ES v13.3.0

Spain (ES) · Module Detail

Spain: Operational Resilience & Critical Infra

← Full Spain overview Build report with Spain Request deeper dive

#

DORA directly applicable since 17 Jan 2025; CNMV 74-question FAQ (early 2026); FSB Nov-2025 peer review confirms robust BdE cyber supervision.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Horizon · 2029 (± more than a year)National offline card-payment continuity system nationwide rolloutProposed · Tier 4 source
Standing sub-brief · as of 8 July 2026114 words · last cycle 2026-08-21

Operational Resilience & Critical Infrastructure

The CNMV published a 74-question FAQ in early 2026, structured around DORA's five pillars: scope and proportionality, ICT risk management, incident reporting, resilience testing, and ICT third-party risk, to assist firms' interpretation of the directly applicable EU regulation. The FSB's November 2025 peer review found Banco de España maintains robust risk-based cyber-resilience supervision and was an early TIBER-EU adopter, while flagging the need for continued enhancement given the evolving cyber threat landscape.

Periodic update · new data 2026-09-08

Operational Resilience & Critical Infrastructure

Spain's National Payments Committee, comprising the Bank of Spain alongside Visa, Mastercard and major domestic banks, proposed an offline card-payment continuity system on 19 November 2025, targeting nationwide deployment by 2029. The proposal addresses continuity of card payments during network or connectivity outages, a resilience concern distinct from, but complementary to, the EU's Digital Operational Resilience Act baseline already applicable to Spanish financial entities. Confidence on this specific proposal is Low, reflecting a single tier-4 secondary source at an early proposal stage rather than a settled infrastructure commitment.

Outlook

The multi-year runway to 2029 means this is a watch item rather than a near-term compliance driver. The next markers to track are formal endorsement by the Bank of Spain beyond committee-level proposal, and any published technical specification for offline continuity that would allow card schemes and acquirers to begin implementation planning.

Sources and findings (5)
  1. T3https://www.regulation-dora.eu/what-is-doraretrieved
  2. T1https://www.grcreport.com/post/spain-moves-to-demystify-dora-with-74-question-industry-guideretrieved
  3. T1https://www.fsb.org/2025/11/peer-review-of-spain/retrieved
  4. T1https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/vigilancia-infraestructuras-mercado/retrieved
  5. T3https://www.regulation-dora.eu/bankingretrieved