Spain

Licensing, Authorisation & Market Access

Spain's payment-institution and e-money-institution licensing landscape faces a material forward-looking structural change through PSD3/PSR. Provisional political agreement on the package was reached on 27 November 2025, and COREPER compromise texts were published on 23 April 2026. National transposition is expected to take approximately 21 months from final adoption, which would push Spanish applicability into mid-to-late 2027, a timeline confirmed at Probable confidence given the package's continued progress through the EU legislative process rather than final enactment.

Once transposed, PSD3 is expected to unify payment institutions and e-money institutions, currently separately licensed and supervised categories, into a single authorised category, tentatively described in Spanish-market commentary as an 'entidad de pago autorizada a emitir dinero electrónico', under Banco de España supervision. This is assessed at Uncertain confidence, since the precise Spanish implementing terminology and structure will depend on national transposition choices not yet finalised. For firms currently licensed under either the payment-institution or e-money-institution category in Spain, this represents a coming structural consolidation of the licensing regime itself, distinct from any change to underlying prudential or safeguarding requirements, which fall under conduct and safeguarding considerations addressed separately.

The bank-PSP versus non-bank payment-institution/e-money-institution distinction remains structurally relevant here: PSD3's unification applies specifically to the non-bank PI/EMI licensing tier under Banco de España supervision, and does not alter the separate prudential and licensing framework applicable to bank-supervised payment activity.

Outlook

The key development to track is the pace and substance of Spain's national transposition process once PSD3/PSR reaches final EU adoption, and specifically how the Banco de España structures the unified PI/EMI authorisation category in practice. Firms currently holding separate PI or EMI licences in Spain should monitor the transposition timeline closely given the mid-to-late 2027 applicability window.

Conduct, Safeguarding & Financial Promotions

Real Decreto 813/2026 makes two conduct-of-business adjustments relevant to payments, both minor relative to the decree's primary AML and gambling focus. It eases access to free basic payment accounts for economically vulnerable persons by allowing certain non-profit entities to certify financial-exclusion risk on behalf of applicants, a change to the gateway through which vulnerable persons access basic payment-account rights rather than to the underlying basic-account entitlement itself. Separately, it flexibilises and expands the electronic payment means available for payments made to Spanish public administrations, specifically enabling card-based electronic payment instruments as a means of paying public bodies. Neither provision touches Banco de España's licensing or prudential framework for payment institutions or electronic-money institutions; both operate at the level of who may certify eligibility or what instrument may be used for a specific payment category, rather than altering any authorisation or safeguarding requirement.

These changes sit within a decree whose primary substance is AML and gambling-regulatory, and the payments-conduct provisions should be read as incidental adjustments rather than evidence of a broader Banco de España conduct-rule overhaul this cycle. No change to financial-promotions rules, safeguarding requirements for client funds, or other core W1b obligations was evidenced.

Outlook

No further payments-conduct development is signalled for the near term beyond these two incidental provisions. Whether Banco de España or the Ministry of Economy issues implementing guidance on which non-profit entities may certify financial-exclusion risk is the main open item, though nothing in the material reviewed indicates a timeline for such guidance.

Stablecoins & Digital Money

Spain's transitional arrangement for crypto-asset service providers already operating in the market before the Markets in Crypto-Assets Regulation took effect has now ended. The CNMV confirms that Spain decided to apply the national transitional period permitted under MiCA Article 143(3) through 30 June 2026, allowing pre-existing providers a defined runway to secure full MiCA authorisation rather than ceasing operations immediately on the regulation's entry into application. That runway has now closed. From 1 July 2026, any crypto-asset service provider operating in Spain without MiCA authorisation sits outside the lawful perimeter for onboarding new customers or marketing its services, and is expected to be winding down rather than continuing to trade.

ESMA's position, issued alongside the close of national transitional periods across the EU including Spain's, states explicitly that unauthorised crypto-asset service providers are expected to take immediate steps to wind down their EU activities in an orderly manner. The emphasis on orderliness is notable: ESMA frames the expectation around safeguarding client interests and mitigating risks to market integrity during the exit, rather than treating wind-down purely as a compliance formality. For market participants, this signals that regulators are alert to disorderly-exit risk — client assets stranded, service interruptions, or last-minute scrambles to transfer custody — as much as to the underlying authorisation gap itself.

