PROJECT SUN ROCK · POR DERECHO
PD-CAJASIETE-ACCOUNTABILITY-20260918 · updated 18 September 2026

CajaSiete: who decided, what did the bank know, and what trace remains?

Three documentary layers — finance/security over Sun Park–MYND Yaiza, investment and access relationships around Orion, and handling of Communication 6 — now have to be reconciled as one governance, conflict, compliance and traceability question. No single layer proves crime or automatic liability; their convergence requires an independent, attributable review.

Governing BoardAudit & RiskRegulatory ComplianceInternal AuditRiskLaw 2/2023
Documented accountability gap. The located substantive channel responses are presented under the generic institutional identity “Gestor del Canal Cajasiete” or through the automated Ethics Channel platform. As of 18 September 2026, after express requests, the informant has not been told who owned the inadmission/review decision, what conflict analysis was carried out, or what decision/preservation audit trail exists. This does not establish that CajaSiete lacks an internal System Officer; its own website says one has been appointed. It does document an external attribution and explanation gap.
Editorial Cajasiete composite on records and independent verification, asking: if everything was independent, the records should match

Visual already used in the public LinkedIn communication and preserved in the repository. This is an explanatory editorial composition, not documentary photography of an event or CajaSiete premises. The portraits are canonical assets from the private-actor perimeter; the lines do not establish coordination, common knowledge or unlawful conduct. Open the 16 September independent-verification page →

WE ARE NOT ASKING FOR CONFESSIONS. WE ARE ASKING FOR THE FILES.

If everything was independent, the contemporary record should allow that to be reconstructed. If information was incomplete, the record should reveal it. If information failed to reach the right function, traceability should explain why.

1. CajaSiete involvement that is documented

DOCUMENTED · SECURITY

3 October 2023 · Sun Park / HNT

The project's controlled documentary register identifies CajaSiete mortgage charges over several former Sun Park properties later associated with Hotel New Trend / MYND Yaiza.

Still open: borrower, cash principal, instrument, valuation, purpose, approving body, drawdowns, additional collateral and full perimeter.

DOCUMENTED · ORION

Investment and corporate access

Public Orion documents record a CajaSiete shareholding at dated points and a historical right to attend the board with voice but without vote. The Acosta Matos perimeter also appears in Orion's structure.

Equity, lending and information access must be analysed separately; none alone proves unlawful coordination.

DOCUMENTED · CANARY FINANCE

Public debt / RIC

Canary Government material preserved in the repository lists CajaSiete among financial institutions in financing/debt operations across several years, including RIC routes. This broadens the institutional map but does not prove those public-finance operations funded Sun Park.

DOCUMENTED · ETHICS CHANNEL

Substantive decisions without a named personal signatory

The bank gave independence/conflict assurances in December 2025; Communication 6 was received in April 2026, rejected on 28 April with announced destruction, and that decision was reaffirmed on 18 September after further official CNMV material.

The latest response still does not identify the decision owner or explain the requested conflict and traceability controls.

2. Ethics Channel accountability chronology

Prior request for independence and conflict assurances

Gil Marer asked for confirmation of case opening, independence, absence of conflict, confidentiality and protection before providing the structured evidence. Native private source retained; public-safe derivative only.

CajaSiete promises independence, traceability and recusal/reassignment

“Gestor del Canal Cajasiete” directed the informant to the Internal Information System and said the Criminal Compliance Body/channel managers acted independently; if a potential conflict were identified, recusal/reassignment measures would be used.

Communication 6 received

The Ethics Channel platform confirmed receipt and assigned an identifier. No access credential is published here.

Inadmission + announced destruction

The platform stated inadmission reasons including public information/rumour, a possible personal conflict outside the organisation, scope exclusion and inability to investigate; it said the information would be destroyed under applicable rules. The notice does not prove actual destruction or its scope.

Official CNMV material and traceability questions added

Two official CNMV documents were supplied and CajaSiete was expressly asked to identify the independent reviewing function, the incorporation reference, conflict analysis, and lawful preservation/anonymisation/deletion position.

Reaffirmation: “no change” to April decision

“Gestor del Canal Cajasiete” said the additional documentation had been incorporated and did not alter the April outcome, and that the material remained registered with confidentiality/restricted access. It did not identify the decision owner, answer the requested conflict-control question, or describe the decision/preservation audit trail.

3. The institutional-liability question is finite and testable

No presumption of guilt is required. The test is whether CajaSiete's own financial/corporate exposure required a different independent review; whether inadmission prevented examination of facts relevant to the bank's own relationships; who took that decision; what each function knew at each date; and what the bank did after notice.
TestQuestion to be answered from records
KnowledgeWhat title, litigation, Insolvency 36/2012, actor, valuation and operating information did CajaSiete have when each facility/security decision was made?
ConflictDid HNT/CAM finance, Orion equity/access or other relationships require recusal, reassignment or a distinct independent second line when Communication 6 arrived?
DecisionWho classified, proposed and approved the 28 April inadmission and 18 September review/reaffirmation?
Document baseWhat was actually reviewed, and what individualised reasoning supported each inadmission ground?
PreservationWhat was retained, transferred, anonymised or deleted; when; by whom; on what basis; and what audit metadata remain?
Post-notice conductAfter notice, what risk, compliance, related-party, credit, valuation or governance checks were performed and with what result?
Benefit/lossWhat facilities, security, interest, fees, equity or economic exposure are actually linked by date and instrument? Association is not unlawful benefit.

