MiCA CASP License in Spain

Spain’s Crypto Licensing Landscape

Spain is a large EU member state that authorises crypto-asset service providers under MiCA, with the CNMV as the designated competent authority for CASPs and the Banco de España supervising issuers of asset-referenced and e-money tokens. A Spanish authorisation carries full EEA passporting and access to one of the EU’s largest domestic crypto user bases.

Authorisations were, however, slow to materialise: the first non-bank CASP was authorised only in mid-2025, and most Spanish entries on the ESMA register date from June and July 2026, around the end of a transitional period that Spain ran to the full 18 months after first applying 12.^[22][25]

Spain’s headline advantage is market size: with about 49.6 million residents it is the EU’s fourth most populous member state,^[20] and a domestic CNMV authorisation signals local credibility to Spanish-speaking retail and institutional clients. The trade-off is process maturity. The first Spanish entries on the ESMA register came only in 2025: BBVA, a credit institution, by an Article 60 notification dated 5 March 2025, and Bit2Me, the first non-bank CASP, which announced its CNMV authorisation on 29 July 2025.^[6][22][23]

Full MiCA Passporting

A Spanish CASP authorisation grants the right to provide crypto-asset services across the EEA through a single notification to the CNMV under MiCA Article 65.^[1] The timing is set out under MiCA Passporting and EU Market Access below.

No additional authorisation is required from host-country regulators. Both cross-border service provision and branch establishment are covered. The passport is reciprocal: a CASP authorised in any other EU member state can serve Spanish clients on the same basis, which is why many operators target the Spanish market without holding a Spanish authorisation.

Large Domestic Market

Spain combines a population of about 49.6 million with a crypto-holding rate slightly below the EU average (4% against an EU-wide 6% in the 2023 Flash Eurobarometer, as reported by the Banco de España),^[20][21] giving CASPs a substantial Spanish-speaking client base and a natural gateway to Latin American markets. For consumer-facing exchanges and brokers, a recognisable local authorisation and Spanish-language onboarding can be a commercial differentiator. This market depth is the principal reason operators authorise directly with the CNMV, and the reason it remains the prize when they instead authorise elsewhere and passport in.

Two-Regulator Architecture

Spain splits MiCA supervision between two authorities. The CNMV authorises and supervises CASPs under MiCA Title V, while the Banco de España supervises issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs) under Titles III and IV.^[2] Most service-provider applicants deal only with the CNMV; the Banco de España becomes relevant where a business issues a stablecoin or token alongside its services. AML/CFT supervision is separate again, sitting with SEPBLAC, Spain’s financial intelligence unit.

Slow Authorisation Track Record

Spain’s defining feature has been a slow start to authorisations. The CNMV published its authorisation manual in July 2024 and could authorise CASPs once MiCA became fully applicable on 30 December 2024, but only five Spanish entries on the ESMA register are dated before December 2025: Bit2Me and four banks.^[3][22] That month, with the 12-month transitional period Spain had first applied about to end, the CNMV confirmed that the period would instead run the full 18 months to 1 July 2026.^[24][25]

Applicants should plan for a thorough review and the upper part of the 5–9 month planning range.

Regulatory Framework

Spain regulates crypto-asset service providers under the EU’s Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114,^[1] which applies directly as an EU Regulation without national transposition. The national framework that designates the competent authorities is Law 6/2023 of 17 March on Securities Markets and Investment Services (the new Ley del Mercado de Valores, LMV), in force since 2023.^[2] The CNMV is the competent authority for authorising and supervising CASPs, while the Banco de España supervises issuers of asset-referenced and e-money tokens. See the consolidated category page for the MiCA framework: requirements and timeline →

Multi-Authority Structure

Spain operates a split-supervision model. The CNMV handles CASP authorisation, prudential supervision, governance, and conduct-of-business oversight; under Article 247 of the LMV it can subject crypto advertising to authorisation or other control, and under Article 246 it can act to stop or correct unlawful advertising.^[2] The Banco de España supervises issuers of ARTs and EMTs under MiCA Titles III and IV.

