Provides financial services, in Spain

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, art. 16, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• Adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems you use to provide the service, and take measures to prevent and minimise the impact of incidents that affect you; as a digital service provider, determine the security measures you apply, taking into account at least the state of the art and the security of your systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with relevant international standards.
• If designated an operator of essential services, designate a responsable de la seguridad de la informacion within three months of your designation, notify the competent authority of the appointment, and file a Declaracion de Aplicabilidad of the security measures you apply within six months of designation, reviewing it at least every three years.
• This binds an operator of essential services designated under Ley 8/2011's critical-infrastructure regime and a digital service provider that is an online marketplace, online search engine or cloud computing service established in Spain, with its EU main establishment in Spain, or that has designated a Spain-based EU representative; a digital service provider that is a micro or small enterprise under Commission Recommendation 2003/361/EC is exempt, and so is an electronic-communications or trust-service operator not separately designated a critical operator.

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• If you are an operator of essential services, notify the competent authority, through your reference CSIRT, of an incident that may have a significant disruptive effect on the provision of your service, making the initial notification without undue delay; if you are a digital service provider, notify the competent authority, through your reference CSIRT, of an incident that has a significant disruptive effect on your service, whether the incident is on your own networks or a third-party provider's.
• For a CRITICO-severity incident under the national notification instruction, notify immediately on becoming aware of it, follow up with an interim notification within 24 to 48 hours of the initial notification, and file a final notification within 20 days of the initial notification; for a MUY ALTO-severity incident, notify immediately on becoming aware of it, follow up within 72 hours of the initial notification, and file a final notification within 40 days of the initial notification; an ALTO-severity incident requires only an immediate initial notification (Real Decreto 43/2021, annex, section 6).
• This binds an operator of essential services and a digital service provider within the scope described on this jurisdiction's companion security-obligations row; a digital service provider's notification duty applies only when it has access to the information needed to assess the incident's impact.

Real Decreto-ley 19/2018, art. 66, servicios de pago · Read the law's page

• If you are a payment service provider (such as a credit institution, an e-money institution, a payment institution or the postal operator for its payment services), this binds you (Article 66).
• Establish a framework, as the Banco de España provides, with mitigation measures and control mechanisms to manage the operational and security risks of the payment services you provide, including effective procedures to detect and classify major operational and security incidents (Article 66.1).
• At least once a year, in the form the Banco de España sets, give it an updated and complete assessment of those risks and of whether your mitigation measures and controls are adequate (Article 66.2).

Real Decreto-ley 19/2018, art. 67, servicios de pago · Read the law's page

• If you are a payment service provider (such as a credit institution, an e-money institution, a payment institution or the postal operator for its payment services), this binds you (Article 67).
• Notify the Banco de España immediately, in the form it determines, of every major operational or security incident (Article 67.1).
• If a security incident affects or may affect the financial interests of your payment service users, tell them without undue delay about the incident and about all the mitigation measures they can take (Article 67.1).
• At least annually, in the form the Banco de España sets, give it statistical data on fraud relating to the different means of payment (Article 67.4).

Real Decreto 193/2023, de 21 de marzo, bienes y servicios privados concertados con las Administraciones, arts. 3, 5, 6, 11, 14 a 18, 21 y 28 · Read the law's page

