Spain

Other Developments

Spain's MiCA implementation continued to mature this cycle. The CNMV was designated competent authority for MiCA Titles II and V covering crypto-asset issuance and CASPs, while Banco de España took Titles III and IV covering asset-referenced and e-money tokens, formalised via the 2023 Securities Markets and Investment Services Law. Spain's transitional period for pre-existing BdE-registered virtual-currency providers, initially set to end 30 December 2025, was extended to the full 18-month maximum ending 30 June 2026, confirmed via ESMA's updated grandfathering-period list published 1 December 2025. On the conduct side, June 2025 joint BdE/SEPBLAC good-practice criteria now require proportionate, documented, case-by-case justification for account restriction or closure decisions taken for AML/CFT reasons, guarding against unjustified financial exclusion. Operational resilience also advanced: the CNMV published a 74-question FAQ structured around DORA's five pillars in early 2026. Separately, the FSB's November 2025 peer review found Banco de España maintains robust risk-based cyber-resilience supervision and was an early TIBER-EU adopter.

On the product side, Bizum Pay went live from 18 May 2026, using NFC technology to route point-of-sale payments directly from customer account to merchant account via instant transfer, explicitly positioned to reduce reliance on card-scheme infrastructure. This sits alongside the EU Instant Payments Regulation, which from 9 October 2025 requires eurozone PSPs including Spanish entities to offer Verification of Payee checking payee IBAN against registered name before transfer execution, alongside sub-10-second instant transfer and fee-parity obligations. Litigation and enforcement also moved. Supreme Court judgment 571/2025 requires banks to prove serious customer negligence or fraud before denying refunds for unauthorised transactions, reversing the prior practice of requiring customers to prove victimhood, in a SIM-swapping case against Ibercaja. Separately, the CNMV published a sanction against Banco de Sabadell, SA for a very serious infringement under Article 293.1.a) of Ley 6/2023 on Securities Markets and Investment Services, following a Council resolution dated 24 June 2025, finalised February 2026. And on 16 June 2026 the CNMC opened a sanctioning file against Spain's six largest banks over public executive statements on fixed-mortgage rate policy, alleging reduced competitive uncertainty in breach of national and EU competition law.

Settlement access continued to open for non-banks: as of October 2025, non-bank PSPs meeting TARGET Guideline requirements can access TARGET Services directly, following the Eurosystem's harmonised policy enabling PI/EMI participation under amended PSD2/SFD provisions. On the commercial side, Bit2Me, a Madrid-based digital-asset platform, raised $30M in an August 2025 round led by Tether Ventures. Bankinter joined that shareholding structure in January 2026 alongside BBVA, Unicaja and Cecabank, part of a broader bank-fintech consolidation trend in Spanish crypto platforms.

Cross-Monitor Connections

SEPBLAC, Spain's Financial Intelligence Unit and AML/CFT supervisory authority since 1993, coordinates with Banco de España and the CNMV. Its July 2025 explanatory note clarifies that obliged entities under Ley 10/2010/RD 304/2014 must apply risk-based due diligence before denying or restricting accounts or payment products. That AML-supervisory material sits within the illicit-finance remit of the Financial Intelligence Monitor rather than this monitor's payments-conduct lens, and is carried here only as proxy disclosure pending restoration of the dedicated Sentinel.gi feed for Spain.

Outlook

The CNMC's antitrust file against six major banks carries a resolution window of up to 24 months, meaning the mortgage-pricing dispute will likely still be open well into 2028 and is a watch item for the industry-structure module. Spain's MiCA transitional period runs out on 30 June 2026, after which every remaining unauthorised provider must either hold a CASP licence or exit the market. Authorised-entity counts reported across sources currently conflict and require verification against the CNMV public register before publication. PSD3 is scheduled for application from 20 November 2026. Its interaction with Bizum Pay's card-displacing NFC rollout and with the instant-payments Verification of Payee mandate will shape whether Spain's account-to-account rails continue gaining share from card schemes through the second half of 2026.

Operational resilience and product infrastructure kept pace. The CNMV's 74-question DORA FAQ and the FSB's favourable November 2025 peer review of Banco de España's cyber supervision confirm an established, rather than reforming, resilience posture. Redsys remains the dominant card-acquiring backbone under IFR interchange caps, even as Bizum's growing merchant base signals gradual account-to-account erosion of that acquiring volume. On product policy, Spain's Law 7/2020 sandbox and the forthcoming PSD3 application from 20 November 2026 continue to broaden non-bank market access. SEPBLAC's AML/CFT supervisory role and its July 2025 due-diligence clarification sit adjacent to, rather than inside, this monitor's payments-conduct remit. Commercially, Bit2Me's Tether-led funding round and Bankinter's subsequent stake illustrate the bank-fintech consolidation running through the CASP licensing wave.

Outlook

Spain's jurisdiction risk level is elevated and trending toward tightening, driven by the combination of active BdE/CNMV/CNMC enforcement, the MiCA CASP licensing wave and DORA implementation work. The CNMC's antitrust file, with its resolution window running to as late as 2028, the 30 June 2026 MiCA transitional deadline, and PSD3's 20 November 2026 application date form the three nearest-term watch points across the ES file; the trajectory across the licensing, litigation and industry-structure modules points toward continued regulatory tightening through the second half of 2026.