The practical consequence for payments businesses is a sharpened counterparty-due-diligence question. Any payments firm with a commercial relationship touching a crypto-asset service provider active in the Spanish market needs to know whether that provider holds CNMV authorisation under MiCA, because continued unauthorised operation past the 30 June 2026 deadline is no longer an ambiguous or tolerated state — it is a direct departure from the applicable transitional framework as confirmed by the regulator itself. This is a market-access and counterparty-risk fact, not a judgment about how any individual firm is handling its obligations.

What is not yet established from available reporting is how the Spanish market has actually responded in practice: whether the unauthorised providers identified at the deadline have completed wind-down, sought late authorisation, or continue to operate in contravention of the expired transitional status. That operational picture — authorised-entity counts, enforcement actions, or confirmed market exits — is not reliably extractable from the sources available this cycle and is not asserted here.

Outlook

The regulatory position itself is now settled and in force: the transitional period is over, and the expectation of authorisation or orderly wind-down is explicit from both the CNMV and ESMA. The open question going forward is one of enforcement visibility — whether the CNMV publishes updates on authorised-entity status, takes visible action against firms that remain unauthorised, or whether the wind-down process proceeds without further public signal. Payments businesses with exposure to the Spanish crypto-asset services market should treat any counterparty's authorisation status as a live question rather than a settled one until confirmed directly, since the deadline itself does not guarantee that every affected provider has in fact exited or come into compliance.

Operational Resilience & Critical Infrastructure

Spain's National Payments Committee, comprising the Bank of Spain alongside Visa, Mastercard and major domestic banks, proposed an offline card-payment continuity system on 19 November 2025, targeting nationwide deployment by 2029. The proposal addresses continuity of card payments during network or connectivity outages, a resilience concern distinct from, but complementary to, the EU's Digital Operational Resilience Act baseline already applicable to Spanish financial entities. Confidence on this specific proposal is Low, reflecting a single tier-4 secondary source at an early proposal stage rather than a settled infrastructure commitment.

Outlook

The multi-year runway to 2029 means this is a watch item rather than a near-term compliance driver. The next markers to track are formal endorsement by the Bank of Spain beyond committee-level proposal, and any published technical specification for offline continuity that would allow card schemes and acquirers to begin implementation planning.

Scheme & Network Compliance

The European Payments Council's Verification of Payee Rulebook version 1.1 became mandatory for all SEPA scheme participants, including Spanish payment service providers, from 20 September 2026. The update revises API specifications, notably prohibiting empty fields in VoP response messaging, and tightens the security framework governing Verification of Payee, SEPA Request to Pay (SRTP), and the SEPA Proxy Lookup and Addressing scheme (SPAA). This is a scheme-rulebook update layered on top of an existing legal obligation rather than a new substantive duty: Verification of Payee, in the form of IBAN-name matching for SEPA Instant credit transfers, has been mandatory in Spain since 9 October 2025 under the EU Instant Payments Regulation (Regulation (EU) 2024/886), with direct effect on both Bizum and conventional SEPA Instant bank transfers.

For Spanish PSPs, the practical consequence is a technical and security compliance update to already-built VoP infrastructure rather than a new build requirement. The underlying regulatory driver, the Instant Payments Regulation's VoP mandate, is unchanged; the EPC rulebook update operates at the scheme layer that all SEPA participants, Spanish or otherwise, must conform to as a condition of continued scheme participation. No Spain-specific implementation notice from Iberpay, Spain's national SEPA clearing and settlement infrastructure operator, or a dedicated Banco de Espana circular addressing the September 2026 update was located this cycle; the sourcing for the rulebook change itself rests on an aggregator account (ClearingPost), corroborated structurally by the Banco de Espana's own prior public guidance describing the October 2025 VoP obligation that the rulebook update amends procedurally.

No other Scheme & Network Compliance development for Spain surfaced this cycle.

Outlook

As scheduled, the EPC Rulebook v1.1 specifications took effect on 20 September 2026 and are now in force across the SEPA area, including for Spanish scheme participants. The next material point of interest specific to Spain would be a direct statement from Iberpay or the Banco de Espana confirming local operational compliance with the updated API and security specifications; no such statement was available this cycle, so the current account rests on scheme-level and aggregator sourcing rather than a Spain-specific primary confirmation.

