Critical Infrastructure Protection for Banks: Detailed Legal Explanation with Case Laws

1. Introduction

Critical Infrastructure Protection (CIP) for banks refers to the legal, regulatory, institutional, technological and operational measures designed to safeguard banking institutions, payment systems, financial networks and essential financial services against disruptions that could threaten economic stability, public security or national security.

Banking infrastructure is critical because the failure of a major bank, payment network, settlement system or financial technology service provider can produce consequences extending far beyond the affected institution.

For example, a serious disruption to a major banking network could prevent individuals from accessing deposits, companies from making payments, financial institutions from settling transactions and governments from disbursing public funds.

Accordingly, modern banking regulation increasingly treats the continuity of essential financial services as a matter of financial stability, operational resilience and, in some circumstances, national security.

The legal framework is broader than cybersecurity alone. It encompasses physical security, systemic risk, payment infrastructure, third-party technology dependencies, crisis management, recovery planning and administrative supervision.

Definition

Critical infrastructure protection in banking may be defined as:

The framework of laws, regulations, supervisory mechanisms and operational safeguards intended to prevent, withstand, respond to and recover from disruptions affecting banking institutions and financial systems whose continued functioning is essential to the economy, public welfare or national security.

This definition is a synthesis of regulatory concepts rather than a single statutory definition applicable across all jurisdictions.

2. Why banks constitute critical infrastructure

Banks perform functions that are indispensable to the functioning of modern economies.

An important legal distinction is that not every bank is automatically designated as critical infrastructure under every statute.

A bank can be:

Subject to ordinary banking regulation.

Designated as systemically important.

Classified as an essential entity or operator of essential services.

Responsible for a separately designated critical payment or information system.

These statuses may overlap, but each arises under different legal tests and can create different obligations.

3. Four principal dimensions of banking infrastructure protection

Critical Banking Infrastructure

Continuity of essential financial services

Physical protection

Branches, cash centres, data centres and facilities

Cybersecurity

Core banking systems, payments, identity and data

Financial stability

Liquidity, capital, recovery and resolution

Operational resilience

Outsourcing, incident response and service continuity

A. Physical infrastructure protection

Protection extends to buildings, technology facilities, cash distribution infrastructure, operational centres and other physical assets necessary for continuity.

Legal and supervisory requirements may include facility security, access control, disaster recovery arrangements, geographical redundancy and emergency coordination.

B. Cybersecurity protection

Banks increasingly depend on interconnected information systems, making cybersecurity a central part of critical infrastructure regulation.

Typical supervisory obligations include ICT risk management, incident reporting, authentication controls, security testing, continuity planning and oversight of technology suppliers.

C. Financial stability protection

A bank may remain technologically functional but become incapable of providing essential services due to liquidity exhaustion, insolvency or systemic contagion.

Therefore, capital adequacy, liquidity regulation, resolution planning and deposit protection also contribute to the broader protection of banking infrastructure.

D. Operational resilience

Operational resilience concerns a bank's ability to continue delivering important services despite serious disruptions.

This includes the resilience of outsourced services, telecommunications networks, energy supply, cloud infrastructure and payment processors.

The modern regulatory approach increasingly focuses not only on preventing failures but also on ensuring that essential services can continue or recover within acceptable limits when failures occur.

4. International legal framework

4.1 Basel Committee on Banking Supervision

The Basel Committee on Banking Supervision (BCBS) provides internationally influential standards on banking supervision.

Its 2021 Principles for Operational Resilience and revised Principles for the Sound Management of Operational Risk are especially relevant.

The operational resilience principles address seven subjects:

Governance.

Operational risk management.

Business continuity planning and testing.

Mapping interconnections and interdependencies.

Third-party dependency management.

Incident management.

ICT, including cybersecurity.

These are international supervisory standards, not directly enforceable statutes. Legal enforceability depends on their incorporation into national laws, regulations or supervisory expectations.

Legal significance: The Basel framework supports the view that a bank's infrastructure risk must be assessed not merely at the level of individual assets but at the level of the essential operations supported by those assets.

4.2 Financial Stability Board

The Financial Stability Board (FSB) develops international policy approaches to systemic financial stability.

Relevant instruments include the Key Attributes of Effective Resolution Regimes for Financial Institutions, initially adopted in 2011 and updated subsequently.

These principles support the resolution of failing financial institutions while maintaining critical functions and avoiding unnecessary disruption to the wider financial system.

A crucial distinction is that resolution law does not guarantee that every failing bank remains operational indefinitely. Its aim is to manage failure in a way that protects financial stability and preserves critical functions where appropriate.

