International Protection Of Banking Consumers

On January 1 of this year marks the fortieth anniversary of the entry of two Iberian countries (Spain and Portugal) into the then European Community.

The reception of European Union Law in different areas (Public and Private, Tax, Commercial, Procedural, Administrative, etc.) has been a fundamental factor in the economic development of our country. And of its citizens. Let’s set an example:

A consumer (regardless of nationality) resident in Spain enjoys a legal status of protection against the supposedly preeminent business counterparty. We can state without equivocation that Consumer Law in the European Union is a certainly relevant legal instrument that seeks to re-balance the weight of the legal relationship.

In this situation, within the framework of the free movement of people, goods, capital and services, that citizen can maintain current accounts open and operational in one or more countries. Not only in the country of residence.

The current account opened by said consumer is a banking contract, usually subject to the national law of the country where it is opened and in which the entity has an operational establishment or branch. It is also subject to the Union rules on payment instruments (e.g. Directive 2015/2366 and its successive amendments) that must be transposed by each Member State within a maximum period of time (e.g. RDLey 19/2018 in the case of Spain).

In this context, consumers residing in our country may face scenarios of blocking or cancellation of their accounts, those opened in the country of residence or in another State of the Union. Or even suffer illicit behavior (account hacking or phishing) on such accounts.

We are going to refer to this second hypothesis: bank accounts opened in a country other than that of the consumer’s residence.

We have examples in this office: A citizen of non-EU nationality but resident in Spain opened an account in Luxembourg in a credit institution in that country. After some time, abruptly and without prior notice, the entity canceled the account.

The first of the initial obstacles (the possibility of suing in a foreign country (that of the place where the account was opened), hiring lawyers and solicitors practising in that country) is smoothed out by the consumer protection regulations themselves: the consumer can sue the bank in the country of his residence. Any agreement or clause that obliges the consumer to sue (or punishes him to be sued) in a place other than his residence is considered abusive and therefore ineffective.

Brussels Regulation 1215/2012 on International Competition is clear in this regard.

Once this first step has been passed, the consumer will sue the credit institution invoking substantive rules governing the banking contract promulgated by the State where the account is opened.

This second obstacle (that is to say, the invocation and application in the country of residence of a foreign law, the banking law of another State of the Union) is certainly relativised as a result of the homogenisation existing in this area within the European Union.

Even though the rules of the country where the account has been opened may have some specialities, we can state clearly that the lowest common denominator of European Union law on the matter (applicable to all countries) allows a series of rights and powers that cannot be waived for all consumers in the Union to be enforced:

In the aforementioned example, the cancellation of a framework agreement regulating a payment instrument (current account) with an indefinite term by the credit institution, whether the injured consumer is resident or non-resident, must be preceded, as a general rule, by a notice of at least two months. Credit institutions have sometimes tried to use the mere citation of anti-money laundering regulations to cancel their customers’ accounts. In these cases, a simple invocation of a generic risk is not enough. A specific risk must be proven. This has been pointed out by the S of the CJEU of 10 May 2016.

Let’s take another practical example of banking operations: in the event that the consumer is harmed by an unlawful cyberattack (phishing) that affects his account and the resources deposited in it, it is the bank, which allegedly has adequate material and personal means to create a safe operating environment, which must prove the concurrence of gross negligence attributable exclusively to the consumer in order to be exonerated from any responsibility towards the consumer.

This reasoning takes as its starting point the special duty of prevention imposed on the entity that in a fully banked economy safeguards our funds. This has been pointed out by the Advocate General of the CJEU in his general conclusions in Case C-70/2025.

At this point, in view of the two practical examples invoked on the application of European Union Consumer Law, we can affirm that consumers in this territorial area have powerful tools to assert their rights. And this regardless of the country of the European Union where they had their account opened.

Knowledge and the search for the appropriate legal solution to these international problems requires an adequate analysis of the case, the elements or points of connection thereof and requires a coordinated management of the different disciplines (Banking Law, European Union Law, Public and Private International Law) and having operational work teams in this international field.