Payment Corridor Dynamics

The EU Instant Payments Regulation (Regulation (EU) 2024/886) is now binding on Spanish payment service providers, mandating ten-second processing for instant credit transfers, IBAN-verification anti-fraud checks, and fee parity between instant and standard transfers. This lands on Spain's existing SCT Inst corridor, carried domestically by the Iberpay SNCE network, which most Spanish banks access via the Redsys aggregator, and which underpins the Bizum-dominant instant-payments user experience. Oversight of this corridor is now genuinely two-layered: Banco de España retains domestic infrastructure oversight while the Regulation itself is EU-level and directly binding, applicable to both bank and non-bank providers connected to the corridor.

Outlook

Compliance with the ten-second processing and fee-parity requirements is the immediate operative burden for PSPs connected to Iberpay SNCE; the practical question to track is how quickly aggregator-dependent smaller banks and non-bank PSPs, reliant on Redsys for connectivity, complete the technical uplift required for IBAN-verification anti-fraud checks at scale.

Legal & Litigation

The EU Council's issuance of compromise texts for PSD3/PSR on 17 April 2026 is this cycle's defining structural development for Spain's payments legal landscape. Formal adoption is expected imminently, at which point a 21-month national transposition clock begins running toward an eventual in-force date projected around 2028. The reform's most consequential structural feature for Spain is the elimination of the standalone EMI regime: PSD3/PSR merges e-money institutions into a Payment Institution sub-category, requiring existing EMIs to undergo re-authorisation under the new framework rather than continuing indefinitely under legacy EMD licensing.

Alongside the licensing-structure merger, the reform introduces expanded APP-fraud reimbursement liability for payment service providers and mandatory IBAN/name-check obligations, under which a PSP must verify that the payee name matches the IBAN before completing a transfer. These consumer-facing fraud-prevention measures apply across the merged Payment Institution category and represent a materially higher compliance bar than the current regime, particularly for entities that have operated under the lighter-touch EMI framework.

This is currently probable-confidence, standing-brief material: the compromise texts have been issued but formal adoption, and the specific mechanics of Spain's national transposition, remain ahead. The 21-month clock is a maximum transposition window rather than a guarantee of early implementation, and Spain's specific transposition approach — including any grandfathering provisions for existing EMIs — has not yet been determined or evidenced this cycle.

Outlook

The key legal-development watch item for coming cycles is formal EU-level adoption of PSD3/PSR, which will fix the exact start date of Spain's 21-month transposition clock. Once transposition legislation is drafted domestically, the treatment of existing EMIs — whether through grandfathering or a hard re-authorisation deadline — will be the most consequential detail for incumbent payment institutions operating in Spain under the current EMD-derived framework.

Product Innovation & Market Development

Spain's buy-now-pay-later sector continues rapid expansion, from an estimated EUR 1.00 billion in 2023 toward a projected EUR 8.12 billion by 2030, a 29.3 percent compound annual growth rate, led by Klarna, Aplazame, SeQura and Afterpay/Pagantis. Confidence is Low, reflecting a single tier-4 vendor source rather than a regulator-published figure, and no discrete regulatory product-access development (comparable to open-banking or BaaS rulemaking) was sourced this cycle to accompany the growth data.

Outlook

The growth trajectory itself is the signal to track rather than any pending rule change; a regulatory response calibrated to BNPL's scale, whether through consumer-credit-style disclosure requirements or Banco de España/CNMV product guidance, would be the next material development to watch for, though none is yet sourced this cycle.

Consumer Protection & APP Fraud

Spain's consumer-facing APP-fraud picture this cycle combines a statistical baseline with a converging legal-and-statutory liability trajectory. Spain's Ministerio del Interior recorded 464,801 registered cyber-offences in 2024, approximately 89% of which were online fraud; notably, this marked the first year-on-year decrease in this statistic. Kaspersky-sourced data places the average per-victim loss at €577, while under-reporting is estimated at near 69%, a figure that suggests the true fraud-loss picture for Spanish consumers is materially larger than officially recorded statistics indicate.

Against this statistical backdrop, Spanish consumers already benefit from judicial protection ahead of formal statutory codification: the Tribunal Supremo's sentencia 571/2025 ordered a bank to refund over €56,000 lost to phishing and SIM-swap fraud for failing to react to evident fraud signals. Once PSD3/PSR is transposed, expected in the mid-to-late 2027 window, this judicial standard is expected to be joined by an explicit statutory provider-liability obligation for authorised push payment fraud under the PSR component of the package.

