Law 2/2023 regulating the protection of whistleblowers (published in the Official State Journal on February 21^st, 2023)
This new piece of legislation transposes Directive (EU) 2019/1937 into Spanish law with the following objectives: (i) providing individuals reporting certain actions or omissions with adequate protection from reprisals by means of specific procedures; and (ii) fortifying a culture and infrastructure of information and integrity across organisations and fostering a culture of information and communication to prevent and detect risks to the public interest. It became effective 20 days after its publication.

By way of summary, the new legislation regulates the following:

1. Protected communications. The legislation protects communication of the following information:
   
   
   • Acts or omissions that could constitute breaches of EU law, so long as they: (i) fall within the scope of the Whistleblower Directive; (ii) affect the EU’s financial interests; or (iii) relate to the internal market, including breaches of EU competition and State aid rules and practices whose purpose is to obtain a tax advantage in relation to corporate tax.
   • Acts or omissions that could constitute serious or very serious criminal or administrative offences, including those implying a financial loss for the Spanish Treasury or Social Security.
     
     

   The protection contemplated under this legislation does not apply to reports that affect classified information or reports resulting from the protection of professional privilege, non-disclosure obligations or the secrecy of court deliberations.

2. Scope of application. The legislation applies to reporting persons who work in the private or public sector who have obtained information about breaches in a labour or professional context, thereby encompassing: (i) workers, including civil servants; (ii) self-employed persons; (iii) shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members; and (iv) any persons working under the supervision and direction of contractors, subcontractors and suppliers.
   
   

   It also applies to reporting persons who report breaches acquired in a work-based relationship which has since ended, volunteers and paid or unpaid trainees and persons whose work-based relationship is yet to begin in cases where information on breaches has been acquired during the recruitment process or other pre-contractual negotiations.

3. Reporting channels. The legislation establishes two reporting channels: the internal reporting channel and the external reporting channel.
   
   
   • Reporting through internal reporting channels is encouraged before reporting through external reporting channels, where the breach can be addressed effectively internally and where the reporting person considers that there is no risk of retaliation. Internal channels must accept written and/or oral communications and the anonymous presentation and subsequent processing of communications.
     
     It is up to the administrative or governance body of each undertaking bound by this legislation to implement the internal reporting channel, designate the person responsible for managing the channel and approve the communication reporting channel. The internal reporting channel can be managed internally by the undertaking itself or by an external third party.
     
     Undertakings from both the private and public sectors are obliged to set up an internal reporting channel. The bound parties specifically include: (i) natural persons and legal entities with 50 or more workers; (ii) legal entities that fall under the scope of application of EU acts that concern certain areas (including financial services, products and markets, and prevention of money laundering and terrorist financing); (iii) political parties, unions, business organisations and their foundations, to the extent they receive or manage public funds; (iv) the state, regional and local governments; (v) public bodies and entities related to or dependent on any public administration; (vi) the independent administrative authorities, the Bank of Spain, and the Social Security managers and service providers, etc.
     
     
   • Communications may also be reported through the external reporting channel of Spain’s competent authority, the Independent Reporting Person Protection Authority (hereinafter, the Authority) or the regional equivalents, either directly or after having first reported through internal reporting channels. Communications may be reported anonymously or the identity of the reporting person protected and the communications may be presented in writing or orally, including via an in-person meeting.
     
     Findings issued by the Authority cannot be appealed, notwithstanding the right to challenge a resolution that closes the disciplinary proceedings.
     
     
4. Independent Reporting Person Protection Authority. This competent authority is a public-law entity with full legal personality and full public and private capacity to act. It will act autonomously and independently, organically and functionally, of the government, the entities comprising
   the public sector and the public powers in the course of carrying out its duties. It is associated with the Ministry of Justice.
   
   
5. Protection procedures. The legislation contemplates the following measures:
   
   
   • Persons who report or disclose breaches will qualify for protection so long as they had reasonable grounds to believe that the information on breaches reported was true at the time of reporting, even if they do not provide conclusive evidence.
   • All forms of retaliation, including threats of retaliation and attempts of retaliation against reporting persons, are prohibited.
   • Provision of support measures, specifically comprehensive information and advice, accessible and free of charge, effective assistance against retaliation, legal aid, financial assistance and psychological support.
   • Reporting persons will not be considered to have breached any restriction on the disclosure of information provided that they had reasonable grounds to believe that the reporting or public disclosure of such information was necessary for revealing a breach pursuant to this Law.
   • Throughout the handling of a case, the persons concerned will enjoy the presumption of innocence, the rights of defence, including the right to access their file, along with the same safeguards as are afforded informants, protecting their identity and guaranteeing the confidentiality of the case facts and developments.
   • Personal data protection under Regulation (EU) 2016/679 (GDPR).
     
     
6. Penalties. It is up to the Authority and the competent authorities at the regional level to apply the contemplated penalties, without prejudice to each organisation’s own internal disciplinary measures.
   
   
7. Execution timing. The authorities, bodies, companies and other undertakings obliged to set up an internal reporting channel must do so within three months of effectiveness of this Law. In the case of legal entities in the private sector with 249 or fewer workers, and towns with fewer than 10,000 inhabitants, that deadline is longer: December 1^st, 2023.
   
