/2014 reserves the taking of repayable funds from the public to appropriately authorized and registered credit institutions.

This establishes an important boundary between:

technological innovation

and

regulated banking activity.

A technology company can create innovative software for financial institutions without necessarily becoming a bank.

However, if its business model enters an activity legally reserved to authorized institutions, regulatory authorization requirements can arise.

The legal question is therefore based on the substance of the activity, rather than simply whether the provider calls itself a fintech company.

5. Spain's Financial Regulatory Sandbox

One of Spain's most important legal developments for financial innovation is Law 7/2020.

The legislation recognizes that technological change is transforming:

financial products;

business models;

relationships with customers;

financial-market structures;

regulatory compliance; and

supervision.

Its central mechanism is the controlled testing environment, commonly called a regulatory sandbox.

The sandbox allows sufficiently developed innovative projects to undergo controlled testing under regulatory supervision.

6. Purpose of the Sandbox

The sandbox seeks to balance two objectives.

First: Promote innovation

Innovative businesses should have an opportunity to test potentially useful financial technologies without unnecessary regulatory uncertainty.

Second: Protect society

Innovation must not undermine:

financial stability;

customer protection;

market integrity;

security; or

applicable safeguards against financial crime.

Law 7/2020 expressly emphasizes that financial innovation should be safe and should benefit society as a whole. It also links digital transformation with financial inclusion, territorial cohesion and equality of opportunity.

This makes the statute particularly relevant to the concept of innovation society finance.

7. Projects Eligible for the Sandbox

Under Article 5 of Law 7/2020, projects can enter the controlled testing environment when they involve technology-based financial innovation and are sufficiently advanced for testing.

They must also potentially provide added value in areas such as:

improving regulatory compliance;

benefiting financial-services users;

reducing costs;

improving quality or accessibility;

increasing customer protection;

improving institutional or market efficiency; or

improving regulation or financial supervision.

This allows innovation to be evaluated on practical financial and social benefits rather than novelty alone.

8. Sandbox Does Not Equal Banking Authorization

A particularly important distinction is that acceptance into the sandbox does not itself constitute authorization to operate permanently as a bank or financial-services provider.

Article 4 of Law 7/2020 makes this distinction explicit. Sandbox projects operate within the limits of the controlled test and applicable protocol.

Therefore:

Sandbox approval ≠ Permanent banking licence.

Once testing is completed, the promoter may still need the relevant authorization before offering a regulated service commercially.

This protects competition because an innovative company does not automatically receive an unrestricted regulatory advantage over already licensed institutions.

9. Financing Innovative Companies

Banks contribute to an innovation society not merely through fintech products but also by financing innovative businesses.

Financing can include:

corporate loans;

working-capital facilities;

project finance;

venture debt;

guarantees;

asset finance;

technology infrastructure finance; and

sustainability-linked facilities.

However, innovative businesses often create special credit-risk problems.

A conventional company might have buildings, machinery and predictable cash flow.

A technology start-up may instead possess primarily:

software + intellectual property + data + human capital + future revenue expectations.

Banks therefore need different risk-assessment techniques while remaining subject to prudential rules.

10. Digital Lending and Automated Credit Decisions

Innovation has increasingly changed credit assessment.

Traditional lending relies heavily on:

income;

collateral;

financial statements;

credit history; and

manual underwriting.

Digital systems can additionally use automated processing and sophisticated risk models.

This can improve efficiency but creates legal concerns relating to:

transparency;

reliability;

discrimination;

consumer protection;

privacy;

data accuracy;

cybersecurity; and

governance of algorithms.

A bank remains responsible for compliance even when technology performs part of the decision-making process.

11. Open Banking

Open banking represents another important feature of innovation society finance.

Under the European payment-services framework, regulated third-party providers can, under the relevant conditions and customer authorization, provide services involving payment accounts.

This can facilitate:

account-information services;

payment initiation;

personal finance applications;

financial comparison services; and

integrated digital banking.

The objective is to permit innovation and competition without treating customer banking information as unrestricted public information.

Security and customer authorization therefore remain central.

12. Data as a Financial Resource

Modern finance increasingly depends upon data.

Banks use information for:

customer identification;

fraud detection;

credit scoring;

risk management;

regulatory reporting;

personalization;

payment authentication; and

financial forecasting.

Spanish banks must therefore reconcile innovation with European data-protection requirements, particularly the GDPR and Spanish implementing legislation.

