Why Choose Portugal for Crypto Licensing?
Portugal is an EU member state offering MiCA CASP authorisation with full EEA passporting, a deep crypto-user base, and a long-standing tax position that exempts long-term holdings. It implemented MiCA late: Law No. 69/2025, published 22 December 2025, designated the supervisors.[1] Portugal applies MiCA’s prudential-safeguard floors of €50,000–€150,000 directly, without national overlays. Around 10 entities held the legacy Banco de Portugal VASP registration before MiCA.[2]
Full MiCA Passporting
A Portuguese CASP authorisation grants the right to provide crypto-asset services across the EEA through a single notification to the Banco de Portugal under MiCA Article 65.[3] After receiving all Article 65 information, the Banco de Portugal must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP, which may start when it receives that notification or, at the latest, 15 calendar days after it supplied the information. No additional authorisation is required from host-country regulators. Both cross-border service provision and branch establishment are covered.
Portugal applies MiCA’s Annex IV class floors directly: €50,000 for Class 1 services, €125,000 for Class 2, and €150,000 for Class 3. Like Estonia, whose national floors of €100,000–€250,000 ended with its former VASP regime,[4] Portugal imposes no national overlay.
For MiCA CASPs, prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).
Favourable Individual Tax on Long-Term Holdings
Portugal’s personal tax treatment of crypto is among the most generous in the EU for buy-and-hold investors. Gains on crypto-assets held by individuals for 365 days or more are exempt from personal income tax; gains on assets held for less than 365 days are taxed at a flat 28% under Category G of the IRS code.[5]
This long-term exemption, in force since 2023, makes Portugal attractive to founders and high-net-worth individuals relocating their personal holdings, though it does not reduce the corporate tax a licensed CASP pays on operating profit. The exemption does not cover crypto-assets that are securities, and it does not apply where the taxpayer or the counterparty is resident outside the EU/EEA and outside any state with which Portugal has a tax treaty or tax information-exchange agreement.[27]
Strong Crypto Adoption and Talent Base
Portugal has built a substantial crypto and Web3 community, concentrated in Lisbon and supported by the digital-nomad visa, the IFICI (NHR 2.0) incentive for skilled inbound professionals, and a low cost of living relative to Western European financial centres.[5] The IFICI regime offers a 20% flat rate on qualifying employment and self-employment income for up to 10 years; investment gains are outside that rate, and only foreign-source income, including capital gains, is exempt.[26]
For a CASP, the practical benefit is access to a motivated, English-speaking talent pool at lower personnel cost than Frankfurt, Paris, or Dublin.
Twin-Peaks Supervision
Portugal supervises CASPs under a twin-peaks model: the Banco de Portugal acts as prudential supervisor and authorising authority, while the CMVM (Comissão do Mercado de Valores Mobiliários) acts as conduct-of-business and market-abuse supervisor.[1] The Banco de Portugal receives and decides every CASP authorisation application, coordinating with the CMVM, which sends a reasoned opinion within 10 or 15 working days only if it sees grounds against a favourable decision. For applicants, this means a single submission point but two supervisory relationships to maintain after authorisation.
Regulatory Framework
Portugal regulates crypto-asset service providers under the EU’s Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114,[3] which applies directly without national transposition. The national implementing legislation is Law No. 69/2025, published in the Diário da República on .[1]
It establishes a twin-peaks model: the Banco de Portugal is the lead authority for CASP authorisation and prudential supervision, and the CMVM is the conduct and market-abuse supervisor. See the consolidated category page for the MiCA framework: requirements and timeline →
Definition: MiCA CASP Authorisation
MiCA CASP authorisation is the regulatory approval required to provide crypto-asset services within the European Union under Regulation (EU) 2023/1114, other than by an eligible financial entity notifying under Article 60 (Markets in Crypto-Assets Regulation).[3] In Portugal, the Banco de Portugal grants this authorisation under Law No. 69/2025, in coordination with the CMVM. Authorised CASPs hold an indefinite authorisation (no renewal) and are subject to ongoing prudential, governance, and conduct-of-business obligations. Crypto-to-fiat exchange services provided by Portuguese CASPs are VAT-exempt under the CJEU Hedqvist ruling.
Twin-Peaks Regulator Structure
Portugal operates a twin-peaks supervision model for CASPs. The Banco de Portugal is the competent authority for the authorisation of CASPs (Title V, Chapter 1), the acquisition of qualifying holdings (Chapter 4), significant CASPs (Chapter 5), and the prudential, governance, information-to-supervisor, outsourcing, and orderly wind-down provisions (Articles 67–69, 73–74).[1] The CMVM supervises crypto-asset offers (Title II), market abuse (Title VI), and CASPs’ conduct-of-business obligations, safekeeping of clients’ assets, complaints handling, and conflicts of interest (Articles 66, 70–72), and the obligations for specific crypto-asset services (Title V, Chapter 3).[17]
Authorisation applications go to the Banco de Portugal, which forwards them to the CMVM within two working days; the CMVM sends a reasoned opinion only if it sees grounds against a favourable decision.[1][17]
Regulatory History
Portugal’s crypto regulatory history explains the current landscape. The legacy VASP registration regime began on , when Law No. 58/2020 of 31 August transposed the Fifth Anti-Money Laundering Directive (AMLD5) into the AML/CFT Law (Law No. 83/2017).[2][19] From that date, virtual-asset activities in Portugal required prior registration with the Banco de Portugal. The registration procedure was detailed in Notice (Aviso) No. 3/2021 of 23 April.[1]
The legacy regime was AML/CFT-focused only: it screened beneficial owners and AML governance but did not impose MiCA-style capital, prudential, or conduct requirements. Roughly 10 entities completed registration, a much smaller cohort than the hundreds seen in Estonia or Lithuania.
On , the Assembleia da República approved the MiCA implementing law; Law No. 69/2025 was published on , designating the Banco de Portugal and the CMVM as the competent authorities. A separate Law No. 70/2025 transposed the Transfer of Funds Regulation amendments into the AML/CFT Law.[6]
Recent Regulatory Developments
- : National transitional period for legacy VASPs ended on , aligned with the EU-wide MiCA Article 143(3) grandfathering cliff.
- : Law No. 26/2026 of 3 June 2026 transposed DAC8, with annual crypto-asset reports due by 31 May for the preceding year.[21]
- : Bison Bank, a Portuguese credit institution, became the first Portugal-home entry on ESMA’s interim MiCA register (19 May 2026).[23]
- : Law No. 69/2025 (MiCA implementation) and Law No. 70/2025 (TFR/AML amendments) published .[1]
- : Banco de Portugal confirmed (press release, ) that no MiCA competent authority had yet been designated and that it could not accept or assess CASP authorisation applications pending the implementing law.[2]
- : MiCA became fully applicable across the EU on ; Portugal had not yet enacted national implementing legislation.
- : Legacy Banco de Portugal VASP registration regime commenced under Law No. 58/2020.
Regulatory Overlap
EMI/PSD2 overlap: EMT issuance and EMT payment services require separate analysis. The EBA’s non-binding June 2025 opinion treats client EMT transfers and custodial wallets enabling transfers to and from third parties as payment services, while distinguishing exchange and crypto-purchase intermediation. Where PSD2 applies, the relevant services require appropriate PSP authorisation or provision through an authorised PSP under MiCA Article 70(4).[7]
The EBA transition ended on 2 March 2026: its February 2026 opinion advises supervisors to require CASPs without the relevant PSP authorisation or PSP partnership to cease these EMT payment services and offboard their clients, unless the supervisor permits temporary continuation under the pending-application conditions in paragraphs 9 to 12.[29]
MiFID II overlap: Crypto-assets that confer equity-like rights or are negotiable on capital markets are classified as transferable securities under MiFID II, not MiCA, and fall under CMVM securities supervision. ESMA’s technology-neutral guidelines (applicable ) establish a substance-over-form classification test.[8]
AML/CFT overlap: Portuguese CASPs remain subject to the AML/CFT Law (Law No. 83/2017, as amended by Law No. 70/2025) and to supervision for money-laundering purposes. The Travel Rule under the TFR Recast applies directly. CASPs must continue to file suspicious-transaction reports and maintain AML governance alongside their MiCA obligations.
