Spain’s Crypto Licensing Landscape
Spain authorises crypto-asset service providers under MiCA, with the CNMV as competent authority for CASPs and the Banco de España supervising issuers of asset-referenced and e-money tokens. The headline advantage is market size: roughly 48 million people with high crypto adoption by EU standards, plus a Spanish-language bridge to Latin America, and full Article 65 passporting across the EEA. The trade-off is process maturity. The CNMV granted its first authorisations only in 2025, and by mid-2026 only a handful of providers held authorisation; the regulator extended its transitional window to the EU maximum rather than force a market exit.
The CNMV has authorised only a handful of CASPs as of mid-2026; a direct Spanish route adds 9+ months to your timeline. Under MiCA Article 65, a CASP authorised in any EEA member state serves Spanish clients on identical regulatory terms, often 4-6 months faster — the market is reachable without a Spanish authorisation, and speed frequently trumps domestic branding for operators prioritising go-live.
Regulatory Framework
MiCA, Regulation (EU) 2023/1114, applies directly without national transposition; the national anchor designating the competent authorities is Law 6/2023 of 17 March on Securities Markets and Investment Services (the new Ley del Mercado de Valores, LMV). SEPBLAC retains a parallel AML/CFT supervisory role under Law 10/2010. A CASP authorisation is indefinite (no renewal) and subject to ongoing prudential, governance and conduct obligations. See the consolidated MiCA framework: requirements and timeline →
Spain’s pre-MiCA framework was AML-based, not a licensing regime: Royal Decree-Law 7/2021 created a Banco de España registry of virtual currency providers covering fiat-to-crypto exchange and custodian wallets. MiCA became fully applicable on 30 December 2024; from that date the registry stopped accepting new entries and the CNMV began accepting CASP applications.
Regulatory Overlaps
EMI/PSD2: CASPs that issue or handle e-money tokens (EMTs) can trigger PSD2 requirements; the EBA confirmed that EMT custody and transfer can constitute payment services, and dual authorisation (MiCA + PSD2) is required for EMT-related services after 2 March 2026. MiFID II and tokenised securities: crypto-assets that qualify as financial instruments are excluded from MiCA under Article 2(4), so a tokenised share, bond or fund unit follows MiFID II, the Prospectus Regulation and the EU DLT Pilot Regime, Regulation (EU) 2022/858, on ESMA’s substance-over-form test. A Spanish CASP authorisation does not cover them; where the structure is a tokenised fund unit, see our fund licensing page.
Registry to MiCA CASP Transition
Spain is moving from its legacy AML-based virtual currency registry to full MiCA CASP authorisation. Under MiCA Article 143(3), firms already providing crypto-asset services under national law before 30 December 2024 may continue without MiCA authorisation through a grandfathering window set by each member state. In Spain that window runs to 1 July 2026; after that date a CNMV CASP authorisation is mandatory. The registry stopped taking new entries on 30 December 2024 and is now informational only, with no automatic conversion to MiCA status.
Key Deadlines
| Milestone | Date | Impact |
|---|---|---|
| MiCA fully applicable | 30 December 2024 | CASP authorisation available; CNMV begins accepting applications; legacy registry closes to new entries |
| Original accelerated cut-off (announced) | 30 December 2025 | Announced early end of the transition; subsequently abandoned |
| Operative transitional deadline | 1 July 2026 | Legacy registry firms must hold CNMV CASP authorisation to continue |
| Full enforcement | After 1 July 2026 | Unauthorised crypto-asset services in Spain become unlawful |
After 1 July 2026, providing crypto-asset services in Spain without CNMV authorisation (and without a valid passport from another member state) exposes operators to administrative penalties under MiCA Article 111 (fines up to €5,000,000 or 12.5% of annual turnover for legal persons), penalties for directors and officers, advertising-removal orders, and public warnings naming unauthorised entities.
Financial Institutions: Article 60 Notification
Already-authorised financial institutions (credit institutions, investment firms, e-money institutions) need not obtain a separate CASP licence. Under MiCA Article 60 they notify the CNMV of their intention to provide crypto-asset services, supplying a programme of operations and evidence of governance. This pathway is significantly quicker than a fresh authorisation but is open only to entities that already hold a qualifying authorisation; at least one established credit institution reached the Spanish market this way.