An innovation cannot be treated as legally acceptable simply because it is technologically efficient.

Data processing still requires an appropriate legal basis and compliance with applicable principles concerning purpose, proportionality, security and individual rights.

13. Artificial Intelligence

Artificial intelligence creates opportunities for:

fraud detection;

transaction monitoring;

customer support;

credit-risk analysis;

regulatory compliance;

cybersecurity; and

operational automation.

But it also creates risks.

For example, an AI-based lending model might produce efficient predictions while remaining difficult to explain.

Banks consequently need governance systems dealing with:

model design → data quality → validation → human oversight → monitoring → accountability.

EU legislation on artificial intelligence increasingly forms part of this wider regulatory environment.

14. Cybersecurity and Operational Resilience

A digital financial system creates new operational dependencies.

Banks can become dependent upon:

cloud infrastructure;

telecommunications networks;

software providers;

data centres;

APIs; and

outsourced technology providers.

Accordingly, innovation society finance must include operational resilience.

The EU Digital Operational Resilience Act (DORA) provides an important harmonized framework for ICT risk in the financial sector.

For Spanish banks, digital innovation must therefore be accompanied by appropriate controls relating to cyber risk, incident management, testing and third-party technology dependencies.

15. Consumer Protection

Innovation cannot lawfully be based simply on transferring technological risks to customers.

Banks and fintech providers must consider requirements relating to:

adequate information;

transparent contractual terms;

fair commercial practices;

payment security;

complaint procedures;

responsible lending; and

protection against unauthorized transactions.

Law 7/2020 expressly identifies customer protection as one of the interests that financial innovation must preserve.

This creates an important policy balance:

Innovation should improve financial services without reducing existing legal safeguards.

16. Financial Inclusion

Technology can potentially improve access to financial services.

Digital banking may help customers who live far from traditional branches and may reduce transaction costs.

Law 7/2020 specifically recognizes the relevance of digital transformation to financial inclusion, demographic challenges and territorial cohesion.

However, complete reliance on digital channels can also create difficulties for customers who have limited digital skills or access.

Innovation society finance therefore involves both:

digital expansion

and

inclusive access.

17. Competition Between Banks and Fintech Firms

Financial innovation has changed traditional market boundaries.

Banks increasingly compete or cooperate with:

payment institutions;

electronic-money institutions;

fintech companies;

technology platforms;

crowdfunding providers; and

specialized financial-service companies.

Spanish and EU law generally distinguish businesses according to the regulated activities they actually perform.

This creates the principle:

Same technology does not necessarily mean same regulation, but the same regulated activity cannot normally escape regulation merely because technology is used.

18. Supervisory Structure

Innovation projects may involve several Spanish financial authorities depending upon their subject matter.

These can include:

Banco de España for banking and certain payment matters;

CNMV for securities and investment-market matters; and

Dirección General de Seguros y Fondos de Pensiones for insurance-related activities.

Law 7/2020 expressly preserves the existing distribution of supervisory competence while requiring cooperation in the new digital environment.

This is important because innovative products sometimes combine characteristics previously associated with separate financial sectors.

Relevant Case Law

Spanish innovation-finance law is relatively recent, particularly the 2020 sandbox legislation. Consequently, there is not yet a large body of Spanish Supreme Court decisions specifically labelled “Innovation Society Finance.”

The most relevant case law comes from broader Spanish and EU banking, digital-payment, consumer and financial-services principles.

Case 1 — CJEU, CaixaBank France, Case C-442/02

Although the proceedings concerned the activities of a Spanish banking group in France, the judgment became important for the EU internal market in banking.

The dispute concerned restrictions affecting the ability of credit institutions to remunerate certain accounts.

Principle

National financial regulation can be examined against EU freedom-of-establishment requirements when it materially restricts how institutions from another Member State compete.

Innovation significance

Financial innovation frequently depends upon institutions being able to introduce new products and business models across the EU.

The case demonstrates that national banking regulation operates within EU internal-market law.

Case 2 — CJEU, Asociación Profesional Elite Taxi v Uber Systems Spain, Case C-434/15

This was not a banking case, but it is highly relevant to the legal classification of technology-based business models in Spain.

Principle

The Court looked beyond the company's description of itself as an information-society service and examined the actual nature of the integrated service being provided.

Banking significance

The same analytical principle is important to fintech.