Regulatory Transition: VASP Registration to MiCA CASP Authorisation
Portugal’s transitional window for moving from the legacy Banco de Portugal VASP registration regime to full MiCA CASP authorisation has closed, although the authorisation cohort itself is still working through. Because national implementing legislation (Law No. 69/2025) was published only on , the authorisation process effectively opened in 2026. The national transitional period for legacy VASPs ran to , aligned with the EU-wide MiCA Article 143(3) grandfathering cliff, and that date has now passed.[1]
Key Deadlines
| Milestone | Date | Impact |
|---|---|---|
| MiCA fully applicable (EU-wide) | 30 December 2024 | MiCA in force; Portugal had not yet designated a competent authority |
| Banco de Portugal cannot accept applications | 3 January 2025 | BdP confirms no authority designated; no CASP applications processed |
| Law No. 69/2025 published | 22 December 2025 | BdP/CMVM designated; CASP authorisation route opens |
| VASP grandfathering window | To 1 July 2026 | Registered VASPs (active by 30 Dec 2024) could continue; treated as CASPs for Travel Rule and AML/CFT purposes |
| Transitional cliff | 1 July 2026 | Operating without MiCA authorisation or eligible Article 60 status loses its legal basis[3] |
Transition Mechanics
The grandfathering relief was narrow. It was available only to entities that, as at , were already registered with the Banco de Portugal and had commenced and duly notified the virtual-asset activities for which they were qualified.[1] During the interim period those entities were treated as CASPs for Travel Rule and AML/CFT purposes, while the legacy registration rules continued to apply;[1] the relief lapsed automatically for any entity that had not commenced its notified activity by that cut-off.
With roughly 10 registered VASPs, Portugal’s grandfathered cohort is small; the larger flow is expected to be fresh applicants drawn by the EU passport and the tax position rather than legacy conversions.[18] On ESMA’s interim register of 24 September 2026, the only Portugal-home entry was Bison Bank, a Portuguese credit institution listed from 19 May 2026.[23]
Article 143(3) Transitional Cliff
MiCA Article 143(3) is the EU-wide grandfathering provision: under it, entities that lawfully provided crypto-asset services under national law before could continue until 1 July 2026 or until a CASP authorisation was granted or refused.[3] Member states could shorten this window or remove it; Portugal adopted the full 1 July 2026 horizon. The practical consequence was a hard deadline: an applicant that did not file in time to be decided by 1 July 2026 now has a gap in its legal basis to operate.
Financial Institutions, Article 60 Notification
Certain already-authorised financial entities can provide crypto-asset services without a separate CASP authorisation by notifying under MiCA Article 60, each within set limits: credit institutions (any crypto-asset service), central securities depositories (custody), investment firms (services equivalent to those their MiFID licence covers), e-money institutions (custody and transfer of the e-money tokens they issue), UCITS management companies and AIFMs (portfolio-type services), and market operators (a trading platform). Payment institutions are not eligible.[3] The notification goes to the Banco de Portugal at least 40 working days before the services start, and the Banco de Portugal checks its completeness within 20 working days;[3] it passes the notification to the CMVM within two working days.[1]
License Types and Activities Covered
MiCA defines 10 crypto-asset services grouped into 3 classes that determine capital requirements. Portugal implements MiCA directly without additional national service categories. The classification determines the Annex IV class floor: €50,000 for Class 1, €125,000 for Class 2, and €150,000 for Class 3.
Covered Activities
| Class | Service | MiCA Reference | Description |
|---|---|---|---|
| 1 | Reception and transmission of orders | Art. 3(1)(23) | Receiving client orders and routing them to another CASP or trading platform |
| 1 | Providing advice on crypto-assets | Art. 3(1)(24) | Personalised recommendations on crypto-asset transactions |
| 1 | Providing portfolio management | Art. 3(1)(25) | Discretionary management of client crypto-asset portfolios |
| 1 | Execution of orders on behalf of clients | Art. 3(1)(21) | Buying/selling crypto-assets per client instructions |
| 1 | Placing of crypto-assets | Art. 3(1)(22) | Marketing newly issued crypto-assets to investors |
| 1 | Transfer services on behalf of clients | Art. 3(1)(26) | Transferring crypto-assets between addresses on behalf of clients |
| 2 | Custody and administration | Art. 3(1)(17) | Safekeeping crypto-assets and private keys on behalf of clients |
| 2 | Exchange of crypto-assets for funds | Art. 3(1)(19) | Fiat-to-crypto and crypto-to-fiat conversion |
| 2 | Exchange of crypto-assets for other crypto-assets | Art. 3(1)(20) | Crypto-to-crypto conversion |
| 3 | Operation of a trading platform | Art. 3(1)(18) | Operating an exchange matching buy/sell orders from multiple parties |
What Does NOT Require CASP Authorisation
Services provided in a fully decentralised manner without any intermediary fall outside MiCA’s scope (Recital 22). Unique, non-fungible tokens (NFTs) are excluded, although fractional parts of an NFT are not treated as unique and issuance in a large series or collection is an indicator of fungibility. Crypto-assets that qualify as financial instruments under MiFID II are regulated under existing securities law, not MiCA. Central bank digital currencies (CBDCs), deposits, insurance products, pension products, and securitisation positions are excluded.
DAO, DeFi, and Regulatory Perimeter
MiCA does not explicitly cover decentralised autonomous organisations (DAOs) or DeFi protocols. ESMA has stated that decentralisation exists on a spectrum rather than as a binary classification. Partially decentralised services: such as DEXs with upgrade keys, admin-controlled smart contracts, or governance tokens concentrated among a small group, remain within MiCA’s scope if an identifiable intermediary exists. The Banco de Portugal and the CMVM have not published Portugal-specific guidance on DAOs, DeFi, or decentralised exchanges. Applicants operating hybrid models should seek pre-application engagement with the Banco de Portugal before filing.
NFT Classification
NFTs that are unique and not fungible with other crypto-assets are excluded from MiCA under Article 2(3). Fractional parts of an NFT are not treated as unique and non-fungible, so the exclusion does not cover fractionalised units. Issuance in a large series or collection is an indicator of fungibility to be weighed, not a conclusive test, and a unique token does not lose the exclusion merely because it is traded or accumulated speculatively.
The classification is substance-based: MiCA still applies to a token that looks unique but whose actual features or uses make it fungible or not unique, and labelling a token as “NFT” does not determine its regulatory treatment. A token that qualifies as a financial instrument falls outside MiCA under Article 2(4)(a) and is regulated under securities law instead.
Tokenised Securities and RWA
MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments. A tokenised security, a tokenised share, bond or fund unit, is regulated under MiFID II, the Prospectus Regulation, and the EU DLT Pilot Regime (Regulation (EU) 2022/858), supervised in Portugal by the CMVM, not under MiCA. ESMA’s Guidelines on the qualification of crypto-assets as financial instruments set the boundary. The honest point: a Portuguese MiCA CASP authorisation does not cover tokenised securities or real-world-asset tokens that are financial instruments; those follow the MiFID securities regime. For the fund-tokenisation route, see fund licensing.
Requirements
MiCA CASP authorisation in Portugal requires a Portuguese corporate entity (typically a Lda or S.A.) with its registered office in Portugal, prudential safeguards of at least the higher of the EUR 50,000/125,000/150,000 Annex IV class floor and 25% of previous-year fixed overheads (projected first-12-month overheads for a new firm), met by qualifying own funds, insurance or a comparable guarantee, or a combination, a place of effective management in the EU with at least one EU-resident director, a compliance officer, and a comprehensive compliance documentation suite. All qualifying shareholders (10%+ of capital or voting rights) undergo fit-and-proper assessment.
