Banking Law and Workforce Continuity Strategies in Spain

Detailed Explanation with Case Laws

1. Introduction

Workforce continuity strategies in banking refer to the legal, organizational, technological, and human-resource measures used by banks to ensure that critical banking services continue despite events such as pandemics, cyberattacks, strikes, natural disasters, major IT failures, staff shortages, or loss of key personnel.

In Spain, workforce continuity is not regulated by one single statute. It is addressed through a combination of:

Banking and prudential regulation

Operational-risk and internal-control requirements

Business-continuity and contingency planning

Employment and labour law

Cybersecurity and ICT-risk regulation

Data-protection law

EU banking and financial-services legislation

Banco de España and European Central Bank supervisory expectations

The legal objective is broader than simply keeping employees available. Banks must ensure that critical functions can continue safely, compliantly and under effective governance even when normal staffing arrangements are disrupted.

2. Legal Framework in Spain

A. Law 10/2014 on the regulation, supervision and solvency of credit institutions

Spain's principal banking statute is Law 10/2014, of 26 June, on the organisation, supervision and solvency of credit institutions (Ley 10/2014).

It establishes requirements concerning:

corporate governance;

internal control;

risk management;

organisational structures;

suitability of management;

supervisory powers;

prudential requirements; and

continuity and resilience of banking operations.

A bank's management therefore cannot treat workforce continuity merely as an HR matter.

Importance

If the loss of employees or key managers threatens a critical banking function, this can become a prudential and governance issue.

For example, a bank should identify personnel necessary for:

payment processing;

treasury operations;

liquidity management;

cybersecurity;

compliance;

AML controls;

risk management;

customer-service operations;

regulatory reporting; and

recovery and resolution functions.

3. EU Banking Rules Applicable in Spain

Spanish banks are also subject to the EU prudential framework.

Important instruments include:

Capital Requirements Directive (CRD)

Directive 2013/36/EU establishes requirements relating to:

governance;

risk management;

internal controls;

management responsibility;

remuneration;

supervisory review.

Capital Requirements Regulation (CRR)

Regulation (EU) No. 575/2013 provides the prudential framework for credit institutions.

EBA Guidelines

The European Banking Authority (EBA) has issued guidance concerning:

internal governance;

outsourcing;

ICT and security risk;

management of operational risk;

business continuity;

recovery planning.

Spanish banks supervised by Banco de España or the ECB must take these requirements into account.

4. DORA and Workforce Continuity

A particularly important development is the Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554.

DORA applies to financial entities, including banks, and has applied since 17 January 2025.

Although DORA is principally an ICT-resilience regime, it has major implications for workforce continuity.

Banks must be able to continue critical operations when:

employees cannot access normal systems;

IT personnel are unavailable;

cyber incidents occur;

critical ICT providers fail;

remote-working infrastructure becomes unavailable; or

technology disruptions prevent normal business processes.

Workforce implication

A bank needs sufficient:

qualified personnel;

backup personnel;

crisis-management arrangements;

ICT expertise;

incident-response capabilities; and

succession arrangements.

Thus, human-resource resilience becomes part of operational resilience.

5. Business Continuity Management

A Spanish bank should maintain a structured Business Continuity Management System (BCMS).

The system generally involves:

Step 1 – Business Impact Analysis

The bank identifies critical functions.

For example:

Step 2 – Identify personnel dependencies

The bank determines whether a critical function depends excessively on:

one employee;

one management team;

one location;

one specialist;

one external provider.

This is sometimes called key-person dependency risk.

Step 3 – Establish substitutes

Banks should maintain:

deputies;

cross-trained employees;

succession plans;

emergency staffing arrangements;

documented procedures.

Step 4 – Testing

Continuity arrangements should be tested through:

simulations;

crisis exercises;

cyberattack scenarios;

system-failure exercises;

pandemic or mass-absence scenarios.

