Banking Law and Supervisory Review and Evaluation Process (SREP) in Spain

1. Introduction

The Supervisory Review and Evaluation Process (SREP) is a central component of prudential banking supervision in Spain. It is the process through which supervisors assess whether a bank has adequate capital, liquidity, governance, risk-management systems and internal controls in light of its risk profile.

For significant Spanish banks, SREP is primarily conducted within the Single Supervisory Mechanism (SSM) by the European Central Bank (ECB), working with the Banco de España. Less significant institutions are primarily supervised by the Banco de España under the SSM framework.

SREP is therefore best understood as a combination of:

EU prudential law + ECB supervision + Banco de España supervision + Spanish banking legislation.

2. Legal Foundation of SREP

The principal legal foundations are:

EU level

• Regulation (EU) No 1024/2013 — SSM Regulation.
• Directive 2013/36/EU (CRD) — prudential requirements and supervisory powers.
• Regulation (EU) No 575/2013 (CRR) — capital and prudential requirements.
• Regulation (EU) 2019/876 (CRR II).
• Directive (EU) 2019/878 (CRD V).
• Directive (EU) 2024/1619 (CRD VI), which further develops the EU prudential framework.
• Regulation (EU) 2024/1623 (CRR III).

Spanish level

A particularly important statute is:

Law 10/2014 of 26 June, on the regulation, supervision and solvency of credit institutions (Ley 10/2014).

It establishes the Spanish framework for:

• supervision;
• solvency;
• governance;
• risk management;
• supervisory powers;
• capital requirements; and
• enforcement.

Its implementing regulations include Royal Decree 84/2015.

3. What Does SREP Examine?

SREP is not simply a check of whether a bank has enough regulatory capital.

Supervisors generally examine four major areas:

1. Business model

Is the bank's business model sustainable?

2. Governance and risk management

Does the bank have effective internal governance and risk controls?

3. Risks to capital

Does the bank adequately manage risks such as:

• credit risk;
• market risk;
• operational risk;
• interest-rate risk;
• concentration risk;
• climate and environmental risks; and
• other material risks?

4. Risks to liquidity

Can the bank withstand liquidity stress?

These assessments contribute to the overall SREP decision.

4. SREP for Significant Spanish Banks

Under the SSM, significant institutions are directly supervised by the ECB.

Spanish institutions meeting the relevant significance criteria can therefore be supervised by an ECB Joint Supervisory Team (JST).

The JST normally includes:

• ECB supervisors; and
• Banco de España supervisors.

This creates a particularly important relationship between European and Spanish banking law.

5. Less Significant Spanish Institutions

Less significant institutions remain primarily under the direct supervision of the Banco de España.

However, they remain within the SSM architecture.

The ECB retains important oversight responsibilities and can exercise certain supervisory powers in accordance with the SSM Regulation.

Thus, SREP in Spain is not completely separate from the European supervisory system even for smaller institutions.

6. SREP Methodology

The supervisory process normally involves several stages.

Stage 1 — Information gathering

Supervisors collect information from:

• regulatory returns;
• financial statements;
• risk reports;
• internal governance documents;
• stress tests;
• internal capital assessments;
• liquidity assessments;
• supervisory inspections; and
• other supervisory information.

7. Business Model Analysis

Supervisors examine whether the bank's business model is sustainable.

Questions include:

• How does the bank generate revenue?
• Is profitability sustainable?
• Is the bank excessively dependent on one business line?
• How exposed is it to economic cycles?
• Does its strategy create excessive risk?
• Is its business plan realistic?

For a Spanish bank heavily exposed to mortgages, for example, supervisors may consider:

• housing-market conditions;
• borrower indebtedness;
• interest-rate sensitivity;
• mortgage concentration;
• collateral quality; and
• potential deterioration in credit quality.

8. Internal Governance and Risk Management

SREP examines whether the institution has adequate governance.

Important areas include:

• board oversight;
• risk committees;
• compliance;
• internal audit;
• risk-management function;
• three-lines-of-defence arrangements;
• remuneration policies;
• risk appetite;
• internal controls; and
• information systems.

A bank with substantial capital can still receive supervisory criticism if governance and risk-management systems are inadequate.

9. Assessment of Capital Risks

Supervisors assess whether the bank has enough capital to absorb risks.

Relevant risks can include:

Credit risk

Failure of borrowers to repay.

Market risk

Losses arising from movements in financial markets.

Operational risk

Losses arising from:

• inadequate processes;
• people;
• systems; or
• external events.

