Critical Infrastructure Investment Review in the Banking Sector: Spain and European Union Law

1. Introduction

Critical infrastructure investment review is the legal and regulatory process by which a government examines proposed investments, acquisitions, mergers, shareholding changes, or transfers of control involving infrastructure essential to national security, economic stability, public safety, or the continuity of essential services.

In the banking sector, investment review is particularly important because banks are not merely commercial enterprises. They form part of a country's financial infrastructure and perform functions essential to the national economy.

These functions include:

Accepting deposits and safeguarding customer funds.

Providing credit to businesses and households.

Operating and participating in payment and settlement systems.

Supporting government financing and treasury operations.

Providing liquidity to the wider economy.

Maintaining financial stability and economic confidence.

Protecting financial information and sensitive customer data.

An investment in a bank can therefore raise concerns beyond the ordinary commercial consequences of a merger or acquisition.

For example, the acquisition of a strategically important Spanish bank by a foreign investor may require several separate assessments: whether the investor satisfies banking prudential standards, whether the acquisition threatens national security or public order, and whether the transaction adversely affects competition.

The central legal principle is that approval under one regulatory regime does not automatically constitute approval under the others.

This explanation focuses primarily on Spain, within the wider EU legal framework, and includes important judicial decisions relevant to investment restrictions, banking supervision, ownership rights, and national security.

2. Legal framework in Spain

Spanish banking investment review operates through overlapping legal regimes.

These rules serve different purposes.

Foreign investment screening principally considers national security, public order and other protected public interests.

Banking prudential supervision examines whether an investor is suitable to own or control a regulated credit institution and whether the transaction endangers sound and prudent management.

Critical-infrastructure regulation concerns the identification and protection of essential infrastructure and services.

Competition law addresses concentrations of economic power and potentially anticompetitive conduct.

A major banking acquisition may engage more than one of these frameworks simultaneously.

3. Why banking is treated as strategic infrastructure

3.1 Banks and the continuity of essential services

A banking system is a network of mutually dependent institutions, systems and services.

Its stability depends on the uninterrupted operation of several critical functions.

Banking critical-infrastructure interdependency

Banking and financial system

Deposits, lending, liquidity and financial stability

Energy

Power for branches, data centres and ATMs

Telecom

Connectivity, networks and customer access

Digital systems

Core banking, cloud and cybersecurity

Critical financial services

Payment systems • Clearing and settlement • Interbank liquidity • Access to deposits

Wider national consequences

Economic continuity • Business operations • Public services • National security

Suppose an investor acquires control of a bank that provides payment services to essential utilities, public authorities and major businesses.

The acquisition might raise questions about:

Whether control over those services could be exercised against Spain's public interests.

Whether key digital infrastructure might become dependent on a high-risk third party.

Whether sensitive financial information could be accessed or transferred improperly.

Whether the transaction could undermine the uninterrupted delivery of essential services.

Whether the investor's financial condition could threaten the bank's solvency or resilience.

These concerns are relevant to investment review, but they do not automatically justify prohibiting a transaction.

A restriction must have an appropriate legal basis and must satisfy applicable principles of proportionality and EU law.

3.2 Are all Spanish banks legally designated critical infrastructure?

No.

A distinction must be maintained between three concepts:

A large bank is not automatically designated critical infrastructure merely because it holds significant deposits or operates nationally.

Similarly, a particular financial infrastructure, such as a payment or settlement system, can be strategically significant even where an individual participating bank has not been specifically classified as a critical-infrastructure operator.

The Spanish designation process under Law 8/2011 involves administrative assessments and security considerations. The complete public identification of sensitive assets may be restricted.

This distinction is essential in legal analysis: national-security screening of an investment does not necessarily require prior formal designation of the target bank as critical infrastructure.

4. Foreign direct investment screening: Article 7 bis of Law 19/2003

4.1 General purpose

Article 7 bis of Law 19/2003 establishes a screening regime for specified foreign investments in Spain.

The screening system was significantly developed in 2020, including through Royal Decree-Law 8/2020, against the background of concerns over strategic acquisitions and economic vulnerabilities.

Royal Decree 571/2023 subsequently developed the framework governing foreign investments.