• If you supply privately owned goods and services that the public administrations contract or supply, observe the basic accessibility and non-discrimination conditions for goods and services available to the public, make reasonable and proportionate adjustments, and give persons with disabilities access to your premises, procedures and services (Real Decreto 193/2023, Arts. 3, 5(2) and 6).
• Give users and customers with disabilities information on your goods and services in accessible formats suited to their needs, whatever the channel, and pay special attention to food information and information on dangerous products (Art. 14(1)).
• If you own a website or mobile application not funded from public money whose content concerns goods or services available to the public, build it to the accessibility criteria of Real Decreto 1112/2018 and, in particular, to the priority A and AA requirements of standard UNE 139803 (Art. 14(2)).
• If you are a company that provides services to the public in general of special economic importance (Art. 14(4), by Ley 56/2007, Art. 2(2): more than 100 workers or an annual volume of operations above EUR 6,010,121.04, in electronic communications, financial services, water, gas or electricity supply, travel agency services, passenger transport or retail), make your publicly open websites universally accessible, state the degree of accessibility of your goods, services, premises and procedures, and state whether you run any line of action or attention aimed at persons with disabilities (Art. 14(3)).
• Guarantee persons with disabilities accessible access to the information on the processing of their personal data and to the exercise of their data protection rights (Art. 14(5)).
• Give persons with disabilities, in accessible format, the information on their consumer rights, including the right to complain, and where applicable the commercial offer, the contract and the invoice, where you are obliged to give them; keep customer service and information services accessible; keep repair and maintenance services in accessible format for at least ten years from the end of manufacture of the good or for as long as the service lasts (Art. 16(1), (2) and (4)).
• If you make vending machines, build them to universal design or adapt machines already in use that are not at the end of their life (Art. 17(1)); if you run a shop of more than 150 square metres of usable exhibition and sales area that makes electronic or technological equipment available to customers, make it accessible where no real impossibility exists and the adaptation is a proportionate reasonable adjustment, including in itinerant sales where the nature of the activity allows it (Art. 17(4) and (5)).
• If you are a financial, banking or credit institution, insurer or insurance intermediary, make your cash machines and other service terminals meet the accessibility requirements of the law transposing Directive (EU) 2019/882, and make telephone and electronic customer service accessible under the applicable technical standard (Art. 18(2) and (3)).
• If you are a postal operator, guarantee accessibility and reasonable adjustments in collection, admission, distribution and delivery and in information, customer attention and complaints, in person or at a distance, including interactive self-service terminals and mobile applications (Art. 28).
• Make your specific customer services accessible, give customers with disabilities personal guidance and help where they ask and need it to use the service, and train the staff of those services in attending persons with disabilities and in using the support products available (Art. 11(2) and (3)).
• If you are an accredited consumer alternative dispute resolution entity, make your procedures, offices and information and attention services universally accessible (Art. 16(3)); if you run a private education center or non-formal education, make your training offer, materials and supports accessible to persons with disabilities (Art. 21(5)).
• Goods and services with a specific regulation that sufficiently guarantees non-discrimination and universal accessibility, as public, public-utility or general-interest services, are outside these conditions (Art. 4); the transport modes stay under Real Decreto 1544/2007 and the European passenger rights regulations (additional provision 5).

Art. 4 del Real Decreto-ley 8/2023, de 27 de diciembre · Read the law's page

• Meet the ICT risk-management obligations of Chapter II of Regulation (EU) 2022/2554, reading the Regulation's references to financial entities as references to you (Article 4(1)).when it serves a financial business
• If you are a payment system operator, payment scheme operator, electronic payment arrangement operator, payment processor or other technology or technical service provider providing services in Spain, Article 4 binds you, unless you are a payment system operator the European Central Bank considers systemically important.

Ley 11/2023, de 8 de mayo, de trasposición de Directivas de la Unión Europea en materia de accesibilidad de determinados productos y servicios, título I (arts. 1 a 31) · Read the law's page

