It is advisable to start where the problem begins, which is not the insurance, but the liability that the insurance aims to protect against. Spanish capital company law establishes the status of the director based on two duties with open content and enormous potential for expansion: the general duty of diligence under Article 225 of Royal Legislative Decree 1/2010, of 2 July, which approves the consolidated text of the Capital Companies Act (hereinafter, “LSC”) —to perform the role “with the diligence of an orderly businessman, taking into account the nature of the role and the functions attributed to each”— and the duty of loyalty under Article 227 LSC, whose breach not only determines the obligation to compensate for the damage caused to the company’s assets but also to return any unjust enrichment obtained.
Liability is joint among all members of the board (unless the director proves that they opposed or were unaware of the agreement), it also extends to those who act as directors without formal appointment, and can be claimed for four years.[1]
Now, for a director of a listed company, there is an additional title of attribution, much more specific and much less commented on in boards than its seriousness would warrant: liability for the prospectus. Article 38 of Law 6/2023, of 17 March, on Securities Markets and Investment Services, states that the liability for the information contained in the prospectus “shall at least fall on the issuer, the offeror or the person requesting admission to trading in a regulated market and the directors of the aforementioned”; and that all of them “shall be liable for all damages caused to the holders of the negotiable securities acquired as a result of false information or omissions” in the prospectus.[2]
“A director of a listed entity that approves a capital increase is personally exposed, by legal mandate, to each investor who subscribes to that operation”
Add to this the criminal exposure —which is what truly causes sleepless nights, as it arrives before any declaration of civil liability and requires technical defence from day one— and you obtain the complete picture: a director of a listed entity who approves a capital increase is personally exposed, by express legal mandate, to each investor who subscribes in that operation.
From personal risk to insurance: what D&O is and what it is not
It is this risk that the civil liability insurance for directors and officers responds to, which fits easily within Article 73 of Law 50/1980, of 8 October, on Insurance Contracts (hereinafter, “LCS”): the insurer undertakes, “within the limits established by law and in the contract,” to cover the risk of the insured's obligation to indemnify a third party for damages caused by an event covered by the contract. Note, even from the precept, the double reference: the limits of the law and the limits of the contract. A significant part of D&O litigation consists of discussing how far the latter extends.
Article 73 LCS expressly admits, moreover, the temporal delimitation through claims-made clauses, to which the precept itself attributes “the same character as limiting clauses according to that Article 3.” The legislator, therefore, has not been neutral: when it wanted to qualify, it has qualified.
It is worth recalling the distinction: the law differentiates between clauses that simply define what is insured (delimiting, valid without more) and those that restrict the rights of the insured (limiting), which are only valid if highlighted and accepted in writing (Article 3 LCS).
Regarding legal defence, the general rule is that of Article 74 LCS: unless agreed otherwise, the insurer assumes the legal direction against the claim of the injured party and “shall bear the defence costs incurred”; and, when there is a conflict of interest, the insured may entrust their defence to another person, with the insurer obliged to cover those costs “up to the limit agreed in the policy.”[3]
D&O insurance operates in a narrow range: between the fault that Article 236.1 of the LSC requires for liability to arise and the intent that Article 19 of that same law declares uninsurable
Add the insurmountable limit of Article 19 LCS —the insurer is obliged to pay the benefit “unless the loss was caused by the bad faith of the insured” — and one understands the narrow margin in which D&O operates: between the fault that Article 236.1 LSC requires for liability to arise and the fraudulent intent that Article 19 LCS declares uninsurable. In simple terms: the insurance covers the errors or lack of diligence of the director, but never their bad faith.