6. Employment Law and Workforce Continuity

Workforce continuity must also comply with Spanish labour law.

The principal statute is the Workers' Statute (Estatuto de los Trabajadores), approved by Royal Legislative Decree 2/2015.

Banks must balance continuity requirements against employees' rights concerning:

working time;

rest periods;

health and safety;

leave;

equality;

remote work;

collective bargaining;

dismissal;

employee representation.

A continuity plan cannot simply disregard labour protections.

7. Working-Time Requirements

Emergency banking operations may require employees to work longer or unusual hours.

However, Spanish working-time rules impose legal limits.

Banks therefore need emergency staffing models that remain compatible with:

maximum working-time rules;

daily rest;

weekly rest;

overtime requirements;

collective agreements.

A bank should maintain rotating emergency teams, rather than relying indefinitely on the same employees.

8. Occupational Health and Safety

The Occupational Risk Prevention Act 31/1995 (Ley 31/1995 de Prevención de Riesgos Laborales) is important for workforce continuity.

Banks must consider employee safety when implementing continuity arrangements.

Examples include:

emergency evacuation;

workplace hazards;

pandemic-related measures;

ergonomic risks from prolonged remote work;

psychological stress;

excessive working hours.

Continuity cannot be achieved by creating unacceptable occupational risks.

9. Remote Working

The Law 10/2021 on remote work is particularly relevant to banking continuity.

Remote work can provide an important continuity mechanism when employees cannot access bank premises.

Banks may therefore use:

secure remote access;

VPNs;

multi-factor authentication;

encrypted devices;

remote customer-service systems;

secure communication platforms.

But remote work introduces additional risks.

Major risks

cyberattack;

credential theft;

data leakage;

insecure home networks;

unauthorized access;

operational errors.

Consequently, remote-working arrangements should be integrated with the bank's cybersecurity and operational-resilience framework.

10. Key-Person Risk

One of the most important workforce-continuity issues is key-person dependency.

Suppose a Spanish bank has only one employee who understands a critical payment system.

If that employee:

becomes ill;

resigns;

dies;

is unavailable during a cyberattack; or

becomes unreachable during a disaster,

the bank could experience operational disruption.

Therefore, banks should establish:

Succession planning

At least one qualified replacement should understand the critical function.

Cross-training

Employees should be trained to perform more than one critical function.

Documentation

Critical processes should not exist only as undocumented employee knowledge.

Delegation

Authority should be delegated so that decisions can continue during management absence.

11. Outsourcing and Workforce Continuity

Banks increasingly outsource:

IT;

cloud services;

customer service;

cybersecurity;

payment processing;

data processing.

Outsourcing can create a different form of workforce risk.

If a bank outsources a critical function and the provider suffers a staff shortage, the bank may still face operational disruption.

Therefore, outsourcing arrangements should address:

continuity;

staffing;

incident notification;

service levels;

contingency arrangements;

substitution;

exit strategies.

Under DORA, ICT third-party risk receives particularly strong regulatory attention.

12. Crisis Management

A bank should have a clearly defined crisis-management structure.

Typical roles include:

Board → Crisis Committee → Senior Management → Operational Teams

The plan should specify:

who makes decisions;

who communicates with regulators;

who activates continuity plans;

who manages employees;

who communicates with customers;

who manages cybersecurity;

who handles liquidity;

who handles media communications.

Ambiguous authority during a crisis can itself become an operational risk.

13. Workforce Continuity During Pandemics

COVID-19 demonstrated the importance of workforce continuity in financial institutions.

Banks had to maintain:

payment services;

ATMs;

online banking;

lending;

liquidity management;

customer support;

compliance functions.

At the same time, employees faced:

illness;

isolation;

office closures;

travel restrictions;

childcare responsibilities.

Spanish banks therefore increasingly relied on:

remote working;

digital banking;

rotating teams;

distributed operations;

secure authentication.

The pandemic reinforced the concept that business continuity and workforce resilience are interconnected.

