title: Spain Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/spain/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Spain ES schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 73 sourced findings · 141 sources in the cumulative register 14 Modules baseline.modules[] 73 Findings modules[].findings[] 170 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) No modules moved this cycle. ** Law made at European Economic Area level** that applies in Spain is covered once, on the [European Economic Area](https://payments.gi/jurisdictions/european-economic-area/) page. This page covers Spain’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief ###### Latest update · 12 October 2026 #### Lead Signal Real Decreto 813/2026, published in Spain's BOE, makes two changes relevant to payments that are incidental to the decree's primary AML and gambling focus. First, it eases access to free basic payment accounts for economically vulnerable persons by allowing certain non-profit entities to certify financial-exclusion risk, a conduct-of-business adjustment rather than a licensing change. Second, it expands and flexibilises the electronic payment means available for payments to Spanish public administrations, specifically enabling cards as a payment instrument for such payments. Neither change touches Banco de España's core payment-institution or e-money-institution licensing framework, nor does either affect corridor dynamics or scheme-level rules; both sit within the conduct and financial-inclusion layer of Spain's payments regulatory environment. #### Other Developments **SEPBLAC-representative coverage expands to small obliged entities, with incidental relevance to payment-adjacent intermediaries.** The same decree removes the exemption that had let small real-estate credit intermediaries and other small obliged entities forgo appointing a SEPBLAC representative, with a nine-month compliance deadline running to 28 July 2027. Payment institutions and electronic-money institutions are not named as a primary target of this provision; the decree's payment-account identity-matching requirements are scoped specifically to gambling operators rather than to payment-service providers generally, so this AML governance extension should be read as touching a narrower population of obliged entities than the payments sector as a whole. #### Cross-Monitor Connections The SEPBLAC-representative extension and the broader AML architecture RD 813/2026 builds, including its crypto-asset-service-provider and crypto-ATM provisions, are analysed substantively by the financial-integrity monitor; this brief's W11 treatment is limited to the conduct and governance dimension as it bears on payment-adjacent intermediaries, without re-analysing the underlying illicit-finance picture. The decree's gambling-sector payment-identity-matching duty is a gambling-regulatory development tracked by the advennt monitor; it is referenced here only to confirm that it is scoped to gambling operators and not to payment institutions or EMIs as a class. #### Outlook Spain's core payments licensing (W1a), stablecoin and digital-money framework (W2), and corridor dynamics (W5) were quiet this cycle, and nothing in the material reviewed suggests near-term movement on those fronts. The items to track are the 28 July 2027 SEPBLAC-representative compliance deadline for newly-covered small obliged entities, and whether Banco de España issues further guidance clarifying which payment-adjacent intermediaries, if any, fall within that newly-expanded population. _5 earlier updates not shown here._ ###### Standing brief · as of 8 July 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Banco de España has escalated prudential enforcement against non-bank payment institutions, publishing sanctions in May 2026 against payment institution Money Exchange SA and its board members for serious infringements in organisational structure, internal control and accounting procedures, with entity fines up to EUR 180,000 after the statutory discount. The action rests on a licensing architecture that is well established: Real Decreto-ley 19/2018 transferred PI/EMI authorisation and registration competence from the Ministry of Economy to Banco de España, transposing PSD2 and repealing Ley 16/2009. Read together, the foundational competence transfer and the live sanction show a regime that is actively policed rather than merely notional, with the central bank willing to escalate against non-bank entrants rather than confining enforcement to systemic banks. #### Other Developments Spain's MiCA implementation continued to mature this cycle. The CNMV was designated competent authority for MiCA Titles II and V covering crypto-asset issuance and CASPs, while Banco de España took Titles III and IV covering asset-referenced and e-money tokens, formalised via the 2023 Securities Markets and Investment Services Law. Spain's transitional period for pre-existing BdE-registered virtual-currency providers, initially set to end 30 December 2025, was extended to the full 18-month maximum ending 30 June 2026, confirmed via ESMA's updated grandfathering-period list published 1 December 2025. On the conduct side, June 2025 joint BdE/SEPBLAC good-practice criteria now require proportionate, documented, case-by-case justification for account restriction or closure decisions taken for AML/CFT reasons, guarding against unjustified financial exclusion. Operational resilience also advanced: the CNMV published a 74-question FAQ structured around DORA's five pillars in early 2026. Separately, the FSB's November 2025 peer review found Banco de España maintains robust risk-based cyber-resilience supervision and was an early TIBER-EU adopter. On the product side, Bizum Pay went live from 18 May 2026, using NFC technology to route point-of-sale payments directly from customer account to merchant account via instant transfer, explicitly positioned to reduce reliance on card-scheme infrastructure. This sits alongside the EU Instant Payments Regulation, which from 9 October 2025 requires eurozone PSPs including Spanish entities to offer Verification of Payee checking payee IBAN against registered name before transfer execution, alongside sub-10-second instant transfer and fee-parity obligations. Litigation and enforcement also moved. Supreme Court judgment 571/2025 requires banks to prove serious customer negligence or fraud before denying refunds for unauthorised transactions, reversing the prior practice of requiring customers to prove victimhood, in a SIM-swapping case against Ibercaja. Separately, the CNMV published a sanction against Banco de Sabadell, SA for a very serious infringement under Article 293.1.a) of Ley 6/2023 on Securities Markets and Investment Services, following a Council resolution dated 24 June 2025, finalised February 2026. And on 16 June 2026 the CNMC opened a sanctioning file against Spain's six largest banks over public executive statements on fixed-mortgage rate policy, alleging reduced competitive uncertainty in breach of national and EU competition law. Settlement access continued to open for non-banks: as of October 2025, non-bank PSPs meeting TARGET Guideline requirements can access TARGET Services directly, following the Eurosystem's harmonised policy enabling PI/EMI participation under amended PSD2/SFD provisions. On the commercial side, Bit2Me, a Madrid-based digital-asset platform, raised $30M in an August 2025 round led by Tether Ventures. Bankinter joined that shareholding structure in January 2026 alongside BBVA, Unicaja and Cecabank, part of a broader bank-fintech consolidation trend in Spanish crypto platforms. #### Cross-Monitor Connections SEPBLAC, Spain's Financial Intelligence Unit and AML/CFT supervisory authority since 1993, coordinates with Banco de España and the CNMV. Its July 2025 explanatory note clarifies that obliged entities under Ley 10/2010/RD 304/2014 must apply risk-based due diligence before denying or restricting accounts or payment products. That AML-supervisory material sits within the illicit-finance remit of the Financial Intelligence Monitor rather than this monitor's payments-conduct lens, and is carried here only as proxy disclosure pending restoration of the dedicated Sentinel.gi feed for Spain. #### Outlook The CNMC's antitrust file against six major banks carries a resolution window of up to 24 months, meaning the mortgage-pricing dispute will likely still be open well into 2028 and is a watch item for the industry-structure module. Spain's MiCA transitional period runs out on 30 June 2026, after which every remaining unauthorised provider must either hold a CASP licence or exit the market. Authorised-entity counts reported across sources currently conflict and require verification against the CNMV public register before publication. PSD3 is scheduled for application from 20 November 2026. Its interaction with Bizum Pay's card-displacing NFC rollout and with the instant-payments Verification of Payee mandate will shape whether Spain's account-to-account rails continue gaining share from card schemes through the second half of 2026. trust tier: ai_unverified ###### Latest update · 12 October 2026 #### Regulatory Status Spain's payments regulatory environment saw two incidental conduct-of-business adjustments and one AML-governance expansion this cycle, all introduced via Real Decreto 813/2026, a decree whose primary focus is AML and gambling regulation rather than payments. On the conduct side, the decree eases access to free basic payment accounts for economically vulnerable persons by permitting certain non-profit entities to certify financial-exclusion risk, and it expands electronic payment means, including cards, for payments to Spanish public administrations. On the AML side, the decree removes the small-entity exemption from the SEPBLAC-representative appointment