Spain Payments & Fintech Regulation

Licensing, Authorisation & Market Access

Monzo, the UK-chartered digital bank, went live in Spain on 28-29 October 2026, its first continental European market since obtaining an EU passport through the Central Bank of Ireland in December 2025. The Spanish operation is registered with Banco de Espana and offers accounts carrying Spanish IBANs linked to Bizum, the countrys dominant instant-payments and mobile-transfer scheme. This is a passporting entry rather than a fresh domestic authorisation: Monzo reaches Spanish retail customers on the strength of its Irish-licensed EU passport, with Banco de Espana registration serving a notification and oversight function rather than a full independent licensing gate.

The entry illustrates a now-familiar pattern among EU-passported digital banks seeking continental scale: rather than compete head-on with Spains existing instant-payments infrastructure, Monzo has built its account offering around direct integration with Bizum, positioning itself as a front-end onto the rail Spanish consumers already use rather than as an alternative to it. Separately, Spains market-access landscape faces a more structural adjustment on the horizon: Spains payment institution and electronic money institution regimes currently sit apart under Law 21/2011 and Royal Decree 778/2012, and the EU's incoming PSD3 and PSR payments rulebook is expected to have a more structural effect in Spain than in jurisdictions where these regimes are already unified, precisely because Spain is starting from a more fragmented baseline.

Outlook

The near-term indicator to watch is whether Monzos Bizum-linked account offering translates into measurable customer acquisition in the Spanish market, though no usage figures have yet been reported since the late-October launch. On the regulatory side, the practical scope of PSD3/PSR structural change for Spain will become clearer as the EU rulebooks implementation timeline firms up; Spains currently separated payment institution and electronic money institution frameworks make it a useful test case for how much domestic restructuring the unification actually requires relative to jurisdictions that began from a more integrated starting point.

Conduct, Safeguarding & Financial Promotions

Real Decreto 813/2026 makes two conduct-of-business adjustments relevant to payments, both minor relative to the decree's primary AML and gambling focus. It eases access to free basic payment accounts for economically vulnerable persons by allowing certain non-profit entities to certify financial-exclusion risk on behalf of applicants, a change to the gateway through which vulnerable persons access basic payment-account rights rather than to the underlying basic-account entitlement itself. Separately, it flexibilises and expands the electronic payment means available for payments made to Spanish public administrations, specifically enabling card-based electronic payment instruments as a means of paying public bodies. Neither provision touches Banco de España's licensing or prudential framework for payment institutions or electronic-money institutions; both operate at the level of who may certify eligibility or what instrument may be used for a specific payment category, rather than altering any authorisation or safeguarding requirement.

These changes sit within a decree whose primary substance is AML and gambling-regulatory, and the payments-conduct provisions should be read as incidental adjustments rather than evidence of a broader Banco de España conduct-rule overhaul this cycle. No change to financial-promotions rules, safeguarding requirements for client funds, or other core W1b obligations was evidenced.

Outlook

No further payments-conduct development is signalled for the near term beyond these two incidental provisions. Whether Banco de España or the Ministry of Economy issues implementing guidance on which non-profit entities may certify financial-exclusion risk is the main open item, though nothing in the material reviewed indicates a timeline for such guidance.

Stablecoins & Digital Money

The CNMVs register of crypto-asset service providers reached 9 authorised Spanish entities as of 2 October 2026, with a further 6 credit institutions notified to provide crypto-asset services under the EU Markets in Crypto-Assets framework. The authorised-provider list includes Bit2Me, Criptan, Minos Global and Prosegur Crypto, while the notified credit institutions include BBVA, Openbank, Cecabank, Renta 4 Banco, CaixaBank and Kutxabank. The presence of six established Spanish banking names on the notified list, alongside dedicated crypto-asset specialists on the authorised list, indicates that crypto-asset service provision in Spain is developing as a dual-track market: specialist crypto-native firms holding full CNMV authorisation, and incumbent banks extending into the space through the lighter notification route available to credit institutions under the framework.

Separately, Bit2Me STX was reported — via a single aggregated secondary source drawing on an earlier Spanish-language report — to have received CNMV clearance to launch a native blockchain stock exchange. This report has not been corroborated against any CNMV primary notice located, and rests on a single low-tier aggregator citation rather than a verifiable regulatory source. It should be treated as an unverified claim pending independent confirmation, not as a settled regulatory development, and is flagged here for completeness rather than asserted as fact.

