Spain

Approves the Statute of the A.A.I., an independent administrative body of State scope with its own legal personality. BOE lists later amendments (Real Decreto 102/2025) and a start-up order (Orden PJC/908/2025).

Protects people who report breaches of EU law or serious criminal and administrative offences learned of in a work context, and transposes Directive 2019/1937. It requires internal reporting systems, creates the external channel run by the A.A.I., sets protection measures and a sanctions regime.

Framework act for Spain's securities markets and investment services, covering trading venues, investment firms and the CNMV's supervisory, inspection and sanctioning powers. It also addresses crypto-assets and distributed ledger technology for representing securities.

Creates a single electronic central register of beneficial ownership for Spanish legal persons and certain entities without legal personality, including trusts, to help prevent money laundering and terrorist financing. The register is managed by the Ministry of Justice.

Sets the basic principles and minimum requirements for protecting information and electronic services handled by the public sector and certain private providers. It repeals Real Decreto 3/2010, the earlier Esquema Nacional de Seguridad.

EU regulation on digital operational resilience for the financial sector, applicable directly in Spain. The Banco de España refers to its Art. 19 for notifying major ICT-related incidents and significant cyber threats, and to Art. 23 for major payment-related operational or security incidents.

Complements the EU eIDAS Regulation on certificates, provider obligations, inspections and penalties, and gives qualified trust services stronger evidentiary weight in electronic documents. It repealed the earlier electronic signature law (Ley 59/2003); Art. 14 names the Ministry of Economic Affairs and Digital Transformation as supervisory body.

Regulates a controlled testing environment (regulatory sandbox) for technological innovation projects in the financial system. The supervisory authorities are the Banco de España, the CNMV and the DGSFP (Art. 3.b), with the Secretaría General del Tesoro y Financiación Internacional as competent authority (Art. 3.a).

EBA outsourcing guidelines adopted by the Banco de España's Executive Commission on 29 July 2019, excluding paragraphs 62 and 63 in part. Paragraph 58 requires institutions to inform the supervisor of planned outsourcing of critical or important functions.

Adapts Spanish law to the GDPR and completes it, and guarantees digital rights under Art. 18.4 of the Constitution. It covers legal bases (Arts. 8 and 9), the exercise of data subject rights (Arts. 12 to 18), the AEPD's regime and powers (Arts. 44 to 56) and infringements and sanctions (Arts. 72 to 78).

The EU data protection regulation that the AEPD supervises in Spain alongside Ley Orgánica 3/2018. The AEPD cites its Art. 33 for breach notification to the supervisory authority and Art. 34 for communication to data subjects.

Establishes recovery plans and resolution rules for credit institutions and investment firms. The FROB is the executive resolution authority (Arts. 1.1 and 2.1.d); the Banco de España and the CNMV act as preventive resolution authorities (Art. 2.1.c).

Governs the licensing, supervision, solvency and winding-up of private insurance and reinsurance companies, with policyholder protection as its main aim. It carries over the EU Solvency II framework, adding governance and public disclosure rules; Art. 7 designates the DGSFP as supervisor.

Defines the inspectorate as a public service that monitors compliance with social-order rules, including labour, occupational risk prevention, Social Security and employment rules, and demands the corresponding liabilities. It creates the Organismo Estatal Inspección de Trabajo y Seguridad Social.

Consolidated text of the Workers' Statute, covering individual employment relationships, the sources of labour rules, workers' rights and duties, contract types and pay. The BOE consolidated version was last updated on 3 October 2026.

Sets the rules for organising, supervising and ensuring the solvency of credit institutions, covering authorisation, registration and revocation. It designates the Banco de España as supervisory authority, and Title IV (Arts. 89 to 122) sets out the sanctioning procedure.

Sets the regime for electronic money institutions, including their authorisation and registration (Art. 4) and issuance and redemption at nominal value (Art. 17). The BOE consolidated text was last updated on 24 November 2018, including amendments made by Real Decreto-ley 19/2018.

Spain's main AML/CFT statute. It requires obliged entities, now including crypto-asset service providers (Art. 2.1.z), to carry out due diligence, keep records, adopt internal controls and report suspicious transactions to SEPBLAC, and it sets the sanctions regime.

Transposes Directive 2000/31/EC. Sets rules for online service providers, commercial electronic communications, the validity of electronic contracts and the liability of intermediaries, with enforcement and penalties.