Critical Infrastructure, Finance and National Security in Spain: Detailed Legal Explanation with Case Laws

1. Introduction

In Spain, critical infrastructure protection, financial stability and national security are interconnected legal and regulatory matters. The Spanish legal system recognises that serious disruption to essential banking services, payment systems, telecommunications, energy supplies or financial-market infrastructure can threaten not only economic activity but also public security, constitutional interests and the functioning of the State.

Spain regulates these risks through a combination of:

Critical infrastructure protection law, particularly Law 8/2011 and Royal Decree 704/2011.

National security law, particularly Law 36/2015 on National Security.

Banking and financial regulation, including Law 10/2014, Law 11/2015 and the European Union banking framework.

Cybersecurity and operational resilience regulation, including the EU Digital Operational Resilience Act (DORA), the NIS2 Directive and Spain's cybersecurity legislation.

Foreign investment screening, under Law 19/2003 and related legislation.

Constitutional and judicial safeguards, including the case law of Spain's Constitutional Court, the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR).

The central legal principle is:

A financial institution or financial infrastructure may become a matter of national-security concern when its disruption, destruction, manipulation or loss of operational control could seriously affect essential services, financial stability or the security of the State.

However, an important distinction must be maintained: a bank is not automatically designated as critical infrastructure merely because it is large, systemically important or economically significant. The legal consequences depend on the applicable designation and regulatory framework.

2. Constitutional foundations in Spain

The Spanish Constitution of 1978 provides the foundations for government intervention, protection of economic activity, national security and judicial supervision.

Constitutional balance

The Spanish State may impose necessary safeguards on financial operators, including security obligations, supervisory restrictions and resolution measures. Nevertheless, those measures must have a lawful basis and comply with applicable requirements of proportionality, due process, property protection and judicial oversight.

National security is therefore not an unrestricted justification for interfering with financial institutions.

3. Spain's critical infrastructure protection legislation

3.1 Law 8/2011 of 28 April

Ley 8/2011, de 28 de abril, por la que se establecen medidas para la protección de las infraestructuras críticas is Spain's foundational critical infrastructure protection statute.

It establishes measures for protecting infrastructures whose disruption or destruction could seriously affect essential services.

Its purposes include identifying critical infrastructure, coordinating public authorities and operators, preventing serious disruptions and improving preparedness against deliberate threats.

Three key legal concepts

Strategic infrastructure (infraestructuras estratégicas)

Facilities, networks, systems and equipment needed for the provision of essential services.

Critical infrastructure (infraestructuras críticas)

Strategic infrastructure whose operation is indispensable and for which adequate alternative solutions are not available, so that its disruption or destruction would seriously affect essential services.

Critical operator (operador crítico)

A public or private entity responsible for the investment in, or day-to-day operation of, an infrastructure designated as critical under the statutory system.

These classifications should not be treated as interchangeable.

3.2 Application to the financial sector

The law includes the financial and tax system among Spain's strategic sectors.

Consequently, infrastructure such as the following may fall within the critical-infrastructure framework if the applicable designation requirements are satisfied:

Interbank payment and settlement systems.

Infrastructure supporting essential banking operations.

Central financial-processing facilities.

Systems essential to securities clearing and settlement.

Data and communications infrastructure on which critical financial services depend.

Infrastructure indispensable to the continuity of essential financial services.

For example, the sustained failure of an indispensable payment-processing platform could create a wider national-security concern by preventing businesses, financial institutions and essential service providers from making payments.

The designation assessment, however, concerns the particular infrastructure and its significance, not merely the commercial importance of its owner.

3.3 Royal Decree 704/2011

Real Decreto 704/2011, de 20 de mayo implements Law 8/2011 and provides the institutional and procedural framework for Spain's critical infrastructure protection system.

Important elements include the identification and designation of critical infrastructure, coordination with relevant authorities and the development of security planning requirements.

The framework provides for instruments including:

Planes Estratégicos Sectoriales — strategic sector plans.

Planes de Seguridad del Operador — operator security plans.

Planes de Protección Específicos — specific protection plans.

Planes de Apoyo Operativo — operational support plans.

The Centro Nacional de Protección de Infraestructuras Críticas (CNPIC) is a central institution in Spain's critical infrastructure protection arrangements.

Legal significance for banks

Where a banking operator or its infrastructure receives the relevant designation, additional requirements may arise concerning risk assessment, protection planning, security coordination and incident preparedness.

