- On 14 July 2026 the Council of Ministers approved the bill on digitalising and modernising the financial sector and sent it to Parliament.
- It completes the application of MiCA and adapts Spanish law to DORA, with its own regime of infringements and penalties.
- It opens payment systems to non-bank institutions and renews the controlled testing environment for innovative projects.
On 14 July 2026, the Council of Ministers approved the bill on the digitalisation and modernisation of the financial sector and sent it to the Cortes Generales, with a request for urgent processing. The text stems from a draft bill the Government had approved in late 2024 and which, now as a bill, begins its parliamentary passage. It is the route by which Spain brings into its law a package of European digital-finance rules adopted in recent years.
The law amends several financial laws to adapt them to a range of European texts: the crypto-asset regulation (MiCA), the digital operational resilience regulation (DORA), the instant payments regulation and the directive on the European single access point (ESAP). It matters to companies, institutions and users because it sets who supervises what, with which obligations and with what consequences if they are breached.
Crypto-assets and cyber resilience
On crypto-assets, the bill completes the application of MiCA: crypto-asset service providers become obliged entities for anti-money-laundering purposes, the CNMV will keep the register of authorised entities and supervise crypto-asset advertising, with power to demand changes, suspend it or ban it. It also applies the European regulation on transfers of funds.
As for DORA, the digital operational resilience regulation, the bill creates a regime of infringements and penalties and strengthens the Bank of Spain’s oversight of payment-system operators, processors and e-money schemes, including how they choose their technology providers and deal with them. The message to the sector is that relying on third-party technology does not dilute one’s own responsibility.
Payments and control of Iberpay
Payment and e-money institutions will be able to access payment systems directly, without going through a bank, in line with the European instant payments regulation. It is a measure that can lower costs and ease the entry of new operators, which matters to shops and to companies that collect and pay every day. The Bank of Spain will also be the competent authority to supervise public administrations’ compliance with the SEPA rules.
Another novelty: acquisitions that give control of Iberpay, described as critical infrastructure of the Spanish payment system, will require prior administrative authorisation, which may be refused if there are risks to its proper management. The stated purpose is to preserve the country’s strategic autonomy in payments.
The sandbox and what to review
The bill renews the controlled testing environment, or financial “sandbox”, so that it is used more: projects can be submitted at any time of the year, burdens and costs are reduced through responsible declarations and a direct channel with Sepblac, and financial guarantees will be required only when tests are carried out with real customers and real money. Thematic cohorts are also enabled to give projects more visibility.
It is still a bill: it may change in the Congress and the Senate. In the meantime, companies in the sector should review their registration and obligations, their technology risk management and their contracts with providers; and anyone using crypto-asset or payment services should check that their provider is authorised. The ESAP directive, which will connect Spain to the European single access point, is expected to be operational in 2027.
More digital financial regulation means more clarity, but also more obligations for those who provide and those who use these services.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