Licence Types and Activities Covered
MiCA defines 10 crypto-asset services grouped into 3 classes that set the minimum own-funds requirement; Spain applies these directly without national service categories. Most exchange operators fall into Class 2 or Class 3.
| Class | Service | MiCA Reference | Description |
|---|---|---|---|
| 1 | Reception and transmission of orders | Art. 3(1)(24) | Receiving client orders and routing them to another CASP or trading platform |
| 1 | Providing advice on crypto-assets | Art. 3(1)(25) | Personalised recommendations on crypto-asset transactions |
| 1 | Providing portfolio management | Art. 3(1)(26) | Discretionary management of client crypto-asset portfolios |
| 1 | Execution of orders on behalf of clients | Art. 3(1)(22) | Buying/selling crypto-assets per client instructions |
| 1 | Placing of crypto-assets | Art. 3(1)(23) | Marketing newly issued crypto-assets to investors |
| 1 | Transfer services on behalf of clients | Art. 3(1)(27) | Transferring crypto-assets between addresses on behalf of clients |
| 2 | Custody and administration | Art. 3(1)(17) | Safekeeping crypto-assets and private keys on behalf of clients |
| 2 | Exchange of crypto-assets for funds | Art. 3(1)(20) | Fiat-to-crypto and crypto-to-fiat conversion |
| 2 | Exchange of crypto-assets for other crypto-assets | Art. 3(1)(21) | Crypto-to-crypto conversion |
| 3 | Operation of a trading platform | Art. 3(1)(18) | Operating an exchange matching buy/sell orders from multiple parties |
What Does Not Require CASP Authorisation
Fully decentralised services without an intermediary fall outside MiCA. Non-fungible tokens are excluded under Article 2(3) unless issued in large series, fractionalised, or functioning as a payment or investment instrument: the test is substance-based, so the “NFT” label is not decisive. Crypto-assets that qualify as financial instruments under MiFID II are regulated as securities, not under MiCA. Partially decentralised services with an identifiable intermediary (a DEX with upgrade keys or admin-controlled contracts) remain in scope; the CNMV has published no Spain-specific DeFi guidance beyond the EU framework, so hybrid models should seek pre-application clarification.
Requirements
The binding constraints are capital, governance substance and documentation quality. The CNMV reviews applications thoroughly and the pipeline has been slow, so expect detailed scrutiny of business models, source of funds and ICT resilience; generic MiCA templates adapted from other jurisdictions are not sufficient. A practical constraint is language: the CNMV operates primarily in Spanish, so authorisation materials and ongoing supervisory correspondence are best handled by Spanish-speaking compliance personnel rather than one-off translation.
| Requirement | Detail |
|---|---|
| Entity type | Spanish legal entity (commonly an SL, Sociedad Limitada, or SA) registered with the Registro Mercantil |
| Minimum own-funds (Class 1) | €50,000 |
| Minimum own-funds (Class 2) | €125,000 |
| Minimum own-funds (Class 3) | €150,000 |
| Ongoing own-funds formula | Higher of: permanent minimum per class OR one quarter of the preceding year’s fixed overheads (MiCA Article 67) |
| Prudential safeguard form | Own funds, a qualifying insurance policy, or a combination (MiCA Annex IV) |
| Management body | Fit-and-proper assessment of directors and key function holders; the CNMV expects at least two persons effectively directing the business (a four-eyes convention) |
| AML function | Designated AML officer; SEPBLAC reporting and KYC/transaction-monitoring systems under Law 10/2010 |
| Local presence | Registered office and central administration in Spain; effective direction from Spain; letterbox structures not accepted |
| Foreign ownership | 100% foreign ownership permitted |
| Qualifying shareholders | All holders of 10%+ capital/voting rights undergo fit-and-proper assessment with source-of-funds verification |
Fit-and-Proper and Local Substance
The CNMV evaluates directors, senior managers, qualifying shareholders and key function holders against MiCA’s fit-and-proper criteria: qualifications and experience, reputation and integrity, financial soundness, and the collective knowledge of the management body. Demonstrating the legitimate origin of owners’ capital is central, and weak source-of-funds documentation is a common cause of delay across EU CASP applications. Spain also requires genuine local substance: a registered office and central administration in Spain, effectively directed by at least two persons; virtual-office and letterbox arrangements are not accepted.
AML/CFT and Travel Rule
Spain’s AML framework is governed by Law 10/2010, supervised by SEPBLAC. The EU’s Transfer of Funds Regulation Recast (Regulation (EU) 2023/1113) applies directly: there is no de minimis threshold for CASP-to-CASP transfers, so full originator and beneficiary information must accompany every crypto transfer. For transfers above €1,000 to or from an unhosted address, the CASP must verify the customer’s ownership or control. Sanctions screening must cover EU and UN lists; suspicious transactions are reported to SEPBLAC.