SEPBLAC (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales), Spain’s financial intelligence unit, retains AML/CFT supervision under Law 10/2010, including KYC, transaction monitoring, and suspicious activity reporting.^[9]

Regulatory History

Spain’s pre-MiCA framework was AML-based, not a bespoke licensing regime. Royal Decree-Law 7/2021 amended Law 10/2010 to create a registry of virtual currency service providers, maintained by the Banco de España from 2021. Registration covered fiat-to-crypto exchange and custodian wallet providers and was an AML compliance measure rather than a prudential authorisation.^[9]

Law 6/2023 (the new LMV) provided the domestic anchor for MiCA, designating the CNMV and the Banco de España as competent authorities. In October 2023, the Spanish government announced it would bring forward full MiCA application domestically to December 2025, six months ahead of the EU backstop.^[5]

MiCA became fully applicable on 30 December 2024. From that date the Banco de España stopped accepting new entries to its virtual currency registry, which now serves an informational purpose only, and the CNMV began accepting formal CASP applications.^[3]

Authorisation Guidance

The CNMV has published a dedicated MiCA section and an applicant manual setting out the standardised authorisation form, the documentation required, and the supervisory expectations for CASPs.^[3] Unlike some EU regulators, the CNMV did not operate a separate crypto sandbox for MiCA applicants; the standard authorisation procedure under MiCA and Commission Delegated Regulation (EU) 2025/305 is the route.

Spain does run a broader financial-sector sandbox under Law 7/2020, which has hosted blockchain pilots, but it is not a substitute for CASP authorisation.

Recent Regulatory Developments

Register entries and dates below are from the ESMA interim register (edition of 24 September 2026) and the firms’ own announcements.^[22][6][23]

• June–July 2026: Eight non-bank CASPs with Spain as home state appear on the ESMA register with dates in these months, taking the Spanish total to 15 by 24 September 2026.^[22]
• December 2025: The CNMV confirmed the full 18-month transitional period, which ran to 1 July 2026, instead of the 12-month period to 30 December 2025 that it had announced in December 2024.^[25]
• July 2025: Bit2Me announced its CNMV authorisation, the first for a Spanish non-bank CASP; its register entry is dated 31 October 2025.^[6][22]
• March 2025: BBVA, already a credit institution, became the first Spanish entry on the ESMA register, by Article 60 notification to the CNMV rather than CASP authorisation.^[23]
• December 2024: MiCA fully applicable from 30 December. The Banco de España registry closed to new entries, and the CNMV announced a 12-month transitional period ending 30 December 2025.^[24]
• October 2023: Spain announced it would bring forward domestic MiCA application by six months.

Regulatory Overlap

EMI/PSD2 overlap: EMT issuance and EMT payment services require separate EMD2/PSD2 analysis; handling an EMT does not by itself require two own licences. The EBA confirmed (June 2025) that custody and transfer of EMTs can constitute payment services.^[7] Since the EBA’s transition ended on 1 March 2026, a CASP that transfers EMTs on behalf of clients or provides custodial wallets allowing EMT transfers to and from third parties needs, subject to the exceptions in the EBA’s no-action letter, a PSD2 authorisation from the Banco de España or an arrangement with an authorised payment service provider.^[25] In Spain, EMT and ART issuance falls to the Banco de España.

MiFID II overlap: Crypto-assets that confer equity-like rights or are negotiable on capital markets are classified as transferable securities under MiFID II, not MiCA. ESMA’s technology-neutral guidelines (applicable 3 June 2025) establish a substance-over-form classification test.^[8]

AIFMD overlap: AIFMs providing discretionary portfolio management, investment advice, or reception and transmission of crypto orders to external clients require MiCA Article 60 notification. Core fund management activities remain under AIFMD without additional MiCA authorisation.

Tokenised securities and RWA

MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments, so a tokenised security (a tokenised share, bond or fund unit) sits outside MiCA. In Spain such instruments are regulated under MiFID II, the Prospectus Regulation, and the EU DLT Pilot Regime, Regulation (EU) 2022/858, and are supervised by the CNMV rather than under the MiCA CASP regime. ESMA’s Guidelines on the qualification of crypto-assets as financial instruments set the boundary between the two perimeters. The honest point for issuers tokenising real-world assets: a Spanish MiCA CASP authorisation does not cover tokenised securities, which follow the MiFID securities regime instead. Where the structure is a tokenised fund unit, see our fund licensing page for the underlying fund-vehicle route.