duty, extending that governance obligation to small real-estate credit intermediaries and other previously-exempt small obliged entities, with a nine-month compliance deadline to 28 July 2027. Payment institutions and electronic-money institutions are not named as a primary target of the decree's payment-account identity-matching provisions, which are scoped to gambling operators specifically. Spain's core payment-institution and e-money-institution licensing framework under Banco de España supervision, stablecoin and digital-money developments, and payment-corridor dynamics all remained quiet this cycle, with no material change evidenced in any of those areas. #### Outlook The 28 July 2027 SEPBLAC-representative compliance deadline for newly-covered small obliged entities is the nearest concrete date for this jurisdiction. Whether any payment institution or EMI falls within that newly-expanded population, and whether Banco de España issues implementing guidance on the basic-payment-account certification process, are the two items most likely to generate further Spain-specific payments content in a future cycle. _3 earlier updates not shown here._ ###### Standing brief · as of 8 July 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Spain's payments regulatory perimeter tightened materially this cycle across licensing, conduct, competition and consumer-protection lines. Banco de España's May 2026 sanctions against payment institution Money Exchange SA for organisational-control and internal-control failures show active enforcement of the prudential floor for non-bank payment institutions. That enforcement rests on a licensing architecture established when Real Decreto-ley 19/2018 transferred PI/EMI authorisation and registration competence from the Ministry of Economy to Banco de España, transposing PSD2 and repealing Ley 16/2009. On the conduct side, June 2025 joint BdE/SEPBLAC good-practice criteria now constrain account restriction and closure decisions taken for AML/CFT reasons, guarding against unjustified financial exclusion. Spain's MiCA architecture splits competence between the CNMV, for crypto-asset issuance and CASPs, and Banco de España, for asset-referenced and e-money tokens. The transitional grandfathering period for pre-existing providers was extended to the maximum 18 months, ending 30 June 2026. Litigation risk rose sharply this cycle. Supreme Court judgment 571/2025 shifted the burden of proof for unauthorised-transaction refunds onto banks, requiring proof of serious customer negligence or fraud before a refund can be denied. Separately, the CNMV sanctioned Banco de Sabadell, SA for a very serious infringement under the 2023 Securities Markets and Investment Services Law, following a Council resolution dated 24 June 2025 and finalised in February 2026. A new competition-law front opened on 16 June 2026 when the CNMC filed a sanctioning case against Spain's six largest banks over public statements on fixed-mortgage pricing. On infrastructure, non-bank PSPs gained direct TARGET access from October 2025, formalising a settlement-system reform that had previously relied on indirect, bank-intermediated participation. Bizum Pay's NFC point-of-sale launch on 18 May 2026 extended instant-payment rails into the card scheme's core retail-checkout territory, positioning account-to-account rails as a direct competitor to cards at the point of sale. Operational resilience and product infrastructure kept pace. The CNMV's 74-question DORA FAQ and the FSB's favourable November 2025 peer review of Banco de España's cyber supervision confirm an established, rather than reforming, resilience posture. Redsys remains the dominant card-acquiring backbone under IFR interchange caps, even as Bizum's growing merchant base signals gradual account-to-account erosion of that acquiring volume. On product policy, Spain's Law 7/2020 sandbox and the forthcoming PSD3 application from 20 November 2026 continue to broaden non-bank market access. SEPBLAC's AML/CFT supervisory role and its July 2025 due-diligence clarification sit adjacent to, rather than inside, this monitor's payments-conduct remit. Commercially, Bit2Me's Tether-led funding round and Bankinter's subsequent stake illustrate the bank-fintech consolidation running through the CASP licensing wave. #### Outlook Spain's jurisdiction risk level is elevated and trending toward tightening, driven by the combination of active BdE/CNMV/CNMC enforcement, the MiCA CASP licensing wave and DORA implementation work. The CNMC's antitrust file, with its resolution window running to as late as 2028, the 30 June 2026 MiCA transitional deadline, and PSD3's 20 November 2026 application date form the three nearest-term watch points across the ES file; the trajectory across the licensing, litigation and industry-structure modules points toward continued regulatory tightening through the second half of 2026. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access Confirmed confirmed 2026-07-04 PSD2 remains active baseline; PSD3/FIDA tracked as upcoming. From 2026, banks/PIs/EMIs must report all accounts to Hacienda regardless of balance, removing the prior EUR 3,000 threshold. Standing sub-brief · as of 8 July 2026 204 words · last cycle 2026-09-14 #### Licensing, Authorisation & Market Access Spain's payment institution and e-money institution licensing regime rests on Real Decreto-ley 19/2018, which transferred PI/EMI authorisation and registration competence from the Ministry of Economy to Banco de España, transposing PSD2 and repealing Ley 16/2009. That competence sits at the centre of the bank-PSP versus non-bank-PI/EMI distinction that runs through this module: banks are prudentially supervised as credit institutions, while payment institutions and e-money institutions answer to Banco de España under a lighter-touch but still binding authorisation and ongoing-supervision regime. The live enforcement record shows that regime is not dormant. In May 2026, Banco de España published sanctions against payment institution Money Exchange SA and its board members for serious infringements in organisational structure, internal control and accounting procedures, with entity fines up to EUR 180,000 after the statutory discount. The action is a direct illustration of the prudential and organisational-control floor that non-bank PIs must meet, and of the central bank's willingness to escalate against smaller entrants rather than reserving enforcement for systemic banks. #### Outlook With the competence-transfer architecture now eight years old and enforcement precedent accumulating, expect continued BdE scrutiny of organisational-control and own-funds compliance among Spain's non-bank PI/EMI population, particularly smaller entities without bank-grade governance infrastructure. Periodic update · new data 2026-09-14 #### Licensing, Authorisation & Market Access Spain's payment-institution and e-money-institution licensing landscape faces a material forward-looking structural change through PSD3/PSR. Provisional political agreement on the package was reached on 27 November 2025, and COREPER compromise texts were published on 23 April 2026. National transposition is expected to take approximately 21 months from final adoption, which would push Spanish applicability into mid-to-late 2027, a timeline confirmed at Probable confidence given the package's continued progress through the EU legislative process rather than final enactment. Once transposed, PSD3 is expected to unify payment institutions and e-money institutions, currently separately licensed and supervised categories, into a single authorised category, tentatively described in Spanish-market commentary as an 'entidad de pago autorizada a emitir dinero electrónico', under Banco de España supervision. This is assessed at Uncertain confidence, since the precise Spanish implementing terminology and structure will depend on national transposition choices not yet finalised. For firms currently licensed under either the payment-institution or e-money-institution category in Spain, this represents a coming structural consolidation of the licensing regime itself, distinct from any change to underlying prudential or safeguarding requirements, which fall under conduct and safeguarding considerations addressed separately. The bank-PSP versus non-bank payment-institution/e-money-institution distinction remains structurally relevant here: PSD3's unification applies specifically to the non-bank PI/EMI licensing tier under Banco de España supervision, and does not alter the separate prudential and licensing framework applicable to bank-supervised payment activity. #### Outlook The key development to track is the pace and substance of Spain's national transposition process once PSD3/PSR reaches final EU adoption, and specifically how the Banco de España structures the unified PI/EMI authorisation category in practice. Firms currently holding separate PI or EMI licences in Spain should monitor the transposition timeline closely given the mid-to-late 2027 applicability window. **1 earlier distinct update(s)** Periodic update · new data 2026-09-08 #### Licensing, Authorisation & Market Access Spain's payment-services perimeter tightened this cycle on the tax-reporting axis rather than the licensing-authorisation axis proper. From 2026, the EUR 3,000 reporting threshold that previously limited which accounts banks, payment institutions and e-money institutions had to report to the Hacienda has been removed; all accounts must now be reported regardless of balance. This is a material expansion of what PSPs and EMIs must capture and transmit to the tax authority, distinct from prudential licensing but carrying real operational weight for account-reporting infrastructure across both bank and non-bank providers. Looking further out, PSD3 is expected in Spain in the fourth quarter of 2026, tracked as a