Ordinary banking supervision alone does not replace these obligations.

4. National Security Law: Law 36/2015

Ley 36/2015, de 28 de septiembre, de Seguridad Nacional provides the principal statutory framework for Spain's national security policy.

4.1 Meaning of national security

Article 3 describes national security as State action directed towards protecting citizens' freedom, rights and welfare, ensuring Spain's defence and constitutional principles and values, and contributing to international security.

This concept is broader than conventional military defence.

It encompasses serious threats to the functioning of society and the State, including threats involving:

Economic and financial instability.

Cyberattacks on essential systems.

Disruption of critical infrastructure.

Organised crime and terrorism.

Foreign interference and strategic dependencies.

Major crises affecting essential services.

4.2 Financial and economic security

Financial stability is an important component of economic security because banking infrastructure supports the functioning of the entire economy.

Consider a cyberattack that simultaneously disables significant interbank payment systems, compromises important transaction records and prevents major businesses from meeting payment obligations.

Such an incident may have consequences beyond the financial sector. It could affect employment, food distribution, hospitals, energy provision, government payments and public confidence.

The national-security significance arises from the systemic consequences of the disruption, rather than simply from the financial losses suffered by one institution.

4.3 Situation of interest for national security

Law 36/2015 provides for a situación de interés para la Seguridad Nacional — a situation of interest for national security.

This is a special mechanism for the coordination of authorities and resources when a serious situation requires enhanced national-level management.

It is not equivalent to the constitutional states of alarm, exception or siege under Article 116 of the Constitution.

The national-security framework permits exceptional coordination, but does not automatically authorise suspension of fundamental rights.

4.4 Obligations of financial institutions

The National Security Law does not, by itself, classify every financial institution as critical infrastructure.

Instead, the applicable obligations arise through the interaction between national-security arrangements and relevant sector-specific legislation.

A bank may therefore be subject simultaneously to:

Prudential supervision by the appropriate banking authority.

Operational resilience and ICT-risk requirements.

Critical infrastructure security requirements if designated.

Resolution and recovery requirements where applicable.

National crisis coordination where legally justified.

5. Banking regulation and protection of financial stability

Spain's financial stability framework operates within the European Union's Banking Union and domestic banking legislation.

5.1 Law 10/2014 — Regulation, supervision and solvency of credit institutions

Ley 10/2014, de 26 de junio, de ordenación, supervisión y solvencia de entidades de crédito establishes important elements of Spain's regulatory regime for credit institutions.

Its objectives include maintaining the safety and soundness of banks, facilitating effective supervision and limiting risks to depositors and the financial system.

Regulatory matters include institutional governance, capital and solvency requirements, supervisory powers and intervention where statutory grounds are met.

5.2 Key institutions

5.3 Systemically important banks versus critical infrastructure

This distinction is fundamental.

A bank may be systemically important without every facility or network it operates being designated critical infrastructure.

Equally, a highly important financial processing system could qualify for critical infrastructure protection even if its operator is not one of Spain's largest banks.

6. Bank resolution as a financial-security mechanism

6.1 Law 11/2015

Ley 11/2015, de 18 de junio, de recuperación y resolución de entidades de crédito y empresas de servicios de inversión forms an important part of Spain's banking recovery and resolution framework.

Together with applicable EU legislation, it is designed to manage failing financial institutions while limiting serious adverse effects on financial stability.

6.2 Critical functions

Bank resolution law uses the concept of critical functions.

These are banking activities, services or operations whose interruption would likely disrupt services essential to the real economy or financial stability, taking into account their systemic importance and the availability of substitutes.

Examples can include:

Deposit-taking and access to transaction accounts.

Essential payment services.

Clearing and settlement.

Provision of financing to important parts of the economy.

Other banking functions whose sudden interruption could produce severe systemic consequences.

A critical function under bank resolution law is not automatically an infrastructure designation under Law 8/2011.

6.3 Main resolution tools

Depending on the applicable legal requirements, bank resolution authorities may use tools such as sale of business, bridge institutions, asset separation and bail-in.

Their objective is to preserve critical financial functions and financial stability, while managing bank failure in accordance with the statutory framework.

Resolution is not an unlimited government power to confiscate assets. It operates under prescribed conditions, procedural safeguards and applicable valuation and compensation rules.

