Banking Law and Tax Information Exchange in Spain — Detailed Explanation with Case Laws

Jurisdiction: Spain / European Union / International Tax Cooperation

Banking law and tax information exchange in Spain concerns the legal duties of banks and other financial institutions to identify customers, maintain financial and tax-related records, report specified information to Spanish authorities, and permit information to be exchanged with foreign tax administrations under EU and international frameworks.

The subject sits at the intersection of banking secrecy, data protection, tax procedure, anti-money-laundering law, EU administrative cooperation, FATCA and the OECD Common Reporting Standard (CRS). Spanish banking confidentiality therefore does not generally provide an absolute shield against a lawful tax-information request.

1. Spanish Legal Framework

The principal framework includes:

• Spanish Constitution of 1978, particularly Article 18 concerning privacy and protection of personal information.
• Law 58/2003, General Tax Law (Ley General Tributaria or LGT).
• Royal Decree 1065/2007, containing detailed tax-management and information-reporting rules.
• Law 10/2010 on prevention of money laundering and terrorist financing.
• Organic Law 3/2018 on personal-data protection and digital rights.
• GDPR — Regulation (EU) 2016/679.
• Directive 2011/16/EU (DAC) on administrative cooperation in taxation, as repeatedly amended.
• OECD Common Reporting Standard (CRS) and the multilateral framework for automatic exchange.
• The Spain–United States FATCA agreement.
• Bilateral double-taxation agreements and tax-information-exchange arrangements containing exchange-of-information provisions.

Consequently, a Spanish bank can face overlapping obligations under banking, tax, AML, privacy and international-cooperation legislation.

2. General Tax Law and Banks' Information Duties

A central provision is Article 93 of Law 58/2003.

It establishes a broad obligation to provide the Spanish tax administration with information having tax relevance concerning relationships of an economic, professional or financial nature.

Financial institutions are particularly important because they hold information concerning accounts, deposits, payments, securities, investments and other financial relationships.

For example, if the Spanish Tax Agency (Agencia Estatal de Administración Tributaria — AEAT) is lawfully investigating whether a taxpayer concealed taxable income, relevant banking information may potentially be required.

Bank confidentiality does not ordinarily override a properly founded statutory information obligation.

3. Banking Secrecy versus Tax Transparency

Spanish law recognises confidentiality surrounding customer banking information, but this is not an absolute banking-secrecy regime.

The basic balance can be expressed as:

Customer confidentiality → general rule

Statutory tax disclosure → lawful exception

A bank should not disclose customer information casually or to an unauthorised third party. However, where legislation requires disclosure to AEAT or another legally authorised authority, compliance with the statutory requirement does not ordinarily constitute an unlawful breach of banking confidentiality.

This distinction is fundamental to Spanish banking law.

4. What Information Can Become Relevant?

Depending on the legal basis and reporting regime, relevant information can include:

• identity of an account holder;
• tax identification number;
• tax residence;
• account number;
• account balances;
• interest income;
• dividends;
• certain investment income;
• proceeds from specified financial assets;
• beneficial ownership information; and
• information concerning entities controlling or owning accounts.

The precise information available depends on whether the case involves a domestic tax investigation, CRS reporting, FATCA, DAC cooperation, AML information or another statutory mechanism.

5. Common Reporting Standard (CRS)

Spain participates in the OECD Common Reporting Standard.

CRS is designed to prevent taxpayers from hiding financial assets outside their jurisdiction of tax residence.

A Spanish reporting financial institution generally performs due diligence to establish whether an account is reportable.

A simplified process is:

Customer → Spanish financial institution → AEAT → foreign tax authority

For example, suppose an individual is tax resident in another CRS-participating jurisdiction but maintains a reportable financial account in Spain.

The Spanish institution determines the customer's tax residence under applicable due-diligence rules. Required account information is reported to the Spanish tax administration. Spain can then automatically exchange the reportable information with the customer's jurisdiction of tax residence.

The system therefore moves international tax cooperation from purely request-based disclosure toward automatic exchange.

6. FATCA and Spain

Spain also entered into an intergovernmental agreement with the United States concerning FATCA.

FATCA primarily addresses financial accounts relevant to U.S. tax reporting.

Spanish financial institutions covered by the regime must perform specified identification and reporting procedures. Under the intergovernmental structure, information can be transmitted through governmental channels rather than treating every Spanish bank as operating independently from the Spanish authorities.

For banking compliance departments, FATCA and CRS therefore require sophisticated systems for customer classification and tax-residence documentation.

7. EU Directive on Administrative Cooperation — DAC

EU tax-information exchange is heavily influenced by Directive 2011/16/EU, commonly called the DAC.

The directive has been expanded repeatedly.

Its framework covers various forms of administrative cooperation, including automatic exchange of specified information and information exchanged on request.

Subsequent amendments expanded cooperation into areas such as financial accounts, cross-border tax rulings, country-by-country information, reportable cross-border arrangements and digital-platform information.