Outlook

The credit-institution notification route appears to be becoming an increasingly normal path for established Spanish banks into crypto-asset services, and further notifications in coming cycles would confirm this as a structural trend rather than a one-off. The unverified Bit2Me STX blockchain-exchange report is the item most in need of resolution: confirmation or correction against a CNMV primary source would materially change how that specific development should be read, and until such confirmation is available it should not be treated as established.

Operational Resilience & Critical Infrastructure

Spain's National Payments Committee, comprising the Bank of Spain alongside Visa, Mastercard and major domestic banks, proposed an offline card-payment continuity system on 19 November 2025, targeting nationwide deployment by 2029. The proposal addresses continuity of card payments during network or connectivity outages, a resilience concern distinct from, but complementary to, the EU's Digital Operational Resilience Act baseline already applicable to Spanish financial entities. Confidence on this specific proposal is Low, reflecting a single tier-4 secondary source at an early proposal stage rather than a settled infrastructure commitment.

Outlook

The multi-year runway to 2029 means this is a watch item rather than a near-term compliance driver. The next markers to track are formal endorsement by the Bank of Spain beyond committee-level proposal, and any published technical specification for offline continuity that would allow card schemes and acquirers to begin implementation planning.

Scheme & Network Compliance

The European Payments Council's Verification of Payee Rulebook version 1.1 became mandatory for all SEPA scheme participants, including Spanish payment service providers, from 20 September 2026. The update revises API specifications, notably prohibiting empty fields in VoP response messaging, and tightens the security framework governing Verification of Payee, SEPA Request to Pay (SRTP), and the SEPA Proxy Lookup and Addressing scheme (SPAA). This is a scheme-rulebook update layered on top of an existing legal obligation rather than a new substantive duty: Verification of Payee, in the form of IBAN-name matching for SEPA Instant credit transfers, has been mandatory in Spain since 9 October 2025 under the EU Instant Payments Regulation (Regulation (EU) 2024/886), with direct effect on both Bizum and conventional SEPA Instant bank transfers.

For Spanish PSPs, the practical consequence is a technical and security compliance update to already-built VoP infrastructure rather than a new build requirement. The underlying regulatory driver, the Instant Payments Regulation's VoP mandate, is unchanged; the EPC rulebook update operates at the scheme layer that all SEPA participants, Spanish or otherwise, must conform to as a condition of continued scheme participation. No Spain-specific implementation notice from Iberpay, Spain's national SEPA clearing and settlement infrastructure operator, or a dedicated Banco de Espana circular addressing the September 2026 update was located this cycle; the sourcing for the rulebook change itself rests on an aggregator account (ClearingPost), corroborated structurally by the Banco de Espana's own prior public guidance describing the October 2025 VoP obligation that the rulebook update amends procedurally.

No other Scheme & Network Compliance development for Spain surfaced this cycle.

Outlook

As scheduled, the EPC Rulebook v1.1 specifications took effect on 20 September 2026 and are now in force across the SEPA area, including for Spanish scheme participants. The next material point of interest specific to Spain would be a direct statement from Iberpay or the Banco de Espana confirming local operational compliance with the updated API and security specifications; no such statement was available this cycle, so the current account rests on scheme-level and aggregator sourcing rather than a Spain-specific primary confirmation.

Payment Corridor Dynamics

The EU Instant Payments Regulation (Regulation (EU) 2024/886) is now binding on Spanish payment service providers, mandating ten-second processing for instant credit transfers, IBAN-verification anti-fraud checks, and fee parity between instant and standard transfers. This lands on Spain's existing SCT Inst corridor, carried domestically by the Iberpay SNCE network, which most Spanish banks access via the Redsys aggregator, and which underpins the Bizum-dominant instant-payments user experience. Oversight of this corridor is now genuinely two-layered: Banco de España retains domestic infrastructure oversight while the Regulation itself is EU-level and directly binding, applicable to both bank and non-bank providers connected to the corridor.

Outlook

Compliance with the ten-second processing and fee-parity requirements is the immediate operative burden for PSPs connected to Iberpay SNCE; the practical question to track is how quickly aggregator-dependent smaller banks and non-bank PSPs, reliant on Redsys for connectivity, complete the technical uplift required for IBAN-verification anti-fraud checks at scale.