Its central objective is to enable Spain to examine foreign acquisitions that may affect protected public interests.

4.2 When can an investment in a bank be screened?

Subject to the statutory conditions and applicable exceptions, screening can apply where an investment by a covered foreign investor:

Results in an ownership interest of at least 10% in a Spanish company; or

Gives the investor effective participation in the management or control of that company.

The regime also identifies certain sensitive sectors and investor characteristics.

Relevant sectors can include:

Critical infrastructure, including financial infrastructure.

Critical technologies and dual-use technologies.

Supply of fundamental inputs.

Access to sensitive information.

Other areas specified by the legislation.

Investor-related concerns can include control by a foreign government, previous involvement in activities affecting security or public order, or serious risks of illegal or criminal activity, within the statutory criteria.

An acquisition of a banking institution can therefore require screening even where its shareholding percentage does not appear to confer outright majority ownership, if the transaction nevertheless meets the legal definition of control or other relevant conditions.

4.3 Does the identity of the foreign investor matter?

Yes.

Spain's principal structural screening rules distinguish between investors outside the EU/EFTA and other investors. Separate temporary or specially extended provisions have also covered certain EU/EFTA investments.

For that reason, the precise position depends on the investment date, the investor's ownership chain, the transaction structure and the screening provisions then in force.

For example:

Scenario A: Non-EU sovereign-controlled investor

A state-controlled investment fund outside the EU seeks to acquire 30% of a Spanish bank.

This presents potentially significant screening questions concerning foreign-government influence, banking infrastructure and control.

Scenario B: Private European banking group

A privately controlled EU banking group seeks to acquire 20% of a Spanish bank.

The transaction would require analysis of the banking qualifying-holding regime. Whether Spanish FDI screening also applies depends on the relevant statutory provisions and transaction circumstances.

Scenario C: Acquisition through a European holding company

A non-EU investor proposes to acquire a Spanish bank indirectly through an EU-incorporated vehicle.

The authorities may need to examine ultimate ownership and control rather than treating the European incorporation of the holding company as conclusive.

4.4 What does the Spanish government evaluate?

The assessment is not confined to the nationality of the investor.

Relevant considerations may include:

First, the target's strategic importance. Does the bank support financial infrastructure essential to the continuity of economic activity?

Second, the identity and control of the investor. Who ultimately controls the acquiring entity, and are any foreign governments involved?

Third, access to sensitive systems and information. Could control of the target create unacceptable security concerns?

Fourth, operational continuity. Could the acquisition weaken the resilience of essential financial services?

Fifth, possible mitigation. Could identified risks be addressed through legally enforceable conditions instead of prohibition?

The detailed assessment must remain anchored in the actual statutory grounds, rather than general political preferences concerning foreign ownership.

4.5 Possible government outcomes

Depending on the applicable procedure and the proposed transaction, the relevant authority may:

Authorize the investment.

Authorize it subject to conditions.

Refuse authorization.

Require compliance with applicable authorization procedures before completion.

Completion without a legally required authorization can carry serious legal consequences, including the investment lacking legal validity or effect until authorization is obtained, as provided by the applicable framework, and possible administrative sanctions.

The precise procedural authority and timetable depend on the governing provisions and transaction characteristics.

5. Banking-specific investment review: ECB and Spanish authorities

An investor acquiring a substantial interest in a Spanish credit institution may be subject to prudential qualifying-holding review, independently of the national-security screening regime.

The legal foundations include:

Council Regulation (EU) No 1024/2013.

Directive 2013/36/EU, as amended.

Spanish Law 10/2014.

Spanish Royal Decree 84/2015.

5.1 Qualifying-holding thresholds

Banking legislation establishes assessment requirements for acquisitions or increases of qualifying holdings.

The commonly relevant thresholds are:

BANK OWNERSHIP THRESHOLDS

10%

Holding threshold

20%

Holding threshold

30%

Holding threshold

50%

Holding threshold

These thresholds concern holdings of capital or voting rights, subject to the relevant legal definitions. Control and becoming a subsidiary can also trigger review. They are not an exhaustive description of all notification obligations.

A person intending to acquire a qualifying holding, or increase one so as to reach or exceed a relevant threshold, generally must notify the competent supervisory authorities in advance.

