Banking Law and Multinational Fintech Intellectual Property in Spain

1. Introduction

“Multinational fintech intellectual property” refers to the intellectual-property rights associated with technology businesses operating across borders in financial services. A fintech may develop payment software, banking applications, artificial-intelligence systems, authentication technology, APIs, blockchain infrastructure, financial algorithms, databases, user interfaces, or proprietary business processes.

In Spain, these assets are protected through several different legal regimes rather than one single “fintech IP law.”

The principal areas are:

copyright in software and digital content;

patents for qualifying technological inventions;

trademarks and branding;

trade secrets;

database rights;

contractual protection of technology;

EU intellectual-property rules; and

international rules applicable to cross-border exploitation.

This becomes particularly important when a multinational fintech works with Spanish banks, establishes a Spanish subsidiary, licenses technology to a bank, acquires a Spanish technology company, or processes its IP across several jurisdictions.

2. Spanish Legal Framework

The principal Spanish framework includes the Intellectual Property Law (TRLPI), Patent Law 24/2015, Trademark Law 17/2001, and Trade Secrets Law 1/2019.

Software is specifically included within the categories of works capable of copyright protection under Spanish intellectual-property legislation. A recent Spanish Supreme Court judgment concerning the BOSCO algorithm likewise recognised that computer applications fall within the protected category of computer programs under the TRLPI.

For inventions, Patent Law 24/2015 establishes patents and utility models as industrial-property rights and identifies the Spanish Patent Register and Spanish Patent and Trademark Office framework. It also excludes computer programs “as such” from patentability, meaning that the legal analysis differs where software forms part of a qualifying technical invention.

Trade Secrets Law 1/2019 protects technological, scientific, industrial, commercial, organisational and financial information when it is secret, has commercial value because it is secret, and has been subject to reasonable measures to maintain secrecy.

3. Why IP Is Particularly Important for Fintech

A fintech business can have several separate IP assets in one product.

For example, a digital banking platform may contain:

Source code
→ copyright

Technical invention
→ potentially patent protection

Brand name and logo
→ trademark protection

Proprietary fraud-detection model
→ potentially trade secret protection

Original database structure/content
→ copyright and/or database protection

User-interface elements
→ potentially copyright, design or trademark protection depending on the feature

Documentation and manuals
→ copyright

Therefore, a multinational fintech should not treat “the software” as one single legal asset.

4. Copyright Protection for Fintech Software

Copyright is usually one of the most important protections for fintech software.

The protected subject matter can include the program's expressive elements, including source code and object code where the statutory requirements are satisfied.

Examples include:

payment-processing software;

banking applications;

API implementations;

authentication software;

risk-management systems;

accounting platforms;

financial-data interfaces; and

other original software.

However, copyright does not give the developer a monopoly over every underlying idea or business function.

This distinction is critical in fintech.

For example:

“A system that calculates credit risk”

is an idea or function.

The particular original source code implementing that system can potentially be protected.

5. Patent Protection

Fintech businesses sometimes seek patent protection for technical inventions.

Spanish Patent Law 24/2015 excludes certain subject matter—including computer programs as such—from patentability. However, the exclusion does not mean that every technology involving software is automatically unpatentable.

The relevant question is whether the claimed invention falls within patentable subject matter and satisfies the applicable requirements.

In practice, multinational fintech businesses therefore need to distinguish:

software as software

from

a technical invention implemented using software.

This distinction is also influenced by European patent law.

6. Trade Secrets

Trade-secret protection can be especially important for fintech.

A company may deliberately avoid publicly disclosing:

fraud-detection methodologies;

proprietary risk models;

source-code architecture;

customer-acquisition algorithms;

internal pricing models;

cybersecurity techniques;

authentication architecture;

proprietary datasets;

technical documentation; and

business strategies.

Spanish Law 1/2019 expressly recognises technological and financial information as potential trade secrets when the statutory conditions are satisfied.

The most important requirement is that secrecy must actually be maintained.

A fintech cannot simply label everything “confidential” and assume that it automatically becomes a trade secret.

Reasonable protective measures are required.

7. Confidentiality and Employee Agreements

Multinational fintech businesses commonly employ developers, engineers, consultants and contractors in multiple countries.

This creates an ownership question:

Who owns the software created by the developer?

Spanish law contains specific rules concerning employee-created intellectual property, while contracts should clearly identify:

assignment of rights;

permitted uses;

confidentiality;

development responsibilities;

source-code ownership;

third-party components; and

post-employment obligations.

For multinational operations, this becomes more complicated because different jurisdictions can have different default rules.

8. Open-Source Software

Fintech businesses frequently incorporate open-source components.

Open-source licensing does not mean:

“There are no legal obligations.”