3A. One chronology, different legal-control lanes

Control rule: RIC, RICPE/CNMV, Regional Incentives and ERDF are not the same funding source or legal regime. Their coexistence does not establish double funding, fraud or money laundering. The narrower CajaSiete question is what the bank knew about each layer when it took exposure, accepted security or received later alerts, and how that information was reconciled across credit, risk, compliance, AML and governance.
LaneExisting fact/controlBounded CajaSiete questionPublic reference
RIC / taxRIC is a tax incentive governed by materialisation, financing and aid-accumulation rules; associated aid/incentives must be reported under the applicable regime.Where material to the transaction, did the credit/KYC file identify the origin and structure of RIC capital or other aid/incentives funding the same project, and reconcile them with debt, own funds and security?Law 19/1994 · RD 1758/2007
RICPE / CNMVThe public record documents Sun Park/MYND as a RICPE project and CNMV activity; the 22 January 2026 response defines documents not found among material obtained in those supervisory actions.Were CajaSiete's own Orion relationships and later HNT/MYND security layer identified in the conflict/independence analysis when Communication 6 and the new CNMV material were reviewed?CNMV/RICPE · RICPE/Sun Park
Regional IncentivesPublic file GC/836/P06 identifies investment, grant and employment figures; the complete file, payments, eligible costs, other aid and controls remain reconciliation targets.If the grant was material to project finance, works, valuation, covenants or repayment, what information entered underwriting and what check was made on other finance/aid sources?GC/836/P06 · Directorate-General for European Funds
ERDFThe public project record identifies an ERDF layer, while the exact programme, operation, percentage, certified expenditure, payments, audits and corrections remain open.Did the bank file record the existence and scope of ERDF support if material to finance, works or valuation? If not, was this revisited after the alerts?ERDF / SNCA · RIC–incentives–ERDF chain
Prudential governanceLaw 10/2014 requires clear responsibility lines, risk identification/control/communication, adequate internal controls and conflict prevention; the Board is accountable for the system's effectiveness.Which body owns this review, which control functions acted, and what remediation follows if a routing, conflict or control weakness is identified?Law 10/2014, art. 29 · Banco de España
AMLLaw 10/2010 requires a written special examination of facts or transactions that are complex, unusual or present indicators of simulation or fraud where the statutory threshold is met.Did AML assess whether the known facts required a special examination under its procedures? No confirmation of any SEPBLAC report is requested or should be disclosed, because tipping-off is prohibited.Law 10/2010, arts. 17, 18 and 24

3B. Four lawful exits: every one needs a record

EXIT 1

The controls worked

CajaSiete can document what it verified, who verified it, what conflict was ruled out, which body decided and why. That outcome should be reflected faithfully in the public record.

EXIT 2

It received incomplete or incorrect information

Identify what was missing or wrong, when it was detected, its impact and what correction/escalation follows. That does not automatically make the bank responsible for information it received.

EXIT 3

Routing or control failed

Identify why information did not reach the proper function, preserve the trail and correct the process. A routing failure does not by itself establish intent.

EXIT 4

No further action is required

CajaSiete can take that position, but should identify the competent function, the basis applied and the conflict control supporting it. A generic signature does not replace that explanation.

Incentive design, not intimidation. No function is asked to accuse another. Each function records only what it did, what it received, what conflict it assessed and what it escalated. Compatible answers reinforce each other; incompatible answers become objectively testable audit or supervisory questions.

3C. Responsibility by function: one question, one owner

FunctionControl questionDocumentable output
Governing Board / ChairHas the matter been received and have clear responsibility lines, independence and conflict prevention been ensured?Date of knowledge, assigned body, governance action and follow-up.
Audit & Risk CommissionHas it reviewed or assumed oversight of the Ethics Channel handling and connected exposure/risk?Confirmation of review, instructing function and status; confidential minutes are not requested.
Director GeneralHas Compliance, Risk, AML, Internal Audit and Legal received the parts within their mandates?Routing map and institutional owner.
Regulatory ComplianceWhat compliance/conflict risk was identified and how was independence preserved?Conflict analysis, recusal/reassignment and bounded conclusion.
RiskWhat title, valuation, borrower, security, material finance/support sources and litigation were recorded when exposure was approved or monitored?Confirmation of internal reconciliation without disclosing third-party bank secrecy.
Global Risk ControlDid the second line validate consistency across credit, valuation, security, related parties and new adverse information?Independent test and any remediation.
AMLWas it assessed whether known facts triggered the internal special-examination duty?Confirmation that the relevant procedure was applied, without disclosing protected SEPBLAC communications.
Internal AuditCan it reconstruct who accessed, classified, decided, retained, anonymised or deleted?Audit trail and design/effectiveness test.
LegalWhat procedure, legal basis and confidentiality limits were applied?Procedure version, legal basis and lawful preservation.
Institutional RelationsWas the notice distributed intact to the competent functions?Delivery/routing confirmation; no merits decision is attributed to this function.