Application Process
Once a complete application is filed, MiCA Article 63 gives the CNMV 25 working days to confirm completeness and 40 working days for substantive assessment, with the clock paused while it awaits requested information (applicants respond within 10 working days). The statutory assessment is therefore roughly 65 working days excluding stop-the-clock periods, but the preparation phase typically takes two to three months before filing, so the realistic end-to-end timeline is 5–9 months. Most elapsed time goes on compliance documentation and CNMV information requests, neither of which can be accelerated with generic templates.
Stage 1 3–6 weeks
Entity Formation and Capital
Incorporate a Spanish entity (commonly an SL) through a notary and the Registro Mercantil, and obtain a tax identification number (NIF). Arrange the minimum own-funds (€50,000–€150,000) or a qualifying insurance policy per MiCA Annex IV. Appoint the management body (at least two persons effectively directing the business), designate an AML officer, and establish the registered office in Spain.
Stage 2 8–12 weeks
Compliance Documentation
Draft the full compliance suite required under MiCA Article 62 and Commission Delegated Regulation (EU) 2025/305: AML/CFT policy manual (aligned to Law 10/2010 and SEPBLAC), enterprise-wide risk assessment, sanctions screening, transaction monitoring, Travel Rule implementation, KYC/CDD procedures, business continuity, DORA/ICT risk management, cybersecurity, complaints handling, conflicts of interest, and a wind-down plan. Each document must be bespoke to the business model.
Stage 3 2–4 weeks (parallel)
Banking Setup
Open a corporate account with a credit institution. MiCA Article 70 requires client funds to be deposited with a credit institution in a segregated account by end of next business day: an e-money account does not satisfy this safeguarding requirement.
Stage 4 1 week
Formal Submission
Submit the complete application to the CNMV using the standardised authorisation form and supporting documentation set out in the CNMV applicant manual. Where the business model raises classification questions, clarify them with the CNMV before filing to reduce information-request cycles once the statutory clock begins.
Stage 5 Up to 25 working days
Completeness Assessment
The CNMV verifies that all required documentation has been submitted. If incomplete, additional information is requested and the assessment clock pauses. Poorly prepared applications stall at this stage.
Stage 6 40 working days (plus stop-the-clock)
Substantive Assessment and Decision
The CNMV assesses the application against MiCA’s authorisation criteria, posing questions answered within 10 working days. Authorisation is published in the CNMV register and notified to ESMA for the EU-wide register.
Compliance documentation is the most time-intensive component, typically 8–12 weeks of specialist drafting. This is exactly the kind of filing we manage end-to-end in the jurisdictions we serve.
Taxation
Spain is a standard-rate EU jurisdiction: corporate income tax is 25%, with reduced rates for micro-enterprises and newly created companies, and crypto-asset exchange services are VAT-exempt across the EU under the CJEU Hedqvist ruling. The detail is below.
| Tax | Rate | Crypto Application |
|---|---|---|
| Corporate income tax (standard) | 25% | All CASP profits |
| Micro-enterprise rate | 23% (turnover < €1 million) | Available if the CASP qualifies |
| New company rate | 15% (first 2 profitable years) | Newly created entities |
| Capital gains (individual) | 19% / 21% / 23% / 27% / 28% | Savings-income scale: see bands below |
| General income (mining, staking, salary) | Up to 47% | Mining and staking rewards taxed as general income |
| VAT (IVA) | 21% standard; crypto exchange VAT-exempt | Fiat-to-crypto exchange exempt per Hedqvist ruling |
| Modelo 721 (foreign crypto) | Informational | Required if foreign-platform crypto > €50,000 at year-end |
| Modelo 172 / 173 | Informational | CASP reporting of customer balances and operations to the tax authority |
Reporting
Individual crypto capital gains are taxed in the savings base (base del ahorro) on a progressive scale to 28% (see table), while mining, staking, salary and certain DeFi yield are treated as general income, taxable at marginal rates to roughly 47% depending on the autonomous community. Residents holding crypto on foreign platforms worth more than €50,000 at year-end file the informational Modelo 721, and Spanish CASPs report customer balances via Modelo 172 and 173. Spain is implementing the DAC8 Directive (the OECD Crypto-Asset Reporting Framework in EU law): data collection from 2026, first reporting in 2027.