14. Cybersecurity and Workforce Continuity

Cyber incidents can simultaneously affect both technology and personnel.

For example:

A ransomware attack prevents employees from accessing the bank's core banking system.

A continuity plan must determine:

which employees activate incident response;

which employees switch to backup systems;

who communicates with regulators;

who manages customers;

who approves emergency payments;

who coordinates forensic investigation.

Therefore, cybersecurity plans should contain human-resource continuity provisions.

15. Data Protection Considerations

The GDPR and Spain's Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD) also affect workforce continuity.

Banks process large amounts of employee and customer information.

During emergency remote work, banks must ensure:

lawful processing;

confidentiality;

access controls;

secure devices;

data minimisation;

breach reporting.

For example, giving employees unrestricted access to customer databases merely because staff shortages exist could violate data-protection requirements.

16. Workforce Continuity and AML Compliance

Workforce shortages cannot justify suspension of anti-money-laundering controls.

Spanish banks must continue complying with:

Law 10/2010 on the prevention of money laundering and terrorist financing.

Critical AML personnel therefore need continuity arrangements.

Banks should maintain backup personnel for:

transaction monitoring;

suspicious transaction reporting;

customer due diligence;

sanctions screening;

enhanced due diligence.

A bank cannot reasonably argue that an AML failure is excusable merely because its principal compliance officer was unavailable.

17. Workforce Continuity and Payment Systems

Payment operations are especially sensitive.

A bank should ensure that sufficient personnel are available to operate:

SEPA payments;

instant payments;

card systems;

ATM networks;

clearing and settlement;

liquidity management.

The continuity plan should include alternative staffing arrangements for payment operations.

A disruption in personnel could potentially create systemic consequences if it interferes with critical payment infrastructure.

18. Role of Banco de España

Banco de España is the principal national banking supervisor for many Spanish credit institutions, while significant institutions fall under the European Central Bank's Single Supervisory Mechanism.

Supervisors examine whether banks have adequate:

governance;

internal controls;

risk management;

operational resilience;

contingency arrangements.

Where workforce deficiencies threaten critical operations, they can therefore become relevant to prudential supervision.

19. Case Law

There is not a large body of Spanish judicial decisions specifically titled "workforce continuity strategies in banking." Consequently, relevant case law is generally drawn from cases concerning banking governance, employment, operational responsibility, financial regulation and the limits of bank management decisions.

Case 1 – Banco Popular resolution litigation

The Banco Popular litigation following its 2017 resolution is highly relevant to banking continuity and governance.

Spanish and EU litigation concerning the resolution examined the circumstances surrounding the bank's failure and the legal framework governing its resolution.

Relevance:
The episode demonstrates why banks need effective governance, liquidity monitoring, contingency planning and early intervention mechanisms. Workforce continuity alone cannot save an institution experiencing a severe liquidity crisis, but continuity arrangements form part of the broader operational-resilience framework.

Case 2 – Ledra Advertising Ltd v European Commission and ECB

CJEU, Joined Cases C-8/15 P to C-10/15 P, Ledra Advertising Ltd v European Commission and ECB (2016).

The case arose from the Cyprus financial crisis and the involvement of EU institutions in financial-stability measures.

Principle:
Financial stability measures remain subject to EU legal principles, including fundamental-rights considerations.

Relevance to Spain:
Spanish banks implementing crisis-management and workforce-continuity measures must operate within the wider EU legal framework. Emergency conditions do not create unlimited regulatory discretion.

Case 3 – Kotnik and Others

CJEU, Joined Cases C-526/14, Kotnik and Others (2016).

The case concerned banking-sector crisis management and burden-sharing.

Principle:
EU banking crisis-management measures must operate within the applicable EU legal framework.

Workforce-continuity relevance:
A bank's continuity planning must form part of broader recovery and crisis-management arrangements. Financial distress can require organisational measures extending beyond ordinary HR management.