proposed instrument that would supersede the PSD2 licensing and conduct baseline, and FIDA is expected in 2027, extending open-finance data-access obligations beyond payments. Neither has advanced to enactment this cycle; both remain horizon items rather than in-force change. #### Outlook The near-term compliance load falls on reporting infrastructure rather than licensing renewal: PSPs, EMIs and banks operating in Spain should expect the widened Hacienda reporting scope to be the operative change this cycle, while PSD3 and FIDA remain the structural items to track toward the second half of 2026 and into 2027. **Sources and findings (6)** 1. T1 [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2018-16036](https://www.boe.es/diario_boe/txt.php?id=BOE-A-2018-16036) 2. T1 [https://www.boe.es/buscar/act.php?id=BOE-A-2009-18118](https://www.boe.es/buscar/act.php?id=BOE-A-2009-18118) retrieved 2026-07-04 3. T1 [https://sedeelectronica.bde.es/sede/es/tramites/autorizacion-entidades-dinero-electronico-p221.html](https://sedeelectronica.bde.es/sede/es/tramites/autorizacion-entidades-dinero-electronico-p221.html) retrieved 2026-07-04 4. T1 [https://sedeelectronica.bde.es/sede/es/menu/institucionesfin/autorizacion-al-/autorizacion_de_aa6f1da00495961.html](https://sedeelectronica.bde.es/sede/es/menu/institucionesfin/autorizacion-al-/autorizacion_de_aa6f1da00495961.html) retrieved 2026-07-04 5. T1 [https://www.derecho.com/boe/resolucion-de-5-de-mayo-de-2026-del-banco-de-espana-por-la-que-se-publican-las-sanciones-impuestas-por-infracciones-graves-a-money-exchange-sa-y-a-los-miembros-de-su-consejo-de-administracion-890347](https://www.derecho.com/boe/resolucion-de-5-de-mayo-de-2026-del-banco-de-espana-por-la-que-se-publican-las-sanciones-impuestas-por-infracciones-graves-a-money-exchange-sa-y-a-los-miembros-de-su-consejo-de-administracion-890347) retrieved 2026-07-04 6. T1 [https://www.bde.es/wbe/en/punto-informacion/contenidos/sanciones-impuestas-banco-espana/](https://www.bde.es/wbe/en/punto-informacion/contenidos/sanciones-impuestas-banco-espana/) retrieved 2026-07-04 ### W1b Conduct, Safeguarding & Promotions limited signal Confirmed confirmed 2026-07-04 RD 712/2010 safeguarding template plus BdE/SEPBLAC June-2025 proportionality guidance on account restriction/closure. Standing sub-brief · as of 8 July 2026 144 words · last cycle 2026-10-12 #### Conduct, Safeguarding & Financial Promotions Real Decreto 712/2010 sets out the safeguarding methods available to payment institutions protecting user funds: segregation in safe, liquid, low-risk assets, or an insurance policy or comparable guarantee meeting specified conditions. In June 2025, joint Banco de España and SEPBLAC good-practice criteria required proportionate, documented, case-by-case justification for account restriction or closure decisions taken for AML/CFT reasons, guarding against unjustified financial exclusion. The two instruments together define the standing conduct baseline for Spanish PIs and EMIs: a funded, verifiable safeguarding method plus a proportionality constraint on the account-closure powers banks and non-banks alike exercise for financial-crime reasons, a constraint directly relevant to the de-risking and financial-inclusion concerns raised in correspondent-banking access debates. #### Outlook Watch for continued alignment between BdE/SEPBLAC de-risking guidance and CNMV/CNMC conduct expectations as APP-fraud liability shifts raise banks' incentive to restrict rather than serve higher-risk customers. Periodic update · new data 2026-10-12 #### Conduct, Safeguarding & Financial Promotions Real Decreto 813/2026 makes two conduct-of-business adjustments relevant to payments, both minor relative to the decree's primary AML and gambling focus. It eases access to free basic payment accounts for economically vulnerable persons by allowing certain non-profit entities to certify financial-exclusion risk on behalf of applicants, a change to the gateway through which vulnerable persons access basic payment-account rights rather than to the underlying basic-account entitlement itself. Separately, it flexibilises and expands the electronic payment means available for payments made to Spanish public administrations, specifically enabling card-based electronic payment instruments as a means of paying public bodies. Neither provision touches Banco de España's licensing or prudential framework for payment institutions or electronic-money institutions; both operate at the level of who may certify eligibility or what instrument may be used for a specific payment category, rather than altering any authorisation or safeguarding requirement. These changes sit within a decree whose primary substance is AML and gambling-regulatory, and the payments-conduct provisions should be read as incidental adjustments rather than evidence of a broader Banco de España conduct-rule overhaul this cycle. No change to financial-promotions rules, safeguarding requirements for client funds, or other core W1b obligations was evidenced. #### Outlook No further payments-conduct development is signalled for the near term beyond these two incidental provisions. Whether Banco de España or the Ministry of Economy issues implementing guidance on which non-profit entities may certify financial-exclusion risk is the main open item, though nothing in the material reviewed indicates a timeline for such guidance. **1 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Conduct, Safeguarding & Financial Promotions The PSR component of the PSD3/PSR package introduces two directly relevant conduct and safeguarding changes for Spanish payment institutions and e-money institutions once transposed. First, it extends provider liability explicitly to authorised push payment (APP) fraud, a confirmed provision in the published provisional compromise text. Second, it requires safeguarding diversification across at least two credit institutions for payment institutions and e-money institutions, a segregation-mechanism requirement intended to reduce concentration risk in how client funds are safeguarded. These two provisions should be read together as raising both the conduct-liability and the operational-safeguarding bar for Spanish PI/EMI-tier firms. The APP-fraud liability extension is particularly significant in the Spanish context because it arrives after, rather than before, a domestic judicial precedent already moving in the same direction: the Tribunal Supremo's sentencia 571/2025 ordered a bank to refund over €56,000 lost to phishing and SIM-swap fraud specifically because the institution failed to react to evident fraud signals, a standard closely anticipating PSR's explicit statutory liability obligation. Firms should treat the current judicial standard as a live compliance benchmark now, ahead of PSR's formal transposition into Spanish law. The safeguarding-diversification requirement is distinctly a non-bank PI/EMI obligation: bank-supervised payment activity in Spain is not subject to the same client-funds segregation mechanism, since bank deposit protection operates under a separate prudential framework entirely. #### Outlook Spanish PI/EMI-tier firms should begin assessing safeguarding-arrangement diversification across multiple credit institutions ahead of PSR's formal transposition, and should treat the Tribunal Supremo's evident-fraud-signal standard as the operative APP-fraud liability benchmark in the interim period before statutory codification. **Sources and findings (5)** 1. T1 [https://www.boe.es/buscar/act.php?id=BOE-A-2010-8551](https://www.boe.es/buscar/act.php?id=BOE-A-2010-8551) retrieved 2026-07-04 2. T1 [https://www.bde.es/wbe/en/noticias-eventos/blog/reclamar-donde-toca-que-problemas-con-mi-banco-puede-ayudarme-a-resolver-el-banco-de-espana-.html](https://www.bde.es/wbe/en/noticias-eventos/blog/reclamar-donde-toca-que-problemas-con-mi-banco-puede-ayudarme-a-resolver-el-banco-de-espana-.html) retrieved 2026-07-04 3. T3 [https://country.db.com/spain/reglamentos-para-la-defensa-del-cliente](https://country.db.com/spain/reglamentos-para-la-defensa-del-cliente) retrieved 2026-07-04 4. T1 [https://clientebancario.bde.es/pcb/en/blog/restriccion-de-los-servicios-bancarios-por-motivos-relacionados-con-la-prevencion-del-blanqueo-de-capitales-y-de-la-financiacion-del-terrorismo.html](https://clientebancario.bde.es/pcb/en/blog/restriccion-de-los-servicios-bancarios-por-motivos-relacionados-con-la-prevencion-del-blanqueo-de-capitales-y-de-la-financiacion-del-terrorismo.html) retrieved 2026-07-04 5. T1 [https://www.derecho.com/boe/resolucion-de-5-de-mayo-de-2026-del-banco-de-espana-por-la-que-se-publican-las-sanciones-impuestas-por-infracciones-graves-a-money-exchange-sa-y-a-los-miembros-de-su-consejo-de-administracion-890347](https://www.derecho.com/boe/resolucion-de-5-de-mayo-de-2026-del-banco-de-espana-por-la-que-se-publican-las-sanciones-impuestas-por-infracciones-graves-a-money-exchange-sa-y-a-los-miembros-de-su-consejo-de-administracion-890347) retrieved 2026-07-04 ### W2 Stablecoins & Digital Money Confirmed confirmed 2026-07-04 CNMV/BdE split MiCA authority; transitional period extended from an initial 30-Dec-2025 deadline to the 18-month maximum ending 30-Jun-2026; CASP authorised-entity counts require verification. Horizon · 2026-06-30 (±quarter) MiCA transitional period end for grandfathered virtual-currency providers_in_force_pending · TT2_ Horizon · 2026-07-01 (±quarter) MiCA full application in Spain_in_force · TT1_ Horizon · 2026-03-01 (±quarter) EBA no-action letter (PSD2/MiCA interaction) transitional period end_in_force_pending · TT1_ Standing sub-brief · as of 8 July 2026 185 words · last cycle 2026-10-06 #### Stablecoins & Digital Money Spain designated the CNMV as competent authority for MiCA Titles II and V, covering crypto-asset issuance other than ART/EMT and CASPs, and the Banco de España for Titles III