• If you provide to consumers a service listed in Article 2(2)(a) to (f) (electronic communications, access to audiovisual media services, elements of passenger transport services, consumer banking, e-books and their dedicated software, or e-commerce), meet the universal accessibility requirements of Sections III and IV of Annex I (Ley 11/2023, Arts. 2(2) and 3(1)); urban, suburban and regional transport services meet Section IV only.
• Provide the service with products that meet Section I of Annex I and, where relevant, Section II; give information on how the service works, and on its accessibility features and interoperability with assistive devices, through more than one sensory channel and in a form that is easy to understand and perceivable; make your websites, related online applications, mobile device services and mobile applications perceivable, operable, understandable and robust; and have any support services you run (help desks, call centers, technical support, relay and training services) give information on the service's accessibility and compatibility with assistive technologies in accessible modes of communication (Annex I, Section III(a) to (d)).
• For e-commerce services, give the accessibility information on the products and services for sale where the responsible economic operator provides it, make the identification, security and payment function perceivable, functional, understandable and robust where it is provided as part of the service, and offer identification methods, electronic signatures and payment services that are perceivable, functional, understandable and robust (Annex I, Section IV(g)).
• For consumer banking services, make identification methods, electronic signatures, security and payment services perceivable, functional, understandable and robust, and keep information at or below level B2 of the Common European Framework of Reference for Languages (Annex I, Section IV(e)).
• For electronic communications services, offer real-time text as well as voice and full conversation with video support, and make emergency communications that use voice and text, or video, synchronized and transmitted by you to the most appropriate public safety answering point (Annex I, Section IV(a)); for services giving access to audiovisual media services, offer accessible electronic program guides and transmit subtitles, audio description, spoken subtitles and sign language in full (Annex I, Section IV(b)).
• For e-books, keep text and audio synchronized, do not block assistive technology, give access to and navigation through the content with a dynamic layout, allow alternative renditions, make the e-book discoverable through accessibility metadata, and do not let digital rights management block accessibility features (Annex I, Section IV(f)); for air, bus, rail and waterborne passenger transport, give information on the accessibility of vehicles, infrastructure and assistance and on smart ticketing, real-time travel information and additional services (Annex I, Section IV(c)); for urban, suburban and regional transport, make the self-service terminals used to provide the service accessible (Annex I, Section IV(d)).
• Include in your general conditions, or an equivalent document, the information that evaluates how the service meets the accessibility requirements, make it available to the public in written and oral form and in a way accessible to persons with disabilities, and keep it up to date (Art. 13(2) and (4)).
• Keep procedures that keep the service conforming, provide information showing that the way you provide and monitor the service keeps it conforming, take corrective measures where it does not conform, tell the competent authorities of the Member States where you provide it, and give a competent authority on a reasoned request the information it needs and your cooperation (Art. 13(5) to (8)).
• Make the products you use in the service with which the consumer interacts meet the accessibility requirements, remain responsible when you subcontract part of the service, and train your staff on accessible products and services (Arts. 14 and 15).
• A passenger transport service that meets the accessible-information and accessibility-information requirements of the European passenger rights regulations and railway interoperability acts is treated as meeting the corresponding requirements of Title I, and any additional requirement of Title I applies in full (Art. 4).
• Assess, under the criteria in Annex V, whether compliance would substantially modify the basic nature of the service or impose a disproportionate burden; document the assessment keep it for five years after the last provision of the service and give the authority a copy on request; renew it for each category or type of service when the service changes, when an authority asks and at least every five years; and send information to the authorities of the Member State where you provide the service (Art. 16(2), (3), (5) and (7)). You cannot rely on the disproportionate burden exception for accessibility improvements you fund from sources other than your own resources (Art. 16(6)), and you must still make the service as accessible as possible (Art. 16(1)).
• The service requirements and any obligation relating to compliance with them do not apply to a microenterprise, meaning an enterprise that employs fewer than 10 persons and whose annual turnover or annual balance sheet total does not exceed EUR 2 million (Arts. 3(3); Annex VII, point 16).
• Until 28 June 2030, you may keep providing services with the products you lawfully used to provide similar services before that date, continue service contracts concluded before 28 June 2025 unchanged until they expire but for no longer than five years from that date, and keep using self-service terminals lawfully in use before 28 June 2025 until the end of their economic life, for no more than ten years after they were put into operation (transitional provision, paras. 1 and 2).

Ley 10/2025, de 26 de diciembre, disposiciones finales primera y tercera (BOE-A-2025-26698), art. 27.9 Ley 3/1991 y art. 20.1.c del texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios · Read the law's page

• If you are a trader making an offer to consumers individually, personalised on the basis of automated decision-making, inform them of the parameters used for the personalisation and, for offers on contracts for financial products or services, of the data sources used (Ley 3/1991, article 27, paragraph 9).
• In contracts concluded at a distance or away from the business premises, give the consumer clear and comprehensible information on the price when it has been personalised on the basis of automated decision-making (Real Decreto Legislativo 1/2007, article 20.1.c).
• Do not let that personalisation increase the final sale price when demand rises in a context of urgency, risk or need of the consumer, such as a civil protection emergency (article 20.1.c).

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to carry out an individualised risk assessment and put in place technical, operational and organisational measures, proportionate to the risk, to secure the networks and information systems you use and to prevent or minimise the impact of an incident.
• As drafted, the Anteproyecto would require you to designate a responsable de la seguridad de la informacion (information security officer) as your point of contact and technical coordinator, with accredited personnel in that role where your entity is classified as essential.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria, which track NIS2's own classification of an online marketplace, online search engine and cloud computing service among the digital providers it names; the wider sector classes the Anteproyecto also reaches (energy, transport, banking, health, water, digital infrastructure, public administration and others) are reached too, by declaring that you are an essential or important entity.