For Spanish banks, DAC2 is particularly significant because it incorporated CRS-style financial-account reporting into the EU administrative-cooperation framework.

8. Exchange of Information on Request

Not all information exchange is automatic.

A foreign tax authority may request information from Spain under an applicable treaty, EU mechanism or other international instrument.

Suppose a French tax authority investigates a French resident believed to maintain undisclosed assets in Spain.

Where the applicable legal conditions are satisfied:

French authority → Spanish competent authority → relevant information gathered/verified → information transmitted under the cooperation framework.

The foreign authority does not simply acquire unrestricted direct access to the Spanish bank's systems.

Legal procedures and competent-authority mechanisms remain important.

9. Foreseeable Relevance

International exchange-of-information systems generally seek to prevent "fishing expeditions."

A requesting authority should ordinarily demonstrate that the requested information is foreseeably relevant to a legitimate tax investigation.

It does not necessarily have to prove the tax violation before receiving information—that could defeat the purpose of information exchange—but the request should have a genuine tax-investigation basis.

This issue has generated important CJEU litigation.

10. Case Law 1 — Berlioz Investment Fund SA v Directeur de l'administration des contributions directes, C-682/15 (2017)

This is one of the most important European tax-information-exchange judgments.

Luxembourg authorities ordered Berlioz to provide information following a request from the French tax administration. A penalty was imposed when part of the information was not supplied.

The CJEU held that judicial review must be capable of examining whether requested information satisfies the foreseeable-relevance requirement.

Importance for Spain

Spanish authorities implementing a foreign tax-information request cannot regard every request as automatically beyond legal scrutiny.

The judgment establishes an important balance between:

effective international tax cooperation

and

protection against unjustified information demands.

For Spanish banking law, it supports the principle that cross-border information exchange requires a valid legal foundation and compliance with the conditions governing administrative cooperation.

11. Case Law 2 — État luxembourgeois v B and Others, Joined Cases C-245/19 and C-246/19 (2020)

These cases also involved information orders issued following foreign tax requests.

The CJEU examined effective judicial protection under Article 47 of the EU Charter of Fundamental Rights.

The Court distinguished between the procedural positions of the person holding the information and the taxpayer or other third parties affected by the investigation.

Banking relevance

Banks frequently act as information holders rather than taxpayers under investigation.

The judgment is therefore highly relevant when considering what procedural rights should exist when a financial institution receives a compulsory information order.

12. Case Law 3 — État luxembourgeois v L, C-437/19 (2021)

The CJEU further considered the requirement that information requested under EU administrative-cooperation rules be foreseeably relevant.

The decision developed the standards applicable to requests covering categories of documents and information.

Importance

Tax authorities can request substantial bodies of information, but the requirement of foreseeable relevance remains a legal limitation.

For Spain, the case assists in interpreting DAC-based requests directed toward financial or corporate information.

13. Case Law 4 — Sabou, C-276/12 (2013)

In Jiří Sabou v Finanční ředitelství pro hlavní město Prahu, the CJEU considered taxpayer procedural rights during exchanges of information between Member States.

The Court concluded, under the framework then applicable, that EU law did not require the taxpayer to participate in the information-gathering request or to be heard before information was exchanged.

Importance for Spanish banking law

Tax-information cooperation is primarily an administrative process between competent authorities.

A taxpayer does not necessarily have a right to intervene at every stage merely because information concerning them is being exchanged.

Later case law, particularly Berlioz and the Luxembourg cases, has nevertheless strengthened judicial-protection analysis.

14. Case Law 5 — Commission v Luxembourg, C-115/08 (2009)

This case arose from Luxembourg's approach to banking secrecy in connection with EU tax cooperation.

The broader European development demonstrated the increasing difficulty of relying on domestic banking secrecy to obstruct legitimate EU tax-information mechanisms.

Spanish significance

Spain cannot construct its banking confidentiality rules in a way that undermines binding EU tax-cooperation obligations.

Where EU law validly requires exchange, national banking-secrecy principles must operate consistently with that framework.

15. Case Law 6 — Schrems, C-362/14 (2015)

This was not a banking-tax case. It concerned international transfers of personal data and the EU–US Safe Harbour arrangement.

Nevertheless, it established powerful principles concerning fundamental rights, privacy, data protection and international transfers of personal information.

Relevance to tax information

Bank-account information is personal data when connected to an identifiable individual.

Tax-information exchange therefore exists alongside EU data-protection principles. Public authorities must have a lawful basis for processing and transferring personal data.

Schrems helps demonstrate that international governmental objectives do not eliminate fundamental-rights considerations.

16. Case Law 7 — Schrems II, C-311/18 (2020)

The CJEU invalidated the EU–US Privacy Shield and examined safeguards surrounding international personal-data transfers.

Again, this was not a tax-information-exchange dispute.

Its broader relevance lies in the proposition that cross-border transmission of personal data must operate within an adequate legal framework protecting fundamental rights.

For banks, this reinforces the need to distinguish mandatory statutory tax reporting from ordinary commercial international data transfers.

17. Tax Reporting and GDPR

Tax information often constitutes personal data.