Regulatory Transition: Banco de España Registry to MiCA CASP Authorisation

Spain has moved from its legacy AML-based virtual currency registry (maintained by the Banco de España from 2021) to full MiCA CASP authorisation (granted by the CNMV). MiCA’s transitional regime under Article 143(3) let firms that were already providing crypto-asset services under national law before 30 December 2024 continue without MiCA authorisation for a grandfathering window set by each member state. In Spain, that window ran to 1 July 2026.^[3]

Key Deadlines

Transition Status

On 24 September 2026 the ESMA register listed 15 providers with Spain as home state: six banks (BBVA the first) and nine other firms (Bit2Me, the first non-bank CASP, and eight dated June and July 2026, around the end of the transitional period).^[22] The practical reading is that the regulator is taking a careful, case-by-case approach and that a Spanish authorisation is a multi-month undertaking, not a formality.

Consequences for Unauthorised Operations

Since the transition closed on 1 July 2026, providing crypto-asset services in Spain without CNMV authorisation (and without a valid passport from another member state or an Article 60 notification) exposes operators to:^[1]

• Administrative penalties under Article 323 of Law 6/2023, which implements MiCA Article 111: for very serious breaches of the CASP rules, fines up to the higher of €5,000,000 or 5% of total annual turnover for legal persons^[2]
• Penalties for natural persons (directors and officers): fines of up to €700,000 for serious and very serious breaches and a temporary ban from management functions at the CASP
• Advertising enforcement: the CNMV can act to stop or correct unlawful crypto advertising under Articles 246 and 247 of the LMV
• Public warnings: the CNMV publishes warnings naming entities operating without authorisation

Financial Institutions, Article 60 Notification

Certain already-authorised financial entities need no separate CASP authorisation. Under MiCA Article 60 they notify the CNMV at least 40 working days before starting, with a programme of operations and evidence of adequate governance, and the CNMV checks completeness within 20 working days. The route covers credit institutions (any crypto-asset service), central securities depositories (custody), investment firms (services equivalent to their MiFID licence), e-money institutions (custody and transfer of the e-money tokens they issue), UCITS managers and AIFMs (portfolio-type services), and market operators (a trading platform); payment institutions are not eligible.^[1] BBVA reached the Spanish market this way as an existing credit institution.^[23] The route is open only to entities that already hold a qualifying authorisation.

License Types and Activities Covered

MiCA defines 10 crypto-asset services grouped into 3 classes that determine capital requirements. Spain applies MiCA directly without additional national service categories. The classification determines the Annex IV class floor: €50,000 for Class 1, €125,000 for Class 2, and €150,000 for Class 3.

Covered Activities

What Does NOT Require CASP Authorisation

Services provided in a fully decentralised manner without any intermediary fall outside MiCA’s scope (Recital 22). Unique, non-fungible tokens (NFTs) are excluded, although fractional parts of an NFT are not treated as unique and issuance in a large series or collection is an indicator of fungibility. Crypto-assets that qualify as financial instruments under MiFID II are regulated under existing securities law, not MiCA. Central bank digital currencies (CBDCs), deposits, insurance products, pension products, and securitisation positions are excluded.

DAO, DeFi, and Regulatory Perimeter

MiCA does not explicitly cover decentralised autonomous organisations (DAOs) or DeFi protocols. ESMA has stated that decentralisation exists on a spectrum rather than as a binary classification. Partially decentralised services: such as DEXs with upgrade keys, admin-controlled smart contracts, or governance tokens concentrated among a small group, remain within MiCA’s scope if an identifiable intermediary exists. The CNMV has not published jurisdiction-specific guidance on DAOs, DeFi, or decentralised exchanges beyond the EU-level framework.^[3] Applicants operating hybrid models should seek pre-application clarification from the CNMV before filing.

NFT Classification

NFTs that are unique and not fungible with other crypto-assets are excluded from MiCA under Article 2(3). Fractional parts of an NFT are not treated as unique and non-fungible, so the exclusion does not cover fractionalised units. Issuance in a large series or collection is an indicator of fungibility to be weighed, not a conclusive test, and a unique token does not lose the exclusion merely because it is traded or accumulated speculatively.

The classification is substance-based: MiCA still applies to a token that looks unique but whose actual features or uses make it fungible or not unique, and labelling a token as “NFT” does not determine its regulatory treatment. A token that qualifies as a financial instrument falls outside MiCA under Article 2(4)(a) and is regulated under securities law instead.