and IV covering ART/EMT issuers, formalised via the 2023 Securities Markets and Investment Services Law. Spain initially set a 12-month MiCA transitional period for pre-existing BdE-registered virtual-currency providers ending 30 December 2025, then extended it to the full 18-month maximum, ending 30 June 2026, confirmed via ESMA's updated grandfathering-period list published 1 December 2025. The two authorisation tracks and the extended grandfathering window together define Spain's live MiCA posture, though this cycle's research flagged a live discrepancy in reported CASP authorised-entity counts (six banks and five fintechs in one account versus roughly three in another) that requires verification against the CNMV public register before any figure is published. #### Outlook The transitional grandfathering window closes on 30 June 2026, after which Spain's remaining unauthorised virtual-currency providers must hold a CASP licence or exit the market — a hard deadline that should sharpen the authorised-entity count dispute into public-register clarity within the current quarter. Periodic update · new data 2026-10-06 #### Stablecoins & Digital Money Spain's transitional arrangement for crypto-asset service providers already operating in the market before the Markets in Crypto-Assets Regulation took effect has now ended. The CNMV confirms that Spain decided to apply the national transitional period permitted under MiCA Article 143(3) through 30 June 2026, allowing pre-existing providers a defined runway to secure full MiCA authorisation rather than ceasing operations immediately on the regulation's entry into application. That runway has now closed. From 1 July 2026, any crypto-asset service provider operating in Spain without MiCA authorisation sits outside the lawful perimeter for onboarding new customers or marketing its services, and is expected to be winding down rather than continuing to trade. ESMA's position, issued alongside the close of national transitional periods across the EU including Spain's, states explicitly that unauthorised crypto-asset service providers are expected to take immediate steps to wind down their EU activities in an orderly manner. The emphasis on orderliness is notable: ESMA frames the expectation around safeguarding client interests and mitigating risks to market integrity during the exit, rather than treating wind-down purely as a compliance formality. For market participants, this signals that regulators are alert to disorderly-exit risk — client assets stranded, service interruptions, or last-minute scrambles to transfer custody — as much as to the underlying authorisation gap itself. The practical consequence for payments businesses is a sharpened counterparty-due-diligence question. Any payments firm with a commercial relationship touching a crypto-asset service provider active in the Spanish market needs to know whether that provider holds CNMV authorisation under MiCA, because continued unauthorised operation past the 30 June 2026 deadline is no longer an ambiguous or tolerated state — it is a direct departure from the applicable transitional framework as confirmed by the regulator itself. This is a market-access and counterparty-risk fact, not a judgment about how any individual firm is handling its obligations. What is not yet established from available reporting is how the Spanish market has actually responded in practice: whether the unauthorised providers identified at the deadline have completed wind-down, sought late authorisation, or continue to operate in contravention of the expired transitional status. That operational picture — authorised-entity counts, enforcement actions, or confirmed market exits — is not reliably extractable from the sources available this cycle and is not asserted here. #### Outlook The regulatory position itself is now settled and in force: the transitional period is over, and the expectation of authorisation or orderly wind-down is explicit from both the CNMV and ESMA. The open question going forward is one of enforcement visibility — whether the CNMV publishes updates on authorised-entity status, takes visible action against firms that remain unauthorised, or whether the wind-down process proceeds without further public signal. Payments businesses with exposure to the Spanish crypto-asset services market should treat any counterparty's authorisation status as a live question rather than a settled one until confirmed directly, since the deadline itself does not guarantee that every affected provider has in fact exited or come into compliance. **Sources and findings (6)** 1. T3 [https://redisbe.com/articulos/reglamento-mica-para-la-regulacion-del-mercado-de-criptoactivos/](https://redisbe.com/articulos/reglamento-mica-para-la-regulacion-del-mercado-de-criptoactivos/) retrieved 2026-07-04 2. T2 [https://sede.agenciatributaria.gob.es/Sede/normativa-criterios-interpretativos/analisis/2026/abril/29/reglamento-mica-abril-2026-nuevo-ue.html](https://sede.agenciatributaria.gob.es/Sede/normativa-criterios-interpretativos/analisis/2026/abril/29/reglamento-mica-abril-2026-nuevo-ue.html) retrieved 2026-07-04 3. T3 [https://crassula.io/es/guides/licenses/mica-casp/](https://crassula.io/es/guides/licenses/mica-casp/) retrieved 2026-07-04 4. T1 [https://www.cnmv.es/portal/mica/regulacion-criptoactivos?lang=en](https://www.cnmv.es/portal/mica/regulacion-criptoactivos?lang=en) retrieved 2026-07-04 5. T1 [https://ajtapia.com/2026/01/criptoactivos-y-criptomonedas-criterios-de-la-cnmv-sobre-la-aplicacion-de-mica-ante-su-aplicacion-plena-desde-el-1-de-julio-de-2026/](https://ajtapia.com/2026/01/criptoactivos-y-criptomonedas-criterios-de-la-cnmv-sobre-la-aplicacion-de-mica-ante-su-aplicacion-plena-desde-el-1-de-julio-de-2026/) retrieved 2026-07-04 6. T3 [https://www.ledgerinsights.com/bankinter-invests-in-spanish-crypto-exchange-bit2me/](https://www.ledgerinsights.com/bankinter-invests-in-spanish-crypto-exchange-bit2me/) retrieved 2026-07-04 ### W3 Operational Resilience & Critical Infra Confirmed confirmed 2026-07-04 DORA directly applicable since 17 Jan 2025; CNMV 74-question FAQ (early 2026); FSB Nov-2025 peer review confirms robust BdE cyber supervision. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/spain/) Standing sub-brief · as of 8 July 2026 114 words · last cycle 2026-08-21 #### Operational Resilience & Critical Infrastructure The CNMV published a 74-question FAQ in early 2026, structured around DORA's five pillars: scope and proportionality, ICT risk management, incident reporting, resilience testing, and ICT third-party risk, to assist firms' interpretation of the directly applicable EU regulation. The FSB's November 2025 peer review found Banco de España maintains robust risk-based cyber-resilience supervision and was an early TIBER-EU adopter, while flagging the need for continued enhancement given the evolving cyber threat landscape. #### Outlook DORA's national-level interpretive layer and the FSB's positive assessment suggest Spain's operational-resilience supervision is in a consolidation phase rather than a reform phase, with attention likely to shift toward ICT third-party oversight of critical outsourced providers. Periodic update · new data 2026-09-08 #### Operational Resilience & Critical Infrastructure Spain's National Payments Committee, comprising the Bank of Spain alongside Visa, Mastercard and major domestic banks, proposed an offline card-payment continuity system on 19 November 2025, targeting nationwide deployment by 2029. The proposal addresses continuity of card payments during network or connectivity outages, a resilience concern distinct from, but complementary to, the EU's Digital Operational Resilience Act baseline already applicable to Spanish financial entities. Confidence on this specific proposal is Low, reflecting a single tier-4 secondary source at an early proposal stage rather than a settled infrastructure commitment. #### Outlook The multi-year runway to 2029 means this is a watch item rather than a near-term compliance driver. The next markers to track are formal endorsement by the Bank of Spain beyond committee-level proposal, and any published technical specification for offline continuity that would allow card schemes and acquirers to begin implementation planning. **Sources and findings (5)** 1. T3 [https://www.regulation-dora.eu/what-is-dora](https://www.regulation-dora.eu/what-is-dora) retrieved 2026-07-04 2. T1 [https://www.grcreport.com/post/spain-moves-to-demystify-dora-with-74-question-industry-guide](https://www.grcreport.com/post/spain-moves-to-demystify-dora-with-74-question-industry-guide) retrieved 2026-07-04 3. T1 [https://www.fsb.org/2025/11/peer-review-of-spain/](https://www.fsb.org/2025/11/peer-review-of-spain/) retrieved 2026-07-04 4. T1 [https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/vigilancia-infraestructuras-mercado/](https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/vigilancia-infraestructuras-mercado/) retrieved 2026-07-04 5. T3 [https://www.regulation-dora.eu/banking](https://www.regulation-dora.eu/banking) retrieved 2026-07-04 ### W4 Scheme & Network Compliance limited signal Probable confirmed 2026-07-04 Spain's instant-payments and card-interchange architecture rests on three pillars: the EU Instant Payments Regulation (Reg (EU) 2024/886) mandating SEPA Instant for euro transfers, the Redsys card-processing/interchange switch, and the EU Interchange Fee Regulation capping domestic debit/credit interchange. Verification of Payee (VoP) became mandatory for SEPA and SEPA Instant transfers on 9 October 2025 under the IPR, directly affecting Bizum (28M+ users) and bank-to-bank SEPA Instant transfers. The EPC's Verification of Payee Rulebook v1.1 updated the governing API and security specifications for VoP, SRTP and SPAA, taking effect 20 September 2026 across all SEPA scheme participants, including