4.3 Financial Market Infrastructures

The 2012 Principles for Financial Market Infrastructures, issued by the Committee on Payment and Settlement Systems (now CPMI) and IOSCO, address infrastructures such as payment systems, central securities depositories, securities settlement systems, central counterparties and trade repositories.

These infrastructures may have extremely high systemic importance even when they are operated by entities that are not conventional deposit-taking banks.

Principle 17 addresses operational risk, including the need for a high degree of security and operational reliability.

5. European Union legal framework

EU law provides one of the clearest examples of how banking protection is distributed across financial regulation, cybersecurity law and critical-entity resilience.

5.1 Digital Operational Resilience Act (DORA)

Regulation (EU) 2022/2554 — applicable from 17 January 2025

DORA creates a harmonised framework for digital operational resilience across significant parts of the EU financial sector, including credit institutions.

Its principal legal requirements concern:

A particularly important provision is Article 28(1), which establishes that financial entities remain responsible for compliance with their DORA obligations even where ICT services are provided by third parties.

Consequently, the outsourcing of a major banking operation to a cloud provider does not automatically transfer the bank's regulatory responsibility to the provider.

DORA also provides for supervisory oversight of designated critical ICT third-party service providers.

This addresses the risk that many banks may depend on the same underlying technology supplier.

Example: If several major banks rely on a common cloud platform, a serious outage may disrupt multiple financial institutions simultaneously. DORA seeks to manage such concentration and interdependency risks through financial-entity obligations and oversight of critical ICT suppliers.

5.2 NIS2 Directive

Directive (EU) 2022/2555

The NIS2 Directive establishes cybersecurity risk-management and reporting requirements for covered sectors, including banking.

However, the interaction with DORA is particularly important.

Under NIS2's sector-specific-law mechanism, corresponding provisions of DORA take precedence for financial entities where the legal conditions are fulfilled.

Therefore, it would be inaccurate to assume that banks must always comply cumulatively with every equivalent cybersecurity obligation under both instruments.

DORA operates as the more specific financial-sector regime for relevant ICT risk-management and incident-reporting obligations.

5.3 Critical Entities Resilience Directive (CER)

Directive (EU) 2022/2557

The CER Directive addresses the resilience of critical entities against risks such as natural disasters, accidents, sabotage and other serious disruptions.

Its framework covers several sectors, including banking and financial market infrastructure.

However, the relationship between CER and sector-specific financial resilience regulation requires careful interpretation.

In particular, Article 8 provides a special treatment for the banking, financial market infrastructure and digital infrastructure sectors, excluding the application of certain CER obligations, including those concerning entity-level resilience measures and incident notification, while preserving other parts of the framework.

This reflects the existence of specialised regulatory regimes.

A designation under CER therefore does not necessarily impose the same full set of obligations on banks as it would on entities in other sectors.

5.4 Capital Requirements and Bank Resolution

Other significant EU instruments include:

Directive 2013/36/EU (Capital Requirements Directive, as amended).

Regulation (EU) No 575/2013 (Capital Requirements Regulation, as amended).

Directive 2014/59/EU (Bank Recovery and Resolution Directive, as amended).

Regulation (EU) No 806/2014 (Single Resolution Mechanism Regulation, as amended).

The Bank Recovery and Resolution Directive is especially important because it recognises the importance of maintaining critical functions during bank resolution.

Article 2(1)(35) defines critical functions by reference to activities, services or operations whose discontinuance would likely disrupt services essential to the real economy or disrupt financial stability, considering factors such as size, market share, substitutability and interconnectedness.

This definition offers a useful legal foundation for determining which banking operations deserve the highest level of protection.

6. Spain: Critical infrastructure protection for banks

Spain provides a particularly useful case study because its legal system combines a general critical infrastructure regime with European financial-sector regulation.

6.1 Law 8/2011 on Critical Infrastructure Protection

Ley 8/2011, de 28 de abril, por la que se establecen medidas para la protección de las infraestructuras críticas is the foundational Spanish legislation on critical infrastructure protection.

Its purpose is to establish measures for protecting infrastructure whose functioning is essential for vital services.

The Spanish framework distinguishes between strategic infrastructure and infrastructure that meets the requirements for designation as critical.

Under the statutory framework, an infrastructure may qualify as critical where it provides an essential service and its functioning does not allow practical alternatives, so its disruption or destruction would have a serious impact on essential services.

The legislation also establishes cooperation between public authorities and infrastructure operators.

In the banking context, potentially relevant infrastructure includes:

Core banking data processing facilities.

Essential payment processing networks.

Settlement and clearing infrastructure.

Critical financial telecommunications.

Facilities supporting uninterrupted access to essential financial services.