7. Cybersecurity and digital operational resilience

Modern banking depends heavily on technology. Payments, account access, authentication, securities trading, fraud prevention and regulatory reporting all rely on digital systems.

A serious operational disruption can therefore rapidly become a financial stability concern.

7.1 Digital Operational Resilience Act (DORA)

Regulation (EU) 2022/2554 — DORA became applicable on 17 January 2025.

Because it is an EU regulation, it is directly applicable within its scope in Spain.

DORA establishes a harmonised framework addressing:

ICT risk management.

ICT-related incident management, classification and reporting.

Digital operational resilience testing.

ICT third-party risk management.

Oversight of designated critical ICT third-party service providers.

Why DORA matters to national security

Suppose multiple Spanish financial institutions depend on the same cloud infrastructure provider.

If that provider experiences a major failure, the effect could extend across different banks, payment services and other financial institutions.

DORA addresses this type of operational concentration and dependency risk.

It creates a connection between financial regulation and protection of technology infrastructure supporting essential financial services.

7.2 NIS2 Directive

Directive (EU) 2022/2555 — NIS2 establishes an EU-wide cybersecurity framework covering important and essential sectors.

The banking sector and financial-market infrastructure fall within its sectoral coverage, although the interaction with DORA is important.

Under NIS2's sector-specific rules, DORA may operate as the relevant special cybersecurity framework for financial entities where its requirements cover the corresponding matters.

It would therefore be inaccurate to assume that every NIS2 obligation applies cumulatively and identically to every DORA-covered financial institution.

Because NIS2 is a directive, its precise implementation through Spanish national legislation must also be examined.

7.3 Spanish cybersecurity legislation

Other important instruments include:

Royal Decree-Law 12/2018, concerning the security of networks and information systems, and Royal Decree 43/2021, developing that earlier framework.

These instruments form part of Spain's existing national cybersecurity architecture, subject to later amendments and the evolution of EU law.

The critical infrastructure regime and cybersecurity legislation may operate together, but neither should automatically be substituted for the other.

7.4 Critical Entities Resilience Directive

Directive (EU) 2022/2557 — Critical Entities Resilience Directive (CER) addresses resilience against non-cyber risks in sectors including banking and financial-market infrastructure.

It is important to distinguish its entity-resilience framework from Spain's earlier Law 8/2011 infrastructure-protection framework.

Financial entities covered by DORA also benefit from particular sector-specific treatment under the CER Directive. Accordingly, the exact interaction between physical resilience obligations, national transposition measures and DORA must be evaluated rather than assuming every general CER requirement applies in full.

Currency note: The EU rules and established Spanish statutes described here can be identified with confidence, but I cannot verify amendments, Spanish NIS2/CER transposition status or regulatory decisions made up to October 2026 because live legal research is unavailable in this chat.

8. Foreign investment and national-security screening in Spain

Foreign acquisition of strategic businesses can create national-security questions, particularly when ownership or control of indispensable infrastructure may be transferred.

8.1 Law 19/2003

Law 19/2003 of 4 July, particularly Article 7 bis, provides a key statutory basis for screening certain foreign direct investments in Spain.

The framework must be read alongside relevant amendments and implementing measures, including Royal Decree 571/2023 on foreign investment.

8.2 Protected interests

The screening framework can reach investments involving strategic or sensitive sectors and other legally specified circumstances.

Relevant factors may include:

Critical infrastructure.

Critical technologies and dual-use technologies.

Essential supplies.

Sensitive information and access to personal data.

Certain investors with links to foreign governments.

Circumstances concerning public order, public security or public health.

8.3 Application to financial infrastructure

Imagine a foreign investor seeking control of a Spanish company that operates infrastructure indispensable to major interbank transactions.

Authorities may need to examine whether the transaction falls within the screening regime and whether it presents an identified risk to public order, public security or public health.

Not every foreign acquisition of shares in a bank requires national-security screening. Questions of investor origin, transaction structure, control, applicable exemptions, statutory thresholds and sector-specific authorisation must be assessed separately.

Banking qualifying-holding approvals and foreign investment screening may also involve different authorities, legal tests and procedures.

8.4 European framework

Regulation (EU) 2019/452 provides the EU framework for screening foreign direct investment.

Its relevance is particularly strong when investments involve critical infrastructure, critical technologies or sensitive information.

The Regulation does not give Member States an unlimited power to exclude foreign investors on grounds of nationality.