Instead, the relevant licence determines permitted uses and obligations.

A multinational fintech should maintain a software bill of materials and identify:

licence type;

attribution requirements;

redistribution requirements;

modification obligations;

source-code obligations where applicable; and

compatibility with the fintech's proprietary software.

This is particularly important when the software is licensed to a regulated bank.

9. Fintech APIs

APIs are central to modern financial technology.

A fintech may provide an API that enables a bank to access:

payment services;

account information;

identity verification;

fraud detection;

financial data;

lending functionality; or

other services.

The API itself may involve protectable software, documentation and branding.

But the function performed by an API should not automatically be confused with copyright protection over its underlying implementation.

The distinction between functionality and protected expression is particularly important under EU software copyright law.

10. Database Protection

Fintech companies often maintain large financial databases.

Potentially relevant rights include:

copyright in original database structure;

the sui generis database right where statutory requirements are satisfied; and

trade-secret protection for confidential database information.

However, ownership of the database does not automatically mean that every individual piece of information contained within it is proprietary.

The legal status must be assessed according to the relevant right and the nature of the information.

11. Trademarks

A multinational fintech's brand can be one of its most valuable assets.

Examples include:

company name;

app name;

product name;

logo;

distinctive service branding.

Spain operates within both national and EU trademark systems.

A fintech entering Spain should therefore examine whether its existing international brand is already protected in the relevant classes and territories.

This is particularly important where a bank distributes the fintech's product under a co-branding arrangement.

12. Fintech and Banking Partnerships

A common arrangement is:

Spanish bank

foreign fintech

technology licence

financial service

This creates several IP questions.

Who owns the software?

Who owns modifications?

Who owns customer-facing materials?

Who owns data-generated improvements?

Can the bank continue using the platform after termination?

Can the fintech use technology developed during the partnership with another bank?

Can either party sublicense the technology?

These questions should be addressed contractually rather than left to implication.

13. Multinational Licensing

Suppose a US fintech licenses software to a Spanish bank and also operates in France, Germany and Italy.

The parties should identify:

territorial scope;

duration;

permitted users;

sublicensing;

modification rights;

source-code access;

maintenance;

upgrades;

ownership of derivative works;

confidentiality;

infringement responsibility; and

governing law.

A licence that says merely “worldwide use” may still leave substantial questions unanswered.

14. Data Versus Intellectual Property

An important distinction exists between data protection and IP protection.

A fintech may possess:

Customer personal data

and

proprietary software

and

confidential business information

at the same time.

These assets are governed by different legal regimes.

For example:

Personal data → GDPR/data-protection rules.

Source code → copyright/trade-secret rules.

Brand → trademark law.

Technical invention → patent law where requirements are satisfied.

Therefore, intellectual-property ownership does not automatically authorise unrestricted use of customer data.

15. AI and Fintech IP

Artificial intelligence introduces additional questions.

A fintech may use AI for:

fraud detection;

credit-risk assessment;

customer support;

transaction monitoring;

financial forecasting; or

document processing.

The company may seek protection for:

software

technical architecture

training methodologies

confidential datasets

models and parameters

documentation

brand

However, the precise legal protection varies according to what has actually been created and whether the relevant statutory requirements are met.

A recent Spanish Supreme Court decision concerning an automated public-sector algorithm illustrates the legal tension between software IP, trade secrets and transparency. The Court held that software can be protected as intellectual property but also emphasised that IP protection does not automatically justify refusing access to information where competing legal rights must be balanced.

16. Six Important Case Laws

Because “multinational fintech IP” is a relatively specialised category, there are not six Spanish judgments all involving the same fintech-IP fact pattern. The most useful authorities are therefore Spanish and EU decisions establishing principles directly relevant to software, digital technology, trademarks and confidential technology.

Case 1 — SAS Institute Inc. v World Programming Ltd

CJEU, Case C-406/10, Judgment of 2 May 2012

This is a foundational EU software-copyright case.

The dispute concerned software capable of reproducing the functionality of another software system.

The CJEU held that the functionality of a computer program and the programming language are not, by themselves, protected by copyright. The purchaser of a licensed program may generally observe, study and test its functioning to determine the ideas and principles underlying it.

Fintech relevance

A competing fintech may potentially develop software performing similar financial functions without automatically infringing copyright merely because the functions are similar.

The risk increases where protected expression, such as source code or other protected elements, has actually been copied.

17. Case 2 — Bezpečnostní softwarová asociace

CJEU, Case C-393/09

This case concerned the protection of a graphical user interface associated with computer software.

The CJEU distinguished the computer program itself from other elements appearing on a screen.

Fintech relevance

A banking application can contain several separate IP elements.

For example:

backend code

interface

icons

graphics

documentation

should not automatically be treated as one indivisible IP asset.