Technology systems whose failure would significantly disrupt nationally important banking operations.

Importantly, the fact that an entity holds a banking licence does not itself establish that all its infrastructure is formally designated as critical under Law 8/2011.

A legally relevant designation requires applying the competent authorities' statutory criteria and procedures.

6.2 Royal Decree 704/2011

Royal Decree 704/2011 implements the Spanish critical infrastructure protection framework.

It establishes planning and coordination arrangements relating to critical infrastructure identification and protection.

The framework is associated with the Centro Nacional de Protección de Infraestructuras Críticas (CNPIC), within the competent Spanish governmental security structure.

The legislation provides for instruments such as strategic sectoral planning, operator security planning and specific protection arrangements.

A bank or financial infrastructure operator subject to these requirements may therefore have obligations beyond conventional financial prudential regulation.

6.3 Spanish banking supervision

Law 10/2014, of 26 June, on the organisation, supervision and solvency of credit institutions, establishes important parts of Spain's banking supervisory framework.

It must be read with directly applicable EU law and the Single Supervisory Mechanism.

The Banco de España and the European Central Bank exercise banking supervisory responsibilities according to the applicable allocation of competence.

DORA adds a specialised layer of ICT operational resilience requirements.

Therefore, a Spanish bank may face several overlapping but legally distinct regimes:

6.4 Banking dependence on energy and telecommunications

One of the most important legal issues in Spanish critical infrastructure protection is interdependency.

Consider the following scenario:

A major Spanish bank operates a national payment-processing facility that depends on the electricity grid, telecommunications operators and externally hosted cloud infrastructure.

An interruption of electricity supply may disable telecommunications or data processing, preventing bank customers from conducting transactions.

Electricity supply

Energy-sector dependency

Telecommunications and cloud services

Connectivity and data-processing dependency

Banking systems and payment infrastructure

Essential financial operations

Customers, businesses and public institutions

Potential disruption of essential economic services

This situation creates interconnected legal responsibilities.

The energy operator may be subject to energy-sector resilience obligations. The telecommunications operator may be regulated under electronic communications and cybersecurity requirements. The bank remains responsible for its own applicable operational resilience and continuity obligations.

Under DORA, outsourcing arrangements must be governed by adequate risk controls and contractual safeguards.

Legal conclusion: A bank cannot generally discharge all its resilience responsibilities merely by arguing that the immediate cause of an outage originated with an external electricity, telecommunications or cloud supplier.

Whether a specific legal breach has occurred will still depend on the applicable legal duty, the measures reasonably required, the facts and the competent authority's findings.

7. United Kingdom: Operational resilience and critical banking services

The UK approaches banking infrastructure protection through financial supervision, operational resilience rules, resolution law, cybersecurity and, where applicable, national security measures.

7.1 Financial Services and Markets Act 2000

The Financial Services and Markets Act 2000 provides the foundational framework for UK financial regulation.

The Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) exercise their respective functions within this framework.

The Bank of England also has systemic financial stability and resolution responsibilities.

7.2 Operational resilience requirements

The PRA and FCA have established operational resilience requirements that apply to firms within the relevant scope.

Significant instruments include:

PRA Supervisory Statement SS1/21, Operational resilience: Impact tolerances for important business services.

FCA rules and policy relating to operational resilience.

PRA Supervisory Statement SS2/21 on outsourcing and third-party risk management.

A central requirement is to identify important business services and determine impact tolerances for disruption.

An impact tolerance specifies the maximum tolerable level of disruption to an important business service, including by reference to time and, where appropriate, other metrics.

For example, a bank may need to consider how long customers could be unable to access essential payment services before intolerable harm to consumers or market integrity would arise.

The UK framework required in-scope firms to achieve the relevant implementation expectations by 31 March 2025.

7.3 Critical third-party providers

The Financial Services and Markets Act 2023 introduced a statutory framework for the oversight of designated critical third parties serving the UK financial sector.

Its purpose is to address risks arising where financial institutions rely on a small number of technology or service providers.

The regime allows relevant UK authorities to oversee designated providers' resilience in the provision of services to financial firms.

However, it does not mean that every supplier to a bank is automatically a designated critical third party.

Formal designation and the scope of applicable regulatory requirements remain legally important.

8. United States: Protection of banking infrastructure

The United States recognises financial services as a critical infrastructure sector.

Its framework involves the Department of the Treasury, federal financial regulators, cybersecurity agencies and financial institutions.

8.1 Critical infrastructure policy

Presidential Policy Directive 21, issued in 2013, identified the Financial Services Sector as one of the United States' critical infrastructure sectors.

In 2024, National Security Memorandum 22 established an updated framework for critical infrastructure security and resilience.