A practical early consideration is the dual-supervisor relationship. The Banco de Portugal leads authorisation, but the CMVM can object through a reasoned opinion and supervises conduct. Applicants should expect their governance, conduct, and client-asset arrangements to be scrutinised against CMVM standards, not only the prudential standards the Banco de Portugal applies.
| Requirement | Detail |
|---|---|
| Entity type | Portuguese company: Sociedade por Quotas (Lda) or Sociedade Anónima (S.A.) |
| Annex IV class floor (Class 1) | €50,000 |
| Annex IV class floor (Class 2) | €125,000 |
| Annex IV class floor (Class 3) | €150,000 |
| Ongoing prudential-safeguard formula | Higher of: permanent minimum per class OR 25% of fixed overheads of the preceding year (MiCA Article 67); for a firm without a full year of operations, use projected fixed overheads for its first 12 months |
| Management body | Suitability assessed individually and collectively (MiCA Art. 68); no statutory minimum number, two directors (four eyes) usual in practice |
| Compliance officer / MLRO | Required; responsible for AML/CFT and the interface with both supervisors |
| Establishment | Registered office in Portugal; place of effective management in the EU; at least one EU-resident director (MiCA Art. 59(2)) |
| Foreign ownership | 100% foreign ownership permitted |
| Qualifying shareholders | All holders of 10%+ capital/voting rights undergo fit-and-proper assessment with source-of-funds verification |
| Prudential safeguard form | Own funds, qualifying insurance policy, or comparable guarantee (MiCA Article 67) |
Fit-and-Proper Assessment
The Banco de Portugal, with the CMVM’s input, evaluates directors, senior managers, qualifying shareholders, and key function holders against MiCA’s fit-and-proper criteria. Assessment dimensions include: professional qualifications and experience, reputation and integrity (criminal background check, regulatory history), financial soundness (no insolvency or ongoing enforcement), and the collective knowledge of the management body.
Across early MiCA cohorts EU-wide, the most common failure point has been an inability to evidence the legitimate origin of owners’ capital, so source-of-wealth documentation should be prepared from the outset.
Local Presence and Substance
MiCA Article 59(2) sets the substance floor: a CASP authorised in Portugal must have its registered office in Portugal and provide at least part of its services there, have its place of effective management in the Union, and have at least one director resident in the Union.[3] Law No. 69/2025 makes a breach of each of these duties a very serious infringement and adds no Portuguese-residence rule.[1] MiCA Article 68 requires the members of the management body to be of good repute and suitably qualified, individually and collectively, but sets no minimum number of directors; a management body of at least two people (four eyes) is the usual planning assumption, not a statutory rule. In practice, a letterbox entity with management outsourced to another jurisdiction will not satisfy the Banco de Portugal, which assesses whether the organisational structure allows effective supervision, or the CMVM within its conduct remit.
AML/CFT and Travel Rule
Portugal’s AML framework is governed by the AML/CFT Law (Law No. 83/2017, as amended), with the Transfer of Funds Regulation amendments transposed by Law No. 70/2025.[6] The EU’s Transfer of Funds Regulation Recast (Regulation (EU) 2023/1113) applies directly. Critical detail: there is no de minimis threshold for CASP-to-CASP transfers: full originator and beneficiary information must accompany all crypto transfers regardless of amount. The €1,000 threshold applies only to transfers involving self-hosted wallets: when a transfer exceeds €1,000 to or from an unhosted address, the CASP must assess whether its client owns or controls that address.[9]
Sanctions screening must cover EU consolidated sanctions lists (mandatory) and UN sanctions lists (implemented via EU legislation). OFAC screening is not legally mandatory in Portugal but is strongly recommended given extraterritorial reach and correspondent-banking expectations. Suspicious-transaction reports are filed to Portugal’s Financial Intelligence Unit (Unidade de Informação Financeira, UIF) and the DCIAP within the legal deadlines.
Application Process
The Banco de Portugal assesses MiCA CASP applications within the statutory MiCA framework: 25 working days for completeness and 40 working days for substantive assessment (from receipt of the complete application, suspended for up to 20 working days by a written information request made by working day 20),[3] with any CMVM objection due as a reasoned opinion within 10 to 15 working days during the procedure. The realistic end-to-end timeline, from initial preparation through authorisation, is 6–12 months.
There is no established Newcomer-style sandbox dialogue specific to CASPs. Applicants should engage the Banco de Portugal early to confirm expectations, particularly on the CMVM-supervised conduct and client-asset arrangements that sit alongside the prudential file.
Application language: The formal authorisation file is expected in Portuguese; supporting documents (articles of association, internal policies, AML manual, ICT framework) generally require certified Portuguese translations, and applicants should expect Portuguese-language correspondence throughout. Neither the Banco de Portugal nor the CMVM has published a CASP policy permitting an English-language formal application.
Pre-application engagement: As of June 2026 neither the Banco de Portugal nor the CMVM operates a CASP-specific formal pre-application programme, but early contact is advisable to confirm documentation expectations before the statutory clock begins, especially while the first authorisation cohort is being processed. Innovators can also use the Portugal FinLab regulator dialogue channel, which is general rather than CASP-specific.
Entity Formation and Prudential Safeguards
Forming a Portuguese entity is the first step. See the Portugal company formation guide → Incorporate a Lda or S.A. and obtain the corporate registration. Put in place prudential safeguards of at least the higher of the EUR 50,000/125,000/150,000 Annex IV class floor and 25% of previous-year fixed overheads (projected first-12-month overheads for a new firm), met by qualifying own funds, insurance or a comparable guarantee, or a combination; MiCA does not require a separate locked cash deposit. Appoint the management body, with at least one director resident in the EU, and a compliance officer/MLRO. Establish the registered office and a working presence in Portugal.
Compliance Documentation Preparation
Draft the full compliance documentation suite required under MiCA Article 62 and Commission Delegated Regulation (EU) 2025/305. This includes the programme of operations, AML/CFT policy manual, enterprise-wide risk assessment, sanctions screening procedures, transaction monitoring framework, Travel Rule implementation documentation, KYC/CDD procedures, business continuity plan, DORA/ICT risk management framework, cybersecurity policies, complaints handling, conflicts of interest, and wind-down plan. Each document must be bespoke and tailored to the applicant’s business model.
Banking and Payment Infrastructure Setup
Open a corporate account and arrange client-fund safeguarding. Unless the CASP is itself a credit institution, EMI, or payment institution, MiCA Article 70(3) requires client funds other than e-money tokens to be placed with a credit institution or a central bank by the end of the following business day, separately identifiable from the CASP’s own funds: an EMI account does not satisfy this safeguarding rule.[3] Begin banking conversations early, as the safeguarding account is the harder one to obtain.
Pre-Application Engagement
Confirm documentation expectations with the Banco de Portugal and clarify the CMVM’s conduct and client-asset requirements before formal filing. This is especially valuable while the first Portuguese CASP cohort is being assessed.
Formal Application Submission
Submit the complete CASP authorisation application to the Banco de Portugal, which coordinates with the CMVM. The Banco de Portugal charges no fee for the application;[28] the CMVM’s fee schedule sets no charge for crypto-asset service providers as of October 2026.[30]
Completeness Assessment
The Banco de Portugal verifies that all required documentation has been submitted. If incomplete, the Banco de Portugal sets a deadline for the missing information; the 40-working-day assessment runs from receipt of the complete application. This is where poorly prepared applications stall.
Substantive Assessment and Decision
The Banco de Portugal assesses the application against MiCA’s authorisation criteria, with any objection from the CMVM made through a reasoned opinion. A written information request made by working day 20 can suspend the assessment once, for up to 20 working days. Authorisation is published in the Portuguese register and notified to ESMA for inclusion in the EU-wide register.
Required Documents
The Banco de Portugal’s CASP authorisation documentation requirements follow MiCA Article 62 and Commission Delegated Regulation (EU) 2025/305.[10] The application must cover governance, the programme of operations, prudential safeguards, and the full AML/CFT and conduct framework, with the CMVM reviewing the conduct and client-asset elements.
Corporate Documents
Certificate of incorporation of the Portuguese company (Lda or S.A.) from the Commercial Registry. Articles of association (contrato de sociedade). Shareholder register. Evidence of the prudential safeguards under MiCA Article 67 (a bank statement for paid-in own funds, or the insurance policy or guarantee). LEI (Legal Entity Identifier). Proof of the registered office address in Portugal.
Personal Documents (All Directors, Officers, and Qualifying Shareholders)
Valid government-issued photo identification (passport or national ID). Curriculum vitae (CV) with detailed professional history. Criminal record certificates from each country of residence in the past 10 years. Declaration of good repute and absence of pending proceedings. Evidence of professional qualifications, skills, and experience relevant to the role. For qualifying shareholders (10%+): detailed source-of-funds and source-of-wealth documentation, consistently the most scrutinised element in MiCA CASP applications.
Compliance Documentation
The compliance documentation is the most heavily scrutinised component of any Portuguese CASP application, and generic MiCA templates are the single most common cause of application delays. Each document must be bespoke and Portugal-specific, reflecting the applicant’s business model, risk profile, and operational structure, and must satisfy both the Banco de Portugal’s prudential standards and the CMVM’s conduct standards. Templates adapted from other jurisdictions are a common cause of rejection.