5.2 The European Central Bank's role

Within the Single Supervisory Mechanism, the European Central Bank has responsibility for decisions on proposed acquisitions of qualifying holdings in credit institutions, working with the relevant national competent authorities.

In Spain, the Banco de España performs important functions in the associated supervisory procedure.

The procedure is established in particular by Articles 4(1)(c) and 15 of Regulation 1024/2013.

The national authority receives and examines the application and submits its assessment or proposal in accordance with the SSM framework. The ECB makes the relevant final prudential decision.

5.3 Criteria for assessing the proposed acquirer

EU banking legislation provides five core assessment criteria.

These criteria help protect the sound and prudent management of banks.

An important limitation is that the ECB's prudential review is not a general national-security veto.

Where a transaction raises national-security issues falling within Spanish FDI screening, those matters must be examined under the applicable screening legislation.

5.4 Comparison between FDI and prudential review

The two processes can operate in parallel. Their legal tests should not be merged.

6. Important European Court of Justice case law

Spain's national-security and banking investment-review powers must be understood in light of EU law, particularly free movement of capital, freedom of establishment, proportionality and effective judicial protection.

The following decisions are particularly important.

Case 1: Commission v Spain — C-463/00

Court of Justice of the European Communities, 13 May 2003

Case: Commission v Spain

Facts

Spain maintained a system of special public powers concerning certain privatized companies operating in strategically important sectors.

These powers could allow the government to influence or control specified corporate decisions, notwithstanding the ordinary ownership and voting structures.

The European Commission challenged the restrictions on the basis that they impeded the free movement of capital.

Legal issue

Could Spain maintain special state authorization powers over strategic private companies in order to protect public interests?

The central question concerned compatibility with what was then Article 56 EC, now Article 63 TFEU.

Judgment

The Court concluded that the challenged Spanish arrangements breached the applicable free-movement obligations.

The mere importance of a company to the national economy did not justify broad or insufficiently confined state intervention in investment decisions.

Legal principle

State measures that deter investment or interfere with shareholder rights can constitute restrictions on free movement of capital.

Public-interest justifications must satisfy EU legal requirements, including proportionality.

Relevance to banking

Suppose Spain establishes a rule requiring government approval for every significant acquisition involving a large Spanish bank, without sufficiently defined substantive criteria.

The rule may face EU-law challenges if it goes beyond the restrictions authorized by the relevant legal framework.

Important distinction: C-463/00 did not concern the current Spanish FDI-screening system and did not prohibit all investment screening. Its importance is that it establishes limits on sweeping national control over corporate acquisitions.

Case 2: Commission v Belgium — C-503/99

Court of Justice, 4 June 2002

Case: Commission v Belgium

Facts

Belgium retained special powers in strategically important energy undertakings.

The powers were intended to safeguard national interests in the energy sector, including security of supply.

The European Commission argued that these measures restricted investment and free movement of capital.

Legal issue

Could special public powers over essential infrastructure be justified by public-security considerations?

Judgment

The Court accepted that safeguarding energy supplies could constitute a legitimate public-security objective.

It also found the particular Belgian arrangements capable of satisfying the applicable EU-law requirements.

Significantly, the mechanisms were more narrowly structured than unrestricted governmental approval powers.

Legal principle

The judgment recognizes that measures protecting genuinely vital infrastructure may be justified when their scope and operation are appropriately limited.

Such measures require:

A legitimate protected public interest.

Suitability for achieving that interest.

Restrictions no greater than necessary.

Sufficiently defined conditions and controls.

Relevance to banking

The reasoning is relevant by analogy to banking infrastructure whose disruption could have serious consequences for essential economic services.

For example, proportionate restrictions directed at a demonstrable threat to continuity of critical payment infrastructure may be easier to justify than a broad prohibition based solely on the nationality of a foreign investor.

The analogy must not be overstated: energy supply and banking prudential stability have different legal characteristics.

Case 3: Commission v Portugal — C-367/98

Court of Justice, 4 June 2002

Case: Commission v Portugal

Facts

Portugal maintained statutory restrictions and special measures relating to investment in privatized companies, including arrangements affecting foreign ownership and acquisitions of significant stakes.