Within that margin, the jurisprudence of the Civil Chamber has been establishing the map: Judgment 58/2019, of 29 January, classified as limiting —for being contrary to the natural content of this type of insurance— the exclusion of tax liability attributed to the director; and the Full Court Judgment 421/2020, of 14 July, admitted that a sub-limit on freely chosen attorney fees, which is initially delimiting, can degrade into a limiting clause if it is evidently insufficient.[4]
Judgment 1127/2026 and the case
In Judgment 1127/2026, of 10 July (Roj: STS 3021/2026 – ECLI:ES:TS:2026:3021; Id Cendoj: 28079110012026101111), the former president of Banco Popular —who held the position until 20 February 2017— was listed as insured under the D&O policy taken out by the entity, with a coverage period from 29 November 2016 to 28 November 2017, extended until 29 November 2021 and a compensation limit of 15,000,000 euros. Among the exclusions of the subscribed policy, stipulation V, section 6, excluded claims based on, related to, or as a direct or indirect consequence of: a) “the sale, placement, admission, acquisition, exclusion or any other public or private offer or proposal or attempt of a public or private offer of the Company’s Securities in any market or stock exchange”; and b) “the Offer of Shares and Preferential Subscription Rights resulting from the Capital Increase approved by the General Shareholders’ Meeting of Banco Popular Español S.A. held on 10 November 2012.”[5]
Following the resolution of the entity in June 2017 and the admission of complaints from former shareholders in preliminary proceedings No. 42/2017 of the Central Investigating Court No. 4 of the National Court —whose piece No. 1 covers the board's actions during its presidency, including the capital increase of May 2016— the insured reported the loss and the appointment of a lawyer. The insurer rejected coverage. The lawsuit claimed the advance of defence costs and the bond retained by the Court, amounting to 2,940,975 euros. The bond is not a minor detail: if the policy links it to the excluded claim, the exclusion also extends to this immediate liquidity risk for the director. In the first instance, the right to advance was recognised with a limit of 750,000 euros for the investigation phase, and the Court confirmed it. However, the Supreme Court annulled and dismissed the aforementioned lawsuit in its entirety.
Judgment 1127/2026, of 10 July, which we discuss here, is not an isolated case: it adds to Judgments 920/2026 and 921/2026, both of 16 June, and Judgment 1125/2026, of 8 July. We are therefore not facing a singular ruling but rather a reiterated doctrine, which will likely project onto the numerous criminal proceedings arising from banking and corporate crises.
The Supreme Court annulled the ruling of the National Court, and if the claim is excluded, the defence costs it generates are also excluded
What the Supreme Court Decides: the policy applies in its literal sense, especially in large risks
The argumentative nerve is of almost geometric simplicity, and from there precisely comes its expansive force.
The Chamber notes that section 6 of stipulation V contains two groups of cases: a general exclusion, referring to claims related to any public or private offer of placement of the policyholder’s securities; and another specific, relating to the offer resulting from the capital increase approved in November 2012. Hence, the circumstance that letter b) specifically excludes the 2012 increase “cannot be understood as the elimination of the general exclusion established in letter a) regarding claims connected to any public subscription offer of securities.”
In other words: that the policy expressly mentioned the capital increase of 2012 does not mean that the rest of the public offers were covered when the immediately preceding letter of the same insurance clause already excluded them all.
On this basis, the Chamber reiterates its hermeneutic doctrine: the literal sense is “the initial premise, as it constitutes the starting point from which meaning is attributed to the statements made”; and when the terms are clear, the literal interpretation prevents that, under the pretext of interpretative work, a statement that is clear and precise is modified. It is the rule of Article 1281, first paragraph, of the Civil Code: “If the terms of a contract are clear and leave no doubt about the intention of the contracting parties, the literal meaning of its clauses shall prevail.” The appealed judgment therefore infringed Articles 73 LCS and 1281 CC.
And it is worth emphasising a decisive fact: the D&O insurance of a large company is a large risk insurance. The law presumes that the company negotiates with advisors and withdraws much of the protection it provides to the ordinary insured.[5]
The circle closes: the director's defence in the criminal process
Let us now return to the starting point, because it is here that the reasoning acquires its true significance for the director. As we saw, the law points to the director as responsible for the issuance of securities, individually and by virtue of their condition as such. And it is precisely this assumption that the D&O policy of Banco Popular expressly excluded.