A business cannot necessarily avoid sector-specific financial regulation merely by describing itself as:

a technology platform;

software company;

marketplace; or

information intermediary.

Regulators and courts can examine what the service actually does.

Case 3 — CJEU, Asociación Española de Banca, Case C-217/08

This case arose from Spain and concerned banking information and the relationship between financial institutions and public authorities.

Principle

The judgment demonstrates that banking activities can involve overlapping obligations derived from national law and EU law.

Innovation significance

Digital financial services depend extensively on information processing.

Innovation therefore does not eliminate legal restrictions governing the collection, processing, transfer and regulatory use of banking information.

Case 4 — CJEU, Banco Español de Crédito SA v Joaquín Calderón Camino, Case C-618/10

This important Spanish reference concerned consumer credit and unfair contractual terms.

Principle

The Court emphasized the effectiveness of EU consumer-protection law in financial contracts and the judicial protection available against unfair terms.

Innovation significance

The principle remains relevant when a credit contract moves from a bank branch to a smartphone.

Digital execution does not eliminate consumer-protection requirements.

A fintech lender or digital bank cannot assume that technological convenience permits weaker contractual safeguards.

Case 5 — CJEU, Aziz v Caixa d'Estalvis de Catalunya, Tarragona i Manresa, Case C-415/11

This major Spanish banking case concerned mortgage enforcement and EU consumer law.

Principle

The Court held that national procedural arrangements must provide effective protection against unfair contractual terms as required by EU law.

Innovation significance

The judgment establishes a wider principle relevant to innovative finance:

Efficiency cannot override effective consumer protection.

Automated contracting, digital lending and technologically accelerated enforcement processes must still operate within applicable consumer-law safeguards.

Case 6 — CJEU, Banco Primus SA v Jesús Gutiérrez García, Case C-421/14

This Spanish banking litigation concerned unfair terms in mortgage lending.

Principle

The Court further developed judicial scrutiny of banking contractual provisions under EU consumer law.

Innovation significance

Financial-product innovation does not exempt a product from substantive fairness requirements.

Whether a credit product is delivered through:

a branch;

website;

mobile application; or

automated platform,

the underlying contractual relationship remains subject to applicable consumer-protection law.

Case 7 — CJEU, Gutiérrez Naranjo and Others, Joined Cases C-154/15, C-307/15 and C-308/15

These Spanish cases concerned mortgage interest-rate floor clauses.

Principle

The Court addressed the consequences of finding consumer contractual terms unfair and emphasized the effectiveness of EU consumer-protection remedies.

Innovation significance

The case illustrates that large-scale standardized financial products can create equally large-scale legal consequences when contractual design fails to comply with consumer law.

This lesson is especially important for fintech platforms capable of issuing standardized digital contracts to thousands of users rapidly.

Case 8 — Banco Santander / Banco Popular Resolution Litigation

The resolution of Banco Popular and subsequent litigation involving Banco Santander has generated significant Spanish and EU judicial proceedings concerning bank resolution, investor claims and the interaction between Spanish litigation and EU resolution rules.

For example, a preliminary reference from the Spanish Supreme Court in Case C-687/23, Banco Santander asked the CJEU to interpret provisions of Directive 2014/59/EU concerning claims connected with financial instruments affected by bank resolution.

Innovation significance

The broader lesson is that innovation operates inside the prudential and resolution framework.

Technology can change how financial services are delivered, but it does not eliminate:

capital requirements;

supervisory authority;

resolution mechanisms;

creditor hierarchy; or

financial-stability requirements.

19. Common Principles Emerging From the Cases

The cases provide several principles relevant to innovation society finance.

Principle 1 — Technology does not determine legal classification

Courts examine what a service actually does.

Principle 2 — Innovation does not eliminate banking authorization

Activities reserved to regulated institutions remain regulated even when performed digitally.

Principle 3 — Consumer protection remains applicable

Digital contracts remain contracts.

Principle 4 — EU law strongly influences Spanish banking law

Spanish innovation finance operates within the EU single financial market.

Principle 5 — Data use is legally regulated

The economic value of information does not eliminate privacy, confidentiality and security requirements.

Principle 6 — Financial stability remains fundamental

Innovation cannot override prudential supervision and resolution rules.

20. Practical Example

Suppose a Spanish technology company develops an AI platform capable of analysing business information and automatically arranging small-business financing.