Legal issue

Could a Member State impose special limitations on investment in important national companies?

Judgment

The Court found the challenged measures incompatible with the free movement of capital.

Legal principle

Restrictions on foreign acquisition cannot be justified merely through general economic policy concerns or a preference for domestic ownership.

Relevance to Spanish banking acquisitions

The government cannot ordinarily rely solely on preserving national ownership as a justification for restricting a protected cross-border investment.

If Spain seeks to refuse an acquisition on national-security grounds, it must identify a legally relevant security or public-order concern rather than simply objecting to foreign ownership.

Case 4: Commission v Italy — C-326/07

Court of Justice, 26 March 2009

Case: Commission v Italy

Facts

Italy retained special state powers in privatized companies.

The legal criteria governing intervention included broad concepts such as threats to essential public interests.

The Commission challenged these powers under EU free-movement law.

Legal issue

Were the criteria sufficiently precise and proportionate to justify interference with investors' rights?

Judgment

The Court held that important aspects of the Italian regime were incompatible with EU law.

The absence of sufficiently specific and objectively constrained criteria was central to the assessment.

Legal principle

Government discretion affecting foreign investment must be subject to meaningful legal limits.

Broad references to national interests cannot replace the need for an identifiable and proportionate justification.

Relevance to banking

This judgment is important when assessing conditions imposed on foreign investors acquiring banks.

For example, a condition requiring an investor to maintain specific, security-sensitive operational capabilities may be more defensible than an indefinite and undefined power allowing the government to block any future managerial decision.

Each condition must be considered under the actual governing legislation and facts.

Case 5: Église de scientologie — C-54/99

Court of Justice, 14 March 2000

Case: Église de scientologie

Facts

French legislation required prior authorization for certain foreign investments considered capable of affecting public order or public security.

The dispute raised questions about whether the authorization regime offered sufficient legal certainty.

Legal issue

Could a Member State require advance authorization of foreign investment on public-order or public-security grounds without sufficiently precise criteria?

Judgment

The Court recognized that public order and public security may justify restrictions in appropriate circumstances.

However, the Court held that an authorization scheme lacking adequate precision about the circumstances in which approval was required was incompatible with EU requirements.

Legal principle

Advance foreign-investment controls must be sufficiently clear and predictable.

Investors must be able to understand when screening applies and the legal criteria governing decisions.

Relevance to Spain

This case is directly relevant to the design and interpretation of investment-screening mechanisms.

A banking investor challenging an adverse authorization decision might examine whether the applicable rules were sufficiently clear and whether the decision was based on identifiable statutory grounds.

Case 6: Fininvest and Berlusconi — C-219/17

Court of Justice, Grand Chamber, 19 December 2018

Case: Silvio Berlusconi and Fininvest SpA v Banca d’Italia and IVASS

This is among the most directly relevant cases for the supervisory approval of bank ownership.

Facts

The dispute concerned the assessment of a qualifying holding in an Italian credit institution.

Italian supervisory authorities participated in proceedings linked to the European Central Bank's decision-making powers concerning qualifying holdings.

Questions arose concerning the allocation of jurisdiction between national courts and EU courts to review acts forming part of the composite administrative process.

Legal issue

Where national supervisory authorities prepare measures leading to a final ECB decision, which courts possess jurisdiction to review those preparatory measures?

Judgment

The Court emphasized that the final qualifying-holding decision lies within the ECB's exclusive decision-making competence under the SSM framework.

Where national preparatory acts are part of that procedure and do not independently bind the ECB, judicial review is allocated to the EU courts in connection with the final ECB decision.

Legal principle

The Court clarified the jurisdictional structure of the SSM's composite administrative procedure.

National authorities participate in the process, but the ECB makes the final qualifying-holding assessment.

Relevance to Spain

Consider an investor applying to acquire 35% of a Spanish bank.

Banco de España participates in examining the transaction, and the ECB ultimately opposes the acquisition on prudential grounds.

The investor cannot automatically treat the national preparatory assessment as an independent final national decision.

The appropriate judicial route must be determined by the structure established under the SSM and the nature of the contested act.

Practical consequence: A prudential ownership dispute and a Spanish national-security screening dispute may fall before different courts and involve separate administrative decisions.

