AI agent training for compliance officers in retail banking in Spain

Spanish retail bank compliance officers should train to handle what AI agents hold for them, read the record behind each verdict, and decide who on the team may release what. The Banco de España, the AEPD, EU payment rules and the EU AI Act shape the content, with older customers and mortgages to the fore. Ninety days is enough.

What does a compliance officer at a Spanish retail bank do day to day?

Mortgage compliance is detailed. Spanish mortgage law requires the borrower to receive key documents in advance and to attend a notary who checks that they understood them before signing. Compliance tests that the bank's process feeds the notary correct, timely documents and that the file proves it. Transparency of fees and terms on everyday accounts, cards and consumer credit sits alongside, together with complaints, which can go on to the Banco de España's complaints service.

Older customers are a live concern. As branches have closed and services moved online, the treatment of elderly customers has become a public issue, and banks have committed to maintaining in-person service for those who need it. Compliance watches how digital tools, including AI agents in apps and phone lines, serve older customers, and whether anyone is pushed into a channel they cannot use.

Where does an AI agent help compliance, and at what depth?

• Mortgage file testing, depth 1. The agent reads mortgage files and checks document delivery dates, the notary's record and the required disclosures, flagging any file that falls short.
• Payee name check outcomes, depth 1. Under the EU Instant Payments Regulation, banks must verify the payee's name before an instant transfer. The agent reads mismatch outcomes and customer decisions to proceed, and flags patterns that suggest scams.
• Complaint theme analysis, depth 2. The agent groups complaints by product, channel and customer age band and drafts a note for the officer.
• Evidence filing, depth 3. Within bounds, the agent attaches test evidence and schedules retests.
• Communications with the Banco de España or the AEPD, held.

Officers also need to know what to do with the items an agent holds for them, such as a draft breach assessment or a flagged mortgage file. How compliance officers handle an action an AI agent has held for them walks through the steps: read the evidence, check the deciding bound, decide, and record the reason.

What should compliance officers learn first, and what remains theirs?

Which AI agent skills matter most for compliance officers ranks the skills; for a Spanish retail bank the top three are reading held items quickly, tracing provenance and overseeing first-line agents. Provenance has a sharp use here. In a payee name mismatch, the receiving bank's response is signed by a named party, while the customer's insistence that the payee is genuine and known to them is declared. A pattern of customers overriding mismatches after phone calls is a scam signal, not a customer preference. The wider map of skills is in AI agent skills by role, and the levels in the competency matrix for the compliance team.

Correcting agents is part of the job. When an officer clears a flagged mortgage file, recording the reason refines the agent's checks for every later file; teaching compliance officers to bank corrections explains the method.

What stays with people:

• concluding whether a mortgage file met the transparency rules
• judging whether older customers are being treated fairly in a channel
• every communication with the Banco de España, the ECB or the AEPD
• approval of the depth any first-line agent may hold
• suspicious transaction decisions, made with the anti-money laundering team

Which Spanish and EU rules shape oversight and literacy?

The Banco de España supervises conduct, transparency and complaints for Spanish banks; significant banks also sit under ECB banking supervision, and EBA guidelines apply. Investment products sold in branches fall under the national securities regulator and ESMA's rules. The AEPD enforces GDPR in Spain, including Article 22 on solely automated decisions and Article 35 impact assessments, and takes an active interest in automated processing. The EU Instant Payments Regulation requires payee name verification. DORA applies to the agent as an ICT service.

Under the EU AI Act, banks are deployers, and Annex III treats creditworthiness assessment and credit scoring of natural persons as high-risk, bringing Article 14 human oversight, Article 26 deployer duties and an Article 27 fundamental rights impact assessment. Article 50 requires that people are told when they interact with an AI system, which matters for older customers on the phone. Article 4 requires sufficient AI literacy for staff, and Spain has created a national agency to supervise AI.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

What does a 90-day training plan look like?

Weeks 1 to 4: vocabulary and handling held items

Compliance, anti-money laundering and the customer protection team complete the Foundations material. Each officer then works through ten held items from a test workspace and records a decision and reason for each.

Weeks 5 to 9: monitoring with an agent

Mortgage testing and payee name monitoring go live at depth 1. Officers compare flags with their own testing and log every disagreement, including any in Catalan, Basque or Galician files.

Weeks 10 to 13: certification and coverage

Officers with release rights certify as reviewers through a two-week practicum. The team then builds a rota so held items never wait beyond the bank's service level; how to build a reviewer rota for the compliance team shows how. Pryme Intelligence Academy's Operator track fits here, with module tests set in retail banking and compliance.