These instruments address national policy and coordination. They should not be confused with statutes that independently create enforceable duties against every banking entity.

8.2 Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act establishes important financial information safeguards.

Relevant financial regulators have promulgated information-security standards under their respective authorities.

For banks, information-security obligations include appropriately protecting customer information, identifying risks and maintaining safeguards consistent with the applicable supervisory framework.

These obligations should be distinguished from the Federal Trade Commission's Safeguards Rule, which generally covers financial institutions within the FTC's jurisdiction rather than duplicating the bank regulators' framework.

8.3 Banking regulators and cybersecurity notification

Important banking supervisors include:

Federal Reserve.

Office of the Comptroller of the Currency.

Federal Deposit Insurance Corporation.

The federal banking agencies' computer-security incident notification rule, effective in 2022, generally requires covered banking organisations to notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a notification incident has occurred.

Not every cybersecurity event meets the rule's threshold.

A notification incident is a defined category of event with specified material consequences, including serious disruption to banking operations or services.

8.4 Systemically important financial institutions

The Dodd-Frank Wall Street Reform and Consumer Protection Act establishes elements of the US framework for heightened prudential supervision, systemic risk oversight and resolution planning.

Title II concerns orderly liquidation authority, while other provisions address enhanced supervision and resolution planning for relevant institutions.

The Federal Reserve and other competent authorities apply the relevant statutory and regulatory criteria.

Systemic importance does not necessarily equal formal critical infrastructure designation. However, both concepts reflect concern about the broader economic consequences of institutional failure.

9. India: Critical information infrastructure and banking protection

India's banking infrastructure protection framework includes information technology law, Reserve Bank of India regulation, payment systems regulation, and national cybersecurity arrangements.

9.1 Information Technology Act, 2000

Section 70: Protected systems

Section 70 permits the appropriate government, by notification in the Official Gazette, to declare specified computer resources affecting critical information infrastructure as protected systems.

Section 70 also addresses authorised access and penalties for unauthorised access to protected systems.

Section 70A: Critical information infrastructure protection

Section 70A provides for the national nodal agency for critical information infrastructure protection.

The National Critical Information Infrastructure Protection Centre (NCIIPC) performs this role under the applicable framework.

Critical information infrastructure is defined by reference to computer resources whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety.

Section 70B: Computer emergency response

Section 70B concerns the Indian Computer Emergency Response Team (CERT-In), including its cybersecurity incident-response functions.

9.2 Reserve Bank of India cybersecurity requirements

The Reserve Bank of India (RBI) has issued various directions concerning bank cybersecurity, IT governance and outsourcing.

Key instruments include the 2016 Cyber Security Framework in Banks, the 2023 Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, and the 2023 Master Direction on Outsourcing of Information Technology Services.

Subject to their respective scopes and subsequent changes, the directions address matters such as:

Board and senior-management oversight of IT and cyber risks.

Information security controls and independent assurance.

Business continuity and disaster recovery.

Outsourcing governance and third-party service risks.

Incident response and reporting.

9.3 Payment and Settlement Systems Act, 2007

The Payment and Settlement Systems Act, 2007 gives the RBI important powers over the regulation and supervision of payment systems.

Payment infrastructure is critical because disruptions can affect economic activity even when individual banks remain financially solvent.

In India, systems such as RTGS, NEFT, UPI and associated infrastructure illustrate the importance of operational continuity.

These payment arrangements have different governance structures and legal roles; they should not all be treated as identical systems for supervisory purposes.

9.4 Legal position in India

A bank's information infrastructure may fall within multiple regulatory regimes simultaneously.

For example, a bank may be regulated by the RBI and subject to relevant CERT-In directions without every one of its computer systems having been individually notified as a protected system under Section 70.

Thus, cybersecurity obligations and formal critical-information-infrastructure status are related but distinct concepts.

10. Important case laws on critical infrastructure protection for banks

A qualification is necessary before considering the judgments: comparatively few reported cases address formal critical infrastructure designation of banks directly.

The most instructive case law comes from related fields such as banking cybersecurity, regulatory duties, state intervention, payment-system security, bank resolution, financial stability and national security.

These judgments provide the principles courts use when evaluating measures taken to safeguard essential banking services.

Case 1: Bank Mellat v HM Treasury (No 2)

United Kingdom Supreme Court, [2013] UKSC 39

Facts

The UK Treasury imposed restrictive measures against Bank Mellat, an Iranian bank, under counter-terrorism legislation.

The measures effectively restricted access to the UK financial sector because of concerns relating to Iran's nuclear programme and the potential use of financial services for proliferation-related activities.

Bank Mellat challenged the restrictions.

