Spain
7 regulators · 19 laws & regulations · 11 obligations · 23 enforcement actions
Under its 1978 Constitution, Spain is a parliamentary monarchy and a democratic state under the rule of law that guarantees self-government to its nationalities and regions.
Overview
Under its 1978 Constitution, Spain is a parliamentary monarchy and a democratic state under the rule of law that guarantees self-government to its nationalities and regions. It is a member State of the European Union and has used the euro since 1999. The IMF's 2026 Article IV consultation records real GDP growth of 2.8% in 2025, projects 2.1% for 2026 and puts unemployment at 10.5% in 2025. The European e-Justice Portal describes the legal system as following the continental model, in which statute and written law take precedence.
The IMF judges overall systemic financial risk to be low and finds households, companies and banks financially healthy, but notes still-rising house prices. It reports a general government deficit of 2.4% of GDP in 2025 and urges faster fiscal consolidation. The FATF mutual evaluation of 5 December 2014 found Spain's AML/CFT laws up to date and its institutions sound, and named organised crime, drug trafficking and the terrorist threat among the main risks. SEPBLAC reports that a 2026 national risk assessment, approved by COPBLAC, was published on 31 July 2026, but its findings could not be read, and the sources reviewed do not set out Spain's corruption or cyber-risk assessments.
The Banco de España supervises credit institutions within the Single Supervisory Mechanism headed by the European Central Bank, the Comisión Nacional del Mercado de Valores (CNMV) supervises the securities markets, and Law 20/2015 makes the Dirección General de Seguros y Fondos de Pensiones (DGSFP) the insurance supervisor. Law 10/2010 is the main AML/CFT statute, and SEPBLAC, the financial intelligence unit, receives suspicious-transaction reports and supervises obliged entities, while the Agencia Española de Protección de Datos (AEPD) supervises Organic Law 3/2018 and the GDPR. No standalone anti-corruption commission was found: Article 31 bis of the Criminal Code makes legal persons criminally liable, Law 2/2023 protects whistleblowers through the Autoridad Independiente de Protección del Informante, and the public prosecution service has a special office against corruption and organised crime. DORA applies directly to financial entities, while a draft cybersecurity coordination and governance law, presented on 14 January 2025, was still a draft in March 2026.
The Ley de Sociedades de Capital recognises the limited liability company, the public limited company (sociedad anónima) and the partnership limited by shares, and leaves the form of the management body to each company's statutes. For listed companies, the CNMV's Good Governance Code, approved in February 2015 and partly revised in June 2020, is voluntary and works on a comply-or-explain basis. It recommends a board of five to fifteen members, at least half of them independent (one third in smaller or controlled companies), with women at least 40% of the board from the end of 2022. On 3 November 2026 the CNMV opened a public consultation on an updated code. Royal Decree 609/2023 creates a central register of beneficial ownership for Spanish legal persons and certain entities without legal personality, including trusts, managed by the Ministry of Justice.
Recent enforcement
Open tracker →| Date | Entity | Regulator | Action | Source |
|---|---|---|---|---|
| Jun 2026 | Compañía Española de Viviendas de Alquiler, SA | CNMV | Monetary Penalty | official |
| Jun 2026 | Sapiens Markets EU, S.V., S.A. | CNMV | Monetary Penalty | official |
| Jun 2026 | Duncan Macinnes | Banco de España | Monetary Penalty | official |
| May 2026 | Ginvest Asset Management, SGIIC, SA | CNMV | Formal Reprimand | official |
| May 2026 | Soltec Power Holdings, SA | CNMV | Monetary Penalty | official |
Industry compliance
Essential obligations
All obligations →| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Anti-bribery and criminal compliance model | Ongoing (exemption condition) | — | source | |
Art. 31 bis makes legal persons criminally liable for offences by representatives and, where supervision duties were seriously breached, by subordinates. Under Art. 31 bis.2 a legal person is exempt if, among other conditions, it adopted and effectively implemented a compliance and management model before the offence. It is a condition of exemption, not a stand-alone licensing duty. |
||||
| Beneficial ownership declaration to the Central Register | Within 1 month of formation; updates within 10 days; annual declaration in January | — | source | |
Under Art. 1 of Real Decreto 609/2023, legal persons not already declared through another registry must file electronically within one month of formation, update data within ten days of any change, and all covered entities make an annual declaration in January (Art. 1.4). Trusts and similar entities not run or registered in the EU must declare before beginning relevant activities in Spain. |
||||
| Internal whistleblowing channel | Ongoing; acknowledgement within 7 calendar days; response within 3 months | — | source | |
Companies with 50 or more workers must have an internal information system (Art. 10), and all public sector entities must have one (Arts. 13 to 15). The system must guarantee confidentiality, allow written or verbal and anonymous reports, name a responsible person, acknowledge receipt within seven calendar days and respond within three months, extendable by up to three more (Arts. 5, 8 and 9). |
||||
| Lawful basis, transparency and data subject rights | Ongoing | AEPD | source | |
Arts. 8 and 9 require processing based on legal obligation or public interest to rest on a law-rank norm, and special categories to meet the further conditions. Arts. 12 to 18 set how access, rectification, erasure, restriction, portability, objection and automated-decision rights are exercised; controllers must explain how and prove they responded. |
||||
| Notification of security incidents through the reference CSIRT | Initial notification without undue delay, then intermediate and final (Art. 22) | CCN | source | |
Art. 19 requires operators of essential services and digital service providers to notify incidents with significant disruptive effects to the competent authority through the reference CSIRT. Art. 22 sets initial, intermediate and final notifications, the first to be sent without undue delay; the article gives no fixed number of hours or days. |
||||
| Personal data breach notification to the AEPD | Within 72 hours of becoming aware | AEPD | official | |
The AEPD states that the supervisory authority must be notified within 72 hours of the controller becoming aware of a breach likely to risk people's rights and freedoms, citing Art. 33 GDPR, and that individuals must be told where the risk is high (Art. 34 GDPR). Notification is made through the breach form in the AEPD's electronic office. |
||||
| No obligations match these filters. | ||||
Quick links — official sites
- AEPD — Agencia Española de Protección de Datos
- Banco de España — Banco de España
- CNMV — Comisión Nacional del Mercado de Valores
- SEPBLAC — Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias
- CCN — Centro Criptológico Nacional - CCN-CERT
- ICAC — Instituto de Contabilidad y Auditoría de Cuentas
- INCIBE — Instituto Nacional de Ciberseguridad
Newsletter
Get CRCGS Weekly
A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.