Interest-rate risk

Changes in interest rates can affect:

• net interest income;
• asset values;
• liabilities; and
• economic value of equity.

Concentration risk

Excessive exposure to:

• one sector;
• geography;
• borrower group; or
• asset class.

10. Internal Capital Adequacy Assessment Process — ICAAP

An important component of SREP is the bank's ICAAP.

ICAAP stands for:

Internal Capital Adequacy Assessment Process.

The bank must assess whether its internal capital is sufficient for its actual risk profile.

The supervisor then evaluates whether the bank's ICAAP is credible and sufficiently comprehensive.

A bank cannot simply argue:

"Our Pillar 1 capital ratio is sufficient."

It must consider risks that may not be fully captured by standard regulatory calculations.

11. Internal Liquidity Adequacy Assessment Process — ILAAP

The corresponding liquidity process is the ILAAP:

Internal Liquidity Adequacy Assessment Process.

The bank assesses:

• liquidity needs;
• funding structure;
• liquidity buffers;
• stress scenarios;
• funding concentration;
• contingency funding arrangements; and
• survival horizons.

Supervisors assess the reliability of this process as part of SREP.

12. Stress Testing

Stress testing is an important supervisory tool.

Supervisors can examine how the bank would perform under adverse scenarios such as:

• severe recession;
• unemployment increases;
• property-price declines;
• interest-rate shocks;
• market stress;
• liquidity withdrawals;
• cyber incidents; or
• combinations of these events.

For Spanish banks with large residential mortgage portfolios, a severe property and unemployment shock can be particularly important.

13. Climate and Environmental Risks

Modern SREP increasingly incorporates climate and environmental risks.

For Spanish banks this can include:

• flood risk;
• wildfire risk;
• drought;
• heat-related risks;
• transition risk;
• carbon-intensive borrowers;
• energy-inefficient property;
• climate-sensitive collateral.

These risks can ultimately become traditional banking risks.

For example:

Climate risk → property deterioration → collateral-value decline → higher credit risk → higher capital requirement.

14. Liquidity Risk Assessment

SREP considers whether a bank can withstand liquidity stress.

Supervisors examine:

• Liquidity Coverage Ratio (LCR);
• Net Stable Funding Ratio (NSFR);
• funding concentration;
• wholesale funding dependence;
• deposit stability;
• collateral availability;
• liquidity buffers; and
• contingency funding plans.

A bank may have strong capital but still face serious liquidity problems.

15. SREP Scoring

The supervisory assessment results in an overall supervisory view of the institution's risk profile.

The ECB's SREP methodology uses supervisory assessments of the principal risk areas and an overall SREP assessment.

The process can lead to:

• supervisory findings;
• qualitative measures;
• additional capital requirements;
• additional liquidity-related requirements or expectations;
• governance improvements; and
• other remedial measures.

16. Pillar 1 and Pillar 2

A fundamental concept is the distinction between:

Pillar 1

Minimum regulatory capital requirements calculated under the CRR.

Pillar 2

Additional capital requirements arising from risks not adequately captured by Pillar 1.

SREP is central to the determination of Pillar 2 Requirements (P2R).

A simplified example:

If a bank's Pillar 1 requirement is:

8%

but supervisors identify additional material risks, the institution may be required to hold additional capital under Pillar 2.

17. Pillar 2 Guidance

SREP can also result in Pillar 2 Guidance (P2G).

P2G is generally intended as a supervisory expectation concerning the capital buffer a bank should maintain to withstand stress.

It differs legally from a binding Pillar 2 Requirement.

This distinction is important when analysing the legal consequences of an SREP decision.

18. Combined Buffer Requirements

SREP should also be understood alongside capital buffers imposed under EU and national law.

These can include:

• capital conservation buffer;
• countercyclical capital buffer;
• systemic risk buffer;
• global systemically important institution buffer;
• other systemically important institution buffer.

Spain's macroprudential framework therefore interacts with SREP.

19. Supervisory Measures

If supervisors identify weaknesses, they may require corrective action.

Examples include:

• improving governance;
• strengthening risk management;
• increasing capital;
• improving liquidity;
• restricting certain activities;
• improving internal controls;
• addressing data deficiencies;
• strengthening IT systems;
• reducing risk concentrations; or
• revising business strategies.

20. Supervisory Powers Under Spanish Law

Law 10/2014 gives the competent authorities significant supervisory powers.

Depending on the circumstances, authorities can:

• obtain information;
• conduct inspections;
• require corrective measures;
• impose requirements;
• intervene in certain circumstances; and
• impose administrative sanctions.