Ongoing Compliance & DORA
Authorisation is indefinite (no renewal) but the post-authorisation burden is substantial. CASPs must maintain the organisational structure, capital adequacy and documentation quality that secured the authorisation, file periodic prudential reporting to the CNMV, meet AML reporting to SEPBLAC, and comply fully with DORA. Enforcement powers under MiCA Article 111 run to fines, public statements naming the entity and breach, withdrawal of authorisation and suspension of services. Spain also runs a notably active crypto-advertising regime: under Article 247 of the LMV and CNMV Circular 1/2022 the regulator supervises mass campaigns and influencer promotions and can order non-compliant advertisements removed, and marketing into Spain must comply regardless of where the CASP is authorised.
DORA and ICT Resilience
DORA (Regulation (EU) 2022/2554) applies to all MiCA-authorised CASPs and has been in force since 17 January 2025, enforced by the CNMV for the CASPs it supervises. Its five pillars are ICT risk management, incident reporting, resilience testing, third-party ICT risk management and information sharing. Major incidents must be notified within 4 hours of classification as major, with an intermediate report at 72 hours and a final report one month later. Threat-led penetration testing applies only to entities the CNMV designates as significant. CASPs providing custody must also maintain segregated hot/cold wallet architectures, multi-signature authorisation and documented key management.
Banking
Banking is a supporting consideration here, but a decisive one. MiCA Article 70 creates a two-tier requirement: an operational account for day-to-day flows, plus a credit-institution account for client-fund safeguarding, where client funds must be deposited in a segregated account by end of next business day. An e-money account does not satisfy the safeguarding obligation, and credit-institution onboarding is the harder and slower of the two.
Spanish and EU credit institutions apply lengthy enhanced due diligence to crypto businesses, so budget two to four months for the safeguarding account and begin in parallel with the authorisation. An operator serving Spanish clients by passport faces the same Article 70 obligation but can satisfy it through a credit-institution relationship in its home jurisdiction, so banking depth is a legitimate jurisdiction-selection criterion. Where we deliver a licence, we help arrange the supporting banking with a licensed EU credit institution alongside it. Banking for licensed crypto operators →
EU Passporting & International Standing
Spain appears on no FATF list and has never been grey- or black-listed; as an EU member state it is also outside the EU list of high-risk third countries. It is a founding FATF member, within scope of the EU’s new AML package (the Anti-Money Laundering Regulation and the new authority, AMLA). For a crypto operator, a CNMV authorisation is a reputable, EU-grade credential with no watchlist baggage.
MiCA passporting is the headline commercial value of any CASP authorisation. Under Article 65 a CASP notifies its home regulator of cross-border services or a branch, and no separate authorisation, capital or waiting period is required from host countries, which cannot block either route except in extraordinary circumstances. The passport covers the full EEA, including Iceland, Liechtenstein and Norway; the UK, Switzerland and Gibraltar sit outside it. This is why the Spanish market is reachable without a Spanish authorisation: a CASP authorised in any EEA member state serves Spanish clients on identical terms to a Spanish-authorised provider.
Spain vs. Routes We Deliver
Because the same passport reaches Spanish clients from any EEA member state, the practical question is rarely “Spain or nothing” but which jurisdiction authorises fastest and most cost-effectively, then passports in. The jurisdictions below are ones we deliver end-to-end; all passport into Spain, and several authorise faster than the CNMV currently does.
| Factor | Spain | Lithuania | Cyprus | Malta | Poland |
|---|---|---|---|---|---|
| Licence Type | MiCA CASP | MiCA CASP | MiCA CASP | MiCA CASP | MiCA CASP |
| Regulator | CNMV | Bank of Lithuania | CySEC | MFSA | KNF |
| Delivered by us | Yes (via passport) | Yes | Yes | Yes | Yes |
| Timeline | 5–9 months (slow pipeline) | 4–8 months | 4–8 months | 9–18 months | 4–8 months |
| Min. Capital | €50,000–€150,000 | €50,000–€150,000 | €50,000–€150,000 | €50,000–€150,000 | €50,000–€150,000 |
| Corporate Tax | 25% / 23% micro / 15% new | 17% standard / 7% small | 12.5% standard | ~5% effective (refund system) | 19% / 9% small |
| Working language | Spanish | Lithuanian | English | English | Polish |
| EU Passporting | Yes | Yes | Yes | Yes | Yes |
| Best For | Domestic Spanish brand presence | Cost-conscious EU access; fintech ecosystem | English-language EU base; fund proximity | Established exchanges; English operations | Central-European base; large home market |
The key point: Spain’s main draw is domestic brand presence in a large market, not regulatory speed or cost. We deliver end-to-end crypto licensing in Lithuania, Cyprus, Malta, Poland, Gibraltar and Switzerland: we form the company, file and manage the application, deal with the regulator directly and arrange the supporting banking, each with Article 65 passporting into Spain. We do that work ourselves, through specialists we vet and control, and we stand behind the outcome.