For a Portuguese CASP, the AML/CFT policy must comply with the AML/CFT Law (Law No. 83/2017, as amended by Law No. 70/2025) and the Banco de Portugal’s AML supervisory expectations. The manual must include the methodology for customer risk categorisation, enhanced due diligence triggers, PEP screening procedures, and the interface with Portugal’s Financial Intelligence Unit (UIF).
The risk assessment must cover Portugal-specific risks, including cross-border client flows and sectors flagged in Portugal’s national risk assessment, and must align with the AML/CFT Law (Law No. 83/2017). For a Portuguese CASP, the assessment must be dynamic and updated at least annually, and is reviewed by the Banco de Portugal as AML supervisor.
Portuguese CASPs must screen against EU consolidated sanctions lists (mandatory) and UN sanctions lists (mandatory). The procedures must specify screening frequency (real-time for onboarding, ongoing monitoring thereafter), the technical screening solution used, false-positive management, and the asset-freeze notification obligations applicable in Portugal.
The framework must address on-chain analytics capability, thresholds for automated alerts, escalation procedures, and investigator workflows. For a Portuguese CASP, the monitoring must support suspicious-transaction reporting to Portugal’s UIF under the AML/CFT Law.
For a Portuguese CASP, the documentation must specify the messaging protocol (IVMS101, OpenVASP/TRP, or proprietary), the process for assessing whether the client owns or controls a self-hosted address for transfers exceeding €1,000, and interoperability arrangements with counterparty CASPs under the TFR Recast, which applies directly alongside Law No. 70/2025; the thresholds are set out under AML/CFT and Travel Rule above.
For a Portuguese CASP, suspicious-transaction reports are filed to Portugal’s Financial Intelligence Unit (Unidade de Informação Financeira) and, where required, the DCIAP, within the deadlines set by the AML/CFT Law. The procedures must cover staff training, internal escalation, tipping-off prohibitions, and record retention.
For a Portuguese CASP, the procedures must differentiate between individual and institutional clients (KYB), specify document requirements for each risk category, and address remote onboarding technology (video verification, electronic identification). Requirements follow the EU AML directives as transposed in Portugal’s Law No. 83/2017.
The documentation must address all five DORA pillars. Banco de Portugal and the CMVM are DORA competent authorities within their respective supervisory remits. For a CASP supervised by both, Banco de Portugal handles major-incident reporting and sanctions as prudential supervisor. See the ICT Risk Management section below for full details.
MiCA requires CASPs to establish and maintain effective complaints handling procedures. For a Portuguese CASP, this is supervised by the CMVM as conduct authority. The policy must specify response timeframes, escalation procedures, and record-keeping, and must be published on the CASP’s website.
The policy must address conflicts arising from proprietary trading, employee personal dealing, related-party transactions, and incentive structures. For a Portuguese CASP, the CMVM supervises conduct obligations under Article 72 and expects specific procedures for disclosure when conflicts cannot be avoided.
Business Plan and Financial Projections
Programme of operations per MiCA Article 62(2)(d): description of all crypto-asset services to be provided, target markets, client profile, marketing strategy. Three-year financial projections including revenue model, cost base, capital adequacy forecasts, and break-even analysis. Description of the governance structure and internal control mechanisms.
Technology and Operational Documentation
IT architecture documentation. Cybersecurity policy and penetration test reports. Hot/cold wallet management and key management procedures (for custody service providers). Business continuity plan and disaster recovery procedures. Third-party ICT provider register (DORA requirement). Incident response plan for major ICT incidents.
Costs and Pricing
Portugal’s MiCA CASP authorisation costs are structured across three tiers matching MiCA’s service classification. The largest cost components are personnel (a small team at Lisbon salary levels) and the bespoke compliance documentation, with the prudential safeguard (own funds, insurance or a comparable guarantee) held on top. Law No. 69/2025 contains no fee provision, and the Banco de Portugal states that neither the CASP application nor the maintenance of the authorisation has associated costs;[28] the CMVM’s supervision fees are set by ministerial portaria, and the one in force (Portaria 913-I/2003, last amended in January 2022) has no charge for crypto-asset service providers as of October 2026.[30] The build estimates below are indicative planning ranges, priced per case.
Statutory Cost, Year 1
| Statutory charge (EUR) | Low (Class 1) | Mid (Class 2) | High (Class 3) |
|---|---|---|---|
| Banco de Portugal application and maintenance fee | €0 | €0 | €0 |
| CMVM supervision charge | €0 (none in the CMVM fee schedule) | €0 | €0 |
| Statutory cost, Year 1 (known) | €0 | €0 | €0 |
The CMVM’s fee schedule has no charge for crypto-asset service providers as of October 2026; if a new portaria adds one, the figures below will need updating.[30]
Typical Build, Year 1 (Quoted Per Case)
| Cost Component (EUR) | Low (Class 1) | Mid (Class 2) | High (Class 3) |
|---|---|---|---|
| Company formation and registration | €3,000 | €5,000 | €7,000 |
| Legal advisory (application preparation) | €12,000 | €28,000 | €55,000 |
| Compliance documentation (AML/CFT policy suite, risk assessment, Travel Rule, sanctions screening) | €6,000 | €16,000 | €26,000 |
| Technology/ICT documentation (DORA framework, cybersecurity policy, BCP, key management) | €5,000 | €10,000 | €20,000 |
| Personnel (MLRO + compliance + operations, annual) | €42,000 | €84,000 | €130,000 |
| Office and operational costs (annual) | €7,000 | €14,000 | €26,000 |
| External audit (annual) | €5,000 | €10,000 | €15,000 |
| Banking setup | €500 | €1,000 | €2,000 |
| Prudential safeguard if funded as own funds (planning assumption; held, not consumed) | €50,000 | €125,000 | €150,000 |
| Typical build, Year 1 (quoted per case, excl. prudential safeguard) | ~€80,500 | ~€168,000 | ~€281,000 |
| Total cash outlay, Year 1 (build + safeguard if held as own funds; no Banco de Portugal fee to add) | ~€130,500 | ~€293,000 | ~€431,000 |
| Typical build, annual from Year 2 (excl. prudential safeguard) | ~€65,000 | ~€115,000 | ~€185,000 |
Note: The capital row assumes the €50,000–€150,000 prudential safeguard is funded as own funds, which stay on the balance sheet and are not consumed during operations. MiCA Article 67(4) also allows an insurance policy or a comparable guarantee, or a combination, and requires no separate locked cash deposit. The ongoing requirement is the higher of the permanent minimum or 25% of the preceding year’s fixed overheads.[3]
Timeline
| Stage | Duration | Cumulative |
|---|---|---|
| Entity formation and prudential safeguards | 2–6 weeks | 2–6 weeks |
| Compliance documentation preparation | 8–12 weeks | 10–18 weeks |
| Banking and payment infrastructure (parallel) | 2–4 months | Parallel with Stages 2–5 |
| Pre-application engagement | 1–2 weeks | 11–20 weeks |
| Formal application submission | 1 week | 12–21 weeks |
| Completeness assessment | Up to 25 working days | 17–26 weeks |
| Substantive assessment (incl. CMVM opinion) | 40–60 working days | 25–38 weeks |
| Allowance for completing an incomplete file or a delayed safeguarding account (where needed) | Up to 14 weeks (planning estimate) | 25–52 weeks |
| Total (best case to complex) | 6–12 months | 25–52 weeks |
The 6–12 month range covers the preparation phase, the statutory MiCA assessment periods (within which the CMVM gives any reasoned opinion to the Banco de Portugal), and the lead time on a credit-institution safeguarding account; its upper end allows for an incomplete file or banking delays. Applicants who targeted authorisation before the transitional cliff had to treat documentation readiness as the critical path, and the same discipline now applies to closing any gap in legal basis quickly.
As of June 2026 the Banco de Portugal had not published average decision-time statistics for CASP authorisations, so the range above reflects the statutory periods and our planning allowance rather than an observed processing record.