Spanish PSPs. Standing sub-brief · as of 8 July 2026 81 words · last cycle 2026-10-04 #### Scheme & Network Compliance The SNCE's STMP subsystem clears net multilateral interbank card-transaction positions, settled on Iberpay's books backed by TARGET prefunding. The EU Interchange Fee Regulation caps domestic debit interchange at 0.2% and credit at 0.3% in Spain, compressing acquirer and gateway take-rates and pushing scheme economics toward value-added services rather than per-transaction margin. #### Outlook Expect continued acquirer diversification into value-added services as IFR caps hold margins flat, with Bizum's emerging scheme-level presence a further structural pressure on card-network economics. Periodic update · new data 2026-10-04 #### Scheme & Network Compliance The European Payments Council's Verification of Payee Rulebook version 1.1 became mandatory for all SEPA scheme participants, including Spanish payment service providers, from 20 September 2026. The update revises API specifications, notably prohibiting empty fields in VoP response messaging, and tightens the security framework governing Verification of Payee, SEPA Request to Pay (SRTP), and the SEPA Proxy Lookup and Addressing scheme (SPAA). This is a scheme-rulebook update layered on top of an existing legal obligation rather than a new substantive duty: Verification of Payee, in the form of IBAN-name matching for SEPA Instant credit transfers, has been mandatory in Spain since 9 October 2025 under the EU Instant Payments Regulation (Regulation (EU) 2024/886), with direct effect on both Bizum and conventional SEPA Instant bank transfers. For Spanish PSPs, the practical consequence is a technical and security compliance update to already-built VoP infrastructure rather than a new build requirement. The underlying regulatory driver, the Instant Payments Regulation's VoP mandate, is unchanged; the EPC rulebook update operates at the scheme layer that all SEPA participants, Spanish or otherwise, must conform to as a condition of continued scheme participation. No Spain-specific implementation notice from Iberpay, Spain's national SEPA clearing and settlement infrastructure operator, or a dedicated Banco de Espana circular addressing the September 2026 update was located this cycle; the sourcing for the rulebook change itself rests on an aggregator account (ClearingPost), corroborated structurally by the Banco de Espana's own prior public guidance describing the October 2025 VoP obligation that the rulebook update amends procedurally. No other Scheme & Network Compliance development for Spain surfaced this cycle. #### Outlook As scheduled, the EPC Rulebook v1.1 specifications took effect on 20 September 2026 and are now in force across the SEPA area, including for Spanish scheme participants. The next material point of interest specific to Spain would be a direct statement from Iberpay or the Banco de Espana confirming local operational compliance with the updated API and security specifications; no such statement was available this cycle, so the current account rests on scheme-level and aggregator sourcing rather than a Spain-specific primary confirmation. **1 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Scheme & Network Compliance Verification of Payee, the IBAN-name matching requirement under Regulation (EU) 2024/886, the Instant Payments Regulation, became mandatory for SEPA Instant credit transfers on 9 October 2025. This confirmed, scheme-level compliance requirement directly affects Bizum, Spain's dominant mobile payment scheme with more than 28 million users, as well as SEPA Instant bank transfers generally, since both rely on the underlying SEPA Instant credit-transfer rail now subject to the VoP mandate. This mandatory-VoP milestone for instant payments specifically is understood to be a precursor to a broader requirement: PSD3/PSR is expected to extend Verification of Payee to all payment channels, not solely instant transfers, once the package is transposed into Spanish law. This means Spanish payment schemes and networks currently compliant with the instant-transfer-specific VoP mandate should anticipate a materially wider scope of application once PSD3/PSR's channel-agnostic VoP requirement takes effect. For Bizum specifically, given its scale and its reliance on the SEPA Instant rail, the current VoP mandate represents an already-live scheme-compliance obligation, while the anticipated PSD3/PSR extension represents the next scheme-compliance milestone to prepare for. #### Outlook The principal scheme-compliance development to watch is the scope and timing of PSD3/PSR's extension of Verification of Payee beyond instant transfers to all payment channels, and how Bizum and other major Spanish payment schemes adapt their existing SEPA Instant VoP infrastructure to that broader mandate once transposition occurs. **Sources and findings (5)** 1. T3 [https://redsys.es/en/sobre-nosotros](https://redsys.es/en/sobre-nosotros) retrieved 2026-07-04 2. T3 [https://www.mordorintelligence.com/industry-reports/spain-payment-gateway-market](https://www.mordorintelligence.com/industry-reports/spain-payment-gateway-market) retrieved 2026-07-04 3. T1 [https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf](https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf) retrieved 2026-07-04 4. T1 [https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/los-sistemas-pago-espana/snce/](https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/los-sistemas-pago-espana/snce/) retrieved 2026-07-04 5. T3 [https://redsys.es/en/politica-corporativa](https://redsys.es/en/politica-corporativa) retrieved 2026-07-04 ### W5 Payment Corridor Dynamics Confirmed confirmed 2026-07-04 Spain's domestic instant-payments corridor (SCT Inst via Iberpay's SNCE, Bizum-dominant) now operates under the binding EU Instant Payments Regulation (2024/886), mandating 10-second settlement and fee parity. Horizon · 2026 (±year) Bizum-EPI/Wero cross-border P2P interoperability go-live_proposed · TT3_ Horizon · 2027 (±year) Bizum-EPI/Wero e-commerce/in-store interoperability go-live_proposed · TT3_ Standing sub-brief · as of 8 July 2026 107 words · last cycle 2026-08-21 #### Payment Corridor Dynamics From 18 May 2026, Bizum Pay uses NFC technology to route point-of-sale payments directly from customer account to merchant account via instant transfer, explicitly positioned to reduce reliance on card-scheme infrastructure. From 9 October 2025, eurozone PSPs including Spanish entities must offer Verification of Payee, checking payee IBAN against registered name before transfer execution, alongside sub-10-second instant transfer and fee-parity obligations under the EU Instant Payments Regulation. #### Outlook Bizum Pay's card-displacing ambitions and the EuroPA/EPI-Wero cross-border roadmap targeting 2026-2027 interoperability make corridor dynamics the fastest-moving module in this cycle's ES file; card-scheme incumbents should expect continued account-to-account share gains at the point of sale. Periodic update · new data 2026-09-08 #### Payment Corridor Dynamics The EU Instant Payments Regulation (Regulation (EU) 2024/886) is now binding on Spanish payment service providers, mandating ten-second processing for instant credit transfers, IBAN-verification anti-fraud checks, and fee parity between instant and standard transfers. This lands on Spain's existing SCT Inst corridor, carried domestically by the Iberpay SNCE network, which most Spanish banks access via the Redsys aggregator, and which underpins the Bizum-dominant instant-payments user experience. Oversight of this corridor is now genuinely two-layered: Banco de España retains domestic infrastructure oversight while the Regulation itself is EU-level and directly binding, applicable to both bank and non-bank providers connected to the corridor. #### Outlook Compliance with the ten-second processing and fee-parity requirements is the immediate operative burden for PSPs connected to Iberpay SNCE; the practical question to track is how quickly aggregator-dependent smaller banks and non-bank PSPs, reliant on Redsys for connectivity, complete the technical uplift required for IBAN-verification anti-fraud checks at scale. **Sources and findings (6)** 1. T3 [https://www.euronews.com/business/2026/05/09/spains-bizum-heads-to-the-high-street-to-take-on-visa-and-mastercard](https://www.euronews.com/business/2026/05/09/spains-bizum-heads-to-the-high-street-to-take-on-visa-and-mastercard) retrieved 2026-07-04 2. T3 [https://hipay.com/en/blog/bizum-spanish-payment-solution/index.html](https://hipay.com/en/blog/bizum-spanish-payment-solution/index.html) retrieved 2026-07-04 3. T3 [https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market](https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market) retrieved 2026-07-04 4. T2 [https://www.finextra.com/the-long-read/1471/europes-instant-payments-regulation-and-the-9-october-deadline-explained](https://www.finextra.com/the-long-read/1471/europes-instant-payments-regulation-and-the-9-october-deadline-explained) retrieved 2026-07-04 5. T1 [https://www.iberpay.com/en/payments/payment-system-snce/about-the-snce](https://www.iberpay.com/en/payments/payment-system-snce/about-the-snce) retrieved 2026-07-04 6. T1 [https://www.bde.es/wbe/en/entidades-profesionales/operativa-gestiones/sistemas-pago-infraestructuras/target-banco-espana/](https://www.bde.es/wbe/en/entidades-profesionales/operativa-gestiones/sistemas-pago-infraestructuras/target-banco-espana/) retrieved 2026-07-04 ### W6 Industry Structure & Commercial Probable confirmed 2026-07-04 CNMC opened a June-2026 antitrust file against six major banks over mortgage-pricing statements; bank equity consolidation into CASP fintechs (Bit2Me) continues. Horizon · 2028-06 (±multi_year) CNMC antitrust investigation resolution deadline (six major banks)_proposed · TT3_ Horizon · 2028-06 (±multi_year) CNMC antitrust proceeding resolution deadline (six banks, fixed-mortgage statements)_consultation · TT3_ Standing sub-brief · as of 8 July 2026 115 words · last cycle 2026-08-08 #### Industry Structure & Commercial Dynamics On 16 June 2026 the CNMC opened a sanctioning file against Spain's six largest banks — Bankinter, Santander, BBVA, Unicaja, CaixaBank and Sabadell — over public executive statements on fixed-mortgage rate policy, alleging reduced competitive uncertainty in breach of national and EU competition law. Separately, Bankinter joined Bit2Me's shareholding structure alongside BBVA, Unicaja and Cecabank, part of a broader bank-fintech consolidation trend among Spanish crypto platforms. #### Outlook The antitrust file carries a resolution window of up to 24 months, meaning the mortgage-pricing dispute is likely to remain live well into 2028; the continued flow of bank equity into CASP-licensed fintechs like Bit2Me suggests consolidation will keep outpacing new independent entry. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market](https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market) retrieved 2026-07-04 2. T3 [https://www.coinspeaker.com/bankinter-invests-bit2me-tether-funding-round/amp/](https://www.coinspeaker.com/bankinter-invests-bit2me-tether-funding-round/amp/) retrieved 2026-07-04 3. T3 [https://roams.es/actualidad/finanzas/guerra-hipotecas-fijas-cnmc-expediente-seis-grandes-bancos/](https://roams.es/actualidad/finanzas/guerra-hipotecas-fijas-cnmc-expediente-seis-grandes-bancos/) retrieved 2026-07-04 4. T3 [https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market](https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market) retrieved 2026-07-04 ### W7 Legal & Litigation Confirmed confirmed 2026-07-04 Supreme Court judgment 571/2025 shifts APP-fraud burden of proof to banks; CNMV Banco Sabadell sanction; CNMC antitrust file adds competition-law dimension. Standing sub-brief · as of 8 July 2026 117 words · last cycle 2026-09-21 #### Legal & Litigation Supreme Court judgment 571/2025 requires banks to prove serious customer negligence or fraud before denying refunds for unauthorised transactions, reversing the prior practice of requiring customers to prove victimhood, in a SIM-swapping case against Ibercaja. The CNMV published a sanction against Banco de Sabadell, SA for a very serious infringement under Article 293.1.a) of Ley 6/2023 on Securities Markets and Investment Services, following a Council resolution dated 24 June 2025, finalised February 2026. #### Outlook The burden-of-proof reversal in judgment 571/2025 sits alongside the CNMV's Sabadell sanction and the CNMC's mortgage-pricing probe, together signalling a courts-and-regulators pincer on Spanish bank conduct that should push PSPs toward more conservative fraud-liability provisioning ahead of further case law. Periodic update · new data 2026-09-28 #### Legal & Litigation The EU Council's issuance of compromise texts for PSD3/PSR on 17 April 2026 is this cycle's defining structural development for Spain's payments legal landscape. Formal adoption is expected imminently, at which point a 21-month national transposition clock begins running toward an eventual in-force date projected around 2028. The reform's most consequential structural feature for Spain is the elimination of the standalone EMI regime: PSD3/PSR merges e-money institutions into a Payment Institution sub-category, requiring existing EMIs to undergo re-authorisation under the new framework rather than continuing indefinitely under legacy EMD licensing. Alongside the licensing-structure merger, the reform introduces expanded APP-fraud reimbursement liability for payment service providers and mandatory IBAN/name-check obligations, under which a PSP must verify that the payee name matches the IBAN before completing a transfer. These consumer-facing fraud-prevention measures apply across the merged Payment Institution category and represent a materially higher compliance bar than the current regime, particularly for entities that have operated under the lighter-touch EMI framework. This is currently probable-confidence, standing-brief material: the compromise texts have been issued but formal adoption, and the specific mechanics of Spain's national transposition, remain ahead. The 21-month clock is a maximum transposition window rather than a guarantee of early implementation, and Spain's specific transposition approach — including any grandfathering provisions for existing EMIs — has not yet been determined or evidenced this cycle. #### Outlook The key legal-development watch item for coming cycles is formal EU-level adoption of PSD3/PSR, which will fix the exact start date of Spain's 21-month transposition clock. Once transposition legislation is drafted domestically, the treatment of existing EMIs — whether through grandfathering or a hard re-authorisation deadline — will be the most consequential detail for incumbent payment institutions operating in Spain under the current EMD-derived framework. **1 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Legal & Litigation Spain's Tribunal Supremo issued a confirmed, directly relevant APP-fraud liability ruling this cycle in the form of sentencia 571/2025, decided 9 April 2025, which ordered a bank to refund a customer more than €56,000 lost to a phishing and SIM-swap fraud scheme. The court's reasoning turned on the bank's failure to react to evident fraud signals, establishing a judicial standard for provider liability in authorised push payment fraud cases ahead of any formal statutory obligation to that effect. This ruling is significant not only in isolation but because it anticipates the PSR's own explicit APP-fraud liability extension, which is expected to become statutory law once PSD3/PSR is transposed, likely in the mid-to-late 2027 window given the current transposition timeline. In the interim period between now and formal transposition, sentencia 571/2025 functions as the operative Spanish judicial standard on this question, meaning payment service providers face live litigation exposure on evident-fraud-signal failures even before the statutory obligation is codified. The convergence of judicial precedent and incoming statutory obligation on the same substantive standard, failure to react to evident fraud signals versus PSR's codified liability extension, suggests a low-uncertainty trajectory: the statutory codification is likely to formalise rather than depart from the standard the courts are already applying. #### Outlook Further Tribunal Supremo or lower-court rulings applying a similar evident-fraud-signal liability standard would be a significant intermediate development to track ahead of PSD3/PSR's formal transposition. Legal and litigation risk for Spanish payment service providers on APP-fraud liability should be treated as already live under the current judicial standard, not merely a future statutory concern. **Sources and findings (4)** 1. T3 [https://euroweeklynews.com/2026/03/08/bank-scam-in-spain-supreme-court-says-banks-may-have-to-give-your-money-back/](https://euroweeklynews.com/2026/03/08/bank-scam-in-spain-supreme-court-says-banks-may-have-to-give-your-money-back/) retrieved 2026-07-04 2. T1 [https://www.derecho.com/boe/resolucion-de-5-de-mayo-de-2026-del-banco-de-espana-por-la-que-se-publican-las-sanciones-impuestas-por-infracciones-graves-a-money-exchange-sa-y-a-los-miembros-de-su-consejo-de-administracion-890347](https://www.derecho.com/boe/resolucion-de-5-de-mayo-de-2026-del-banco-de-espana-por-la-que-se-publican-las-sanciones-impuestas-por-infracciones-graves-a-money-exchange-sa-y-a-los-miembros-de-su-consejo-de-administracion-890347) retrieved 2026-07-04 3. T1 [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-4960](https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-4960) retrieved 2026-07-04 4. T3 [https://roams.es/actualidad/finanzas/guerra-hipotecas-fijas-cnmc-expediente-seis-grandes-bancos/](https://roams.es/actualidad/finanzas/guerra-hipotecas-fijas-cnmc-expediente-seis-grandes-bancos/) retrieved 2026-07-04 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-07-04 Redsys dominates card acquiring under IFR-compressed margins; Bizum/Amazon integration signals A2A erosion of card-scheme acquiring volume. Standing sub-brief · as of 8 July 2026 117 words · last cycle 2026-08-08 #### Merchant Acquiring & Risk Redsys' infrastructure connects more than 1.5 million active merchants across Visa, Mastercard and other brands, processing over EUR 505 billion and 19.7 billion transactions annually as Spain's dominant acquiring-processing backbone. Amazon's Bizum integration and a 19% year-on-year rise in Bizum-accepting merchants, now more than 50,000, signal a tipping-point shift of Spanish merchants toward account-to-account checkout and away from card-scheme acquiring, though this single-source market-research finding warrants corroboration before being treated as a confirmed structural shift. #### Outlook Redsys' scale under IFR-compressed margins and the growing Bizum/A2A checkout footprint point toward a slow but structural erosion of card-scheme acquiring share in Spain over the coming cycles, pending confirmation of the market-research signal from independent sources. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://redsys.es/en/sobre-nosotros](https://redsys.es/en/sobre-nosotros) retrieved 2026-07-04 2. T3 [https://www.mordorintelligence.com/industry-reports/spain-payment-gateway-market](https://www.mordorintelligence.com/industry-reports/spain-payment-gateway-market) retrieved 2026-07-04 3. T1 [https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf](https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf) retrieved 2026-07-04 4. T3 [https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market](https://www.mordorintelligence.com/industry-reports/spain-real-time-payments-market) retrieved 2026-07-04 ### W9 Product Innovation & Market Development Probable confirmed 2026-07-04 Law 7/2020 sandbox baseline; PSD3 application from 20 Nov 2026; FIDA extends open finance beyond payment accounts; Bizum Pay NFC as flagship product innovation. Horizon · 2026-11-20 (±quarter) PSD3 application date_adopted · TT3_ Standing sub-brief · as of 8 July 2026 106 words · last cycle 2026-08-21 #### Product Innovation & Market Development Spain's Law 7/2020 of 13 November for digital transformation of the financial system established a controlled testing sandbox, jointly overseen by Banco de España, the CNMV and the DGSFP. PSD3, published 30 October 2023, requires transposition by 20 November 2025 with application from 20 November 2026, strengthening open-banking competitiveness, user protection and non-bank PSP access. #### Outlook With PSD3 applying from 20 November 2026 and Bizum Pay already live, Spain's product-innovation pipeline is running ahead of several EU peers on open-banking-adjacent payment experience, though the sandbox framework will need to demonstrate it can process a comparable wave of PSD3-driven non-bank access applications. Periodic update · new data 2026-09-08 #### Product Innovation & Market Development Spain's buy-now-pay-later sector continues rapid expansion, from an estimated EUR 1.00 billion in 2023 toward a projected EUR 8.12 billion by 2030, a 29.3 percent compound annual growth rate, led by Klarna, Aplazame, SeQura and Afterpay/Pagantis. Confidence is Low, reflecting a single tier-4 vendor source rather than a regulator-published figure, and no discrete regulatory product-access development (comparable to open-banking or BaaS rulemaking) was sourced this cycle to accompany the growth data. #### Outlook The growth trajectory itself is the signal to track rather than any pending rule change; a regulatory response calibrated to BNPL's scale, whether through consumer-credit-style disclosure requirements or Banco de España/CNMV product guidance, would be the next material development to watch for, though none is yet sourced this cycle. **Sources and findings (5)** 1. T3 [https://iclg.com/practice-areas/fintech-laws-and-regulations/spain](https://iclg.com/practice-areas/fintech-laws-and-regulations/spain) retrieved 2026-07-04 2. T3 [https://www.euronews.com/business/2026/05/09/spains-bizum-heads-to-the-high-street-to-take-on-visa-and-mastercard](https://www.euronews.com/business/2026/05/09/spains-bizum-heads-to-the-high-street-to-take-on-visa-and-mastercard) retrieved 2026-07-04 3. T3 [https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/spain/](https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/spain/) retrieved 2026-07-04 4. T3 [https://www.embat.io/es/blog/psd3-cambios-directiva](https://www.embat.io/es/blog/psd3-cambios-directiva) retrieved 2026-07-04 5. T1 [https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/](https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/) ### W10 Consumer Protection & APP Fraud Confirmed confirmed 2026-07-04 BdE Complaints Service (15-day SAC, 13-month claim window) plus Supreme Court 571/2025 burden-of-proof reversal and live VoP fraud-prevention mandate. Standing sub-brief · as of 8 July 2026 123 words · last cycle 2026-09-14 #### Consumer Protection & APP Fraud The Banco de España Complaints Service does not assess damages or fraud-and-authorisation disputes requiring legal assessment, such as customer responsibility when tricked into authorising payments, limiting its remit to transparency and good-practice breaches. From 9 October 2025, all euro-area PSPs including Spanish entities must verify payee name against account number before transfer execution, as a preventive control against authorised-push-payment fraud. #### Outlook The administrative complaints channel and the courts are increasingly complementary rather than overlapping: transparency and good-practice breaches route to Banco de España, while unauthorised-transaction liability disputes now route to a judiciary applying a bank-favourable-to-customer standard under judgment 571/2025, with VoP acting as the preventive layer that should, over time, reduce the volume of disputes reaching either channel. Periodic update · new data 2026-09-14 #### Consumer Protection & APP Fraud Spain's consumer-facing APP-fraud picture this cycle combines a statistical baseline with a converging legal-and-statutory liability trajectory. Spain's Ministerio del Interior recorded 464,801 registered cyber-offences in 2024, approximately 89% of which were online fraud; notably, this marked the first year-on-year decrease in this statistic. Kaspersky-sourced data places the average per-victim loss at €577, while under-reporting is estimated at near 69%, a figure that suggests the true fraud-loss picture for Spanish consumers is materially larger than officially recorded statistics indicate. Against this statistical backdrop, Spanish consumers already benefit from judicial protection ahead of formal statutory codification: the Tribunal Supremo's sentencia 571/2025 ordered a bank to refund over €56,000 lost to phishing and SIM-swap fraud for failing to react to evident fraud signals. Once PSD3/PSR is transposed, expected in the mid-to-late 2027 window, this judicial standard is expected to be joined by an explicit statutory provider-liability obligation for authorised push payment fraud under the PSR component of the package. Taken together, Spanish PSPs face a converging statutory-and-case-law liability regime for APP fraud, arriving in two stages: an already-live judicial standard now, and a codified statutory obligation once transposition is complete. Consumers experiencing APP fraud losses in Spain currently have judicial precedent to draw on even before PSR's liability provisions take direct legal effect domestically. #### Outlook The near-term-to-mid-term development to track is whether Spain's declining year-on-year cyber-offence statistic continues, and whether further judicial rulings extend or refine the evident-fraud-signal liability standard ahead of PSD3/PSR's formal transposition into Spanish consumer-protection law. **Sources and findings (5)** 1. T3 [https://euroweeklynews.com/2026/03/08/bank-scam-in-spain-supreme-court-says-banks-may-have-to-give-your-money-back/](https://euroweeklynews.com/2026/03/08/bank-scam-in-spain-supreme-court-says-banks-may-have-to-give-your-money-back/) retrieved 2026-07-04 2. T3 [https://payok.app/blog/prevencion-fraude/reclamacion-banco-de-espana-pasos](https://payok.app/blog/prevencion-fraude/reclamacion-banco-de-espana-pasos) retrieved 2026-07-04 3. T1 [https://www.bde.es/wbe/en/noticias-eventos/blog/reclamar-donde-toca-que-problemas-con-mi-banco-puede-ayudarme-a-resolver-el-banco-de-espana-.html](https://www.bde.es/wbe/en/noticias-eventos/blog/reclamar-donde-toca-que-problemas-con-mi-banco-puede-ayudarme-a-resolver-el-banco-de-espana-.html) retrieved 2026-07-04 4. T2 [https://www.finextra.com/the-long-read/1471/europes-instant-payments-regulation-and-the-9-october-deadline-explained](https://www.finextra.com/the-long-read/1471/europes-instant-payments-regulation-and-the-9-october-deadline-explained) retrieved 2026-07-04 5. T1 [https://sedeelectronica.bde.es/sede/es/tramites/reclamaciones-transparencia-buenas-practicas-p104.html](https://sedeelectronica.bde.es/sede/es/tramites/reclamaciones-transparencia-buenas-practicas-p104.html) retrieved 2026-07-04 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/spain/#sec-dom-D7) limited signal Probable confirmed 2026-07-04 Ley 10/2010/RD 304/2014 AML framework; SEPBLAC FIU; CaixaBank EUR30m AML fine; June-2025 de-risking guidance; no dedicated Sentinel feed queryable this cycle. Standing sub-brief · as of 8 July 2026 146 words · last cycle 2026-10-12 #### AML/CFT & Financial Crime SEPBLAC, established in 1993, is Spain's Financial Intelligence Unit and AML/CFT supervisory authority, coordinating with Banco de España and the CNMV. SEPBLAC's July 2025 explanatory note clarifies that obliged entities under Ley 10/2010 and RD 304/2014 must apply risk-based due diligence — identification, purpose understanding, ongoing monitoring — before denying or restricting accounts, services or payment products. This module's intelligence is attributed to the Sentinel.gi illicit-finance feed; no dedicated Sentinel query was available for Spain this cycle, so the above is carried as a proxy drawn from public SEPBLAC disclosures, and no independent illicit-finance analysis is offered here — see the Financial Intelligence Monitor for that remit. #### Outlook Expect W11 coverage to remain proxy-sourced until the dedicated Sentinel.gi feed is restored for Spain; the June-2025 de-risking clarification should continue to feed directly into the W1b and W12 access-and-exclusion narrative in the interim. Periodic update · new data 2026-10-12 #### AML/CFT & Financial Crime Real Decreto 813/2026 extends the existing SEPBLAC-representative obligation under Ley 10/2010's implementing regulation to small real-estate credit intermediaries and other small obliged entities that had previously benefited from an exemption. Those entities now face a nine-month compliance deadline, running to 28 July 2027, to appoint a SEPBLAC representative. This is a governance-coverage expansion rather than a new type of obligation: the representative duty itself already existed for larger obliged entities, and the decree simply removes the small-entity carve-out. Payment institutions and electronic-money institutions are not named as a primary target of this provision in the material reviewed, and the decree's payment-account identity-matching requirements, which do touch how funds are credited and returned electronically, are scoped specifically to gambling operators rather than to payment-service providers as a class. The substantive AML-architecture analysis of RD 813/2026, including its crypto-asset-service-provider SEPBLAC-gateway and crypto-ATM identification provisions, is carried by the financial-integrity monitor; this W11 treatment notes only the governance-coverage dimension as it might touch payment-adjacent intermediaries falling within the newly-expanded small-obliged-entity population. #### Outlook The 28 July 2027 compliance deadline for newly-covered small obliged entities is the concrete date to track. Whether any payment institution or EMI falls within the expanded small-entity population subject to the SEPBLAC-representative duty was not established in the material reviewed this cycle and would be the clearest item to confirm in a future cycle. **Sources and findings (8)** 1. T1 [https://www.sepblac.es/en/2026/02/18/development_harmonized/](https://www.sepblac.es/en/2026/02/18/development_harmonized/) retrieved 2026-07-04 2. T? FIM (sentinel.gi) per-JID baseline profile — Spain — Spain's AML/CFT regime rests on Law 10/2010 and its implementing regulation, with Sepblac acting as both FIU and primary AML/CFT supervisor. FATF rates Spain compliant/largely compliant on 38 of 40 Recommendations and high/substantial on 10 of 11 effectiveness outcomes. CNMV supervises MiCA-authorised crypto firms; the golden-visa residency-by-investment channel was abolished in 2025. 