Legal & Litigation

The EU Council's issuance of compromise texts for PSD3/PSR on 17 April 2026 is this cycle's defining structural development for Spain's payments legal landscape. Formal adoption is expected imminently, at which point a 21-month national transposition clock begins running toward an eventual in-force date projected around 2028. The reform's most consequential structural feature for Spain is the elimination of the standalone EMI regime: PSD3/PSR merges e-money institutions into a Payment Institution sub-category, requiring existing EMIs to undergo re-authorisation under the new framework rather than continuing indefinitely under legacy EMD licensing.

Alongside the licensing-structure merger, the reform introduces expanded APP-fraud reimbursement liability for payment service providers and mandatory IBAN/name-check obligations, under which a PSP must verify that the payee name matches the IBAN before completing a transfer. These consumer-facing fraud-prevention measures apply across the merged Payment Institution category and represent a materially higher compliance bar than the current regime, particularly for entities that have operated under the lighter-touch EMI framework.

This is currently probable-confidence, standing-brief material: the compromise texts have been issued but formal adoption, and the specific mechanics of Spain's national transposition, remain ahead. The 21-month clock is a maximum transposition window rather than a guarantee of early implementation, and Spain's specific transposition approach — including any grandfathering provisions for existing EMIs — has not yet been determined or evidenced this cycle.

Outlook

The key legal-development watch item for coming cycles is formal EU-level adoption of PSD3/PSR, which will fix the exact start date of Spain's 21-month transposition clock. Once transposition legislation is drafted domestically, the treatment of existing EMIs — whether through grandfathering or a hard re-authorisation deadline — will be the most consequential detail for incumbent payment institutions operating in Spain under the current EMD-derived framework.

Product Innovation & Market Development

Spain's buy-now-pay-later sector continues rapid expansion, from an estimated EUR 1.00 billion in 2023 toward a projected EUR 8.12 billion by 2030, a 29.3 percent compound annual growth rate, led by Klarna, Aplazame, SeQura and Afterpay/Pagantis. Confidence is Low, reflecting a single tier-4 vendor source rather than a regulator-published figure, and no discrete regulatory product-access development (comparable to open-banking or BaaS rulemaking) was sourced this cycle to accompany the growth data.

Outlook

The growth trajectory itself is the signal to track rather than any pending rule change; a regulatory response calibrated to BNPL's scale, whether through consumer-credit-style disclosure requirements or Banco de España/CNMV product guidance, would be the next material development to watch for, though none is yet sourced this cycle.

Consumer Protection & APP Fraud

Spain's consumer-facing APP-fraud picture this cycle combines a statistical baseline with a converging legal-and-statutory liability trajectory. Spain's Ministerio del Interior recorded 464,801 registered cyber-offences in 2024, approximately 89% of which were online fraud; notably, this marked the first year-on-year decrease in this statistic. Kaspersky-sourced data places the average per-victim loss at €577, while under-reporting is estimated at near 69%, a figure that suggests the true fraud-loss picture for Spanish consumers is materially larger than officially recorded statistics indicate.

Against this statistical backdrop, Spanish consumers already benefit from judicial protection ahead of formal statutory codification: the Tribunal Supremo's sentencia 571/2025 ordered a bank to refund over €56,000 lost to phishing and SIM-swap fraud for failing to react to evident fraud signals. Once PSD3/PSR is transposed, expected in the mid-to-late 2027 window, this judicial standard is expected to be joined by an explicit statutory provider-liability obligation for authorised push payment fraud under the PSR component of the package.

Taken together, Spanish PSPs face a converging statutory-and-case-law liability regime for APP fraud, arriving in two stages: an already-live judicial standard now, and a codified statutory obligation once transposition is complete. Consumers experiencing APP fraud losses in Spain currently have judicial precedent to draw on even before PSR's liability provisions take direct legal effect domestically.

Outlook

The near-term-to-mid-term development to track is whether Spain's declining year-on-year cyber-offence statistic continues, and whether further judicial rulings extend or refine the evident-fraud-signal liability standard ahead of PSD3/PSR's formal transposition into Spanish consumer-protection law.

