This country-specific Q&A provides an overview of the legal framework and key issues surrounding fintech law in Spain.
This Q&A is part of the global guide to Fintech.
For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech-2nd-edition
What are the sources of payments law in your jurisdiction?
The Royal Decree-Law 19/2018, of 23 November, on payment services and other urgent measures on financial matters ("Royal-Decree Law"), is the main piece of legislation regulating payment services in Spain.
The Royal Decree-Law partially transposed the Directive (EU) 2015/2366, of 25 November, on payment services in the internal market ("PSD2"), in Spain and its main objectives are to facilitate and improve the security in the use of payment systems through the Internet, to reinforce the level of protection of users against fraud and potential abuse, as well as promoting innovation and competition in payment services through mobile and internet channels.
Nevertheless, because the Royal Decree-Law only transposes PSD2 in part, the Royal Decree 712/2010, of 28 May, and the Order EHA/1608/2010, of 14 June, are still in force as long as they do not contravene the dispositions contained in the Royal-Decree Law and the new legal regime is not approved.
On April 2019 the draft Royal Decree on the legal regime of payment services and payment entities that will complete the transposition of PSD2 into the Spanish legal system was released. Likewise, the draft Order on transparency and information requirements for payment services was published on May 2019. Both drafts are not yet in force and await final approval.
Can payment services be provided by non-banks, and if so on what conditions?
Yes, they can. Payment services can be provided on a professional basis by the following categories of payment service providers in Spain, in accordance to article 5 of the Royal Decree-Law 19/2018, of 23 November:
- Credit institutions: essentially banks;
- Payment institutions: there are two new categories of payment service providers with relevant regulatory consequences in the field of access to payment accounts for payment initiation services and for account information services;
- Electronic money institutions;
- Post office institutions which are entitled to provide payment services under national law.
Therefore, the new rules will equally apply to traditional banks and to innovative payment services and new providers, such as Fintechs. These players, also called third party payment service providers (“TPPs”), will be able to initiate payments on behalf of customers, give assurance to retailers that the money is on its way or give an overview of available accounts and balances to their customers.
Payment service providers must comply with common minimum requirements in relation to capital, knowledge and competence, corporate governance and anti-money laundering procedures before they can apply for authorization and registration with the Bank of Spain.
What are the most popular payment methods and payment instruments in your jurisdiction?
The most popular payment methods in Spain are debit or credit card payments, followed by Paypal and, finally, by bank transfers.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
The PSD2 has been partially transposed in Spain and the Royal Decree Law has already mandated that the two new categories of payment services providers should have access to payment accounts in order to be able to provide their services, provided that the owner of the account has given explicit consent.
In particular, the Royal Decree Law provides that payment account users have the right to use third party payment services providers such as Payment Initiation Service Providers (“PISP”) and Account Information Service Providers (“AISP”). Therefore, Account Servicing Payment Service Providers (“ASPSP”), which are essentially banks, are obliged by law to provide access to the information of the payment accounts designated by the user and the corresponding payment operations.
However, it is important to note that the transposition of PSD2 is not yet finalised. On April 2019 the draft of the Royal Decree on the legal regime of payment services and payment entities was published but awaits final approval. The Royal Decree is intended to transpose the remaining content of the PSD2 into the Spanish legal system rescinding by then the Royal Decree 712/2010, of 28 May and related legislation.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
The PSD2 introduces strict security requirements for the initiation and processing of electronic payments, which apply to all payment service providers, including newly regulated payment service providers. This stricter approach on security should contribute to reducing the risk of fraud for all new and more traditional means of payment, especially online payments, and to protecting the confidentiality of the user's financial data (including personal data).
Notwithstanding, the regulation that deals with data protection issues in Spain is not specific for the financial sector. This piece of law is the Organic Law 3/2018, of December 5, which adapts the Spanish data protection legislation to the General Data Protection Regulation (GDPR).
Both, the PSD2 and the GDPR, were introduced in 2018 as comprehensive sets of legislation focusing on consumer data. However, these regulations were devised with very different approaches in mind:
- PSD2 opens up the banking market, promoting competition and innovation, but any access to new products and services that involve personal data must comply with GDPR.
- GDPR seeks to protect personal data and facilitates the exercise of certain rights.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
In July 2018, the Spanish Ministry of Economy and Business published the Draft Law on Measures for the Digital Transformation of the Financial System (“Draft Law”) that intends to bring Spain closer to the verge of financial technology in Europe. This proposal is intended to benefit both entrepreneurs and supervisory authorities.
