FINANCIAL LAW AS A COMPUTATIONAL SYSTEM: FUTURE ARCHITECTURE UNDER SPANISH AND EUROPEAN UNION LAW

1. INTRODUCTION

Financial Law as a Computational System refers to the transformation of traditional financial regulation into a technology-driven legal architecture in which statutory rules, regulatory obligations, financial transactions and compliance procedures can be represented, interpreted and implemented through computational systems.

This approach combines financial legislation, artificial intelligence (AI), blockchain technology, regulatory technology (RegTech), supervisory technology (SupTech), automated decision-making and digital financial infrastructure.

In Spain and the European Union, this emerging architecture seeks to make financial regulation more efficient, transparent, traceable and responsive. Instead of relying exclusively on manual compliance procedures, financial institutions increasingly use automated systems to monitor transactions, assess risks, detect suspicious activities and report regulatory information.

However, computational financial regulation must remain consistent with legality, accountability, transparency, data protection, fundamental rights and judicial review.

2. LEGAL AND REGULATORY FRAMEWORK

A. EUROPEAN UNION LEGISLATION

Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554: Establishes requirements for ICT risk management, incident reporting, operational resilience testing and third-party technology risk management.

Markets in Financial Instruments Directive II (MiFID II), Directive 2014/65/EU: Establishes regulatory requirements for investment services, algorithmic trading and investor protection.

Markets in Financial Instruments Regulation (MiFIR), Regulation (EU) No. 600/2014: Establishes transparency and reporting requirements for financial markets.

General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: Regulates personal data processing, automated individual decision-making and data protection rights.

Artificial Intelligence Act, Regulation (EU) 2024/1689: Establishes a risk-based framework for AI systems, including applicable obligations for relevant financial-sector applications.

Digital Services and financial data legislation: The EU's digital regulatory framework also includes legislation governing electronic identification, cybersecurity and financial data access.

B. SPANISH LEGAL FRAMEWORK

Important Spanish legislation includes:

Law 10/2014 on the regulation, supervision and solvency of credit institutions.

Law 6/2023 on Securities Markets and Investment Services.

Law 7/2020 for the digital transformation of the financial system.

Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights.

Law 10/2010 on the prevention of money laundering and terrorist financing.

The Banco de España, CNMV and Spanish Data Protection Agency (AEPD) have important supervisory or enforcement responsibilities within their respective jurisdictions.

3. FUTURE ARCHITECTURE OF COMPUTATIONAL FINANCIAL LAW

A. MACHINE-READABLE LEGISLATION

Future financial legislation may be represented through structured digital rules that allow institutions to translate legal obligations into automated compliance procedures.

For example, capital adequacy requirements, reporting deadlines and transaction restrictions may be translated into machine-readable regulatory specifications.

Nevertheless, computational representations cannot independently replace authoritative statutory interpretation.

B. ALGORITHMIC REGULATORY COMPLIANCE

Financial institutions can use algorithms to monitor transactions, calculate regulatory indicators, detect suspicious activities and identify compliance failures.

Such systems must operate within applicable legal requirements and maintain appropriate human oversight.

C. BLOCKCHAIN-BASED FINANCIAL GOVERNANCE

Distributed ledger technology may support transaction verification, settlement records, auditability and financial asset management.

The EU Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, provides a regulatory framework for relevant crypto-assets and service providers.

D. ARTIFICIAL INTELLIGENCE IN FINANCIAL SUPERVISION

AI can support fraud detection, credit-risk analysis, regulatory monitoring and supervisory risk assessment.

Where an AI system falls within a high-risk category under the AI Act, applicable requirements may include risk management, data governance, technical documentation, record-keeping and human oversight.

E. REAL-TIME REGULATORY REPORTING

Computational financial law may develop towards continuous regulatory reporting, allowing supervisory authorities to receive structured information about financial activities and institutional risks.

Such systems must preserve data accuracy, security, proportionality and appropriate access controls.

4. FUNDAMENTAL LEGAL PRINCIPLES

The computational architecture of financial law should follow these principles:

Legality: Every automated regulatory decision must have an identifiable legal foundation.

Transparency: Financial institutions should explain relevant automated decisions.

Accountability: Institutions remain legally responsible for their compliance systems.

Proportionality: Automated controls must be appropriate to the regulatory risk.

Data Protection: Personal information must be processed according to GDPR requirements.

Human Oversight: Automated decisions affecting legal rights must remain subject to appropriate review.