Case 7: Landeskreditbank Baden-Württemberg v ECB — C-450/17 P

Court of Justice, 8 May 2019

Case: Landeskreditbank Baden-Württemberg v ECB

Facts

Landeskreditbank challenged its classification as a significant supervised entity within the Single Supervisory Mechanism.

The dispute concerned the allocation of supervisory responsibilities under the SSM.

Legal issue

How should EU legislation allocating supervisory responsibilities between the ECB and national authorities be interpreted?

Judgment

The Court rejected the appeal and confirmed the legal approach to the ECB's supervisory powers under the SSM framework.

Legal principle

Banking supervisory competence is governed by the allocation of authority established in EU legislation.

National supervisory arrangements cannot be treated as independent of that framework.

Relevance to investment review

This case helps explain why Spanish prudential supervision must operate within the European banking-supervision architecture.

It does not, however, directly determine whether Spain may block an acquisition on national-security grounds under its separate foreign-investment legislation.

Case 8: Kotnik and Others — C-526/14

Court of Justice, 19 July 2016

Case: Kotnik and Others

Facts

The dispute concerned European Commission banking-sector state-aid rules and measures affecting shareholders and subordinated creditors before state aid was granted to distressed banks.

Legal issue

How could measures protecting financial stability interact with shareholder and creditor rights and EU state-aid law?

Judgment

The Court upheld the validity of the relevant Commission banking communication against the challenges considered, while addressing legal protections applying to affected stakeholders.

Legal principle

Financial stability is an important public interest, but measures affecting investors must still comply with the governing legal framework and applicable protections.

Relevance to banking investment review

The case illustrates that banking-sector interventions must balance stability concerns against protected legal rights.

However, it concerns state aid and financial-sector restructuring, not foreign-investment authorization. It should therefore be used as supplementary authority rather than a direct precedent for an FDI prohibition.

Case 9: Pringle — C-370/12

Court of Justice, 27 November 2012

Case: Pringle

Facts

The case challenged aspects of the legal framework enabling euro-area Member States to establish the European Stability Mechanism.

Legal issue

Was the mechanism compatible with the EU Treaties?

Judgment

The Court upheld the relevant legal arrangements, recognizing the framework through which euro-area Member States could provide stability support subject to the applicable conditions.

Relevance to banking and infrastructure

The judgment provides wider legal context concerning systemic financial stability in the EU constitutional framework.

It does not itself confer a general power on Member States to reject bank acquisitions or foreign investment.

7. Summary of case-law principles

These judgments are not all FDI-screening cases. Their relevance comes from the distinct principles of free movement, public security, banking supervision and financial stability.

8. Spanish critical-infrastructure legislation and its relationship with bank acquisitions

8.1 Law 8/2011

Spanish Law 8/2011 establishes measures for the protection of critical infrastructure.

It is complemented by Royal Decree 704/2011.

The legal framework addresses the identification, classification and protection of infrastructure whose disruption or destruction could seriously affect essential services.

For the financial sector, potentially relevant infrastructure can include payment, clearing, settlement, communications and technology systems, subject to applicable legal criteria and designation.

Important legal distinction

The following propositions are not equivalent:

A bank is economically important.

A bank is systemically important under financial-regulatory law.

A particular banking asset is designated critical infrastructure.

A foreign investment in the bank is subject to national-security screening.

Each requires its own legal analysis.

8.2 Effect of critical-infrastructure designation

Critical-infrastructure designation may produce legal responsibilities concerning security planning, cooperation with public authorities and protection measures.

It does not automatically create a general government right to veto every transfer of shares in the operator.

Any foreign-investment authorization obligation must be established independently under the applicable investment legislation.

Likewise, approval of a share acquisition does not terminate the operator's obligations under critical-infrastructure law.

8.3 How critical infrastructure and FDI screening interact

Suppose a foreign investor proposes to acquire a Spanish financial institution that operates particularly important payment-processing infrastructure.

Three distinct legal questions arise.

Question 1 — Infrastructure protection: Does the target operate assets classified as critical infrastructure, and what protection obligations apply?

Question 2 — Foreign investment screening: Does the transaction fall within Article 7 bis of Law 19/2003 and the implementing rules?

