Back to all jurisdictions

Spain

ES · ESP · Europe

7 regulators · 19 laws & regulations · 11 obligations · 23 enforcement actions

Under its 1978 Constitution, Spain is a parliamentary monarchy and a democratic state under the rule of law that guarantees self-government to its nationalities and regions.

Overview

Under its 1978 Constitution, Spain is a parliamentary monarchy and a democratic state under the rule of law that guarantees self-government to its nationalities and regions. It is a member State of the European Union and has used the euro since 1999. The IMF's 2026 Article IV consultation records real GDP growth of 2.8% in 2025, projects 2.1% for 2026 and puts unemployment at 10.5% in 2025. The European e-Justice Portal describes the legal system as following the continental model, in which statute and written law take precedence.

The IMF judges overall systemic financial risk to be low and finds households, companies and banks financially healthy, but notes still-rising house prices. It reports a general government deficit of 2.4% of GDP in 2025 and urges faster fiscal consolidation. The FATF mutual evaluation of 5 December 2014 found Spain's AML/CFT laws up to date and its institutions sound, and named organised crime, drug trafficking and the terrorist threat among the main risks. SEPBLAC reports that a 2026 national risk assessment, approved by COPBLAC, was published on 31 July 2026, but its findings could not be read, and the sources reviewed do not set out Spain's corruption or cyber-risk assessments.

The Banco de España supervises credit institutions within the Single Supervisory Mechanism headed by the European Central Bank, the Comisión Nacional del Mercado de Valores (CNMV) supervises the securities markets, and Law 20/2015 makes the Dirección General de Seguros y Fondos de Pensiones (DGSFP) the insurance supervisor. Law 10/2010 is the main AML/CFT statute, and SEPBLAC, the financial intelligence unit, receives suspicious-transaction reports and supervises obliged entities, while the Agencia Española de Protección de Datos (AEPD) supervises Organic Law 3/2018 and the GDPR. No standalone anti-corruption commission was found: Article 31 bis of the Criminal Code makes legal persons criminally liable, Law 2/2023 protects whistleblowers through the Autoridad Independiente de Protección del Informante, and the public prosecution service has a special office against corruption and organised crime. DORA applies directly to financial entities, while a draft cybersecurity coordination and governance law, presented on 14 January 2025, was still a draft in March 2026.

The Ley de Sociedades de Capital recognises the limited liability company, the public limited company (sociedad anónima) and the partnership limited by shares, and leaves the form of the management body to each company's statutes. For listed companies, the CNMV's Good Governance Code, approved in February 2015 and partly revised in June 2020, is voluntary and works on a comply-or-explain basis. It recommends a board of five to fifteen members, at least half of them independent (one third in smaller or controlled companies), with women at least 40% of the board from the end of 2022. On 3 November 2026 the CNMV opened a public consultation on an updated code. Royal Decree 609/2023 creates a central register of beneficial ownership for Spanish legal persons and certain entities without legal personality, including trusts, managed by the Ministry of Justice.

Law or regulation Type Year Regulator Source
Real Decreto 1101/2024, de 29 de octubre, por el que se aprueba el Estatuto de la Autoridad Independiente de Protección del Informante, A.A.I. (Royal Decree 1101/2024 approving the Statute of the Independent Whistleblower Protection Authority) Regulation 2024 — official
Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción (Law 2/2023 on the protection of persons who report regulatory breaches and on combating corruption) Act 2023 — official
Ley 6/2023, de 17 de marzo, de los Mercados de Valores y de los Servicios de Inversión (Law 6/2023 on Securities Markets and Investment Services) Act 2023 CNMV official
Real Decreto 609/2023, de 11 de julio, por el que se crea el Registro Central de Titularidades Reales y se aprueba su Reglamento (Royal Decree 609/2023 creating the Central Register of Beneficial Ownership) Regulation 2023 — official
Real Decreto 311/2022, de 3 de mayo, por el que se regula el Esquema Nacional de Seguridad (Royal Decree 311/2022 of 3 May regulating the National Security Framework) Regulation 2022 — official
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (DORA) status not recorded Regulation 2022 Banco de España official
Ley 6/2020, de 11 de noviembre, reguladora de determinados aspectos de los servicios electrónicos de confianza (Law 6/2020 regulating certain aspects of electronic trust services) Act 2020 — official

View all 19 laws & regulations →

Recent enforcement

Open tracker →
Enforcement actions in Spain
Date Entity Regulator Action Source
Jun 2026 Compañía Española de Viviendas de Alquiler, SA CNMV Monetary Penalty official
Jun 2026 Sapiens Markets EU, S.V., S.A. CNMV Monetary Penalty official
Jun 2026 Duncan Macinnes Banco de España Monetary Penalty official
May 2026 Ginvest Asset Management, SGIIC, SA CNMV Formal Reprimand official
May 2026 Soltec Power Holdings, SA CNMV Monetary Penalty official

Essential obligations

All obligations →
Obligation Timing Regulator Source Detail
Anti-bribery and criminal compliance model Ongoing (exemption condition) — source
Beneficial ownership declaration to the Central Register Within 1 month of formation; updates within 10 days; annual declaration in January — source
Internal whistleblowing channel Ongoing; acknowledgement within 7 calendar days; response within 3 months — source
Lawful basis, transparency and data subject rights Ongoing AEPD source
Notification of security incidents through the reference CSIRT Initial notification without undue delay, then intermediate and final (Art. 22) CCN source
Personal data breach notification to the AEPD Within 72 hours of becoming aware AEPD official

Quick links — official sites

Newsletter

Get CRCGS Weekly

A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.

Free. We first email you a link to confirm the address; you can unsubscribe at any time. How we handle your address: our Privacy Policy.