The effect on the ancillary coverage of legal defence is what Judgment 1127/2026 teaches starkly: that coverage follows the fate of the claim to which it is linked; if the claim is excluded, the defence costs it generates are excluded. In the analysed policy, there was no “counter-exception” (carve-back) that rescued defence costs from the exclusion of operations on securities. And nothing indicates that it was negotiated.
The contrast with the Full Court doctrine in Judgment 421/2020 is illustrative: there the discussion was about the sufficiency of the sub-limit —a quantitative limit that can degrade into a limiting clause if it is evidently insufficient—; here there is no question of sufficiency, but a total absence of coverage due to the subject matter. And against a clear exclusion, incorporated into a large risk insurance, the theory of surprising clauses that prospered in Judgment 58/2019 has very little room. Fifteen million in limit and, for the criminal investigation, not a euro.
Questions the board should ask before taking out D&O insurance
1. What exactly does the policy exclude regarding securities? Review the exclusion of public or private issues and offers, and any nominal exclusion of past operations.
2. Is there a counter-exception for defence costs? Negotiate that defence costs (including criminal) and bonds continue to be advanced, even if the underlying claim is excluded, with reimbursement if fraud is declared.
3. Is there specific insurance for the issuance? In increases and IPOs, consider a specific issuance policy or an express extension of coverage, always before approving the prospectus.
4. Is the director who has already left protected? Check the extension periods and coverage for former directors: the former president of Popular had left the position months before the claim.
5. Who has reviewed the wording? In large risks, the court will not protect the director against clear wording; the review should be brought to the board or the audit and risk committee, with a report from the broker and an independent advisor.
Conclusion: insurance is negotiated before the issuance, not after the complaint
Judgment STS 1127/2026 does not create a new risk, but makes it visible. If the exclusion is clear and the insurance is for large risks, the courts will apply it as is, without reinterpreting it in favour of the director. And the defence, which in a criminal case is the most urgent, follows the same fate as the excluded claim. A director of a listed company who votes for a capital increase assumes personal liability that the law expressly attributes to them. Reviewing the policy before that vote is not a technical matter that can be delegated lightly: it is part of the diligence of an orderly businessman required by Article 225 LSC. Fifteen million in limit is worthless if, for the criminal investigation, there is not a single euro.
Notes
[1] Arts. 236.3, 237, 238, 241, 241 bis and 367 LSC: de facto directors; joint liability and circumstances of exemption; social action; individual action; four-year statute of limitations; and liability for corporate debts in case of dissolution.
[2] In the facts under judgment, Article 38 of Royal Legislative Decree 4/2015, of 23 October, which approves the consolidated text of the Securities Market Act, was in force.
[3] It is worth clarifying a point that is often cited lightly: the regime of legal defence insurance in Articles 76 a) to 76 g) LCS —whose Article 76 b) excludes “the payment of fines and the indemnification of any costs arising from sanctions imposed on the insured by administrative or judicial authorities” — is not applicable to the legal defence carried out by the civil liability insurer in accordance with Article 74, by express mandate of Article 76 g).1.º LCS.
[4] STS 1349/2025, of 30 September: positive definition of risk and clear and correctly incorporated material exclusions. STS 433/2026, of 19 March: subjective perimeter of the insured against the legal entity director. STS 479/2026, of 25 March: legitimisation of a group company as a third party harmed by direct damage and application of interest ex officio under Article 20 LCS.
[5] Article 44, second paragraph, LCS states that the mandate of Article 2 LCS shall not apply to insurance contracts for large risks. The definition of Article 107.2 LCS was repealed by Law 20/2015, and Article 11.c) of Law 20/2015, of 14 July, on the regulation, supervision, and solvency of insurance and reinsurance entities (LOSSEAR), includes civil liability insurance in general when the policyholder exceeds at least two of these three thresholds: €6,200,000 in assets, €12,800,000 in turnover, and 250 employees.