Question 3 — Banking prudential approval: Does the proposed acquisition constitute a qualifying-holding transaction requiring an ECB assessment?

The answers may differ. A transaction could pass prudential screening but still raise a genuine national-security concern, or it could receive foreign-investment authorization but fail the prudential suitability assessment.

9. EU Foreign Direct Investment Screening Regulation 2019/452

Regulation (EU) 2019/452 provides an EU framework for cooperation in the screening of foreign direct investments.

It expressly identifies factors that Member States may consider when evaluating effects on security or public order.

These include critical infrastructure, whether physical or virtual, such as:

Energy infrastructure.

Transport infrastructure.

Water infrastructure.

Health infrastructure.

Communications infrastructure.

Data processing and storage infrastructure.

Financial infrastructure.

Other relevant sensitive facilities and systems.

Article 4: Important screening factors

Article 4 identifies potentially relevant considerations, including whether a foreign investment is likely to affect critical infrastructure, critical technologies, access to essential inputs, sensitive information or media freedom and pluralism.

It also provides for consideration of specified characteristics of the foreign investor.

For banking-sector investments, the references to financial infrastructure, communications, data storage and sensitive information can be particularly significant.

Article 6: Cooperation mechanism

Under the regulation, the European Commission and other Member States may provide comments or opinions concerning an investment undergoing screening in a Member State.

The screening Member State must give the required consideration to comments and opinions under the relevant provisions.

The cooperation framework does not turn the European Commission into the ordinary final decision-maker for every national FDI authorization.

The final screening decision remains the responsibility of the Member State concerned, subject to applicable EU law.

Article 8: Projects or programmes of Union interest

Additional considerations arise where an investment is likely to affect projects or programmes of Union interest.

This mechanism may be relevant when a transaction has implications extending beyond one Member State.

The significance for banking acquisitions depends on the actual infrastructure, services and EU programmes concerned.

10. DORA: Cybersecurity and digital operational resilience

Regulation (EU) 2022/2554, known as the Digital Operational Resilience Act or DORA, became applicable from 17 January 2025.

DORA is especially important in modern banking acquisitions because a bank's infrastructure increasingly depends on digital systems, technology vendors and cloud providers.

It imposes obligations concerning:

Information and communication technology risk management.

ICT-related incident management and reporting.

Digital operational resilience testing.

Management of ICT third-party risk.

Oversight of designated critical ICT third-party service providers.

Example

A foreign investor acquires a Spanish banking group and proposes to move its core processing operations to a technology company controlled by an entity in another jurisdiction.

That restructuring could raise several separate issues.

DORA does not itself establish a blanket prohibition on foreign acquisition of a bank. Its role is primarily operational resilience and ICT-risk management.

However, genuine concerns about technology dependencies and operational resilience may be relevant to other legally applicable assessments.

11. Detailed hypothetical: Foreign acquisition of a strategically important Spanish bank

Consider the following transaction.

ILLUSTRATIVE TRANSACTION — NOT AN ACTUAL CASE

Target

Banco Iberia S.A.

Hypothetical Spanish credit institution

Acquirer

Global Strategic Investment Fund

Hypothetical non-EU state-controlled fund

35%

Proposed stake

€4bn

Transaction value

3

Regulatory areas

Assumptions: The target is a licensed Spanish bank, operates services important to national payments, and owns technology infrastructure essential to its operations. The investor seeks significant governance rights.

Stage 1: Identify the proposed investment

The first task is to identify precisely what the investor proposes to acquire.

Relevant facts include:

Direct and indirect shareholdings.

Voting rights.

Rights to appoint directors.

Shareholders' agreements.

Veto powers over business decisions.

Ultimate beneficial ownership and state influence.

Existing investments by related entities.

The 35% proposed ownership stake would meet several potentially relevant thresholds, but threshold analysis alone is insufficient.

Stage 2: Conduct Spanish FDI analysis

The investor is a non-EU state-controlled fund.

The proposed acquisition concerns a Spanish bank with strategically significant financial activities.

The legal team would therefore need to determine whether the transaction falls within the screening mechanism under Article 7 bis and Royal Decree 571/2023.

The assessment would examine the precise statutory scope, exemptions, investor status and nature of the target's activities.