- For entrepreneurs - it facilitates the verification of the regulatory implications of a project before incurring the time and expenses that involves the administrative authorisation for a regulated activity.
- For supervisory authorities - it will mean being closer to innovators and facilitating the identification eventual risks for consumers.
The above-mentioned Draft Law foresees the creation of a Regulatory Sandbox operating in Spain, as well as the removal of certain obstacles to participants in the Sandbox, the formation of faster communication channels between Fintechs and supervisory authorities (i.e. the Bank of Spain, the Spanish Securities Commission or CNMV and the Directorate-General for Insurance and Pension Funds or even other authorities if needed) and, finally, providing close supervision during the testing phase under the terms defined in each Protocol, which is ruled on a case by case basis.
Additionally, regulators are playing a proactive role in Spain and both the Bank of Spain and the Spanish Securities Commission (“CNMV”) have dedicated units dealing with financial technology issues. The Spanish Securities Commission has a dedicated site for Fintech related issues on its website and has published several documents and Q&A about different Fintech topics.
Furthermore, Spain was one of the pioneering countries in the field of crowdfunding and the regulation of Crowdfunding entered into force on 29 April 2015 (Law 5/2015, of 27 April, Promoting Business Finance, Title V) which covers both equity and loan-based crowdfunding. Given the imminence of a new European Regulation on Crowdfunding and although it is well known that the European Regime does not intend to interfere with national bespoke regimes or existing licenses, it is likely that the existing legislation is to some extent adjusted.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
The main risk to the growth of the fintech market in Spain is somehow connected to the current political situation which in turn deviated into a legislative paralysis during the past years.
For instance, one of the reasons for not having an operational Regulatory Sandbox in Spain is precisely due to fact that Congress is not passing laws. The problem does not seem to be a lack of political appetite for this kind of regulatory tools but rather the mere incapacity to do so. Therefore, the Draft Law for the Digital Transformation of the Financial System still waits for its ride to Congress since February 2019 when it was endorsed by the Council of Ministers.
This situation might push some Spanish Fintech players to search for other countries where they could test their business models and establish their businesses.
On the other hand, although some of the measures recently taken by the Spanish authorities are worthy of applause, like the publication of Q&A on some of the more complex Fintech issues and the very much needed new guidelines proposed on authorisation procedures, bold and meaningful action is needed to place Spain in the pole position together with other countries.
What tax incentives exist in your jurisdiction to encourage fintech investment?
The Spanish Tax Administration Agency published, on 17 January 2019, the Annual Plan for Tax Control, which establishes the Agency’s top priorities for the current year.
In this Plan the Agency announces a study on Fintech in order to better understand this area of business and, therefore, avoiding a disconnection between the reality and its current procedures. With this study, the Agency expects to better serve the taxpayers.
Also, the Agency states that a similar study, with similar objectives, will be focused on e-commerce and new business models.
Finally, the Spanish Patent Box is a tax incentive associated with research, development and innovation that could be applied to patented inventions in the field of Fintech. This incentive is common throughout Europe and was created in order to align the system to the EU and OECD standards, which basically requires an effective link between the territory where the intangible asset is created and where the tax incentive is received.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Spain has seen an exponential growth in Fintech and Tech investment, with over € 100m raised in capital in 2019. The area of fintech that relates to these investments is extremely varied, including but not limited to peer to peer business and consumer lending, invoice trading, equity-based crowdfunding, payments, etc. However, the area that seems to attract more interest in Spain is peer to peer business lending.
Recently, a Spanish fintech raised the largest Series A funding ever, however, most of the investment in Spain is at Series B or C level.
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
Spain currently has over 300 fintech companies, it was number five in the European ranking by volume of assets in Fintech between 2013 and 2016 and number eight in 2017.
Therefore, it seems that the late arrival of the Regulatory Sandbox has not slowed down the development of the industry and the entrepreneurial spirit of Spanish Fintechs.
One of the main attributes to this growth, was the shift in paradigm experienced with some of the incumbent financial entities, that stopped viewing fintech players as potential competitors and started to see these players as potential partners. The work carried out in this field by some Spanish banks is remarkable and they are attracting an impressive number of fintechs to collaborate with them.