Intervention must remain within the applicable legal framework and respect EU law.

9. Important Case Laws

There is no single Spanish judgment that comprehensively defines the relationship between critical infrastructure, national security and banking. The legal principles instead emerge from constitutional litigation, EU banking supervision, bank resolution, financial-crisis cases and cases involving restrictions on strategic investment.

The following decisions are particularly relevant.

Case 1: European Commission v Kingdom of Spain — restrictions on strategic shareholdings

CJEU, Case C-463/00, judgment of 13 May 2003

Background

Spain maintained special governmental powers affecting companies in strategic economic sectors through a system commonly described as golden shares or special administrative controls.

The European Commission challenged aspects of this regime on the basis that the restrictions interfered with the free movement of capital.

Legal issue

Could Spain retain special powers over strategic undertakings to protect public interests without violating EU law?

Judgment

The Court of Justice found the challenged Spanish arrangements incompatible with the free movement of capital.

Although public-security considerations can, in principle, justify certain restrictions, they must comply with EU law and the principle of proportionality.

Broad administrative discretion and insufficiently defined constraints create serious legal difficulties.

Legal principles

Strategic importance does not create unrestricted government authority over private undertakings.

Public-security justifications must be legally supportable.

Restrictions must be proportionate and subject to sufficient legal safeguards.

Ownership controls cannot be justified merely by invoking economic importance.

Relevance to Spanish banks

This is an important authority for assessing government intervention in ownership or control of strategic businesses.

Its practical lesson is that Spain cannot simply label a financial enterprise strategically important and thereby bypass EU internal-market protections.

A modern intervention must rest on the applicable legislative framework and be justified under the relevant legal test.

This is an investment and free-movement judgment, not a decision designating a bank as critical infrastructure.

Case 2: Xella Magyarország — security-based foreign investment restrictions

CJEU, Case C-106/22, judgment of 13 July 2023

Background

The case concerned a Hungarian restriction on a transaction involving a company supplying raw materials used in construction.

The national authorities justified the intervention by reference to strategic supply concerns.

Legal issue

To what extent may a Member State restrict an acquisition by invoking security or strategic economic interests?

Judgment

The Court held that the restriction at issue was incompatible with Article 49 TFEU on freedom of establishment.

It emphasised the need for a sufficiently serious threat to a fundamental interest of society when relying on public-security justification.

General economic concerns did not establish the necessary justification in the circumstances of the case.

Relevance to Spain

Although the judgment concerns Hungary, it helps explain the constraints applying to Spanish security-related investment measures.

For a banking or financial infrastructure acquisition, authorities should identify the relevant statutory power, the protected interest and the relationship between the transaction and the asserted threat.

Important qualification: the result in Xella cannot automatically be extended to every acquisition involving a non-EU investor. Its factual and EU-law context matters.

Case 3: Landeskreditbank Baden-Württemberg v European Central Bank — systemic importance and banking supervision

CJEU, Case C-450/17 P, judgment of 8 May 2019

Background

Landeskreditbank Baden-Württemberg challenged the ECB's decision classifying it as a significant supervised entity under the Single Supervisory Mechanism.

The bank argued that there were circumstances justifying direct supervision by the national competent authority instead.

Legal issue

What principles govern the allocation of direct supervisory responsibility between the ECB and national banking authorities?

Judgment

The Court upheld the approach taken by the EU courts regarding the ECB's competence and the interpretation of the relevant framework.

The judgment clarified the legal structure governing direct ECB prudential supervision.

Legal principles

Supervisory significance is determined under the relevant EU regulatory criteria.

Allocation of supervisory responsibility is a legal decision subject to judicial review.

The Single Supervisory Mechanism must be interpreted according to its governing legislative framework.

Relevance to Spain

Spanish banks falling within the ECB's direct supervision remain subject to the requirements of EU banking law.

However, ECB significance does not automatically mean that the bank or its facilities are designated as critical infrastructure under Spanish Law 8/2011.

This case is particularly useful when separating prudential importance from critical infrastructure status.

Case 4: Berlusconi and Fininvest v Banca d'Italia — judicial review of banking ownership decisions

CJEU, Case C-219/17, judgment of 19 December 2018

Background

The dispute arose from a procedure involving the acquisition of a qualifying holding in a credit institution.

The relevant process involved national authorities and the European Central Bank.

Legal issue

Which court has jurisdiction where national authorities perform preparatory acts in a procedure culminating in an ECB decision?