Case 4 – Mallis and Others v Commission and ECB

CJEU, Joined Cases C-105/15 P to C-109/15 P, Mallis and Others (2016).

The litigation concerned financial-sector restructuring measures during the Cyprus banking crisis.

Relevance:
It illustrates the distinction between institutional decisions and legally binding measures adopted under the EU financial-stability framework.

For Spanish banks, crisis planning must therefore distinguish between:

internal continuity decisions;

supervisory intervention;

resolution measures.

Case 5 – Römer v Freie und Hansestadt Hamburg

CJEU, Case C-147/08, Römer (2011).

Although not a banking case, this decision is relevant to the principle that employment arrangements must comply with EU equality law.

Workforce-continuity relevance:
Banks cannot use emergency staffing arrangements as a justification for discriminatory treatment.

Case 6 – Spanish Constitutional Court and working-time/employee-rights jurisprudence

Spanish Constitutional Court and Supreme Court employment jurisprudence repeatedly emphasises that employer management powers are subject to statutory and constitutional limitations.

This is important for banks because continuity measures may involve:

changes to schedules;

remote work;

emergency staffing;

reassignment;

overtime;

monitoring.

A bank's continuity strategy must therefore remain consistent with employees' statutory and constitutional rights.

20. Workforce Continuity Strategy for a Spanish Bank

A legally robust strategy can be structured as follows:

21. Three Lines of Defence

Workforce continuity should be incorporated into the three-lines model.

First line – Business operations

Operational departments ensure that employees can continue performing critical activities.

Second line – Risk and compliance

Risk management identifies:

staffing risks;

operational risks;

concentration risks;

key-person dependency.

Compliance ensures legal requirements remain satisfied.

Third line – Internal audit

Internal audit independently evaluates whether:

continuity plans exist;

plans are realistic;

employees are trained;

testing has occurred;

weaknesses are corrected.

22. Board Responsibilities

The board has an important role in workforce resilience.

It should ensure that:

critical functions are identified;

management succession exists;

operational risks are monitored;

continuity plans are funded;

crisis responsibilities are clear;

testing is conducted;

deficiencies are corrected.

The board should not assume that workforce continuity is exclusively an HR function.

In a modern bank, it is a prudential governance issue.

23. Regulatory Consequences of Poor Workforce Continuity

Failure to maintain adequate continuity arrangements can potentially produce:

Supervisory consequences

supervisory findings;

remediation requirements;

enhanced monitoring;

governance requirements.

Operational consequences

payment disruption;

customer losses;

regulatory reporting failures;

cybersecurity incidents.

Employment consequences

labour disputes;

health and safety claims;

unlawful working-time practices.

Financial consequences

compensation claims;

regulatory penalties;

operational losses;

reputational damage.

24. Important Legal Principle

The central principle can be expressed as:

A Spanish bank must maintain sufficient organisational, technological and human-resource capacity to perform critical banking functions continuously and safely, while respecting prudential, labour, data-protection and financial-crime requirements.

Workforce continuity is therefore not simply about having "enough employees." It concerns whether the bank can continue critical services when ordinary staffing arrangements fail.

25. Conclusion

Banking Law and Workforce Continuity Strategies in Spain sit at the intersection of banking regulation, operational resilience, employment law, cybersecurity and corporate governance.

The Spanish framework requires banks to think systematically about:

key-person risk;

succession;

cross-training;

remote working;

crisis staffing;

outsourcing;

ICT resilience;

cybersecurity;

AML continuity;

payment-system continuity;

employee rights; and

regulatory supervision.

The introduction of DORA from January 2025 has strengthened the connection between technology resilience and workforce resilience. A bank that has sophisticated backup technology but insufficient qualified personnel may still be unable to maintain critical services.

Accordingly, the strongest Spanish banking continuity model is one in which people, technology, governance and legal compliance are integrated into a single operational-resilience framework.