This is particularly important when a multinational fintech copies or redesigns another financial application's interface.

18. Case 3 — Nintendo Co. Ltd v PC Box Srl

CJEU, Case C-355/12, Judgment of 23 January 2014

The case concerned technological protection measures used to protect copyrighted software.

The CJEU examined the relationship between copyright protection and technological measures designed to prevent unauthorised use.

Fintech relevance

The principle is relevant to software-protection architecture.

A fintech can use technical mechanisms to protect software, but legal assessment of those mechanisms must be considered together with the underlying intellectual-property rights and applicable law.

For financial technology, this can matter when proprietary software is distributed through APIs, devices or controlled environments.

19. Case 4 — Ranks and Vasiļjevs

CJEU, Case C-166/15, Judgment of 12 October 2016

This case concerned the resale of software licences and the exhaustion of copyright in software.

The CJEU considered circumstances surrounding the transfer of software licences and the conditions under which copyright exhaustion operates.

Fintech relevance

A fintech licensing software to banks must carefully distinguish:

licence

from

transfer of ownership

and determine what rights the customer actually receives.

A bank acquiring a licence does not necessarily acquire the underlying intellectual-property ownership.

20. Case 5 — Top System SA v Belgian State

CJEU, Case C-13/20, Judgment of 6 October 2021

This case concerned the alteration/decompilation of computer software and the scope of rights available to a lawful acquirer of software.

The CJEU considered circumstances in which correction of errors could involve reproduction or alteration of protected software.

Fintech relevance

A bank receiving licensed fintech software may need to modify or integrate that software with its own infrastructure.

The parties should therefore clearly address:

integration;

maintenance;

error correction;

modifications;

interoperability; and

access to source code.

Otherwise, a technically necessary modification can become an IP dispute.

21. Case 6 — Gómez del Moral Guasch v Bankia

CJEU, Case C-125/18, Judgment of 3 March 2020

This case concerned an interest-rate reference mechanism in a Spanish mortgage agreement rather than intellectual property directly.

It is nevertheless relevant to the banking-law side of the subject.

The CJEU examined transparency requirements concerning the contractual use of the IRPH reference index.

Fintech relevance

When a fintech supplies software or algorithms used by a bank to determine financial pricing, the technology cannot be considered purely as an IP asset.

The bank must also comply with applicable financial, consumer and transparency requirements.

Thus:

IP ownership ≠ regulatory permission.

A fintech can own an algorithm while the bank remains responsible for the legality and transparency of the financial product in which that technology is used.

22. Case 7 — Tribunal Supremo, Judgment No. 1119/2025

Spanish Supreme Court, 11 September 2025

This recent Spanish Supreme Court judgment concerned the BOSCO automated decision-making application used in the public administration.

The Court recognised that the application constituted a computer program protected under Spanish intellectual-property legislation but considered IP protection alongside transparency and access-to-information interests.

The judgment is particularly valuable for modern fintech because it demonstrates that software IP may come into conflict with other legal interests rather than operating as an absolute shield.

Fintech relevance

A fintech's proprietary algorithm may be protected, but regulators, courts or other legally authorised bodies may still have grounds to scrutinise how the system operates where another legally protected interest requires access or explanation.

23. Case 8 — Aranzadi La Ley v VLex Networks

CJEU Case C-517/26 — pending

The Spanish Supreme Court referred questions concerning whether a third-party browser extension could constitute an “alteration” of a computer program under the EU Software Directive.

The case is particularly interesting because it concerns digital interoperability and software interaction. As of the current date, the reference remains a pending proceeding rather than a final CJEU judgment.

Fintech relevance

The case could become relevant to fintech ecosystems in which third-party applications interact with proprietary web platforms, banking interfaces or software environments.

Because the case is pending, it should not be presented as settled law.

24. Trade Secrets and Fintech Algorithms

A fintech should consider trade-secret protection where publication would destroy the competitive value of the technology.

For example, a proprietary fraud-detection model may be difficult to protect solely through copyright because copyright does not give ownership of the underlying mathematical idea.

Trade-secret protection can potentially protect confidential implementation information if the statutory conditions are satisfied.

Spanish Law 1/2019 requires secrecy, commercial value arising from secrecy and reasonable measures to maintain secrecy.

Therefore:

confidentiality agreement

restricted access

technical security

internal classification

need-to-know controls

can be legally significant.

25. Multinational Ownership Problems

A major problem arises where development occurs in several countries.

For example:

Parent company — United States

Developers — Spain

Bank customer — Spain

Cloud infrastructure — Ireland

Fintech subsidiary — Germany

The question “Who owns the software?” cannot necessarily be answered simply by looking at the location of the customer.