Judgment

The Court held that, in the particular composite administrative procedure at issue, judicial review of the final ECB decision and the relevant preparatory national acts fell within the exclusive jurisdiction of the EU courts.

Legal principles

Banking ownership authorisations operate within a defined allocation of EU and national powers.

National preparatory acts cannot always be challenged independently before national courts.

Effective judicial protection must be secured through the correct judicial route.

Application in Spain

Where an investor seeks to acquire a significant holding in a Spanish bank, the appropriate banking authorisation procedure must be followed.

Where national-security investment screening is also relevant, that separate process must be assessed on its own legal terms.

Significance: the decision demonstrates that regulatory approval of banking ownership is a legally structured process, not merely an unrestricted governmental security assessment.

Case 5: Kotnik and Others — financial stability and bank rescue measures

CJEU, Case C-526/14, judgment of 19 July 2016

Background

The case arose from measures related to State aid for banks experiencing financial difficulties.

Questions concerned burden-sharing measures imposed on shareholders and holders of certain subordinated instruments in the context of recapitalisation.

Legal issue

Were the European Commission's banking-sector State aid conditions legally binding, and were burden-sharing measures compatible with EU law?

Judgment

The Court clarified that the Commission's 2013 Banking Communication did not itself legally bind Member States in the same way as legislation.

It also addressed the compatibility of burden-sharing requirements with relevant EU principles, including property protection, subject to applicable legal constraints.

National-security relevance

The judgment shows how severe banking instability may justify significant intervention in private financial interests.

However, the Court's reasoning does not establish a general power to take private banking assets whenever a government invokes national security.

Application to Spain

If Spanish authorities participate in a bank recapitalisation or restructuring, the measures must comply with applicable bank-resolution rules, State aid law where relevant and protected legal rights.

Case 6: Ledra Advertising and Others v European Commission and ECB — financial crisis and fundamental rights

CJEU, Joined Cases C-8/15 P to C-10/15 P, judgment of 20 September 2016

Background

The case concerned financial-assistance arrangements for Cyprus during its banking crisis.

Depositors challenged aspects of the arrangements and alleged infringements of fundamental rights.

Legal issue

Could EU institutions potentially incur legal responsibility for their involvement in financial assistance arrangements that affected protected property interests?

Judgment

The Court recognised that the European Commission remained required to ensure consistency with EU law, including the Charter of Fundamental Rights, when acting within the relevant European Stability Mechanism arrangements.

On the facts, the Court did not find the necessary unlawful interference with property rights to establish the claimed liability.

Legal principles

Financial stability is a legitimate public-interest objective.

Property rights are not absolute.

Interference must comply with the relevant legal requirements.

EU institutions do not escape fundamental-rights constraints merely because the circumstances involve a severe financial crisis.

Relevance to Spain

Emergency bank restructuring must not be treated as legally immune from review.

Measures affecting depositors, shareholders or other investors require a valid legal basis and compliance with applicable safeguards.

Case 7: Banco Popular Español — resolution and continuity of financial functions

General Court of the European Union, Case T-481/17, Fundación Tatiana Pérez de Guzmán el Bueno and SFL v Single Resolution Board, judgment of 1 June 2022

Related judgment: Case T-628/17, Aeris Invest v European Commission and Single Resolution Board, 1 June 2022

Background

Banco Popular Español, a significant Spanish credit institution, experienced a severe deterioration in its position.

On 7 June 2017, the Single Resolution Board adopted a resolution scheme involving the sale of the business to Banco Santander.

The decision followed the assessment that Banco Popular was failing or likely to fail, and the authorities considered the applicable resolution conditions to be satisfied.

The resolution generated extensive litigation by affected investors.

Legal issues

The proceedings raised issues concerning:

Whether the statutory resolution conditions were fulfilled.

The public interest in resolution.

Valuation and decision-making procedures.

Procedural rights and judicial review.

The effect on shareholders and other affected investors.

General Court decisions

In its judgments of 1 June 2022, the General Court dismissed several major actions challenging the resolution scheme.

The litigation illustrates the application of EU bank-resolution law to a major Spanish banking institution.

These 2022 judgments should be read alongside any subsequent appellate decisions; the procedural position as of October 2026 has not been independently verified here.

Importance for financial security

Banco Popular provides a concrete example of the interaction between financial stability and continuity of essential banking services.