Taxation
Portugal is a moderate-tax EU jurisdiction with a well-known incentive for long-term individual crypto holders, but a standard corporate burden for the CASP itself. The standard corporate income tax (IRC) rate is 19% for financial years beginning in , reduced from 20% in 2025 and on a legislated path toward 17% by 2028.[11]
A preferential 15% rate applies to qualifying SMEs on the first €50,000 of taxable income. Municipal and state surtaxes (derrama) apply on top of the headline rate.
| Tax | Rate | Crypto Application |
|---|---|---|
| Corporate income tax (IRC) | 19% (standard, from ) | All CASP operating profits, before surtaxes |
| SME first bracket | 15% (first €50,000 of taxable income) | Available if the CASP qualifies as an SME |
| Capital gains (individual, held < 365 days) | 28% flat (Category G) | Short-term crypto disposals by individuals |
| Capital gains (individual, held ≥ 365 days) | 0% (exempt) | Long-term holdings; excludes security tokens and counterparties outside the EU/EEA and treaty or information-exchange states |
| VAT | 23% standard; crypto-to-fiat exchange VAT-exempt | Crypto-to-fiat exchange exempt per CJEU Hedqvist ruling |
| Stamp duty on VASP/CASP commissions | 4% | On fees and commissions; borne by the client |
| Stamp duty on gratuitous transfers | 10% | Inheritance/gift transfers of crypto (with exemptions) |
IFICI (NHR 2.0) and Inbound Talent
The Tax Incentive for Scientific Research and Innovation (IFICI), often called NHR 2.0, offers a 20% flat personal income tax rate on qualifying Portuguese employment and self-employment income from eligible activities for up to 10 years.[5] For a CASP recruiting skilled staff into Portugal, IFICI can lower the personal tax burden on key hires. The 20% rate does not extend to investment income: IFICI beneficiaries are exempt on foreign-source income, including capital gains, under the exemption method (income paid from blacklisted jurisdictions is taxed instead), but Portuguese-source trading gains get no relief, and the regime is distinct from the long-term holding exemption described above.[25][26]
DAC8 / CARF Reporting
Portugal, as an EU member state, is bound by the DAC8 Directive (Council Directive (EU) 2023/2226), under which crypto-asset service providers were required to begin collecting reportable data from , with the first reporting expected in 2027 (covering calendar year 2026).[12] DAC8 transposes the OECD Crypto-Asset Reporting Framework (CARF) into EU law.[20]
Portugal transposed DAC8 (and DAC9) through Law No. 26/2026 of 3 June 2026, published in the Diário da República on ; the annual CASP report is due by 31 May each year for the preceding calendar year.[21]
Pillar Two (Global Minimum Tax)
Portugal has transposed the EU Pillar Two Directive (Council Directive (EU) 2022/2523) into domestic law. The OECD Global Minimum Tax applies a 15% effective floor to multinational and large domestic groups with consolidated revenue of €750 million or more in at least two of the four preceding fiscal years: a threshold unlikely to affect standalone Portugal-domiciled CASPs, but relevant to applicants that form part of a large group.
Ongoing Compliance & Post-Registration
MiCA CASP authorisation creates a permanent compliance infrastructure obligation. The authorisation is indefinite (no renewal), but the Banco de Portugal and the CMVM conduct ongoing supervision through reporting, periodic inspections, and incident reporting. Annual ongoing compliance costs range from around €65,000 for a minimal Class 1 operation to €185,000+ for a full-service Class 3 exchange.
Annual Reporting Obligations
CASPs must submit financial statements, capital-adequacy reports, and activity reports to the competent authorities and maintain annual audited financial statements. AML/CFT reporting obligations under Law No. 83/2017 continue alongside the MiCA prudential and conduct reporting. DAC8 reporting on reportable crypto-asset users begins for data collected from , with first reporting in 2027.
As of June 2026 the Banco de Portugal and the CMVM had not published CASP-specific periodic reporting templates or submission deadlines, so applicants should confirm the operational reporting calendar with each supervisor.
Supervision Fees
MiCA authorisation is indefinite: there is no renewal fee. The Banco de Portugal states that maintaining the authorisation has no associated costs;[28] the CMVM’s fee schedule has no charge for crypto-asset service providers as of October 2026.[30]
Regulatory Inspections
The Banco de Portugal and the CMVM conduct both scheduled and unscheduled supervisory inspections within their respective remits. Banco de Portugal reviews focus on prudential soundness, governance, AML/CFT, and operational resilience; CMVM reviews focus on conduct of business, client-asset safekeeping, complaints handling, and market abuse. The twin-peaks model means inspections from either authority can occur independently.
Enforcement
The competent authorities’ enforcement powers under MiCA include:
- For CASP-service breaches classified as very serious under Law No. 69/2025, Article 17: base fines of €25,000–€5,000,000 for legal persons and €4,000–€5,000,000 for natural persons (Article 13).[1]
- For infringements relating to crypto-asset services, the ceiling rises where three times the economic benefit, including avoided losses, or 5% of turnover is higher. The turnover test uses the latest approved accounts, with consolidated group turnover where Article 13(3) applies. Separate infringement classes have different limits.[1]
- Public statements naming the entity and the nature of the breach
- Withdrawal of authorisation
- Temporary prohibition on management functions
- Suspension or limitation of services
Advertising and Promotion Rules
MiCA’s marketing communications regime (Articles 7, 29, 53, and 66) applies directly to Portuguese CASPs, with the CMVM as conduct supervisor.[3] All marketing must be fair, clear, and not misleading. Marketing communications must be identifiable as such and consistent with the published documentation. CASPs are accountable for third-party promotional content, including influencer and social media marketing. Google’s advertising policy accepts ads for cryptocurrency exchanges and software wallets targeting Portugal and other EU states only from advertisers authorised as MiCA CASPs and certified by Google.[24]
ICT Risk Management & Operational Resilience
The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) applies to MiCA-authorised CASPs from .[13] Under Law No. 73/2025, Banco de Portugal and the CMVM are DORA competent authorities within their respective supervisory remits. For a Portuguese CASP supervised by both, Banco de Portugal, as prudential supervisor, receives major ICT incident reports and exercises sanctioning powers, sharing relevant information with the CMVM.[1][22]
Law No. 73/2025, Article 11, sets base fines for DORA breaches in CASP activity of €10,000–€5,000,000 for legal persons and €5,000–€2,500,000 for natural persons. The ceiling rises where three times the economic benefit, including avoided losses, is higher; for legal persons, 10% of turnover under the latest approved consolidated or individual accounts is a further ceiling test. Article 9 halves the maximum for negligent infringements.[22]
Incident Reporting
A Portuguese CASP supervised by both authorities reports major ICT incidents to Banco de Portugal as its prudential supervisor. Banco de Portugal shares the reports and relevant follow-up information with the CMVM.[22] The reporting deadlines are:
| Report | Deadline |
|---|---|
| Initial notification | as early as possible, within 4 hours of classification as major and normally no later than 24 hours after awareness (if classified after that window, within 4 hours of classification) |
| Intermediate report | 72 hours after initial notification |
| Final report | 1 month after latest intermediate report |
Digital Resilience Testing
MiCA-authorised CASPs must conduct general resilience testing under DORA Articles 24–25. Advanced threat-led penetration testing (TLPT) under Articles 26–27 applies only to entities selected by the relevant competent authority using DORA’s impact, financial-stability, and ICT-risk criteria. Selected entities test at least every 3 years unless the competent authority adjusts the interval based on risk and operational circumstances. Microenterprises are excluded from TLPT.[13]
Third-Party ICT Risk
CASPs must maintain a register of all ICT third-party service providers, including cloud providers, blockchain infrastructure providers, and custody technology vendors. Contractual arrangements must include audit rights, termination provisions, and data localisation specifications.
Wallet and Key Management
CASPs providing custody services must implement segregated hot/cold wallet architectures, multi-signature authorisation for material transactions, key generation in secure environments, and documented key backup and recovery procedures.
Banking
Banking access for Portugal-licensed CASPs is moderate to difficult. Domestic Portuguese banks remain cautious about onboarding crypto-asset service providers, and MiCA authorisation improves credibility but does not guarantee acceptance. The constraint is not access to any account: it is access to the right accounts for client-fund safeguarding.
EMIs licensed across the EU and connected to SEPA provide credit-transfer rails for day-to-day payments, reducing dependency on a single domestic banking relationship for payment processing.