Therefore, SREP is not merely an informal assessment.

It can produce legally significant supervisory consequences.

21. Relationship Between SREP and Enforcement

A distinction should be made between:

Supervisory assessment

The supervisor determines that a bank has weaknesses.

Supervisory measure

The bank is ordered or expected to take corrective action.

Administrative sanction

A breach of applicable law may result in a formal enforcement proceeding and penalty.

Not every negative SREP finding is automatically a regulatory offence.

22. Case Law — Crédit Agricole v ECB

One of the most important SSM cases is:

General Court, Joined Cases T-133/16 to T-136/16, Crédit Agricole SA and Others v ECB, judgment of 13 December 2018.

The cases concerned ECB prudential supervision and capital requirements.

Importance

The General Court examined the ECB's authority under the SSM framework and its ability to impose prudential requirements.

Principle

The case illustrates that ECB supervisory decisions must be based on the powers granted by EU banking legislation and must comply with procedural and substantive legal requirements.

Spanish relevance

Spanish banks directly supervised by the ECB are subject to the same European supervisory architecture.

23. Case Law — Landeskreditbank Baden-Württemberg v ECB

CJEU, Case C-450/17 P, Landeskreditbank Baden-Württemberg v ECB, judgment of 8 May 2019.

This case concerned the division of supervisory responsibilities under the SSM.

The bank challenged the ECB's classification and supervisory arrangements.

The Court upheld the basic SSM architecture under which the ECB has direct supervisory responsibility for significant institutions while national authorities supervise less significant institutions subject to ECB oversight.

Spanish significance

The judgment is important for understanding why a Spanish bank cannot necessarily challenge the ECB's supervisory role merely by arguing that national supervision should apply.

24. Case Law — L-Bank

The Landeskreditbank judgment is particularly important because it confirms the institutional structure of the SSM.

The legal principle is:

Significance classification determines the allocation of direct supervisory responsibilities between the ECB and national competent authorities.

For Spain, this explains the division between:

• ECB direct supervision of significant institutions; and
• Banco de España direct supervision of less significant institutions.

25. Case Law — Berlusconi and Fininvest

CJEU, Case C-219/17, Silvio Berlusconi and Fininvest SpA v Banca d'Italia and others, judgment of 19 December 2018.

The case concerned the SSM procedure relating to the acquisition of qualifying holdings in financial institutions.

Although not an SREP case specifically, it is highly relevant to the broader legal structure of ECB banking supervision.

Principle

Where EU banking law assigns a final supervisory decision to the ECB, the relevant EU judicial review structure applies.

SREP relevance

It reinforces the importance of distinguishing between:

• national preparatory measures; and
• final ECB supervisory decisions.

26. Case Law — Trasta Komercbanka

CJEU, Case C-663/17 P, Trasta Komercbanka AS and Others v ECB, judgment of 5 November 2019.

This litigation concerned ECB action in banking supervision and the withdrawal of authorisation.

Although more closely connected with licensing and resolution-related questions than SREP, it is relevant to the limits and judicial review of ECB supervisory powers.

It confirms the significance of the EU institutional framework in reviewing ECB supervisory decisions.

27. Case Law — Versobank

The Versobank litigation before the EU Courts also illustrates judicial review of ECB banking-supervisory decisions, particularly concerning withdrawal of authorisation.

The broader lesson for SREP is that supervisory discretion is substantial but not unlimited.

The ECB must:

• identify the relevant legal basis;
• assess the relevant facts;
• provide adequate reasoning;
• follow applicable procedures; and
• respect EU legal principles.

28. Judicial Review of SREP Decisions

Banks can challenge certain supervisory decisions.

Judicial review can consider matters such as:

• competence;
• procedural legality;
• reasoning;
• factual findings;
• proportionality;
• legal interpretation; and
• exercise of supervisory discretion.

However, courts generally recognise that banking supervision involves complex economic and prudential assessments.

Therefore, judicial review does not necessarily mean that courts substitute their own banking-risk assessment for that of the supervisor.

29. Proportionality

The principle of proportionality is important.

A supervisory measure should be appropriate to the identified risk and should not go beyond what is necessary to achieve the regulatory objective.

For example, if a bank has a limited governance weakness, the supervisor should have a rational basis for determining the appropriate remedial response.

30. Due Process

Banks subject to SREP have important procedural rights.

These can include:

• being informed of supervisory concerns;
• responding to findings;
• receiving reasons for relevant decisions;
• access to applicable procedural safeguards; and
• judicial review where legally available.