3. T2 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-002) — Enforcement: Sepblac — Banco Santander (Openbank digital unit) 4. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness 5. T2 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-001) — Enforcement: Sepblac — CaixaBank 6. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: legal-gap 7. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: regulatory-failure 8. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: enforcement-absence ### W12 Correspondent Banking, Settlement & Access limited signal Confirmed confirmed 2026-07-04 TARGET-BdE RTGS and Iberpay SNCE retail clearing baseline; non-bank PSP direct TARGET access formalised October 2025. Standing sub-brief · as of 8 July 2026 133 words · last cycle 2026-09-21 #### Correspondent Banking, Settlement & Access TARGET-Banco de España, part of the consolidated Eurosystem TARGET platform since March 2023, provides RTGS for large-value euro payments, central bank operations, securities cash settlement and instant payment settlement. As of October 2025, non-bank PSPs meeting TARGET Guideline requirements can access TARGET Services directly, following the Eurosystem's harmonised policy enabling PI/EMI participation under amended PSD2 and Settlement Finality Directive provisions — a material access reform for entities that previously relied on indirect, bank-intermediated settlement. #### Outlook The correspondent-banking spine here is structural rather than event-driven: the bank-versus-non-bank access asymmetry in settlement systems is narrowing as TARGET access opens to qualifying PI/EMIs, a trend worth monitoring alongside the de-risking guidance carried in W1b and W11 for its effect on smaller non-bank PSPs' practical ability to secure and retain settlement relationships. Periodic update · new data 2026-09-28 #### Correspondent Banking, Settlement & Access Banco de España has expressly described refusal to accept non-domestic EU IBANs for SEPA credit transfers and direct debits as non-compliant practice. This is a live, currently-uncertain-confidence practical access issue in Spain's payments environment, and it is analytically distinct from the incoming PSR mandatory IBAN/name-check regime that forms part of the PSD3/PSR reform package. The PSR mechanism, once transposed, will require PSPs to verify that a payee's name matches the IBAN supplied — a fraud-prevention control. Banco de España's concern, by contrast, addresses outright refusal to accept a valid, correctly-issued EU IBAN purely because it is not domestically issued, which is a market-access and non-discrimination issue rather than a fraud-prevention one. The practical effect for payment service providers and their customers is a two-track compliance landscape emerging in Spain's correspondent and settlement environment: an existing, Banco de España-flagged non-compliance risk around IBAN-origin discrimination, and a forthcoming, PSR-driven mandatory verification obligation that will sit alongside it once national transposition occurs. Both bank and non-bank payment institutions are implicated, since the IBAN-acceptance issue as characterised by Banco de España applies across the SEPA credit-transfer and direct-debit rails generally rather than being confined to a specific class of institution. #### Outlook The principal watch item is whether Banco de España's non-compliance characterisation translates into supervisory action against specific institutions independent of, and ahead of, the PSR's own mandatory IBAN/name-check requirements entering into force via national transposition. Given the confidence level attached to this finding this cycle is uncertain, further primary-source confirmation of both the scope of the practice and any resulting supervisory response should be a priority for the next research cycle. **Sources and findings (5)** 1. T1 [https://www.bde.es/wbe/en/entidades-profesionales/operativa-gestiones/sistemas-pago-infraestructuras/target-banco-espana/](https://www.bde.es/wbe/en/entidades-profesionales/operativa-gestiones/sistemas-pago-infraestructuras/target-banco-espana/) retrieved 2026-07-04 2. T1 [https://www.ecb.europa.eu/paym/retail/instant_payments/html/instant_payments_regulation.en.html](https://www.ecb.europa.eu/paym/retail/instant_payments/html/instant_payments_regulation.en.html) retrieved 2026-07-04 3. T1 [https://www.iberpay.com/en/payments/payment-system-snce/about-the-snce](https://www.iberpay.com/en/payments/payment-system-snce/about-the-snce) retrieved 2026-07-04 4. T1 [https://clientebancario.bde.es/pcb/en/blog/restriccion-de-los-servicios-bancarios-por-motivos-relacionados-con-la-prevencion-del-blanqueo-de-capitales-y-de-la-financiacion-del-terrorismo.html](https://clientebancario.bde.es/pcb/en/blog/restriccion-de-los-servicios-bancarios-por-motivos-relacionados-con-la-prevencion-del-blanqueo-de-capitales-y-de-la-financiacion-del-terrorismo.html) retrieved 2026-07-04 5. T1 [https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/sistemas-liquidacion-compensacion-valores/iberclear/](https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/sistemas-liquidacion-compensacion-valores/iberclear/) retrieved 2026-07-04 ### W13 Commercial Intelligence (M&A, Investment & Product) Probable confirmed 2026-07-04 Bit2Me EUR30M Tether-led round (Aug 2025) with Bankinter joining cap table (Jan 2026); CNMV MiCA CASP wave (6 banks, 5 fintechs). Standing sub-brief · as of 8 July 2026 113 words · last cycle 2026-08-21 #### Commercial Intelligence (M&A, Investment & Product) Bit2Me, a Madrid-based digital-asset platform, raised $30M in an August 2025 investment round led by Tether Ventures, with additional investors undisclosed, to accelerate EU expansion and Latin American consolidation. Bankinter acquired a stake in Bit2Me in January 2026 by joining its Tether-led round, positioning alongside BBVA, Unicaja and Cecabank as banking shareholders; the amount of Bankinter's investment was not publicly disclosed. #### Outlook The Bit2Me cap table — now including Bankinter alongside BBVA, Unicaja and Cecabank — is the clearest evidence this cycle of banks buying rather than building crypto-asset distribution capability, a pattern likely to continue as MiCA CASP licensing lowers the execution risk of such stakes. Periodic update · new data 2026-09-08 #### Commercial Intelligence & Fintech The same Spain BNPL growth data point (EUR 1.00 billion in 2023 to a projected EUR 8.12 billion by 2030) surfaces here as a market-intelligence figure rather than a discrete commercial event; no M&A, funding round, or product-launch event with a complete commercial-event shape was identified this cycle for Klarna, Aplazame, SeQura or Afterpay/Pagantis in the Spanish market. Confidence is Low, sourced to a single tier-4 vendor figure. #### Outlook This module is thinly evidenced this cycle beyond the aggregate growth figure; a discrete funding round, acquisition, or product launch among the named BNPL providers would be the next concrete commercial-intelligence data point to track for the Spanish market. **Sources and findings (5)** 1. T3 [https://www.finsmes.com/2025/08/bit2me-raises-30m-in-funding.html](https://www.finsmes.com/2025/08/bit2me-raises-30m-in-funding.html) retrieved 2026-07-04 2. T3 [https://www.ledgerinsights.com/bankinter-invests-in-spanish-crypto-exchange-bit2me/](https://www.ledgerinsights.com/bankinter-invests-in-spanish-crypto-exchange-bit2me/) retrieved 2026-07-04 3. T3 [https://crassula.io/es/guides/licenses/mica-casp/](https://crassula.io/es/guides/licenses/mica-casp/) retrieved 2026-07-04 4. T3 [https://newsletter.dealflow.es/p/dealflowes-511-freepik-is-magnific](https://newsletter.dealflow.es/p/dealflowes-511-freepik-is-magnific) retrieved 2026-07-04 5. T1 [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-4960](https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-4960) retrieved 2026-07-04 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Spain| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{"legal_accessibility": {"per_product": {"account_to_account": "regulated", "cards": "regulated", "stablecoin": "emerging-regime"}}}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 1 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 73 finding(s), 141 source(s) in the cumulative register. **Audit trail** Machine check Challenged on 6 Oct 2026: not upheld (39 confirmed against the cited source; 6 contradicted by the cited source; 66 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).