The project potentially offers:

faster credit decisions;

lower administrative costs;

improved access to finance;

automated compliance checks; and

personalized lending.

The legal analysis would proceed through several stages.

Stage 1 — Determine the activity

Is the company merely supplying technology to banks, or is it itself providing regulated financial services?

Stage 2 — Determine authorization requirements

If it carries out a reserved activity, the appropriate banking or financial authorization regime must be considered.

Stage 3 — Sandbox eligibility

If the project represents sufficiently advanced technology-based financial innovation, it could potentially qualify for testing under Law 7/2020, subject to statutory requirements.

Stage 4 — Customer protection

The digital nature of the platform does not remove consumer and contractual safeguards.

Stage 5 — Data and AI governance

The company must consider applicable rules governing personal data, automated systems and cybersecurity.

Stage 6 — Commercial deployment

Successful sandbox testing does not itself constitute authorization for unrestricted commercial operation.

This example demonstrates the central philosophy of Spanish innovation finance:

Experimentation is encouraged, but regulated financial activities remain subject to law.

21. Innovation and Financial Stability

There can be tension between innovation and stability.

Innovation encourages:

speed + experimentation + new entrants + new technologies.

Banking regulation traditionally emphasizes:

capital + governance + security + predictability + risk control.

Spanish law attempts to reconcile these objectives rather than choosing one over the other.

Law 7/2020 is particularly significant because its controlled testing framework allows regulators to observe innovative technologies before they are deployed more broadly.

22. Innovation and Social Benefit

The Spanish framework does not treat innovation as valuable merely because a technology is new.

Law 7/2020 allows sandbox projects to demonstrate added value through matters such as:

lower costs;

improved service quality;

better accessibility;

stronger customer protection;

improved regulatory compliance;

increased efficiency; and

better supervision.

This creates an important connection between banking innovation and wider society.

Financial technology should ideally contribute to productive economic activity and access to financial services rather than technological novelty alone.

23. Main Legal Risks

Innovation society finance in Spain creates several interconnected risks.

Authorization risk: carrying out regulated activities without the necessary authorization.

Consumer risk: unfair or insufficiently transparent digital financial products.

Data risk: unlawful or insecure processing of financial information.

Algorithmic risk: unreliable or inadequately governed automated decisions.

Cyber risk: attacks, service interruption and compromised information.

Outsourcing risk: excessive dependency on external technology providers.

Prudential risk: innovation increasing credit, liquidity or operational risks.

Competition risk: technology platforms or financial institutions restricting market access.

Financial-exclusion risk: digitalization making essential services difficult to access for certain customers.

The regulatory framework seeks to promote innovation while controlling these risks.

24. Relationship Between Banks, Fintechs and Society

The modern Spanish financial ecosystem can be represented as:

Customers ↔ Banks ↔ Fintechs ↔ Technology providers ↔ Financial markets

with oversight from:

Banco de España + CNMV + other competent Spanish authorities + EU institutions.

This interconnected structure explains why innovation society finance cannot be regulated exclusively through traditional banking statutes.

Banking law now interacts increasingly with:

technology law;

consumer law;

data protection;

cybersecurity;

competition law;

payment regulation;

AI regulation; and

EU financial legislation.

Conclusion

Banking Law and Innovation Society Finance in Spain describes the legal framework through which financial innovation is encouraged while maintaining banking stability, consumer protection and regulatory supervision.

The two central Spanish legislative pillars are:

Law 10/2014, which provides the fundamental regulatory and supervisory framework for Spanish credit institutions; and

Law 7/2020, which establishes Spain's controlled environment for testing technology-based financial innovation.

The relevant case law—including CaixaBank France (C-442/02), Elite Taxi (C-434/15), Asociación Española de Banca (C-217/08), Banco Español de Crédito (C-618/10), Aziz (C-415/11), Banco Primus (C-421/14), Gutiérrez Naranjo (Joined Cases C-154/15, C-307/15 and C-308/15) and the Banco Popular/Banco Santander resolution litigation—illustrates the wider principles governing innovative financial services.

The central legal formula is:

Innovation + Authorization + Consumer Protection + Data Governance + Cybersecurity + Prudential Supervision + EU Law + Financial Inclusion.

Spain's approach therefore does not treat innovation and regulation as opposites. The objective is to permit useful technological experimentation and new financing models while ensuring that digital transformation does not undermine the protections on which the banking system and its customers depend.