Requirements

MiCA CASP authorisation in Spain requires a Spanish corporate entity (most commonly a Sociedad Limitada), prudential safeguards of at least the higher of the EUR 50,000/125,000/150,000 Annex IV class floor and 25% of previous-year fixed overheads (projected first-12-month overheads for a new firm), met by qualifying own funds, insurance or a comparable guarantee, or a combination, a registered office in Spain, fit-and-proper management, at least one director resident in the EU (MiCA Article 59(2)), effective direction from Spain (expected in supervisory practice), robust AML/CFT systems under SEPBLAC oversight, and a comprehensive compliance documentation suite. All qualifying shareholders (10%+ of capital or voting rights) undergo a fit-and-proper assessment with source-of-funds verification.

A practical consideration is language. The CNMV operates primarily in Spanish, and authorisation materials, ongoing correspondence, and supervisory interactions are most efficiently handled by Spanish-speaking compliance personnel. Applicants without Spanish-language capability should budget for a permanent local arrangement rather than a one-off translation. The CNMV publishes its authorisation manual and standardised forms in Spanish, and the extent to which it accepts English-language supporting materials is not set out in public English-language guidance, so applicants should assume Spanish-language drafting is the working default.^[3]

Fit-and-Proper Assessment

The CNMV evaluates directors, senior managers, qualifying shareholders, and key function holders against MiCA’s fit-and-proper criteria. Assessment dimensions include professional qualifications and experience, reputation and integrity (criminal background check, regulatory history), financial soundness (no insolvency or ongoing enforcement), and the collective knowledge of the management body. Demonstrating the legitimate origin of owners’ capital is a central element, and weak source-of-funds documentation is a common reason for delay across EU CASP applications generally.

Local Presence and Substance

Spain requires genuine local substance for authorised CASPs. A registered office and central administration in Spain are expected; the CNMV accepts a co-working space only if it is sized for the staff assigned, separated from the other occupants, and no obstacle to supervision.^[25] A management body of at least two people (four eyes) is the usual planning assumption rather than a statutory rule, and the CNMV assesses whether the applicant’s organisational structure permits effective supervision from Spain. As supervisory practice rather than law, ESMA’s briefing on CASP authorisation expects at least one executive board member to be resident in the Member State of authorisation, decision-making to lie there, and an executive board that does not depend on one member.^[31]

A letterbox entity with management outsourced to another jurisdiction is not acceptable. Substance expectations scale with the service profile: a Class 3 trading-platform operator faces materially higher governance and staffing expectations than a Class 1 advisory firm.

AML/CFT and Travel Rule

Spain’s AML framework is governed by Law 10/2010 on the Prevention of Money Laundering and Terrorist Financing, with SEPBLAC as the financial intelligence unit and AML supervisor.^[9] The EU’s Transfer of Funds Regulation Recast (Regulation (EU) 2023/1113) applies directly. Critically, there is no de minimis threshold for CASP-to-CASP transfers: full originator and beneficiary information must accompany every crypto transfer regardless of amount. The €1,000 threshold applies only to transfers involving self-hosted wallets: where a transfer exceeds €1,000 to or from an unhosted address, the CASP must assess whether the customer owns or controls that address.^[10]

Sanctions screening must cover EU consolidated sanctions lists (mandatory) and UN sanctions lists (implemented via EU legislation). OFAC screening is not legally mandatory in Spain but is strongly recommended given extraterritorial reach and correspondent banking expectations. Suspicious transactions are reported to SEPBLAC, and obliged entities also file systematic monthly reports of certain transactions under Article 20 of Law 10/2010 and Article 27 of Royal Decree 304/2014.^[9][32]

Application Process

MiCA Article 63 gives the CNMV 25 working days from receipt to check that an application is complete, and 40 working days from receipt of the complete application to assess it and decide; a written request for further information made by working day 20 of that period suspends it until the reply, for no more than 20 working days, and later requests do not suspend it.^[1]

Including entity setup and documentation drafting, the realistic end-to-end timeline is 5–9 months on our planning estimate.

The CNMV has published a MiCA applicant manual and a standardised authorisation form, and applicants benefit from clarifying business-model questions with the regulator before filing.^[3] Early clarity on classification (for example, whether a token is a financial instrument under MiFID II rather than a crypto-asset under MiCA) can save significant time during the substantive review.

Application language: the CNMV operates primarily in Spanish. The CNMV’s applicant manual and standardised forms are published in Spanish, and applicants without Spanish-language compliance capability should plan for local-language drafting and correspondence rather than relying on ad hoc translation.^[3]

Compliance documentation is the most time-intensive component of any CASP application, typically 8–12 weeks of specialist drafting covering AML/CFT policy manuals, enterprise-wide risk assessments, sanctions-screening frameworks, and Travel Rule implementation. Generic templates adapted from other jurisdictions are a common cause of delay and information-request cycles.