4. The law requires an owner of responsibility

LAW 2/2023 · ART. 8

System Officer

The governing body appoints a natural person responsible for the Internal Information System; if a collegiate body is used, one member must be delegated management and investigation powers. Appointments/removals are notified to the competent authority.

Consolidated BOE text

LAW 2/2023 · ART. 26

Information register

Obliged entities must keep a confidential register of reports and resulting internal investigations. It is not public; the public question here is decision ownership and traceability, not indiscriminate access to protected data.

LAW 2/2023 · ART. 32

Data, access and retention

The statute limits access and provides for deletion/anonymisation under conditions. Deleting personal/report data and erasing responsibility traceability are not the same proposition.

CAJASIETE · PUBLIC STATEMENT

The bank says a System Officer exists

CajaSiete states publicly that it has appointed a Responsable del Sistema Interno de Información and that its channel managers include the Technical Criminal Compliance Unit.

CajaSiete Ethics Channel · Criminal compliance

5. Escalation to identifiable governance

CajaSiete's own published composition allows the issue to be directed to identifiable governance and control functions without assuming that any listed person participated in the historic events or channel decision.

Internal competence published by the bank itself. The Audit & Risk Commission regulation assigns the Commission regulatory-compliance oversight, investigation of irregular conduct and third-party complaints and, expressly, responsibility for the Ethics Channel and decisions on files arising from valid reports that have undergone investigation. It provides for technical support in the investigation phase from the Ethics & Conduct Committee and Internal Audit. Communication 6 can therefore be escalated to an identifiable, auditable governance function; a generic channel signature does not exhaust that accountability architecture.

Audit & Risk Commission regulation · published last review 24/03/2025

Manuel del Castillo González
Chair · Governing Board
María Dolores Pérez Martínez
Chair · Audit & Risk Commission
Samuel Cruz Palenzuela
Secretary · Audit & Risk Commission
Belinda Anta Jiménez
Member · Audit & Risk Commission
Luis Alberto Díaz Dorta
Director General
María Coromoto Trujillo Pérez
Director of Regulatory Compliance
Sara González Febles
Director of Internal Audit
Juan Miguel López Luis
Director of Risk
Miguel Ángel Rivero Romero
Director of Global Risk Control
Juan Alberto González Dorta
Director of Legal
José Manuel Garrido García
Director of Institutional Relations

CajaSiete published composition · December 2025

6. Actions requested from the Board, Audit & Risk, Compliance and Internal Audit

  1. Governing Board: confirm receipt and assign an institutional owner for this review, insulated from relevant commercial exposure.
  2. Audit & Risk Commission: open a governance review of Communication 6 and the 18 September response, recording conclusions and remedial measures in minutes.
  3. System Officer / Compliance: confirm whether the RSII is an individual or collegiate body; confirm appointment notification to the competent authority; identify at least the function/person with decision responsibility or state the specific legal basis for withholding identity.
  4. Conflicts: document what conflict check occurred before inadmission and whether recusal/reassignment was considered under the 10 December 2025 assurance.
  5. Internal Audit: verify the audit trail for receipt, access, classification, assessment, decision, communications, retention, anonymisation and any deletion.
  6. Risk: reconstruct relevant CajaSiete exposures concerning Sun Park/HNT/MYND, Orion and related perimeters by instrument, date, borrower, collateral, valuation, approver, related parties, drawdown and repayment.
  7. Legal: identify the internal procedure/version applied to Communication 6 and the basis for each inadmission ground and any destruction/anonymisation.
  8. Preservation: lawfully retain metadata, logs, minutes, conflict checks, reassignments, decisions and cross-references; this does not ask the bank to retain data whose deletion is legally mandatory.
  9. Response: issue one attributable, documented response distinguishing facts, confidentiality limits, decisions and open points.

7. Reserved external routes

Independent Whistleblower Protection Authority

For Internal Information System, System Officer and Law 2/2023 guarantee issues, subject to explicit competence determination where required.

AIPI

Banco de España

CajaSiete is listed as credit institution ES3076. The prudential issue would be governance, internal control, compliance independence, conflicts and traceability—not transforming a private dispute into a supervisory conclusion.

BdE register

ECB / SSM

Reserved where facts engage EU prudential rules or warrant additional supervisory routing. This page does not assert material jurisdiction over every allegation.

Criminal / insolvency authorities

Any criminal, insolvency or recovery relevance depends on individualised acts, knowledge, duty, causation, benefit/loss and admissible evidence. This page is not a complaint or adjudication.

8. Evidence boundaries and correction right

This page does not say: CajaSiete funded the original 2018 acquisition; a mortgage charge equals cash drawn; every Board member knew the report; announced destruction actually occurred; or equity, lending or institutional proximity by itself proves intent or crime.

It does document this question: financial/corporate exposure, receipt of an alert touching that same environment, and later substantive decisions communicated without externally identifying the decision owner or explaining the requested conflict and traceability controls. That calls for a governance response, not another anonymous response.

Control sources and links