Legal issues

The Supreme Court considered whether the Treasury's measures were lawful and proportionate.

The case raised questions regarding national security, financial restrictions, fairness and judicial scrutiny of executive action.

Judgment

The Supreme Court held, by a majority, that the measure was unlawful. The reasoning included serious concerns about proportionality and the differential treatment of Bank Mellat.

The Court applied a structured proportionality analysis examining the relationship between the legitimate objective and the means selected to achieve it.

Principle

National security and financial-system protection are legitimate public interests, but governmental interference with banking activities must remain legally justified.

Relevance to banking infrastructure: If a government restricts a bank, isolates a financial network or imposes exceptional measures for security reasons, the existence of a national security objective does not eliminate the requirement of legality or proportionality.

The case concerns financial restrictions justified by national security, not the technical designation of bank systems as critical infrastructure.

Case 2: Peter Paul and Others v Germany

Court of Justice of the European Union, Case C-222/02, judgment of 12 October 2004

Facts

Depositors suffered losses following the failure of a German bank.

They argued that the competent banking supervisory authorities had failed to fulfil obligations under relevant EU banking directives.

They sought compensation from the state for alleged supervisory failures.

Legal issue

Whether EU banking supervisory directives conferred rights on depositors to claim damages from the state because supervisory authorities had allegedly failed to supervise a bank properly.

Judgment

The CJEU concluded that the relevant directives did not confer the asserted individual rights to compensation based on inadequate prudential supervision, in the circumstances considered.

The Court recognised that the relevant supervisory framework pursued broader public-interest objectives.

Principle

Banking supervision serves the general interests of the financial system, and a breach of supervisory duties does not necessarily create a private damages remedy for individual depositors.

Application to critical infrastructure

Suppose a regulator supervises the resilience of a major bank, but the bank nevertheless suffers a severe infrastructure failure.

A claimant cannot automatically establish regulatory liability merely by showing that a supervisory authority was responsible for overseeing the bank.

The claimant must identify an applicable legal duty, an available cause of action and the elements necessary to establish liability.

This distinction is important when evaluating whether a banking regulator can be sued for failing to prevent disruptions to critical financial services.

Case 3: Kotnik and Others

CJEU, Case C-526/14, judgment of 19 July 2016

Facts

The case arose from measures associated with support for financial institutions during a banking crisis in Slovenia.

The dispute concerned the European Commission's banking-sector state-aid framework and the treatment of shareholders and subordinated creditors before the provision of state support.

Legal issues

The questions included whether burden-sharing measures were consistent with EU law, property rights and the framework governing state aid.

Judgment

The Court accepted that burden-sharing requirements of the type considered could be compatible with EU law, subject to relevant safeguards and limits.

It also clarified the legal status of the Commission's Banking Communication.

Principle

The objective of preserving financial stability can justify significant interventions affecting private financial interests, provided that the applicable legal rules and safeguards are observed.

Application

Where a systemically significant bank faces failure, protecting the continuation of essential banking functions may justify exceptional regulatory intervention.

However, protecting critical banking infrastructure does not confer unlimited authority to interfere with property rights.

Case 4: Kantarev v Balgarska Narodna Banka

CJEU, Case C-571/16, judgment of 4 October 2018

Facts

The dispute arose following problems affecting Corporate Commercial Bank in Bulgaria.

A depositor raised issues concerning the timing of access to deposit guarantee compensation and the obligations of the competent authorities under EU law.

Legal issues

The Court examined requirements under EU deposit-guarantee law and questions relating to state liability for breaches of EU law.

Judgment

The Court interpreted the obligations imposed by the relevant deposit-guarantee framework and considered the circumstances in which a sufficiently serious breach of EU law could support liability.

Principle

Protection of the banking system includes the protection of depositors through legally enforceable obligations concerning deposit guarantee arrangements.

Application

Critical infrastructure protection is not limited to preventing cyberattacks or physical destruction.

A bank's inability to return deposits may disrupt essential financial services and engage statutory protection mechanisms.

The case demonstrates the importance of distinguishing public supervisory objectives from specific enforceable rights conferred on depositors.

Case 5: Patco Construction Co v People's United Bank

United States Court of Appeals for the First Circuit, 684 F.3d 197 (2012)

Facts

Patco Construction maintained commercial banking services with the defendant bank.

Unauthorised electronic transfers were made from its account using compromised authentication information.

A dispute arose over the adequacy of the bank's security procedures.

Legal issue

Whether the bank's procedures were commercially reasonable under the applicable provisions of Uniform Commercial Code Article 4A.

Judgment

The First Circuit concluded that the bank's security procedures were not commercially reasonable in the circumstances.