Required Documents

The CNMV’s CASP authorisation documentation requirements follow MiCA Article 62 and Commission Delegated Regulation (EU) 2025/305.^[11] The CNMV publishes a standardised authorisation form and an applicant manual covering governance, programme of operations, and prudential safeguards.^[3]

Corporate Documents

Certificate of incorporation from the Registro Mercantil. Articles of association (estatutos sociales). Shareholder register. Spanish tax identification number (NIF). Evidence of the prudential safeguard (own funds, qualifying insurance or a comparable guarantee, or a combination) per MiCA Article 67. Legal Entity Identifier (LEI). Proof of registered office address in Spain.

Personal Documents (All Directors, Officers, and Qualifying Shareholders)

Valid government-issued photo identification (passport or national ID). Curriculum vitae with detailed professional history. Criminal record certificates from each country of residence in the past 10 years. Declaration of good repute and absence of pending proceedings. Evidence of professional qualifications, skills, and experience relevant to the role. For qualifying shareholders (10%+): detailed source-of-funds and source-of-wealth documentation, among the most scrutinised elements in EU CASP applications.

Compliance Documentation

The compliance documentation is the most heavily scrutinised component of any Spanish CASP application. Each document must be bespoke, reflecting the applicant’s specific business model, risk profile, and operational structure, and aligned to Spanish AML law and SEPBLAC expectations. Generic MiCA templates adapted from other jurisdictions are a common cause of information requests and delay.

Business Plan and Financial Projections

Programme of operations per MiCA Article 62(2)(d): description of all crypto-asset services to be provided, target markets, client profile, marketing strategy. Three-year financial projections including revenue model, cost base, capital adequacy forecasts, and break-even analysis. Description of the governance structure and internal control mechanisms.

Technology and Operational Documentation

IT architecture documentation. Cybersecurity policy and penetration test reports. Hot/cold wallet management and key management procedures (for custody service providers). Business continuity plan and disaster recovery procedures. Third-party ICT provider register (DORA requirement). Incident response plan for major ICT incidents.

Costs and Pricing

Spanish cost divides between the build, quoted per case, and the prudential safeguard, which may be met with own funds, qualifying insurance or a comparable guarantee, or a combination. The build runs roughly €103,000 to €348,000, and its largest components are professional advisory, personnel (Spanish salary levels are higher than in the Baltics) and compliance documentation. All figures below are indicative planning ranges, not CNMV quotes.

Typical Build, Quoted Per Case

Own Funds: Held, Not Spent

The typical build ranges shown above are quoted per case and exclude own funds. Where the safeguard is met with own funds rather than qualifying insurance or a comparable guarantee, the total cash outlay also includes at least the higher of the EUR 50,000/125,000/150,000 class floor and 25% of previous-year fixed overheads (projected first-12-month overheads for a new firm). From Year 2, the recurring build ranges shown above remain quoted per case and exclude capital.

Note: the prudential safeguard (€50,000–€150,000 by class) must be met at all times; MiCA does not equate it with share capital or require cash to be locked away. The ongoing obligation is the higher of the permanent minimum or one quarter of the preceding year’s fixed overheads. CASPs may meet the requirement with own funds, a qualifying insurance policy or comparable guarantee, or a combination.

Timeline

Spain’s statutory clocks are those of MiCA Article 63 (completeness within 25 working days of receipt; decision within 40 working days of receipt of the complete application, with one suspension of up to 20 working days for a written request made by working day 20), but the time taken to complete the file and answer requests is the main driver of real-world timelines.^[1] The slow authorisation pipeline through 2025–2026 means applicants should plan for the upper part of the range rather than the lower; well-prepared applications with clear classification and strong source-of-funds evidence move fastest.