The credit-institution relationship is the harder account to obtain. European credit institutions are more receptive to MiCA-authorised entities than to the legacy VASP cohort, but enhanced due diligence remains lengthy. Banking access for Portugal-licensed entities typically requires 2–4 months for safeguarding-account setup, so applicants should begin banking conversations during the application preparation phase rather than after authorisation is granted.
This second relationship, rarely solved with a domestic bank, is the one that decides whether the licence can operate. Learn about crypto business banking →
EU EMIs for operational payments, EEA credit institutions for MiCA Article 70 safeguarding, and SEPA-connected redundancy planned alongside the Banco de Portugal application. Jagelski & Partners introduces an independent banking specialist to assess suitable routes before a licence application is filed. You agree the engagement directly with the specialist; account approval remains the financial institution's decision.
Explore Banking SolutionsFATF Status & International Standing
Portugal does not appear on any FATF list. It is absent from both the FATF list of Jurisdictions under Increased Monitoring (the “grey list”) and the list of High-Risk Jurisdictions subject to a Call for Action (the “black list”), and has never been listed under either. As an EU member state, Portugal is likewise outside the scope of the EU list of high-risk third countries, which by definition covers non-EU jurisdictions only.
Portugal is a full member of the FATF and is assessed directly by it, rather than through a FATF-style regional body. Its fourth-round Mutual Evaluation Report was adopted at the FATF Plenary in and published in , concluding that Portugal has a sound and effective regime for combating money laundering and terrorist financing, while recommending stronger implementation of measures for designated non-financial businesses and professions.[14]
For crypto businesses, the practical significance is reputational comfort: a Portuguese CASP operates from a clean, FATF-member jurisdiction, which eases correspondent-banking and counterparty due diligence relative to grey-listed or offshore alternatives. The legacy VASP registration regime, run by the Banco de Portugal since 2020, was the national response to the FATF and EU virtual-asset standards; the MiCA framework now layers a full prudential and conduct regime on top of that AML foundation.
MiCA Passporting and EU Market Access
MiCA passporting is the headline commercial value of Portuguese CASP authorisation. Under Article 65, a Portuguese CASP notifies the Banco de Portugal of its intention to provide cross-border services or establish a branch in other EEA member states. After receiving all Article 65 information, the Banco de Portugal must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP. The CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the Article 65 information. No separate authorisation or additional capital is required from host countries.[3]
Both routes are covered: freedom to provide services (cross-border without establishment) and right of establishment (opening a branch). Host NCAs cannot block either route except in extraordinary circumstances. A single Portuguese authorisation therefore opens the entire EEA market from a Lisbon base.
The MiCA passport extends across the full EEA. The EEA EFTA states Iceland, Liechtenstein, and Norway sit inside the MiCA passport via EEA Joint Committee Decision No 41/2025 of (with supplementary RTS via JCD 138/2025 of ); three non-EU/non-EEA jurisdictions in geographical Europe sit outside the passport regime, so their own rules decide whether serving local clients needs a local licence or registration: the United Kingdom, Switzerland, and Gibraltar.[15]
Article 61 reverse solicitation is third-country-only and does not apply to a Portuguese-authorised CASP marketing to other EU/EEA Member States: passporting via Article 65 is the operative pathway. The ESMA Guidelines on reverse solicitation () are framed for non-EU operators serving EU clients on a strictly unsolicited basis, with any further same-type marketing confined to the context of the original transaction. See the dedicated reverse solicitation guide for the third-country compliance pattern.[16]
The ESMA Interim MiCA Register has been operational since , published as CSV files updated regularly.[8] A Portuguese CASP authorisation, once granted, is notified to ESMA for inclusion in the EU-wide register.
Advantages and Limitations
Portugal offers a genuine commercial proposition for MiCA CASP authorisation: EU passporting, a generous long-term individual tax position, and a deep crypto community. The limitations set out below are real but manageable.
- Full MiCA passporting across the EEA. A single Portuguese authorisation grants cross-border service provision and branch establishment rights across the 27 EU Member States, reaching Iceland, Liechtenstein, and Norway through EEA Joint Committee Decision No 41/2025.
- MiCA prudential safeguards applied directly, no national overlays. Portugal follows the MiCA Annex IV class floors (€50,000–€150,000) without national buffers. Prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement.
- Long-term individual crypto holdings are tax-exempt. Gains on assets held for 365 days or more are exempt from personal income tax, attractive to founders and high-net-worth relocators.
- Deep crypto community and English-friendly talent. Lisbon hosts a large Web3 ecosystem, and the IFICI incentive and digital-nomad visa support inbound skilled hiring at lower cost than Western European hubs.
- Clean FATF-member jurisdiction. Portugal is a full FATF member, never grey- or black-listed, which eases correspondent-banking and counterparty due diligence.
- Brand-new authorisation route with no track record. The implementing law was published only on 22 December 2025, so there is no settled body of decided CASP applications. Mitigation: Build the application directly to the MiCA RTS standard and engage the Banco de Portugal early to confirm expectations.
- Compressed transitional cliff, now passed. The 1 July 2026 grandfathering deadline left a narrow window for applicants who needed authorisation before then, and that window has now closed. Mitigation: Prioritise documentation readiness as the critical path and file as early as the entity and capital allow.
- Dual-supervisor model increases coordination burden. CASPs must satisfy the Banco de Portugal on prudential matters and the CMVM on conduct and client-asset matters. Mitigation: Appoint compliance staff familiar with both supervisors’ expectations and prepare conduct and client-asset documentation to CMVM standards.
- Banking access remains moderate to difficult. Domestic banks are cautious with crypto, and unless the CASP is itself a credit institution, EMI, or payment institution, MiCA Article 70(3) requires client funds other than e-money tokens to be placed with a credit institution or a central bank, not an EMI. Mitigation: Begin banking conversations during the application preparation phase, not after authorisation.
- Portuguese-language regulatory environment. Regulatory correspondence and filings are expected in Portuguese. Mitigation: Engage Portuguese-speaking compliance counsel and budget for certified translations of supporting documents.
How Portugal Compares
Portugal competes with Spain (the larger Iberian market), Malta (the established crypto centre), and Cyprus (the financial-services hub). Estonia is a common Baltic alternative. Each offers MiCA passporting; the differentiators are timeline, tax, regulatory maturity, and how settled the authorisation route is.
| Factor | Portugal | Spain | Malta | Cyprus |
|---|---|---|---|---|
| Licence Type | MiCA CASP | MiCA CASP | MiCA CASP | MiCA CASP |
| Regulator | Banco de Portugal + CMVM | CNMV | MFSA | CySEC |
| Timeline | 6–12 months | 5–9 months | 9–18 months | 8–14 months |
| Annex IV class floors | €50,000–€150,000 | €50,000–€150,000 | €50,000–€150,000 | €50,000–€150,000 |
| Year 1 budget | €80,500–€281,000 (build; no Banco de Portugal fee) | €103,000–€348,000 (build; CNMV tariff unvalidated) | €490,000–€1,075,000 build; statutory fees additional | €217,000–€462,000 + pro-rata annual fees |
| Corporate Tax | 19% (15% SME first €50k) | 25% (2026: 19–21% micro, 23% small; 15% new company, first 2 profitable periods) | 35% headline; ~5% effective after the 6/7 shareholder refund | 15% (from ) |
| Individual long-term crypto gains | 0% (held ≥ 365 days) | 19%–30% savings-income scale | 0%–35% (case-by-case) | 8% flat (from ) |
| Local Presence | Registered office, EU-resident director (two usual), compliance officer | Office, directors, compliance officer | Office, 2+ directors, company secretary | Office, 2+ directors, compliance officer |
| EU Passporting | Yes | Yes | Yes | Yes |
| Route maturity | New (law in force Dec 2025) | Operational under CNMV | Established (former VFA regime) | Established (CIF/AML track record) |
| Best For | EU access + long-term individual holders; Lisbon ecosystem | Operators targeting the large Spanish market | Established exchanges; English-language operations | Financial-services groups; investment-firm overlap |
For MiCA CASPs, the amounts shown are Annex IV class floors. Prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).
Compare every crypto jurisdiction side by side →
The key difference is: all four apply MiCA capital requirements directly, so the spread is on route maturity and tax. Portugal’s standout is the individual long-term holding exemption, which benefits founders rather than the entity. For the CASP itself, Malta’s low effective rate via the refund system and Cyprus’s 15% headline rate are competitive against Portugal’s 19% IRC. Malta and Cyprus also offer more settled, English-language authorisation routes.