As the political and legislative scenario settles in Spain, we expect that the right conditions will be implemented in order to further develop this market to allow Spanish fintech players to better escalate their models and operations under a safe and regulated environment.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
Yes. This is an extremely important topic that needs to receive adequate attention by public authorities in order to deal with it in an appropriate manner.
Spain, like many other European countries, has set up an Entrepreneur Visa program, designed to attract talent and foreign investment in the country. Non-EU nationals who intend to develop an innovative business or entrepreneurial activity with special economic interest for Spain may apply for a visa or residence authorization for entrepreneurs. The visa is valid for one year with the possibility of being renewed for two-year periods, provided that the entrepreneur continues to meet the requirements that originated this right.
There is also a Highly Skilled Professional Visa that consists on a work permit that allows citizens from outside the European Union to work and reside in Spain, provided they are management staff, highly-qualified professionals and graduates or postgraduates from universities and prestigious business schools working for a Spanish company.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
Like so many other European countries, Spain recognizes the value of highly qualified or highly skilled professionals in the advancement of its industry. The fintech industry is not an exception and given the rapid rise in fintech investment and the great potential associated with its implementation, the fintech industry might have some impact in immigration policy.
However, although these measures are important, we must acknowledge that sometimes talent is closer than it seems. Therefore, initiatives such as the Regulators Pioneer Fund in the UK, the challenges prizes calling for solutions to fix social problems through technology and the type of networks created in other countries and inspirational are extremely interesting. Also, public funding supporting these kinds of initiatives is very much needed in these areas in order to keep at least local talent within borders.
Furthermore, we are in the age of collaboration and remaining as a one-man-band in this complex and brave new world does not seem to be a smart option. Therefore, innovative approaches and partnerships embracing diversity of skills and experience might be a short-term solution for the skills gap we are currently seeing.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
Regarding inventions, that most likely result from innovations (as it is the case for most fintech players), the protection can be made through different paths.
Patents are valid for 20 years and prevent the use from anyone other than the owner of the patent (or someone authorised by the owner).
Utility models are also very common, offering protection for 10 years and are usually easier to obtain than a patent.
Trade secrets are now covered under the new Law 1/2019, of 21 February, on Business Secrets, which transposes the European Directive (2016/943) on Trade Secrets, and business secrets are considered a subjective right of an economic nature. Unlike the formerly mentioned industrial property rights, this is not an exclusive right and are generally defined as something that is secret, it has commercial value and it has been subject to reasonable steps, under the circumstances, taken by the person lawfully in control of the information, to keep it secret.
Lastly, software would be considered copyright and therefore protected under the Spanish Copyright Law.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
Currently, there is not a specific regulation concerning cryptocurrencies in Spain. However, before answering this question it is important to note that cryptocurrencies urgently demand for an international taxonomy as, otherwise, we risk talking about very different concepts. We need a common language in this area and reference points both for regulators and market participants.
Having said that, it is important to note that cryptocurrencies and the various market participants directly involved in marketing them are not regulated in the European Union. This means that individuals who purchase or hold cryptocurrencies might not benefit from the guarantees and safeguards associated with regulated financial products.
The Spanish Securities Regulator, CNMV, considers that only on case by case analysis it is possible to determine whether a cryptocurrency is subject to regulation.
The CNMV, like all other European and international supervisors, is aware of the difficulty that fitting cryptocurrencies in the current legislation may entail, and of the possible unsuitability of the regulatory framework for some new business and digital collaboration models. The difficulty of applying the rules in a digital and essentially transnational context, moreover, makes an international cooperation effort necessary.
ESMA has already asked for a harmonized response at EU level to avoid more regulatory uncertainty and arbitrage.
The CNMV has issued guidance on this topic both at its own initiative and also in collaboration with the Bank of Spain.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
As referred in our previous point, there is no current regulation addressing cryptocurrencies, and the same goes for Initial Coin Offerings (“ICOs”).
Nonetheless, tokens issued through an ICO may qualify (depending on the specific circumstances) as a financial instruments in Spain, which in turn would make them automatically fall under the scope of several other legislation, such as MiFID, Prospectus Directive, AIFMD and AML rules.
The CNVM stated in the guidance published on its website that a good number of the operations structured as Initial Coin Offerings should be treated as issues or public offerings of transferable securities.
Among other reasons, they refer to the broad concept of “transferable security” as contained in Art. 2.1 of the Spanish Capital Markets Regulation.
Therefore, harmonizing the concept of “transferable security” in Europe is another urgent call for regulators in order to tackle the lack of convergence around Europe on this critical concept for financial services.