The case was remanded for further proceedings.

Principle

A banking institution's security arrangements must be assessed according to applicable standards of commercial reasonableness, not merely the existence of formal authentication measures.

Application

This case is particularly relevant to digital banking infrastructure.

Even where a bank has introduced authentication controls, it may still face legal scrutiny over whether its overall procedures adequately respond to transaction risks and suspicious activity.

Significance: Compliance is not simply a matter of possessing cybersecurity software. Security measures must be appropriate to the nature of the financial service and the governing legal standard.

Case 6: Choice Escrow and Land Title LLC v BancorpSouth Bank

United States Court of Appeals for the Eighth Circuit, 754 F.3d 611 (2014)

Facts

Choice Escrow suffered losses arising from fraudulent electronic funds transfers.

The dispute concerned the bank's online banking security procedures and the customer's rejection of an additional security feature.

Legal issue

Whether the bank's security procedures satisfied the commercial reasonableness requirements of UCC Article 4A.

Judgment

The Eighth Circuit ruled in favour of the bank, upholding the determination that its security procedures were commercially reasonable in the circumstances.

Principle

The legal assessment of banking cybersecurity measures is contextual.

It may depend on the safeguards offered, the customer's choices, industry practices and the circumstances of the transaction.

Application

Read together, Patco and Choice Escrow show that courts do not necessarily impose absolute liability on banks whenever a cyber-enabled financial loss occurs.

Instead, they assess the parties' legal obligations and the adequacy of security procedures under the applicable statutory framework.

This is an important distinction in critical banking infrastructure litigation.

Case 7: Federal Trade Commission v Wyndham Worldwide Corp.

United States Court of Appeals for the Third Circuit, 799 F.3d 236 (2015)

Facts

Wyndham's computer systems were compromised in cybersecurity incidents that exposed consumer payment-card information.

The FTC brought an enforcement action under Section 5 of the Federal Trade Commission Act.

Legal issue

Whether the FTC could pursue allegedly unreasonable cybersecurity practices as unfair practices under its statutory authority.

Judgment

The Third Circuit upheld the FTC's authority to bring the challenged cybersecurity unfairness claim and rejected the relevant fair-notice objection at that stage.

It did not conduct a final trial determination that every allegation had been proven.

Principle

Inadequate cybersecurity may give rise to regulatory enforcement under generally applicable statutory duties, depending on the regulator's jurisdiction and the requirements of the law.

Application to banks

Although Wyndham was not a bank, the decision is influential in understanding how courts evaluate statutory cybersecurity enforcement.

Its significance for banks is analogical, not direct: federally regulated banks are subject to their own applicable information-security and supervisory regimes.

Case 8: Internet and Mobile Association of India v Reserve Bank of India

Supreme Court of India, (2020) 10 SCC 274

Facts

The RBI issued a circular restricting entities regulated by it from providing specified banking services to persons and businesses dealing in virtual currencies.

The measure was challenged on legal and constitutional grounds.

Legal issues

The principal issues included the scope of RBI's regulatory authority and whether the restriction satisfied proportionality requirements.

Judgment

The Supreme Court recognised the RBI's broad authority over the banking and financial system but set aside the disputed circular on proportionality grounds in the circumstances of the case.

Principle

Financial-system protection can support preventive regulatory intervention, but regulatory powers must be exercised consistently with legal and constitutional limits.

Application to banking infrastructure protection

Suppose the RBI imposes a measure intended to prevent systemic technology risk or protect payment-system stability.

The measure's public-interest objective may be legitimate, but its legality may still depend on statutory authority, the evidence supporting it and proportionality.

The case does not establish that all preventive RBI directions are invalid. Its importance lies in the judicial limits on regulatory intervention.

Case 9: Reserve Bank of India v Jayantilal N. Mistry

Supreme Court of India, (2016) 3 SCC 525

Facts

The case involved requests for information held by the RBI, including information connected with banking inspection and supervision.

The RBI resisted disclosure of certain materials under the Right to Information Act.

Legal issue

Whether the RBI could rely on asserted fiduciary relationships and other grounds to withhold supervisory information.

Judgment

The Supreme Court rejected the broad position that the RBI held the requested supervisory information in a fiduciary capacity for regulated banks.

The Court emphasised the public-interest responsibilities of the banking regulator.

Principle

Banking supervision must serve the public interest, and supervisory confidentiality cannot be invoked automatically to defeat legally enforceable disclosure rights.

Application

Critical infrastructure protection may require the confidentiality of sensitive technical, security and supervisory information.

However, the existence of a security or financial-system interest does not automatically make all information confidential.

The applicable statutory exemptions must be examined independently.