If authorization is required, the parties must respect the applicable pre-completion rules.

Stage 3: Obtain prudential assessment

A 35% acquisition would ordinarily trigger a qualifying-holding assessment.

The proposed acquirer would need to provide information on matters including its reputation, financial strength, ownership structure, proposed management influence and other relevant prudential criteria.

The ECB would make the qualifying-holding decision through the applicable SSM procedure.

Stage 4: Evaluate critical-infrastructure risks

The authorities and parties would examine, where legally relevant:

Whether designated critical assets are involved.

Whether operation of essential payment services could be disrupted.

Whether security-sensitive systems would be exposed to new risks.

Whether the target's operational continuity would remain protected.

Whether relevant obligations under critical-infrastructure and financial-sector law would continue to be satisfied.

Stage 5: Consider less restrictive conditions

Where legally permitted and justified by the assessment, potential measures might include maintaining adequate operational continuity arrangements, appropriate information-security controls, governance safeguards or compliance-monitoring obligations.

Any conditions must be tailored to the risks, supported by applicable legal powers and consistent with relevant EU law.

The principle illustrated by the golden-share cases is that broad, discretionary restrictions require particularly careful justification.

Stage 6: Complete competition assessment

If the transaction constitutes a concentration meeting the relevant jurisdictional thresholds, EU or Spanish merger-control review may also be necessary.

The competition authority considers issues different from both prudential safety and national security.

Potential concerns may include reduced competition in retail banking, lending, payment services or relevant regional markets.

Stage 7: Determine the transaction's outcome

Illustrative regulatory decision tree

Proposed bank acquisition

Is Spanish FDI authorization required?

Assess investor, target, ownership, control and exemptions

Yes

Obtain required Spanish authorization

No

Continue with other applicable approvals

Banking qualifying-holding assessment

ECB decision under the SSM framework, where required

Other applicable reviews and obligations

Competition, operational resilience, infrastructure security and other sector-specific rules

Completion only after all mandatory clearances and conditions are satisfied

Approval under one regime does not replace approval under another

This is a conceptual decision tree. In practice, several approval processes may proceed concurrently, and a transaction's contractual closing conditions will need to account for their interaction.

12. Judicial review of banking investment decisions

An adverse decision does not necessarily end the investor's legal options.

The proper challenge depends on which authority made the decision and under which statutory regime.

12.1 Spanish FDI-screening decisions

Where a Spanish authority refuses authorization or imposes restrictive conditions, the affected investor may have access to administrative and judicial remedies under Spanish law.

Potential grounds of challenge include:

Lack of legal basis: The transaction did not fall within the applicable authorization regime, or the authority exceeded its statutory powers.

Incorrect assessment of facts: The decision relied on materially incorrect assumptions about control, infrastructure or the investor.

Insufficient reasoning: The authority did not adequately explain why the relevant statutory criteria justified its decision.

Disproportionality: The restriction went beyond what was necessary to address the identified legitimate risk.

Infringement of EU law: The decision unlawfully restricted free movement of capital or establishment, taking account of applicable Treaty exceptions and secondary legislation.

Judicial review would proceed through the competent Spanish contentious-administrative jurisdiction, with the precise court and available remedies depending on the deciding authority and applicable procedural rules.

The Spanish courts may also refer questions of EU-law interpretation to the Court of Justice under Article 267 TFEU.

12.2 ECB decisions

A final ECB decision concerning an acquisition of a qualifying holding can be challenged under the applicable EU judicial-review framework.

Article 263 TFEU provides the principal Treaty basis for actions seeking annulment of reviewable EU acts.

The Fininvest and Berlusconi judgment, C-219/17, is particularly important in determining the relationship between national preparatory acts and the final ECB decision.

12.3 Confidentiality and national security

Investment-screening cases may involve confidential information about national security, banking systems, business operations or financial stability.

Confidentiality can affect how information is disclosed and reviewed.

However, a national-security classification does not automatically place every aspect of the administrative decision outside judicial scrutiny. The applicable procedural framework must balance protected information against the requirements of lawful decision-making and effective judicial protection.

13. Fundamental legal principles governing banking investment review

Five principles emerge from the interaction of Spanish legislation and EU case law.