Consequently, GDPR principles remain relevant, including:

lawfulness, purpose limitation, data minimisation, accuracy, security and accountability.

However, GDPR does not mean that a customer can simply refuse all tax reporting.

Where EU or Spanish legislation imposes a valid reporting obligation, the bank can have a statutory basis for processing and disclosing the required information.

The correct principle is therefore:

Data protection regulates lawful tax information processing; it does not automatically prohibit it.

18. Relationship with AML Rules

Tax-information exchange and anti-money-laundering regulation overlap but are not identical.

Under Law 10/2010, Spanish financial institutions have extensive customer due-diligence and beneficial-ownership obligations.

AML information can help authorities understand who actually controls companies, trusts or financial structures.

For example:

A company is formally the account holder.

Another individual ultimately controls the company.

AML procedures may identify the beneficial owner, while CRS rules may separately require analysis of controlling persons depending on the entity's classification.

The two regimes therefore reinforce financial transparency, although each has its own legal basis and purpose.

19. Bank Compliance Process

A Spanish bank's compliance structure can broadly be represented as:

Account opening

↓
Customer identification

↓
Tax-residence determination

↓
TIN/self-certification documentation

↓
CRS/FATCA classification

↓
AML and beneficial-owner verification

↓
Identification of reportable accounts

↓
Reporting to AEAT

↓
International exchange where legally applicable.

Banks must also maintain appropriate records because regulators or tax authorities may subsequently examine whether due-diligence obligations were correctly performed.

20. Example

Suppose Mr X is tax resident in France and maintains a qualifying investment account with a Spanish bank.

The account contains €600,000.

The Spanish institution determines that Mr X is French tax resident and that the account falls within applicable CRS reporting requirements.

The institution reports the prescribed information to AEAT.

Under the automatic-exchange framework:

Spanish Bank → AEAT → French competent authority

French authorities can then compare that information with Mr X's French tax declarations.

If the information reveals a discrepancy, French tax law determines the tax consequences.

Importantly, the Spanish bank does not itself decide whether Mr X committed tax evasion. Its role is principally identification, due diligence and legally required reporting.

21. Legal Risks for Spanish Banks

Failure to operate an effective tax-information system can create several forms of risk:

Banks therefore face two opposite dangers: under-disclosure and over-disclosure.

A sound compliance system must avoid both.

22. Banking Confidentiality Is Not Absolute

The central legal principle can be summarised as:

Banking confidentiality protects customers against unjustified disclosure, but it does not create immunity from lawful taxation.

Spanish banks therefore cannot simply invoke customer confidentiality when AEAT issues a legally valid information requirement.

At the same time, tax authorities must respect statutory competence, procedural requirements, proportionality, EU fundamental rights and the limits governing international information requests.

Cases such as Berlioz demonstrate that tax cooperation is powerful but not legally unlimited.

23. Importance of Automatic Exchange

The evolution of the law can be understood in three stages:

Traditional model:
Foreign authority requests information only when it already suspects hidden assets.

Intermediate model:
Treaties and EU mechanisms make request-based cooperation faster and stronger.

Modern model:
CRS, DAC and FATCA enable large categories of financial information to be reported automatically.

This represents a major transformation in banking law. Banks have effectively become important institutional participants in the international tax-transparency system.

24. Key Case-Law Principles

The principal lessons from the cases are:

1. Berlioz, C-682/15 — foreseeable relevance of requested information is subject to meaningful legal scrutiny.
2. B and Others, C-245/19 & C-246/19 — effective judicial protection matters in compulsory information procedures.
3. L, C-437/19 — requests involving categories of information remain constrained by foreseeable relevance.
4. Sabou, C-276/12 — taxpayers do not automatically participate in every stage of inter-state information gathering.
5. Commission v Luxembourg, C-115/08 — national banking-secrecy arrangements operate within overriding EU tax-cooperation obligations.
6. Schrems, C-362/14 — international personal-data transfers engage fundamental privacy and data-protection principles.
7. Schrems II, C-311/18 — cross-border processing and transfer of personal information requires adequate legal safeguards.

It is important academically to identify the last two as data-protection authorities relevant by analogy, rather than presenting them as direct tax-information cases.

Conclusion

Banking law and tax information exchange in Spain reflects the movement from traditional bank confidentiality toward regulated financial transparency.

Spanish financial institutions must comply with domestic information obligations under the General Tax Law, while also operating within CRS, FATCA, the EU DAC framework, AML legislation and GDPR. AEAT plays the central domestic role in receiving and exchanging tax-relevant information.

The governing balance is not simply privacy versus taxation. It is a structured system in which tax authorities receive powerful information-gathering and international-exchange powers while remaining constrained by legality, foreseeable relevance, proportionality, data protection and effective judicial protection.

The CJEU decisions in Berlioz, B and Others, L,* and *Sabou are particularly important because they demonstrate that European tax information exchange must be effective enough to combat cross-border tax evasion while still operating under the rule of law and EU fundamental-rights guarantees.