AML/CFT & Financial Crime

Real Decreto 813/2026 extends the existing SEPBLAC-representative obligation under Ley 10/2010's implementing regulation to small real-estate credit intermediaries and other small obliged entities that had previously benefited from an exemption. Those entities now face a nine-month compliance deadline, running to 28 July 2027, to appoint a SEPBLAC representative. This is a governance-coverage expansion rather than a new type of obligation: the representative duty itself already existed for larger obliged entities, and the decree simply removes the small-entity carve-out.

Payment institutions and electronic-money institutions are not named as a primary target of this provision in the material reviewed, and the decree's payment-account identity-matching requirements, which do touch how funds are credited and returned electronically, are scoped specifically to gambling operators rather than to payment-service providers as a class. The substantive AML-architecture analysis of RD 813/2026, including its crypto-asset-service-provider SEPBLAC-gateway and crypto-ATM identification provisions, is carried by the financial-integrity monitor; this W11 treatment notes only the governance-coverage dimension as it might touch payment-adjacent intermediaries falling within the newly-expanded small-obliged-entity population.

Outlook

The 28 July 2027 compliance deadline for newly-covered small obliged entities is the concrete date to track. Whether any payment institution or EMI falls within the expanded small-entity population subject to the SEPBLAC-representative duty was not established in the material reviewed this cycle and would be the clearest item to confirm in a future cycle.

Correspondent Banking, Settlement & Access

Banco de España has expressly described refusal to accept non-domestic EU IBANs for SEPA credit transfers and direct debits as non-compliant practice. This is a live, currently-uncertain-confidence practical access issue in Spain's payments environment, and it is analytically distinct from the incoming PSR mandatory IBAN/name-check regime that forms part of the PSD3/PSR reform package. The PSR mechanism, once transposed, will require PSPs to verify that a payee's name matches the IBAN supplied — a fraud-prevention control. Banco de España's concern, by contrast, addresses outright refusal to accept a valid, correctly-issued EU IBAN purely because it is not domestically issued, which is a market-access and non-discrimination issue rather than a fraud-prevention one.

The practical effect for payment service providers and their customers is a two-track compliance landscape emerging in Spain's correspondent and settlement environment: an existing, Banco de España-flagged non-compliance risk around IBAN-origin discrimination, and a forthcoming, PSR-driven mandatory verification obligation that will sit alongside it once national transposition occurs. Both bank and non-bank payment institutions are implicated, since the IBAN-acceptance issue as characterised by Banco de España applies across the SEPA credit-transfer and direct-debit rails generally rather than being confined to a specific class of institution.

Outlook

The principal watch item is whether Banco de España's non-compliance characterisation translates into supervisory action against specific institutions independent of, and ahead of, the PSR's own mandatory IBAN/name-check requirements entering into force via national transposition. Given the confidence level attached to this finding this cycle is uncertain, further primary-source confirmation of both the scope of the practice and any resulting supervisory response should be a priority for the next research cycle.

Commercial Intelligence & Fintech

Monzos launch in Spain on 28 October 2026 is this cycles clearest discrete commercial event: a specific, dated market entry by a named foreign digital bank, built on an EU passport obtained via the Central Bank of Ireland in December 2025, offering Spanish-IBAN accounts linked to Bizum. No transaction value applies to a market-entry event of this kind, and none was disclosed in connection with the launch. Separately, Spains draft Consumer Credit Contracts Act, dated January 2026, is extending supervisory coverage to buy-now-pay-later providers, addressing interest rates, credit costs and lender authorisation requirements — a thematic regulatory build-out around product access to consumer credit, distinct from any single disclosed commercial transaction.

The combination of these two items — a discrete foreign-entrant launch and a broader domestic regulatory build-out around a different credit product category — illustrates how Spains fintech commercial landscape is being shaped simultaneously from outside (foreign passported entrants choosing Spain for expansion) and from inside (domestic legislative attention turning to previously lightly-supervised consumer credit products).

Outlook

Further disclosed commercial events — additional market entries, funding rounds, or product launches — would sharpen the picture of how attractive Spain is proving as a destination for EU-passported fintech expansion following the Monzo entry. On the buy-now-pay-later side, the draft Consumer Credit Contracts Acts progress toward enactment is the item to track, since its current status is a draft rather than an enacted instrument, and its eventual scope for lender authorisation requirements will determine how significant a compliance shift it represents for existing buy-now-pay-later providers operating in Spain.