Spain shares the Iberian market and a broadly comparable timeline but carries a higher corporate tax rate (25%), and the CNMV is its only MiCA authority for CASPs (SEPBLAC supervises AML separately), whereas Portugal splits MiCA competence for CASPs between the Banco de Portugal and the CMVM.
Jagelski & Partners scopes your written brief and introduces an independent specialist for Portuguese MiCA CASP authorisation: company formation, the Banco de Portugal authorisation file and CMVM conduct dossier, banking introductions, and post-licensing compliance. If the comparison points you toward Malta, Cyprus, or Estonia, we can scope those routes and introduce a specialist for the selected jurisdiction.
Portugal: a written MiCA CASP scope and specialist introduction
Jagelski & Partners scopes the Banco de Portugal and CMVM route from your written brief, then introduces an independent specialist who runs the application, banking, and ongoing-compliance work. Book a free assessment and we’ll map your route to authorisation now that the 1 July 2026 transitional cliff has passed.
Book a Licensing AssessmentWhen Portugal Is the Right Choice
Choose Portugal if: the priority is EU-wide passporting from a country with strong crypto adoption and an English-friendly business environment; founders or key individuals will benefit from the long-term holding exemption; the team can work to the standard CASP timetable now that the compressed transitional window closed on 1 July 2026.
Consider alternatives if: a settled, English-language authorisation route is a priority (Malta and Cyprus offer track records); lower corporate tax on the entity matters more than individual tax (Cyprus at 15% or Malta’s refund system); the operation reinvests profits and a 0%-on-retained-profits model is preferred (Estonia).
Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.
Common Mistakes in Portugal Applications
Because Portugal’s CASP route is new, the failure patterns are drawn from the EU-wide MiCA experience and the structure of the Portuguese framework rather than a settled local rejection record. The recurring themes are documentation quality, source-of-funds evidence, and underestimating the dual-supervisor and deadline dynamics.
- Treating the legacy VASP registration as a head start. A Banco de Portugal VASP registration was an AML-only screen and does not convert into a CASP authorisation. Grandfathered VASPs must file a full MiCA application; assuming the registration carries over is a costly misread of the 1 July 2026 cliff.
- Inadequate source-of-funds documentation for beneficial owners. Across MiCA cohorts, the most common rejection driver is failure to evidence the legitimate origin of qualifying shareholders’ capital. Tax returns, bank statements, and employment records covering 3–5 years are the starting point, not certificates of deposit alone.
- Preparing only for the prudential supervisor. Applicants often build a strong prudential file for the Banco de Portugal but underweight the conduct, client-asset safekeeping, complaints, and conflicts documentation the CMVM reviews. Both supervisors must be satisfied for authorisation.
- Submitting generic compliance templates. Documentation adapted from other jurisdictions or template libraries does not pass. Each policy must reflect Portuguese law (Law No. 83/2017 for AML, Law No. 70/2025 for the Travel Rule) and the applicant’s specific business model and risk profile.
- Underestimating the compressed timeline. With the implementing law published only on 22 December 2025 and the cliff at 1 July 2026, applicants who delayed entity formation and documentation drafting risked missing the window to be decided in time.
- Failing to begin banking setup in parallel. MiCA Article 70(3) requires client funds other than e-money tokens to be placed with a credit institution or a central bank, unless the CASP is itself a credit institution, EMI, or payment institution, and obtaining that account for a crypto business takes 2–4 months. Banking should commence during the documentation preparation phase, not after authorisation.
Frequently Asked Questions
Portugal operates a twin-peaks model under Law No. 69/2025 of 22 December 2025. The Banco de Portugal (Bank of Portugal) is the lead competent authority for CASP authorisation, prudential supervision, and governance, and receives and decides every authorisation application. The CMVM (Comissão do Mercado de Valores Mobiliários), the securities market regulator, supervises conduct-of-business obligations, the safekeeping of client assets, complaints, conflicts of interest, and market abuse.
During authorisation, if the CMVM sees grounds against a favourable decision, it sends the Banco de Portugal a reasoned opinion within 10 working days on completeness or 15 working days on the grant or refusal; if it does not, it is deemed to have no objection.
Entities registered with the Banco de Portugal as virtual asset service providers that had commenced and duly notified their activity by could continue operating under a grandfathering regime until , or until their MiCA authorisation was granted or refused, whichever came first. During that window they were treated as CASPs for Travel Rule (Regulation (EU) 2023/1113) and AML/CFT purposes, while the legacy registration rules continued to apply.
There was no automatic conversion: every grandfathered VASP that wanted to keep operating from Portugal had to file a full MiCA CASP authorisation application with the Banco de Portugal, unless it was an eligible financial entity notifying under Article 60.[3] Approximately 10 VASPs were registered with the Banco de Portugal.
1 July 2026 was the end of Portugal’s national transitional period for legacy VASPs, set by Law No. 69/2025 and aligned with MiCA Article 143(3). It was also the EU-wide grandfathering cliff: since that date a Portuguese crypto firm must hold MiCA CASP authorisation from the Banco de Portugal, or be an eligible financial entity that has notified under Article 60, to provide crypto-asset services.[3]
Firms that did not obtain authorisation, or did not file in time to be decided, lost their legal basis to operate. Because national implementing legislation was published only in late December 2025, the authorisation window was compressed.
The realistic end-to-end timeline is 6–12 months. The statutory MiCA assessment is 25 working days for completeness and 40 working days for the decision from receipt of the complete application (with one suspension of up to 20 working days),[3] with any CMVM objection due as a reasoned opinion within 10 to 15 working days. The preparation phase (entity formation, prudential safeguards, and bespoke documentation drafting) typically takes 10–18 weeks before filing, and the credit-institution safeguarding account adds lead time; the CMVM’s opinion runs inside the statutory periods. Because the route opened only in late December 2025, there is no settled record of decided cases yet: on ESMA’s interim register of 24 September 2026, the only Portugal-home entry was Bison Bank, a credit institution, listed from 19 May 2026.[23]
Portugal applies MiCA’s prudential safeguards directly, as set in Article 67 and Annex IV: €50,000 for Class 1 services (execution, advice, portfolio management, R&T orders, placing, transfer), €125,000 for Class 2 (adding custody and exchange), and €150,000 for Class 3 (adding operation of a trading platform). The prudential safeguard is the higher of the permanent minimum or one quarter of the preceding year’s fixed overheads, and may be met through own funds, a qualifying insurance policy, or a comparable guarantee. Portugal imposes no national capital overlay above the MiCA minimums.
Since 2023, gains on crypto-assets held by individuals for less than 365 days are taxed at a flat 28% under Category G of the Personal Income Tax Code (IRS). Gains on assets held for 365 days or more are exempt, except for crypto-assets that are securities and for counterparties resident outside the EU/EEA and outside states with a tax treaty or information-exchange agreement with Portugal. Crypto-to-fiat exchange is VAT-exempt following the CJEU Hedqvist ruling.
Commissions and fees charged by VASPs carry a 4% stamp duty borne by clients. Corporate profits are subject to standard corporate income tax (IRC), which is 19% for 2026. The IFICI (NHR 2.0) regime offers a 20% flat rate on qualifying employment and self-employment income; investment gains are outside that rate, and only foreign-source income, including capital gains, is exempt.
Yes. DORA (Regulation (EU) 2022/2554) has been applicable since and explicitly includes CASPs authorised under MiCA. Portuguese CASPs must comply with all five DORA pillars: ICT risk management, incident reporting (initial notification as early as possible, within four hours of classification as major and normally no later than 24 hours after awareness (if classification occurs after that 24-hour window, within four hours of classification)), resilience testing, third-party ICT risk management, and information sharing.
Banco de Portugal and the CMVM are DORA competent authorities within their respective remits. For a CASP supervised by both, Banco de Portugal handles major-incident reporting and sanctions as prudential supervisor, sharing information with the CMVM. TLPT applies only to entities selected under DORA criteria; microenterprises are excluded.
Under the Transfer of Funds Regulation Recast (Regulation (EU) 2023/1113), which applies directly and is complemented in Portugal by Law No. 70/2025, there is no de minimis threshold for CASP-to-CASP transfers: full originator and beneficiary information must accompany every crypto-asset transfer regardless of amount. The €1,000 threshold applies only to transfers involving self-hosted wallets: for transfers exceeding €1,000, the CASP must assess whether the client owns or controls the unhosted address. The dominant messaging standard is IVMS101, transported via protocols including OpenVASP/TRP and TRISA.
No. MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments. A tokenised security, a tokenised share, bond or fund unit, is regulated under MiFID II, the Prospectus Regulation, and the EU DLT Pilot Regime (Regulation (EU) 2022/858), supervised in Portugal by the CMVM, not under MiCA.
ESMA’s Guidelines on the qualification of crypto-assets as financial instruments set the boundary. A Portuguese MiCA CASP authorisation does not cover tokenised securities; real-world-asset tokens that are financial instruments follow the MiFID securities regime. For the fund-tokenisation route, see fund licensing.
Yes. MiCA Article 65 grants a Portuguese CASP the right to provide crypto-asset services across the EEA through a single notification to the Banco de Portugal. Both cross-border service provision and branch establishment are covered. After receiving all Article 65 information, the Banco de Portugal must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP, which may start when it receives that notification or, at the latest, 15 calendar days after it supplied the information. No additional authorisation or capital is required from host-country regulators. The three EEA EFTA states, Iceland, Liechtenstein, and Norway, are inside the MiCA passport via EEA Joint Committee Decision No 41/2025 of 20 February 2025. The Banco de Portugal and the CMVM remain the home supervisors of a passported CASP; host authorities cooperate with them and may take precautionary measures under MiCA Article 102.
Banking access is moderate to difficult. Domestic Portuguese banks remain cautious with crypto businesses, and MiCA authorisation improves credibility but does not guarantee acceptance. Unless the CASP is itself a credit institution, EMI or payment institution, MiCA Article 70(3) requires client funds other than e-money tokens to be placed with a credit institution or a central bank (not an EMI) by the end of the following business day, in an account separately identifiable from the CASP's own. One practical arrangement is a European EMI for operational payments alongside a credit institution for client-fund safeguarding. Operators should begin banking conversations during the application preparation phase.
Start your Portugal CASP application
Jagelski & Partners scopes your written brief and introduces an independent specialist for Portuguese MiCA CASP authorisation: entity formation, the Banco de Portugal and CMVM authorisation, banking, and ongoing compliance. You contract directly with the specialist; our role ends at the introduction. Book a free assessment and we’ll map your route to authorisation now that the 1 July 2026 transitional cliff has passed.
Not ready to submit a brief? Ask Emma first. She answers now and can collect your written brief for a specialist introduction.
References
Show all references
- Law No. 69/2025 of 22 December 2025 (implementing Regulation (EU) 2023/1114 / MiCA in Portugal), Articles 2, 6, 13, 17 and 30, Diário da República, accessed .
- Banco de Portugal, Registration of virtual assets service providers and Virtual assets (legacy VASP regime under Law No. 58/2020 and Notice No. 3/2021; press release of 3 January 2025), bportugal.pt, accessed .
- Regulation (EU) 2023/1114 (Markets in Crypto-Assets Regulation, MiCA), Official Journal of the European Union, EUR-Lex, accessed .
- Estonian FSA (Finantsinspektsioon), Crypto-Asset Service Provider requirements, fi.ee, accessed .
- Global Legal Insights, Blockchain & Cryptocurrency Laws and Regulations 2026 – Portugal (crypto taxation, Category G 28% short-term / exemption over 365 days, stamp duty, IFICI), globallegalinsights.com, accessed .
- Law No. 70/2025 of 22 December 2025 (amending the AML/CFT Law No. 83/2017 to implement the Transfer of Funds Regulation amendments). Summarised in Morais Leitão, Legal Alert: Implementation of the Markets in Crypto-Assets Regulation in Portugal, mlgts.pt, accessed .
- EBA, Opinion on the regulatory treatment of E-Money Token services under MiCA and PSD2 (), eba.europa.eu, accessed .
- ESMA, Guidelines on conditions and criteria for qualification of crypto-assets as financial instruments and the MiCA Interim Register, esma.europa.eu, accessed .
- Regulation (EU) 2023/1113 (Transfer of Funds Regulation Recast), EUR-Lex, accessed .
- Commission Delegated Regulation (EU) 2025/305: RTS for MiCA CASP authorisation, EUR-Lex, accessed .
- KPMG, Portugal: Reduction in corporate income tax rates from 20% to 17% (IRC reduced to 19% for 2026; 15% SME first bracket), kpmg.com, accessed .
- Council Directive (EU) 2023/2226 (DAC8) on administrative cooperation in taxation for crypto-assets, EUR-Lex, accessed .
- Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA), EUR-Lex, accessed .
- FATF, Anti-money laundering and counter-terrorist financing measures: Portugal, Mutual Evaluation Report (adopted at the November 2017 Plenary, published December 2017), fatf-gafi.org, accessed .
- EEA Joint Committee, Decision No 41/2025 of 20 February 2025 amending Annex IX (Financial services) to the EEA Agreement (incorporation of MiCA); supplementary JCD No 138/2025 of 13 June 2025 (RTS), efta.int, accessed .
- ESMA, Guidelines on reverse solicitation under MiCA (ESMA35-1872330276-2030), , esma.europa.eu, accessed .
- CMVM (Comissão do Mercado de Valores Mobiliários), Crypto-assets / MiCA (conduct and market-abuse supervisor), cmvm.pt, accessed .
- Abreu Advogados, MiCA in Portugal: Highlights of the New Implementing Law (Law No. 69/2025; twin-peaks supervisory split; 1 July 2026 transitional deadline), abreuadvogados.com, accessed .
- Law No. 58/2020 of 31 August 2020 (transposing AMLD5; basis of the Banco de Portugal VASP registration regime) amending Law No. 83/2017 (AML/CFT Law), bportugal.pt, accessed .
- OECD, Crypto-Asset Reporting Framework (CARF), oecd.org, accessed .
- Law No. 26/2026 of 3 June 2026 (transposing Council Directive (EU) 2023/2226 / DAC8 and Council Directive (EU) 2025/872 / DAC9 into Portuguese law), Diário da República, 1st series, no. 107, 3 June 2026. Summarised in Madeira Corporate Services, Portugal Crypto Tax Reporting 2026: What Law 26/2026 Changes, mcs.pt, accessed .
- Law No. 73/2025 of 23 December 2025 (implementing DORA in Portugal), Articles 3–4 and 8–11, Diário da República, consolidated text, accessed .
- ESMA, Interim MiCA register: crypto-asset service providers (CASPS.csv), edition of 24 September 2026 (the only Portugal-home entry: Bison Bank, S.A., a credit institution, dated 19 May 2026), esma.europa.eu, accessed .
- Google, Advertising Policies Help: Cryptocurrencies and related products (European Union: cryptocurrency exchanges and software wallets), support.google.com, accessed .
- Autoridade Tributária e Aduaneira, Estatuto dos Benefícios Fiscais, Article 58-A (IFICI: 20% on qualifying category A and B income for 10 consecutive years), info.portaldasfinancas.gov.pt, accessed .
- Autoridade Tributária e Aduaneira, Código do IRS, Article 81(4)-(5) (exemption method for IFICI beneficiaries’ foreign-source income of categories A, B, E, F and G), info.portaldasfinancas.gov.pt, accessed .
- Autoridade Tributária e Aduaneira, Código do IRS, Article 10 (crypto-asset gains: paragraph 1(k), the 365-day exclusion and its limit for counterparties outside the EU/EEA and treaty or information-exchange states; paragraphs renumbered by Decreto-Lei n.º 97/2026), info.portaldasfinancas.gov.pt, accessed .
- Banco de Portugal, Application for authorisation as a crypto-asset service provider (stages of the procedure and FAQ: neither the application nor the maintenance of the authorisation has associated costs; submission through SIRES), bportugal.pt, accessed .
- European Banking Authority, EBA/OP/2026/01: Opinion on the end of the No Action Letter transition period, , paragraphs 7 to 14, eba.europa.eu, accessed .
- Ministério das Finanças, Portaria n.º 913-I/2003 (supervision fees due to the CMVM), consolidated text as last amended by Portaria n.º 60/2022 of 31 January 2022 (no fee for crypto-asset service providers; Article 3: monthly fee for financial intermediaries), fees set under Article 31(2) of the CMVM Statutes (Decreto-Lei n.º 5/2015), diariodarepublica.pt, accessed .