Case 10: STC 111/1983

Spanish Constitutional Court, Judgment 111/1983, 2 December 1983

Facts

The case concerned the expropriation of the RUMASA group through Royal Decree-law 2/1983.

The Spanish government justified intervention by reference to serious economic and financial concerns associated with the group's activities.

Legal issues

The Spanish Constitutional Court examined constitutional questions concerning the use of emergency decree-law powers and the expropriation measure.

Judgment

The Court upheld the challenged decree-law framework in the principal constitutional respects considered.

Its reasoning recognised the relevance of urgent public-interest considerations while examining constitutional constraints.

Principle

Serious threats to economic and financial stability may support exceptional state intervention, but such intervention must remain within constitutional and statutory limits.

Application to Spanish banking infrastructure

The case illustrates the constitutional balance between private economic interests and public measures intended to avert serious financial consequences.

However, it is a historical expropriation and constitutional law case, not a decision applying Law 8/2011 or DORA.

It should therefore be used as supporting authority on public-interest intervention, rather than as direct precedent for a modern critical infrastructure designation.

11. Comparative legal principles derived from the cases

Taken together, these cases support five major propositions.

First, governments and regulators may adopt measures protecting systemic financial interests where they possess the necessary legal authority.

Second, such measures remain subject to judicial scrutiny, including proportionality and procedural requirements where applicable.

Third, banking security involves both preventive operational controls and legally defined responsibilities when failures occur.

Fourth, protection of the financial system does not necessarily create an unlimited private right to damages against regulators.

Fifth, regulatory intervention must balance financial stability against property rights, commercial freedom, privacy, transparency and other legally protected interests.

12. Legal obligations of banks protecting critical infrastructure

The precise requirements vary by jurisdiction and designation status, but a comprehensive framework generally covers the following areas.

12.1 Governance and accountability

The bank's board and senior management must oversee relevant operational and technology risks according to the applicable regulations.

This involves assigning responsibilities, approving policies, assessing significant risks and reviewing resilience arrangements.

A critical legal issue is whether responsibility for outsourcing, cyber risk and continuity has been appropriately allocated.

12.2 Identification of critical functions

Banks should identify services whose disruption could have significant effects on customers, counterparties or the financial system.

Relevant considerations include:

Importance of the service to the economy.

Number and type of affected customers.

Availability of substitute providers.

Duration and geographic extent of potential disruption.

Dependence of other critical sectors on the service.

Potential consequences for liquidity and financial stability.

Under some legal regimes, these factors determine formal criticality. Under others, they guide internal operational resilience assessments.

12.3 Risk assessment

Banks must assess risks from cyber incidents, natural disasters, technology failures, internal control weaknesses, outsourcing dependencies and other relevant sources.

A sound legal compliance approach must evaluate both the probability of disruption and its potential consequences.

12.4 Business continuity and disaster recovery

Banks may be required to maintain tested arrangements to preserve or restore essential services.

Relevant measures include backup processing capacity, alternative communications, data recovery, crisis governance and continuity testing.

The legally required recovery objectives depend on the services involved and the applicable supervisory regime.

12.5 Third-party and supply-chain protection

Cloud computing, telecommunications, payment processing and outsourced operational services create dependencies that may affect multiple banks simultaneously.

Relevant contractual obligations can concern audit rights, security standards, incident cooperation, data access, subcontracting, termination and exit planning.

DORA is a particularly important example of statutory regulation of ICT third-party risk.

12.6 Incident notification

Incident reporting requirements are jurisdiction-specific.

For example, the US federal banking agencies' notification rule establishes a 36-hour outer limit after a covered bank determines that a qualifying notification incident has occurred.

DORA establishes a different incident classification and reporting structure, supplemented by detailed secondary rules.

Banks operating internationally must therefore assess which reporting obligations apply to each legal entity and incident, rather than assuming one universal deadline.

13. Legal liability arising from failure to protect banking infrastructure

Four broad categories of liability may arise.

An infrastructure failure alone does not automatically establish any of these forms of liability.

The legal analysis ordinarily requires identification of the duty, its scope, the applicable liability standard, the conduct constituting a breach, causation and the legally available remedy.

14. Hypothetical case study: Cyber disruption of a systemically important bank

Consider a hypothetical international banking group operating in Spain, with major payment operations and outsourced cloud infrastructure.

A cyber incident compromises a technology service provider, causing significant interruptions to payments and account-access services.

The disruption affects customers and businesses and creates concerns about settlement delays and financial-market confidence.

Stage 1: Determine the bank's legal status

The authorities would need to establish whether the relevant banking entity is a credit institution subject to DORA, whether its services are classified as critical functions, and whether particular infrastructure has formal critical infrastructure status under Spanish law.