Principle 1: National security is a legitimate consideration, not an unlimited discretion

Spain may adopt qualifying measures to protect public security and strategically important financial infrastructure.

However, intervention must satisfy the governing law and applicable EU requirements.

The reasoning of Commission v Belgium, C-503/99, is especially relevant.

Principle 2: Foreign ownership alone is not necessarily sufficient

A transaction should be assessed according to the applicable statutory criteria and its particular risks.

A general preference for domestic ownership is not equivalent to an established national-security justification.

Commission v Portugal, C-367/98, and Commission v Spain, C-463/00, illustrate the relevant EU-law restrictions.

Principle 3: Legal certainty is essential

Investors must be able to identify applicable notification and authorization obligations through sufficiently clear laws.

Église de scientologie, C-54/99, is particularly important in this respect.

Principle 4: Banking safety and national security are legally distinct

The ECB's assessment of a proposed bank owner concerns prudential suitability under the SSM.

Spanish FDI screening addresses security and public-order questions under its own legal framework.

Fininvest and Berlusconi, C-219/17, demonstrates the importance of the SSM's allocation of decision-making powers.

Principle 5: Restrictions must be proportionate

Where the applicable law permits the imposition of conditions, the authorities should consider whether appropriately tailored measures can address an identified risk.

The legality of any particular condition depends on its statutory foundation, supporting evidence and effects.

Commission v Italy, C-326/07, is an important authority concerning the limits of broad governmental special powers.

14. Practical due-diligence checklist for investors

An investor considering a significant acquisition of a Spanish bank should analyze the following matters before signing and completion.

Investment-review preparation

0 of 8 reviewed

Ownership and control

Identify direct, indirect and ultimate beneficial owners; voting rights; board rights; and control arrangements.

Spanish FDI screening

Determine whether the investor, target and investment fall within Article 7 bis and Royal Decree 571/2023.

ECB qualifying-holding assessment

Check ownership thresholds, notification obligations and the applicable prudential assessment.

Critical-infrastructure status

Identify any designated infrastructure and resulting statutory security obligations.

Digital resilience

Review ICT systems, technology dependencies, cloud arrangements, outsourcing and DORA obligations.

Competition approval

Assess whether EU or Spanish merger-control notification is required.

Transaction documents

Include applicable regulatory conditions precedent, cooperation duties and an appropriate long-stop mechanism.

Remedies and mitigation

Consider legally available measures for addressing established security or prudential concerns.

Copy checklist

15. Primary legal sources for further research

For formal legal research, the following are the most important primary authorities.

The statutory and case references above provide a research foundation. I could not perform a live legislative or case-law update in this conversation, so the precise consolidated law applicable on 20 October 2026, including any temporary FDI-screening extensions or later judicial developments, should be checked before relying on this analysis for a transaction.

16. Conclusion

Under Spanish and European Union law, investment review of banking-sector critical infrastructure is a multilayered regulatory mechanism rather than a single authorization procedure.

Its central characteristics are:

1. Foreign investment screening: Spain may review covered foreign investments that engage statutory public-security or public-order concerns, including risks affecting financial infrastructure.

2. Banking prudential assessment: The ECB, acting within the SSM and with national supervisory participation, determines whether proposed acquirers of qualifying bank holdings satisfy the prescribed prudential criteria.

3. Critical-infrastructure protection: Separate Spanish legislation protects designated infrastructure essential to the continuity of important services.

4. Operational and digital resilience: DORA and related financial-sector rules address risks arising from technology, cybersecurity, outsourcing and operational dependencies.

5. Judicial control: Spanish and EU courts provide mechanisms for challenging unlawful restrictions, while the CJEU's case law requires attention to legal certainty, proportionality and the allocation of regulatory authority.

The most significant judicial authorities for a Spanish banking-investment dispute are C-463/00, Commission v Spain; C-503/99, Commission v Belgium; C-54/99, Église de scientologie; and C-219/17, Fininvest and Berlusconi.

Together, they establish an important distinction: the state may protect genuinely sensitive infrastructure and the stability of its financial system, but investment restrictions must be supported by the applicable legal framework and must respect EU rules concerning capital movements, banking supervision, proportionality and judicial review.