Cybersecurity: Financial computational infrastructure must maintain adequate security and operational resilience.

Judicial Review: Automated financial decisions must not eliminate access to effective legal remedies.

5. RELEVANT CASE LAWS

1. SCHREMS II v DATA PROTECTION COMMISSIONER (2020), CASE C-311/18

Authority: Directly relevant to computational financial data governance.

The CJEU invalidated the EU-US Privacy Shield and examined safeguards for international personal data transfers. The judgment is relevant to financial institutions using international cloud infrastructure and cross-border computational services.

2. SCHUFA HOLDING (2023), CASE C-634/21

Authority: Directly relevant to algorithmic financial decision-making.

The Court examined automated credit scoring under Article 22 GDPR. It clarified that automated creditworthiness assessments may constitute automated individual decision-making where they play a determining role in a third party's decision to establish, implement or terminate a contractual relationship.

3. DUN & BRADSTREET AUSTRIA (2025), CASE C-203/22

Authority: Directly relevant to algorithmic transparency.

The CJEU addressed the right to meaningful information about the logic involved in automated decision-making under the GDPR. It emphasised that explanations must enable individuals to understand and challenge relevant automated decisions.

4. GOOGLE SPAIN SL AND GOOGLE INC. v AEPD (2014), CASE C-131/12

Authority: Analogous authority on digital accountability and data protection.

The Court recognised important data protection responsibilities concerning the processing of personal information through online search services. Its reasoning is relevant to accountability in computational financial data systems.

5. GOOGLE LLC v COMMISSION NATIONALE DE L'INFORMATIQUE ET DES LIBERTÉS (2019), CASE C-507/17

Authority: Analogous authority on territorial limits of digital regulation.

The Court considered the territorial scope of the right to delisting under EU data protection law. The judgment is relevant to the cross-border architecture of digital financial regulation.

6. VOLKSWAGEN AG v LANDESANSTALT FÜR MEDIEN NORDRHEIN-WESTFALEN (2023), CASE C-134/22

Authority: Analogous authority on digital regulatory enforcement.

This decision concerned the interpretation of EU data protection requirements and the exercise of regulatory powers. It provides useful context for understanding the relationship between digital compliance systems and supervisory accountability.

6. LEGAL RISKS AND REGULATORY CHALLENGES

The future computational architecture of financial law creates several challenges:

Algorithmic discrimination: Automated credit systems may unfairly disadvantage particular individuals.

Cybersecurity threats: Financial databases and automated infrastructure may become targets of cyberattacks.

Regulatory fragmentation: Different jurisdictions may apply inconsistent computational compliance standards.

Accountability gaps: Financial institutions may attempt to attribute failures to external software providers.

Data privacy violations: Excessive collection or processing of financial information may violate GDPR requirements.

Systemic technological failures: A common software or cloud infrastructure failure may disrupt several financial institutions simultaneously.

Lack of explainability: Complex algorithms may make financial decisions difficult to understand or challenge.

Regulatory authorities must therefore ensure that automation strengthens rather than weakens legal accountability.

7. FUTURE REGULATORY DEVELOPMENT

The future architecture of computational financial law may include:

Machine-readable financial legislation and regulatory standards.

AI-supported financial supervision.

Automated regulatory reporting and compliance verification.

Blockchain-based transaction audit systems.

Standardised digital financial identities.

Cross-border regulatory data interoperability.

Automated detection of systemic financial risks.

Legally accountable algorithmic decision-making.

Digital audit trails for financial institutions.

Integrated cybersecurity and operational resilience frameworks.

Spain can develop these mechanisms through cooperation between Banco de España, CNMV, AEPD and European supervisory institutions.

8. CONCLUSION

Financial Law as a Computational System represents a significant transformation in the future governance of financial markets. It integrates legislation, algorithms, digital infrastructure and automated regulatory supervision into a connected legal architecture.

European legislation such as DORA, GDPR, MiFID II and the AI Act provides important foundations for this transformation. The judgments in Schrems II, SCHUFA, Dun & Bradstreet Austria and other relevant decisions demonstrate that technological efficiency must remain subject to legal accountability, transparency and fundamental rights.

Ultimately, the future of computational financial law should not involve replacing legal institutions with algorithms. Instead, it should create a legally controlled technological system in which automation improves regulatory efficiency while preserving human responsibility, financial stability, consumer protection and the rule of law.