   The existing external reporting channels and procedures will be governed by specific regulations, which must be adapted within six months of effectiveness of this Law.
   
   
8. Amendment of other laws. It has the effect of amending the following pieces of legislation, among others:
    
   • Law 10/2014 (supervision and solvency): introduction of the role of the Authority for reporting person protection purposes.
   • Law 10/2010 (AML/CFT): amendments to allow persons exposed to threats, hostilities or adverse labour conditions as a result of reporting internally or to the SEPBLAC (executive branch) on activities related with money laundering or the financing of terrorism to present a claim before the Authority.

Royal Decree-Law 20/2022 on measures in response to the economic and social consequences of the war in Ukraine and providing support for the reconstruction of La Palma and other situations of vulnerability (published in the Official State Journal on December 28^th, 2023)
The measures enacted via this piece of legislation have the effect of amending the following laws, among others:

• Royal Decree-Law 11/2020: extension of the suspension of eviction proceedings and foreclosures for vulnerable households without alternative living arrangements (in the instances and in the manner already stipulated) until June 30^th, 2023.
• Royal Decree-Law 37/2020: extension of the period for calculating compensation for the owners and landlords of the affected houses until June 30^th, 2023, and of the deadline for applying for that compensation until July 31^st, 2023.
• Royal Decree 401/2021: extension of the period for calculating compensation until June 30^th, 2023, and of the deadline for landlords and owners to apply for that compensation until July 31^st, 2023.
• Royal Decree 164/2019: increase in the gross income threshold for qualifying as a ‘vulnerable’ or ‘at risk of financial exclusion’ customer as follows:
  
  
  • three times (formerly two times) the so-called 12-payment multi-purpose income indicator prevailing at the time of the application in the case of persons that do not belong to any household unit;
  • three and a half times (formerly two and half times) that same indicator in the case of persons belonging to a household unit with less than four members;
  • four times (formerly three times) that same indicator in the case of household units made up of four or more members or families officially qualifying as ‘large families’; and
  • four times (formerly three times) that same indicator in the case of household units where one of the members has a certified disability of a severity of 33% or more.
• Royal Decree-Law 20/2021: extension, until January 30^th, 2023, of the deadline for applying for an additional six-month moratorium on payment obligations under secured or unsecured loan or credit agreements affected by the seismic movements and volcanoes affecting La Palma Island on September 19^th, 2021.
• Law 16/2022: update of the regime for collecting the guarantees contemplated in article 16 of Royal Decree-Law 5/2021 and in the Cabinet Resolution of May 11^th, 2021.

Royal Decree-Law 1/2023 on urgent matters around hiring incentives and social protection for artists (published in the Official State Journal on January 11^th, 2023)
Among other measures, the new legislation amends Royal Decree-Law 11/2020 in relation to situations of economic vulnerability. Those changes do not modify the situations qualifying for economic vulnerability for the purposes of obtaining moratoria, aid or other measures related with rent on a regular abode but rather eliminate the reference to the COVID-19 pandemic as a cause of vulnerability. That allows extension of the vulnerability concept to new situations unfolding since the pandemic, such as the economic and social consequences of the war in Ukraine.

CNMV Circular 4/2022 on the accounting standards and annual and interim financial statements of the Spanish securities market infrastructure providers (published in the Official State Journal on December 31^st, 2022)
The purpose of this Circular is to regulate the specific accounting standards, the interim and annual financial statement templates disclosed to the public and those provided to the CNMV applicable to the following companies and entities: the bodies governing regulated markets, the entities governing multilateral trading facilities and organised trading facilities, central counterparties and central securities depositories and Sociedad de Bolsas, as well as to the undertakings holding all of the shares or a stake giving them control, directly or indirectly, of the aforementioned entities.

It took effect on January 1^st, 2023, and will apply to audited interim and annual financial statements issued in reporting periods beginning on or after that date. As a result, it will apply to the annual financial statements audited in respect of 2023, to be submitted for the pertinent shareholder approval in 2024.

In broad terms, the Circular introduces the following changes:

• It eliminates sections that did not describe accounting criteria specific to these entities which are adequately addressed in the General Accounting Plan.
• It modifies certain accounting standards and financial statements to include the novelties introduced via Royal Decree 1/2021.
• It reduces the number of interim financial statements with the aim of eliminating overlap between the confidential and public statements. It circumscribes the public disclosure requirement to the annual financial statements. Therefore the interim financial statements set down in the Circular are: (i) the balance sheet; (ii) the statement of profit or loss; (iii) the supplementary segmented revenue and price information; (iv) other supplementary financial information; and (v) the statement of compliance with own funds requirements or the own funds information statement.
• It introduces a new analytical statement of profit or loss for central securities depositories which separates the costs and revenues associated with each of their basic services from those associated with auxiliary services.
• It includes templates for preparing separate and consolidated balance sheets and statements of profit or loss.
• It requires recognition of the assets and liabilities derived from the positions resulting from the interposition of the central counterparty in financial instrument purchase and sale transactions on the transaction date, classifying them “at amortised cost” for measurement purposes, as the positions to be offset are held with the objective of collecting the contractual cash flows derived from the sale-purchase price on a specified date.
• It contemplates requiring central counterparties and central securities depositories to present the minimum own funds requirement statement.