Ownership may depend upon:

employment contracts;

assignment agreements;

applicable copyright law;

corporate structure;

commissioning arrangements;

development agreements; and

applicable conflict-of-laws rules.

A multinational fintech should therefore maintain a clear IP chain of title.

26. IP Due Diligence in Fintech Acquisitions

When a bank or financial group acquires a fintech, IP due diligence should examine:

Software

Who created the code?

Who owns it?

Were contractors used?

Were employee assignments properly documented?

Open source

Which open-source licences are incorporated?

Patents

Are relevant inventions registered?

Are applications pending?

Trademarks

Are brands protected in Spain and other target markets?

Trade secrets

Are reasonable secrecy measures actually being used?

Third-party technology

Does the fintech have permission to sublicense everything it provides?

Data

Are customer databases being confused with IP assets?

These questions can materially affect the value and legal security of an acquisition.

27. Banking Regulatory Dimension

Fintech IP cannot be separated entirely from banking regulation.

Suppose a fintech owns proprietary payment software.

The software may be protected by IP law.

But if the fintech provides a regulated payment service, it may also need to comply with the applicable Spanish and EU financial regulatory framework.

Likewise, if a bank uses a third-party algorithm:

IP question: Who owns the algorithm?

Banking question: Is its use legally permissible?

Consumer question: Is the financial service transparent and fair?

Data question: Is personal data lawfully processed?

These are different legal questions.

28. Cross-Border Enforcement

A multinational fintech may face infringement in several jurisdictions.

A Spanish company may need to enforce:

Spanish copyright;

EU trademarks;

Spanish trade secrets;

European patents;

contractual rights; and

international licensing rights.

The appropriate court and applicable law depend on the right involved and the facts.

EU intellectual-property rights can provide broader territorial protection than purely national rights, while Spanish national rights remain important for particular disputes.

The company should therefore design enforcement strategy according to the actual IP asset rather than treating all technology rights identically.

29. Injunctions and Urgent Protection

IP disputes involving fintech can require rapid action.

For example, a former employee might allegedly take confidential source code and begin using it for a competing financial application.

Potential legal responses can include:

injunctions;

preservation of evidence;

prohibition of use;

prohibition of disclosure;

damages;

destruction or return of unlawful copies; and

other remedies provided by the relevant IP regime.

Spanish courts have also developed expedited IP procedures around major technology events. The Barcelona judiciary's Mobile World Congress IP protocol expressly contemplates urgent measures involving software, algorithms and AI-generated content.

30. Important Compliance Checklist

A multinational fintech operating in Spain should maintain:

IP ownership register

Software chain-of-title documentation

Employee and contractor assignments

Open-source compliance programme

Trademark portfolio

Patent strategy

Trade-secret programme

Confidentiality agreements

Technology-licensing agreements

Banking-partner IP provisions

Third-party software audit

Source-code escrow arrangements where appropriate

Cross-border enforcement strategy

Data/IP separation

AI and algorithm governance

31. Key Legal Distinction

The most important conceptual distinction is:

Intellectual-property protection

does not equal

financial-regulatory authorisation.

For example:

A fintech may own a proprietary lending algorithm.

That does not by itself establish that a Spanish bank may use the algorithm without complying with applicable banking, consumer, data-protection and other regulatory requirements.

Similarly:

A bank may have a contractual licence to use fintech software.

That does not automatically mean that the bank owns the underlying IP.

32. Conclusion

Multinational fintech intellectual property in Spain sits at the intersection of IP law, banking regulation, technology contracts, data law and EU law.

The major protection mechanisms are:

Copyright → software and other original expression.

Patents → qualifying technical inventions.

Trademarks → fintech brands and commercial identifiers.

Trade secrets → confidential algorithms, technical information and business knowledge.

Database rights → qualifying databases.

The case law provides several important boundaries.

SAS Institute confirms that software functionality and programming languages are not themselves protected by copyright.

Top System illustrates the importance of lawful software modification and interoperability.

Nintendo demonstrates the relationship between software copyright and technological protection measures.

Ranks and Vasiļjevs illustrates important issues surrounding software licensing and exhaustion.

Gómez del Moral Guasch demonstrates from the banking side that technology used in financial products remains subject to transparency and consumer-law requirements.

Most importantly for Spain, the Spanish Supreme Court's 2025 BOSCO judgment shows that software IP can have to be balanced against other legal interests, rather than functioning as an absolute barrier to scrutiny.

For a multinational fintech operating with Spanish banks, the central legal challenge is therefore not simply “Who owns the technology?” It is the broader set of questions:

Who owns it?
Who may use it?
Where may it be used?
What happens after termination?
Which parts are protected by which IP right?
What information must remain confidential?
And does use of the technology comply with Spanish and EU financial regulation?