The resolution framework sought to prevent an uncontrolled failure that might adversely affect critical banking functions, financial stability and the broader economy.

Crucial distinction: Banco Popular's resolution does not establish that the bank had been designated a critical infrastructure operator under Law 8/2011.

Its importance lies in the application of the EU banking resolution regime.

Practical legal takeaway

A bank may be considered sufficiently important to justify resolution in the public interest, even where no publicly established critical-infrastructure designation is being relied upon.

The public interest in maintaining critical financial functions is legally distinct from the formal identification and designation of infrastructure under the Spanish critical infrastructure regime.

Case 8: Spanish Constitutional Court — emergency powers and constitutional limits

Tribunal Constitucional, STC 148/2021, 14 July 2021

Background

The Spanish Constitutional Court examined restrictions introduced during the COVID-19 emergency under the constitutional state-of-alarm framework.

Judgment

The Court held that important aspects of the restrictions adopted under the first state of alarm were unconstitutional because of the constitutional framework required for the degree of interference involved.

Relevance

This was not a banking or critical infrastructure case.

Its relevance is constitutional: severe emergencies do not remove the requirement that government measures be adopted through the legally appropriate mechanism.

Applied by analogy to financial-sector national-security intervention, it supports careful scrutiny of:

The statutory authority relied upon.

The nature and degree of interference with rights.

Whether the relevant emergency powers permit the measure.

Constitutional limits on executive action.

A declaration of national-security interest under Law 36/2015 is not a substitute for every other constitutional or statutory authorisation.

Case 9: Spanish Constitutional Court — prolonged emergency measures

Tribunal Constitucional, STC 183/2021, 27 October 2021

Background

The judgment addressed constitutional issues concerning the extension and administration of Spain's later COVID-19 state of alarm.

Judgment

The Court found constitutional defects in important aspects of the challenged arrangements, including the design of the extension and delegation of certain powers.

Relevance to national security

The decision reinforces the importance of constitutional accountability, parliamentary control and the proper allocation of authority during a national emergency.

For financial infrastructure disruptions, it illustrates why the scale of a crisis does not, by itself, resolve questions of legal competence.

It is an analogical constitutional authority, not a precedent directly interpreting Law 8/2011 or the financial-sector critical infrastructure designation procedure.

10. Legal procedure for designation of financial critical infrastructure in Spain

Spain's critical infrastructure system follows an administrative identification and designation process governed by Law 8/2011 and Royal Decree 704/2011.

A simplified explanation is:

Stage 1 — Identification of essential financial services

Determine which services and infrastructure are essential to the functioning of the financial sector.

Stage 2 — Criticality assessment

Assess potential consequences of disruption, available substitutes and the infrastructure's importance to essential services.

Stage 3 — Formal designation

Apply the statutory designation procedure involving the competent authorities and CNPIC.

Stage 4 — Security planning

Fulfil applicable operator security planning and specific infrastructure protection obligations.

Stage 5 — Continuing protection and coordination

Maintain required security measures, institutional coordination and preparedness as prescribed by law.

This is an explanatory summary rather than a replacement for the detailed procedure in the legislation.

Is designation publicly disclosed?

Critical infrastructure information may contain sensitive operational and security details. Consequently, the absence of a bank from an ordinary public list should not be treated as conclusive proof that it has no designated infrastructure.

Conversely, a bank's economic significance does not justify asserting that it is formally designated without authoritative evidence.

11. Hypothetical legal scenarios

Scenario A: Cyberattack against Spanish payment infrastructure

A major payment infrastructure operator suffers a prolonged cyber incident.

Potential legal regimes: Law 8/2011 where applicable, DORA for covered financial entities, banking supervisory requirements and national-security crisis coordination mechanisms.

Legal analysis: The relevant authorities would examine whether the infrastructure was formally designated, which entity bears the operational duties, whether reportable incidents occurred and whether exceptional coordination was legally justified.

Relevant cases: Landeskreditbank for the supervisory framework and Ledra Advertising for the importance of maintaining legal safeguards during financial crises.

Scenario B: Foreign acquisition of sensitive banking infrastructure

A foreign investor proposes acquiring control over a company operating infrastructure essential to important banking services.

Potential legal regimes: Law 19/2003, Royal Decree 571/2023, Regulation (EU) 2019/452 and, if a qualifying holding in a bank is involved, the applicable banking ownership rules.