As well as with cryptocurrencies, ESMA has already expressed the need for a European regime to cover Initial Coin Offerings.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
There are already companies in the market testing and applying blockchain to its businesses and blockchain has become a trendy topic in Spain. There are also several entities dedicated to expanding blockchain and promoting its benefits.
It seems that there are more than 120 blockchain start-ups in Spain, acting in different areas such as decentralized marketplaces for video gamers, decentralized P2P bitcoin exchange and even platforms dedicated to finding real estate.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
No one doubts that artificial intelligence is a powerful tool for the financial sector but not only. However, although it is a trend topic and there is a lot of talk about it, in accordance to experts’ opinions this technology is still very much underway.
The main application of artificial intelligence in financial services is machine learning, specifically applied to credit scores determination. Through the use of machine learning, banks are able to determine the likelihood of a loan being repaid in time or the chances of default, allowing a much deeper analysis into the client’s credit behaviours.
Using artificial intelligence techniques in the provision of financial services can heighten efficiency, reduce costs, enhance quality, raise customer satisfaction levels and boost financial inclusion.
The Bank of Spain issued in March 2019 an Economic Bulletin on “Artificial intelligence in financial services”, referring several positive changes brought possible by artificial intelligence, such as greater automation and analytical capacity.
However, artificial intelligence also poses a series of risks and limitations that must be known and managed so as to be able to correctly extract all their potential.
Bank of Spain considers that cooperation with other authorities, both at a national and a global level, is particularly important in this respect, given that the use of artificial intelligence crosses both national and sectoral boundaries.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
Spain hosted in June 2019 the 4th edition of the Global Summit for Insurance Innovation dedicated to the innovation in the Insurtech market.
As of September 2019, at least 193 startups dedicated to Insurtech were recorded in the Spanish market.
Back in 2018 the Spanish Association of Fintech and Insurtech (AEFI) stated that 2018 had been the year in which Insurtech start-ups and pre-established insurance big players had begun to discuss agreements and collaborations.
The existing Insurtech ecosystem works in different areas in Spain, from medical care to using artificial intelligence to manage car and home accidents.
Are there any areas of fintech that are particularly strong in your jurisdiction?
Fintechs are currently operating in all financial sectors but, as previously mentioned, peer to peer business lending is particularly strong in Spain.
This might be case because Spain was one of the pioneering countries regulating crowdfunding and, for instance, there are almost 30 platforms registered with the Spanish Securities Commission, which is a rather high number in comparison with other jurisdictions.
With the implementation of the Regulatory Sandbox in Spain we expect to see significant growth in all other fintech areas.
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
When the fintech market began to grow, so did the concern on whether Fintechs would replace the incumbent financial institutions. Fintechs were sometimes viewed as a threat as they were providing some of the same services at a smaller cost and with faster and better technology.
Recently the landscape has shifted, with incumbent financial institutions realising that fintech players can and should be partners and collaborators.
Associating the pre-established infrastructure, manpower, financial resources, brand and clientele existing in incumbent financial institutions with the innovation and outside-the-box thinking usually associated with fintech companies allowed incumbent financial institutions to incorporate the potential disruption into their ecosystem.
On the other hand, it allowed fintech players with (still) limited resources and little brand recognition to implement their business ideas under a structured and mature environment.
On its July 2018 report the European Banking Authority (“EBA”) expressed exactly this, highlighting the immense potential for collaboration and the positive impact it could have on consumers. (“Report on the impact of fintech in incumbent credit institutions business models”).
We believe that collaboration would be the way forward either for Fintechs, Banks and Bigtechs (even for regulators).
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
We have seen some banks and incumbent financial institutions (even law firms) developing their own fintech and innovation programmes. This is because big institutions have realised that the research and development costs would be significantly reduced through collaboration (as we mentioned before).
Another path approached by banks is to outsource some services, like IT or data analytics. This allows banks to make use of programmes that would have high costs to develop internally and, most importantly, it saves the time and expertise that it would take to develop and test.
Are there any strong examples of disruption through fintech in your jurisdiction?
Some Fintechs in Spain are doing extremely well and one in particular has over 800.000 users, which is an impressive number.
It is our understanding that the main disruption will not occur as expected through loosing market quota from incumbents but rather in the provision of services. With the recent shift in the new ways of collaboration clients would be the ultimate beneficiaries.