The importance of reasoning is particularly significant when the supervisory measure has substantial financial consequences.

31. SREP and Banking Governance

SREP has moved beyond traditional capital ratios.

Modern supervisory review considers whether the board and senior management:

• understand the bank's risks;
• establish appropriate risk appetite;
• challenge management decisions;
• maintain independent control functions;
• respond to risk indicators; and
• ensure reliable risk data.

Weak governance can therefore become a prudential issue.

32. SREP and Operational Resilience

Operational resilience is increasingly important.

Supervisors examine risks involving:

• IT failures;
• cyber incidents;
• outsourcing;
• cloud services;
• critical third parties;
• business continuity; and
• data integrity.

The Digital Operational Resilience Act (DORA) also strengthens the EU framework for ICT risk in financial entities.

For Spanish banks, DORA operates alongside existing prudential supervision and therefore feeds into the broader supervisory assessment.

33. SREP and AML/CFT

Anti-money-laundering weaknesses can also become relevant to supervisory assessments where they affect governance, risk management or the institution's safety and soundness.

Spanish banks are subject to:

• Spanish AML legislation;
• EU AML requirements; and
• supervisory expectations.

However, prudential SREP and AML supervision remain legally distinct regulatory functions.

34. SREP and Consumer Protection

SREP is primarily prudential rather than a general consumer-protection procedure.

Nevertheless, weaknesses in:

• product governance;
• conduct;
• mis-selling;
• remuneration;
• internal controls; or
• complaint management

can indicate broader governance and risk-management deficiencies.

Spanish mortgage jurisprudence therefore provides an important contextual background for bank governance, even though consumer litigation is not itself SREP.

35. Example

Assume a Spanish bank has:

• rapidly expanding mortgage lending;
• high exposure to residential property;
• weak interest-rate stress testing;
• insufficient climate-risk data; and
• inadequate board oversight.

During SREP, supervisors could conclude that the bank's risk-management framework is insufficient.

Potential consequences could include:

1. enhanced supervisory monitoring;
2. governance remediation;
3. improved risk measurement;
4. additional capital requirements;
5. enhanced stress testing;
6. stronger climate-risk management; and
7. restrictions or other supervisory measures where legally justified.

36. Importance for Spanish Banking Law

SREP effectively connects several areas of banking regulation:

Capital regulation

↓

Risk management

↓

Governance

↓

Liquidity

↓

Climate and environmental risk

↓

Operational resilience

↓

Supervisory intervention

This makes SREP one of the central mechanisms through which prudential banking law operates in Spain.

37. Key Legal Principles

The most important principles are:

1. Risk-based supervision

Supervisory intensity should reflect the institution's risk profile.

2. Proportionality

Supervisory intervention must have a rational relationship with identified risks.

3. Effective governance

The board and senior management remain responsible for risk management.

4. Capital adequacy

Banks must maintain sufficient capital for their risk profile.

5. Liquidity adequacy

Banks must maintain adequate liquidity and funding resilience.

6. Supervisory discretion

The ECB and Banco de España possess substantial prudential supervisory discretion.

7. Judicial review

Supervisory decisions remain subject to legal review.

8. European integration

Spanish banking supervision operates within the SSM rather than exclusively under national law.

38. Conclusion

The Supervisory Review and Evaluation Process in Spain is a fundamental part of modern banking supervision. It evaluates not only whether a Spanish bank satisfies minimum capital ratios but also whether its business model, governance, risk-management systems, capital planning and liquidity framework are appropriate for its actual risk profile.

For significant institutions, the ECB and Banco de España work through the SSM and Joint Supervisory Teams, while less significant institutions are primarily supervised by Banco de España within the SSM framework.

The most important legal foundations are Law 10/2014, the CRR, CRD, SSM Regulation and associated EU prudential legislation. SREP can result in additional capital requirements, supervisory expectations and remedial measures.

The leading EU banking cases—including Crédit Agricole v ECB, Landeskreditbank v ECB, Berlusconi/Fininvest and Trasta Komercbanka—also demonstrate that ECB supervisory authority is extensive but remains subject to legal competence, procedural safeguards, adequate reasoning, proportionality and judicial review.

Principal authorities

Important distinction: the cited cases are principally EU banking-supervision/SSM cases rather than cases specifically challenging a Spanish SREP score or SREP capital decision. They are therefore best used to explain the legal authority, allocation of powers and judicial-review principles underlying SREP in Spain.