Legal analysis: The State must determine whether the transaction falls within the relevant authorisation or screening requirements and whether a legally supportable security concern exists.

Relevant cases: Commission v Spain (C-463/00), Xella Magyarország (C-106/22) and Berlusconi and Fininvest (C-219/17).

Scenario C: Sudden failure of a systemically important Spanish bank

A bank faces severe liquidity difficulties and can no longer continue its normal operations.

Potential legal regimes: Law 11/2015, the EU Bank Recovery and Resolution Directive, the Single Resolution Mechanism and relevant prudential legislation.

Legal analysis: Resolution authorities determine whether the applicable failure, alternatives and public-interest conditions are satisfied.

Relevant cases: Banco Popular, Kotnik and Ledra Advertising.

The legal question is not necessarily whether the bank owns designated critical infrastructure. It is whether the conditions for applying the bank-resolution framework exist.

Scenario D: Government imposes emergency restrictions on a financial operator

Spanish authorities impose extraordinary restrictions on a financial operator following a serious national-security incident.

Legal analysis: The restrictions require identification of the relevant statutory power, competent authority, applicable procedural requirements and judicial remedy.

Relevant cases: STC 148/2021, STC 183/2021 and Commission v Spain.

These decisions help establish the general limits on extraordinary government intervention, although they do not determine the legality of a hypothetical financial restriction without further facts.

12. Comparison of the main legal regimes

13. Legal remedies and judicial oversight

Where financial or critical infrastructure operators dispute an administrative decision, possible legal remedies depend upon which authority issued it and the applicable procedure.

For example:

Spanish administrative decisions: These may be subject to administrative-law remedies and judicial review before the competent Spanish contentious-administrative courts, subject to the governing procedural rules.

ECB decisions: These may be challenged through the relevant EU procedures and before the EU courts where appropriate.

Single Resolution Board decisions: Judicial review is governed by applicable EU banking resolution law and EU judicial procedures.

Fundamental rights concerns: Operators and affected parties may invoke relevant constitutional protections, the EU Charter of Fundamental Rights where applicable, and other relevant legal safeguards.

No single procedural route applies to all financial-security decisions.

14. Principal legislation and judgments for legal research

The primary sources should be consulted directly when preparing a legal opinion, academic dissertation or litigation submission.

Spanish legislation

Spanish legislation can be located through the Boletín Oficial del Estado (BOE).

European legislation

Regulation (EU) 2022/2554 — DORA.

Directive (EU) 2022/2555 — NIS2.

Directive (EU) 2022/2557 — Critical Entities Resilience.

Regulation (EU) 2019/452 — Foreign Direct Investment Screening.

Directive 2014/59/EU — Bank Recovery and Resolution Directive.

Regulation (EU) No 806/2014 — Single Resolution Mechanism.

Regulation (EU) No 1024/2013 — Single Supervisory Mechanism.

Official texts are available through EUR-Lex.

Case law research

The judgments discussed above can be researched through CURIA, Court of Justice of the European Union and the Spanish Constitutional Court.

For academic or professional purposes, particular care should be taken to verify whether judgments have been appealed, modified or subsequently interpreted.

15. Overall legal conclusion

Spain's framework demonstrates that protection of financial infrastructure is both a financial-regulatory concern and, in appropriate circumstances, a national-security concern.

Four conclusions emerge.

First, Law 8/2011 provides the legal framework for identifying and protecting critical infrastructure, including infrastructure within the financial and tax sector.

Second, Law 36/2015 recognises a broader national-security framework capable of addressing serious crises with consequences extending beyond individual financial institutions.

Third, banking legislation provides a distinct system for addressing financial instability, systemic risk and continuity of critical financial functions. The Banco Popular litigation illustrates the importance of this framework in Spain.

Fourth, EU and Spanish case law demonstrates that national security, systemic importance and financial stability do not remove legal constraints on government or regulatory intervention. Public authorities must act within their statutory powers and comply with applicable principles of proportionality, procedural protection and judicial review.

The most important legal distinction is between (a) a designated critical infrastructure, (b) a systemically important financial institution, (c) a critical function under bank-resolution law, and (d) an undertaking subject to national-security investment screening. These categories overlap in practice but remain legally separate.

For an assessment of a particular bank in Spain, the strongest legal approach is to determine its status independently under each framework, identify the competent authority and applicable obligations, and then assess any proposed intervention against the relevant Spanish and EU case law.