Reach the Spanish market faster
We deliver MiCA CASP authorisation in jurisdictions with a faster, English-language process, then passport into Spain under Article 65: the same clients, a shorter path. Book a free consultation and we will map the fastest route to your Spanish clients.
Common Mistakes With the Spanish Regime
Most errors around Spain are strategic rather than procedural.
- Relying on the abandoned 30 December 2025 deadline. The operative transitional deadline is 1 July 2026; planning around the withdrawn date leads to premature wind-downs or false comfort.
- Assuming a Spanish authorisation is required to serve Spanish clients. A CASP authorised in any EEA member state passports in under Article 65, often faster and cheaper than a direct CNMV authorisation.
- Treating the legacy registry as a licence. The registry is an AML measure, now informational only; entries buy time during the transition but are not authorisations and do not convert to MiCA status.
- Underestimating the Spanish-language process. Applicants without Spanish-language compliance capability face slower drafting and correspondence and more information-request cycles.
- Inadequate source-of-funds evidence. Qualifying shareholders (10%+) must evidence the legitimate origin of capital in depth: tax returns and a multi-year record, not a single certificate.
- Ignoring the advertising regime. Spain supervises crypto advertising, including influencer campaigns, under Article 247 of the LMV and CNMV Circular 1/2022, regardless of where the CASP is authorised.
Frequently Asked Questions
Which authority issues crypto licences in Spain?
The Comisión Nacional del Mercado de Valores (CNMV) is the competent authority for authorising and supervising crypto-asset service providers (CASPs) under MiCA in Spain, designated by Law 6/2023. The Banco de España supervises issuers of asset-referenced and e-money tokens, and AML/CFT supervision sits with SEPBLAC under Law 10/2010.
When does Spain’s MiCA transitional period end?
On 1 July 2026. Spain initially announced an accelerated end date of 30 December 2025 but reversed it, aligning with the maximum 18-month grandfathering window because so few CASPs had been authorised. Firms in the legacy Banco de España registry may continue without MiCA authorisation until that date, after which a CNMV CASP authorisation is required; the registry is now informational only and does not convert to MiCA status.
What is the minimum capital requirement for a Spanish MiCA CASP?
Spain applies MiCA’s own-funds requirements (Annex IV) directly: €50,000 for Class 1 services, €125,000 for Class 2, and €150,000 for Class 3. The ongoing obligation is the higher of the permanent minimum or one quarter of the preceding year’s fixed overheads, met with own funds, a qualifying insurance policy, or a combination.
Does DORA apply to Spanish CASPs?
Yes. DORA (Regulation (EU) 2022/2554) has been applicable since 17 January 2025 and includes CASPs authorised under MiCA. Spanish CASPs must comply with all five pillars: ICT risk management, incident reporting (initial notification within 4 hours of classification as major), resilience testing, third-party ICT risk management and information sharing. The CNMV is the enforcement authority for the CASPs it supervises.
Does Tomberg & Partners deliver crypto licensing in Spain?
Yes. We deliver crypto licensing for operators targeting Spain via a MiCA CASP authorisation in a jurisdiction we file in — Lithuania, Cyprus, Malta, Gibraltar or Poland — passported into Spain under Article 65 without a separate Spanish authorisation. We form the company, file and manage the application, deal with the regulator directly, and stand behind the outcome. Book a free consultation and we will advise on the best route.
Targeting Spain? Authorise where we deliver.
We deliver crypto licences end-to-end in EU jurisdictions that passport into the Spanish market under Article 65. Book a free consultation and we will advise on your options and map the fastest route to your Spanish clients.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Resources
- Cyprus CASP Licensing: English-language MiCA authorisation that passports into Spain
- Lithuania CASP Licensing: cost-competitive MiCA authorisation with a deep fintech ecosystem
- Malta CASP Licensing: established English-language crypto centre
- Poland CASP Licensing: central-European MiCA base with a large home market
- European Company Formation: EU and EEA entity formation for MiCA passporting
- MiCA / CASP Licensing: the EU framework, requirements and timeline