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to notify the competent authority of a significant incident affecting the provision of your service, whether on your own networks or a third-party provider's.
• As drafted, the Anteproyecto would require you to send an early warning without undue delay, and in any event within 24 hours of becoming aware of a significant incident, to the competent authority through your reference CSIRT, stating, where applicable, whether the incident is suspected to result from an unlawful or malicious act or could have cross-border repercussions (Article 18(6)(a)).
• As drafted, the Anteproyecto would then require you to submit an incident notification to the competent authority, through your reference CSIRT, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident; a trust service provider whose services the incident affects would have to submit it within 24 hours instead (Article 18(6)(b)).
• As drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)).
• As drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Ley 10/2025, de 26 de diciembre, por la que se regulan los servicios de atención a la clientela, art. 8 y disposición transitoria única (BOE-A-2025-26698) · Read the law's page

• If you are a company providing water, gas or electricity, passenger transport, postal, electronic communications or financial services in Spain, do not use an answering machine or similar means as the exclusive customer service channel (article 8(1)).
• When your answering machine, conversational bot or similar means handles a customer's query, complaint, claim or incident report by telephone or electronic means, let the customer request personalised attention from the options of your main menu at any time from the start of the interaction (article 8(2)).
• Provide personalised attention through a natural-person operator who answers in real time and identifies themselves at the start of the conversation, as soon as possible, so that on average 95 percent of requests are attended within three minutes (article 8(2)).
• This law is in force from 28 December 2025 but gives companies twelve months from then to adapt their customer service, so these duties bind from 28 December 2026 (disposición transitoria única, point 1).

Real Decreto 193/2023, de 21 de marzo, resto de bienes y servicios privados, arts. 3, 5, 6, 11, 14 a 18, 21 y 28 · Read the law's page

• If you supply privately owned goods and services other than those the public administrations contract or supply, observe the basic accessibility and non-discrimination conditions for goods and services available to the public, make reasonable and proportionate adjustments, and give persons with disabilities access to your premises, procedures and services (Real Decreto 193/2023, Arts. 3, 5(2) and 6).
• Give users and customers with disabilities information on your goods and services in accessible formats suited to their needs, whatever the channel, and pay special attention to food information and information on dangerous products (Art. 14(1)).
• If you own a website or mobile application not funded from public money whose content concerns goods or services available to the public, build it to the accessibility criteria of Real Decreto 1112/2018 and, in particular, to the priority A and AA requirements of standard UNE 139803 (Art. 14(2)).
• If you are a company that provides services to the public in general of special economic importance (Art. 14(4), by Ley 56/2007, Art. 2(2): more than 100 workers or an annual volume of operations above EUR 6,010,121.04, in electronic communications, financial services, water, gas or electricity supply, travel agency services, passenger transport or retail), make your publicly open websites universally accessible, state the degree of accessibility of your goods, services, premises and procedures, and state whether you run any line of action or attention aimed at persons with disabilities (Art. 14(3)).
• Guarantee persons with disabilities accessible access to the information on the processing of their personal data and to the exercise of their data protection rights (Art. 14(5)).
• Give persons with disabilities, in accessible format, the information on their consumer rights, including the right to complain, and where applicable the commercial offer, the contract and the invoice, where you are obliged to give them; keep customer service and information services accessible; keep repair and maintenance services in accessible format for at least ten years from the end of manufacture of the good or for as long as the service lasts (Art. 16(1), (2) and (4)).
• If you make vending machines, build them to universal design or adapt machines already in use that are not at the end of their life (Art. 17(1)); if you run a shop of more than 150 square metres of usable exhibition and sales area that makes electronic or technological equipment available to customers, make it accessible where no real impossibility exists and the adaptation is a proportionate reasonable adjustment, including in itinerant sales where the nature of the activity allows it (Art. 17(4) and (5)).
• If you are a financial, banking or credit institution, insurer or insurance intermediary, make your cash machines and other service terminals meet the accessibility requirements of the law transposing Directive (EU) 2019/882, and make telephone and electronic customer service accessible under the applicable technical standard (Art. 18(2) and (3)).
• If you are a postal operator, guarantee accessibility and reasonable adjustments in collection, admission, distribution and delivery and in information, customer attention and complaints, in person or at a distance, including interactive self-service terminals and mobile applications (Art. 28).
• Make your specific customer services accessible, give customers with disabilities personal guidance and help where they ask and need it to use the service, and train the staff of those services in attending persons with disabilities and in using the support products available (Art. 11(2) and (3)).
• If you are an accredited consumer alternative dispute resolution entity, make your procedures, offices and information and attention services universally accessible (Art. 16(3)); if you run a private education center or non-formal education, make your training offer, materials and supports accessible to persons with disabilities (Art. 21(5)).
• Goods and services with a specific regulation that sufficiently guarantees non-discrimination and universal accessibility, as public, public-utility or general-interest services, are outside these conditions (Art. 4); the transport modes stay under Real Decreto 1544/2007 and the European passenger rights regulations (additional provision 5).