These are different questions.

Stage 2: Examine preventive obligations

Supervisors would assess whether the bank maintained appropriate ICT risk controls, resilience testing, third-party arrangements, recovery procedures and governance systems.

They would not necessarily conclude that the occurrence of a cyber incident, by itself, establishes regulatory non-compliance.

Stage 3: Examine the response

Authorities would review the incident classification and notification process, continuity measures, containment, restoration and communications.

If the bank failed to comply with a mandatory reporting obligation, that failure might constitute an independent regulatory breach.

Stage 4: Evaluate liability

Civil claims would require consideration of customer agreements, payment services law, applicable statutory protections, causation and losses.

Regulatory sanctions would require the competent authority to establish breaches under the applicable regulatory framework.

Stage 5: Consider systemic intervention

If the disruption also threatened financial stability, the competent banking, resolution or other authorities might consider measures within their statutory powers.

Such measures would need to satisfy applicable legal safeguards.

The central distinction is between an operational incident, a regulatory violation and a systemic financial crisis. They can coincide, but one does not necessarily establish the others.

15. Challenges in protecting critical banking infrastructure

Cross-border regulatory fragmentation

International banks may operate under different incident-reporting, outsourcing, financial stability and critical infrastructure regimes.

Differences between national frameworks can complicate governance and crisis response.

Technology concentration

A small number of cloud, telecommunications or technology providers may support many financial institutions.

A disruption to a common supplier could therefore produce consequences across multiple banks.

Interdependency with other sectors

Banking continuity depends on electricity, telecommunications, data centres and payment infrastructure.

Effective protection may require coordination between financial regulators, cybersecurity authorities and critical infrastructure agencies.

National security versus commercial rights

Critical infrastructure measures can involve sensitive information, intervention powers, restrictions and enhanced state oversight.

The Bank Mellat judgment demonstrates that national security objectives do not automatically displace legal constraints on governmental action.

Public accountability versus security confidentiality

Regulators may possess commercially or security-sensitive banking information.

The law must balance legitimate confidentiality requirements against legally enforceable rights to information and public accountability.

The Jayantilal N. Mistry judgment provides an important Indian perspective on this issue.

16. Practical compliance framework for banks

A useful approach is to organise protection through a sequence of legal and operational assessments.

Determine legal classification

Establish the bank's supervisory status, critical functions and any formal critical infrastructure designation.

Map essential services

Identify critical payments, settlement operations, customer services and underlying technology dependencies.

Assess applicable regulatory obligations

Map banking supervision, cybersecurity, outsourcing, continuity, incident-reporting and critical infrastructure laws.

Implement and test controls

Maintain governance, security, business continuity, third-party risk controls and recovery arrangements.

Prepare regulatory incident response

Define decision-making authority, reporting thresholds, escalation procedures and crisis coordination.

Review accountability and resilience

Conduct periodic assessments, independent assurance and legally required supervisory engagement.

17. Principal legislation and authorities for further legal research

The following are primary materials useful for an academic paper, legal opinion or regulatory compliance analysis.

Research limitation: This analysis identifies established statutory frameworks and reported cases, but live legal databases were not available for verification. Amendments, national transposition measures, implementing regulations and regulatory developments through October 2026 should be checked against official sources before relying on the discussion as a statement of current law.

18. Conclusion

Critical infrastructure protection for banks is a multidimensional legal responsibility connecting banking supervision, cybersecurity, operational resilience, financial stability, national security and administrative law.

The law seeks not simply to protect bank buildings or computer networks but to preserve the essential financial services on which economic and social activity depends.

The comparative analysis reveals three particularly important conclusions.

First, formal critical infrastructure status and systemic banking importance are not legally identical. A bank may be heavily regulated and systemically significant without every part of its infrastructure having been formally designated as critical.

Second, operational resilience is increasingly a distinct supervisory obligation. Legislation such as DORA demonstrates the shift from protecting individual technology assets towards maintaining essential financial services despite disruptions and third-party failures.

Third, the protection of financial stability must remain consistent with the rule of law. Cases such as Bank Mellat, Peter Paul, Kotnik, Patco Construction and Internet and Mobile Association of India v RBI demonstrate how judicial scrutiny addresses state powers, regulatory liability, cybersecurity responsibilities and proportionality.

For Spain in particular, the most important analytical issue is the interaction between Law 8/2011, Royal Decree 704/2011, DORA, EU banking regulation and the legislation governing banking recovery and resolution. Together, these frameworks provide different, complementary forms of protection without treating every bank, activity or supplier as automatically subject to the same legal obligations.