Banking - InSight Analysis - Spain

Spain’s banking sector in 2025 demonstrated strong financial performance. Net profit rose 10.5% to €21.1bn despite net interest income declining 6.6%, but the technology agenda has fundamentally shifted. Digital resilience, cyber security, and third-party ICT governance are no longer improvement projects; they are now core safeguards that determine sustainable competitive performance. This report explains why operational resilience has become the most reliable driver of software and IT services demand in Spanish banking.

Strategic Context. Spain’s near-term macro-outlook remains supportive (2.9% GDP growth in 2025, moderating to 1.9% by 2027), but medium-term structural constraints like weak productivity, adverse demographics, and elevated external uncertainty, mean banks must continuously invest in resilience, automation, and control frameworks that protect service continuity when conditions deteriorate. With branches declining 1.2% year-on-year and digital customer bases exceeding 12 million at leading banks, the digital stack is no longer optional infrastructure. Identity systems, payment rails, fraud controls, and customer communications must be secure, resilient, and capable of rapid recovery.

Regulatory Imperative. The Digital Operational Resilience Act (DORA), effective 17 January 2025, transformed resilience from a discretionary programme to an inspectable requirement. Banco de España explicitly positions cyber incidents as a leading threat to financial stability, noting that severe operational disruption can trigger confidence loss and liquidity pressure. Banks must now demonstrate evidence-based resilience across governance, testing, recovery objectives, and third-party oversight not as compliance theatre, but as operational capacity that withstands supervisory scrutiny and real-world stress.

Technology Transformation in Action. In 2025, Spain’s major banks executed significant technology programmes: Santander completed migration of its Spanish core banking to Gravity, a proprietary cloud platform, becoming the first major Western bank running 100% cloud-based core systems. BBVA finished global rollout of its ADA data platform on AWS and announced deployment of ChatGPT Enterprise to all 120,000 employees. CaixaBank launched its €5bn Cosmos programme (2025–2027) to accelerate digital transformation, hired 500 developers, and established a dedicated AI Office for governance. Sabadell expanded its Alicante Technology Competence Centre with partnerships including NTT DATA’s innovation lab. Bankinter migrated core workloads to Google Cloud, cutting data processing times by 30–40% and model development cycles by 30%. These initiatives share a common pattern; cloud-native architectures, industrial-scale AI deployment, and governance frameworks that align innovation with regulatory expectations.

AI Industrialisation and Ecosystem Dynamics. Generative AI moved decisively from experimentation to scaled deployment. The winning approach combines AI with governance; secure prompt handling, explainability, human oversight, and audit trails. Highest-value use cases sit in regulated workflows like KYC/AML processing, customer communications, software development, where productivity gains are measurable. Spain’s fintech ecosystem (427 entities mapped by Banco de España) is structurally closer to software and IT services than traditional financial intermediation, with 81 classified under programming/IT consultancy versus 51 as financial services. This expands partnership opportunities but also increases third-party governance complexity, integration demands, and operational dependency management.

Market Implications. For buyers, optimal technology investments strengthen customer experience while improving trust and continuity. For suppliers, differentiation comes from selling measurable outcomes like improved detection, faster containment, shorter recovery times, supported by robust third-party governance artefacts (subcontractor transparency, data residency clarity, exit plans, continuity evidence). The Spanish banking market rewards those who simplify architectures while strengthening controls, not those promising the longest feature lists.

Spanish banking’s binding constraints are operational resilience, compliance execution, and delivery at scale. Financial strength enables continued investment, but success belongs to banks and suppliers who defend trust, grow fee-based revenue engines, and compete effectively in an AI-accelerated, digitally intermediated banking ecosystem where operational continuity is non-negotiable.

Recommended advisory: PAC Leadership Session – Financial Services Industry – AI Adoption