title: Spain — Operational Resilience & Critical Infra | World Payments Monitor canonical: https://payments.gi/jurisdictions/spain/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infra Confirmed confirmed 2026-07-04 DORA directly applicable since 17 Jan 2025; CNMV 74-question FAQ (early 2026); FSB Nov-2025 peer review confirms robust BdE cyber supervision. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/spain/) Horizon · 2029 (± more than a year) National offline card-payment continuity system nationwide rollout_Proposed · Tier 4 source_ Standing sub-brief · as of 8 July 2026 114 words · last cycle 2026-08-21 #### Operational Resilience & Critical Infrastructure The CNMV published a 74-question FAQ in early 2026, structured around DORA's five pillars: scope and proportionality, ICT risk management, incident reporting, resilience testing, and ICT third-party risk, to assist firms' interpretation of the directly applicable EU regulation. The FSB's November 2025 peer review found Banco de España maintains robust risk-based cyber-resilience supervision and was an early TIBER-EU adopter, while flagging the need for continued enhancement given the evolving cyber threat landscape. #### Outlook DORA's national-level interpretive layer and the FSB's positive assessment suggest Spain's operational-resilience supervision is in a consolidation phase rather than a reform phase, with attention likely to shift toward ICT third-party oversight of critical outsourced providers. Periodic update · new data 2026-09-08 #### Operational Resilience & Critical Infrastructure Spain's National Payments Committee, comprising the Bank of Spain alongside Visa, Mastercard and major domestic banks, proposed an offline card-payment continuity system on 19 November 2025, targeting nationwide deployment by 2029. The proposal addresses continuity of card payments during network or connectivity outages, a resilience concern distinct from, but complementary to, the EU's Digital Operational Resilience Act baseline already applicable to Spanish financial entities. Confidence on this specific proposal is Low, reflecting a single tier-4 secondary source at an early proposal stage rather than a settled infrastructure commitment. #### Outlook The multi-year runway to 2029 means this is a watch item rather than a near-term compliance driver. The next markers to track are formal endorsement by the Bank of Spain beyond committee-level proposal, and any published technical specification for offline continuity that would allow card schemes and acquirers to begin implementation planning. **Sources and findings (5)** 1. T3 [https://www.regulation-dora.eu/what-is-dora](https://www.regulation-dora.eu/what-is-dora) retrieved 2026-07-04 2. T1 [https://www.grcreport.com/post/spain-moves-to-demystify-dora-with-74-question-industry-guide](https://www.grcreport.com/post/spain-moves-to-demystify-dora-with-74-question-industry-guide) retrieved 2026-07-04 3. T1 [https://www.fsb.org/2025/11/peer-review-of-spain/](https://www.fsb.org/2025/11/peer-review-of-spain/) retrieved 2026-07-04 4. T1 [https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/vigilancia-infraestructuras-mercado/](https://www.bde.es/wbe/en/areas-actuacion/sistemas-pago/vigilancia-infraestructuras-mercado/) retrieved 2026-07-04 5. T3 [https://www.regulation-dora.eu/banking](https://www.regulation-dora.eu/banking) retrieved 2026-07-04