Taken together, Spanish PSPs face a converging statutory-and-case-law liability regime for APP fraud, arriving in two stages: an already-live judicial standard now, and a codified statutory obligation once transposition is complete. Consumers experiencing APP fraud losses in Spain currently have judicial precedent to draw on even before PSR's liability provisions take direct legal effect domestically.

Outlook

The near-term-to-mid-term development to track is whether Spain's declining year-on-year cyber-offence statistic continues, and whether further judicial rulings extend or refine the evident-fraud-signal liability standard ahead of PSD3/PSR's formal transposition into Spanish consumer-protection law.

AML/CFT & Financial Crime

Real Decreto 813/2026 extends the existing SEPBLAC-representative obligation under Ley 10/2010's implementing regulation to small real-estate credit intermediaries and other small obliged entities that had previously benefited from an exemption. Those entities now face a nine-month compliance deadline, running to 28 July 2027, to appoint a SEPBLAC representative. This is a governance-coverage expansion rather than a new type of obligation: the representative duty itself already existed for larger obliged entities, and the decree simply removes the small-entity carve-out.

Payment institutions and electronic-money institutions are not named as a primary target of this provision in the material reviewed, and the decree's payment-account identity-matching requirements, which do touch how funds are credited and returned electronically, are scoped specifically to gambling operators rather than to payment-service providers as a class. The substantive AML-architecture analysis of RD 813/2026, including its crypto-asset-service-provider SEPBLAC-gateway and crypto-ATM identification provisions, is carried by the financial-integrity monitor; this W11 treatment notes only the governance-coverage dimension as it might touch payment-adjacent intermediaries falling within the newly-expanded small-obliged-entity population.

Outlook

The 28 July 2027 compliance deadline for newly-covered small obliged entities is the concrete date to track. Whether any payment institution or EMI falls within the expanded small-entity population subject to the SEPBLAC-representative duty was not established in the material reviewed this cycle and would be the clearest item to confirm in a future cycle.

Correspondent Banking, Settlement & Access

Banco de España has expressly described refusal to accept non-domestic EU IBANs for SEPA credit transfers and direct debits as non-compliant practice. This is a live, currently-uncertain-confidence practical access issue in Spain's payments environment, and it is analytically distinct from the incoming PSR mandatory IBAN/name-check regime that forms part of the PSD3/PSR reform package. The PSR mechanism, once transposed, will require PSPs to verify that a payee's name matches the IBAN supplied — a fraud-prevention control. Banco de España's concern, by contrast, addresses outright refusal to accept a valid, correctly-issued EU IBAN purely because it is not domestically issued, which is a market-access and non-discrimination issue rather than a fraud-prevention one.

The practical effect for payment service providers and their customers is a two-track compliance landscape emerging in Spain's correspondent and settlement environment: an existing, Banco de España-flagged non-compliance risk around IBAN-origin discrimination, and a forthcoming, PSR-driven mandatory verification obligation that will sit alongside it once national transposition occurs. Both bank and non-bank payment institutions are implicated, since the IBAN-acceptance issue as characterised by Banco de España applies across the SEPA credit-transfer and direct-debit rails generally rather than being confined to a specific class of institution.

Outlook

The principal watch item is whether Banco de España's non-compliance characterisation translates into supervisory action against specific institutions independent of, and ahead of, the PSR's own mandatory IBAN/name-check requirements entering into force via national transposition. Given the confidence level attached to this finding this cycle is uncertain, further primary-source confirmation of both the scope of the practice and any resulting supervisory response should be a priority for the next research cycle.

Commercial Intelligence & Fintech

The same Spain BNPL growth data point (EUR 1.00 billion in 2023 to a projected EUR 8.12 billion by 2030) surfaces here as a market-intelligence figure rather than a discrete commercial event; no M&A, funding round, or product-launch event with a complete commercial-event shape was identified this cycle for Klarna, Aplazame, SeQura or Afterpay/Pagantis in the Spanish market. Confidence is Low, sourced to a single tier-4 vendor figure.

Outlook

This module is thinly evidenced this cycle beyond the aggregate growth figure; a discrete funding round, acquisition, or product launch among the named BNPL providers would be the next concrete commercial-intelligence data point to track for the Spanish market.