Taxation

Spain is a standard-rate EU jurisdiction. The general corporate income tax rate is 25%. For tax periods starting in 2026, companies with turnover below €1 million pay 19% on the first €50,000 of taxable profit and 21% on the rest, and other small companies (turnover below €10 million) pay 23%; a newly created company pays 15% in its first profitable period and the next, unless it belongs to a group or is an asset-holding company.^[12] Crypto-asset exchange services are VAT-exempt across the EU under the CJEU Hedqvist ruling. For individuals, crypto capital gains are taxed as savings income on a progressive scale up to 30%.^[13]

Individual Savings-Income Bands

Crypto capital gains realised by Spanish-resident individuals are taxed in the savings base (base del ahorro) on a progressive scale: 19% up to €6,000; 21% from €6,000 to €50,000; 23% from €50,000 to €200,000; 27% from €200,000 to €300,000; and 30% above €300,000, a band Law 7/2024 raised from 28% with effect from 1 January 2025.^[13] Mining, staking, salary, and certain DeFi yield are instead treated as general income, taxed on a progressive scale that combines the state and regional rates, so the top marginal rate depends on the autonomous community.^[13]

Modelo 721 and CASP Reporting

Residents holding crypto-assets on foreign platforms worth more than €50,000 at year-end must file the informational Modelo 721 between 1 January and 31 March; filing it does not itself trigger a payment.^[13] Spanish CASPs and certain intermediaries report customer balances and operations to the Spanish tax authority via Modelo 172 and Modelo 173. These reporting obligations are distinct from the EU-wide DAC8 framework described below.

DAC8 / CARF Reporting

Spain is implementing the DAC8 Directive (Council Directive (EU) 2023/2226), under which CASPs collect and report customer transaction data, with reporting that broadly aligns to the EU-wide schedule (data collection from 2026, first reporting in 2027 covering 2026).^[14] DAC8 transposes the OECD Crypto-Asset Reporting Framework (CARF) into EU law, harmonising crypto tax transparency across member states.^[15]

Spain’s transposing act amends Law 58/2003 (the General Tax Law, Ley General Tributaria) but had not been published in the Official State Gazette (BOE) by 26 September 2026, and the European Commission sent Spain a letter of formal notice for late transposition on 30 January 2026.^[28] A draft ministerial order of March 2026 would withdraw Modelo 173 from the 2026 reporting year and add a new Modelo 175 for reporting crypto-asset service providers, filed each January for the previous year.^[29] Under the directive, member states exchange the first data, on 2026, by 30 September 2027.^[14]

Pillar Two (Global Minimum Tax)

Spain has implemented the OECD Pillar Two global minimum tax by transposing EU Directive 2022/2523, which applies a 15% effective minimum rate to multinational and large-scale domestic groups with consolidated revenue of €750 million or more.^[33] This threshold is unlikely to affect a standalone Spain-domiciled CASP, but it is relevant where a CASP forms part of such a large group.

Ongoing Compliance & Post-Authorisation

MiCA CASP authorisation creates a permanent compliance obligation. The authorisation is indefinite (no renewal), but the CNMV conducts ongoing supervision through periodic reporting, inspections, and ICT incident reporting. On our planning estimate, the recurring build runs from about €65,000 a year for a minimal Class 1 operation to about €208,000 for a full-service Class 3 exchange, excluding capital.

Reporting Obligations

CASPs must submit periodic reporting to the CNMV under MiCA’s reporting framework, including financial information, prudential data, and activity reporting. The CNMV has published CASP reporting templates and communications setting out the templates and submission requirements.^[4] Audited financial statements are required, and CASPs separately meet AML reporting obligations to SEPBLAC and tax reporting obligations (Modelo 172/173 and, once Spain transposes DAC8, the proposed Modelo 175).^[29]

Supervision Fees

MiCA authorisation is indefinite, so there is no annual renewal fee. The CNMV’s fees are set by Law 16/2014, which, as consolidated in the BOE on 26 September 2026, contains no fee item for crypto-asset service providers; the CNMV’s authorisation manual nonetheless asks applicants to name who will pay the fee for examining the file, so confirm any tariff with the CNMV before budgeting.^[30][3] The ongoing figures in the cost table are planning estimates, not published tariffs.

Regulatory Inspections

The CNMV conducts both scheduled and unscheduled supervisory inspections, with thematic reviews focused on AML/CFT compliance, client asset segregation, cybersecurity, and governance. SEPBLAC conducts separate AML/CFT supervision under Law 10/2010, so a CASP can face oversight from either body independently.

Enforcement

The CNMV’s enforcement powers under MiCA include:

• Administrative fines for very serious breaches up to the higher of €5,000,000 or 5% of total annual turnover for CASPs (Law 6/2023, Article 323, implementing MiCA Article 111)^[2]
• Fines of up to €700,000 for natural persons (directors, officers)
• Public statements naming the entity and the nature of the breach
• Withdrawal of authorisation
• Temporary prohibition on management functions
• Suspension or limitation of services

Advertising and Promotion Rules

MiCA’s marketing communications regime (Articles 7, 29, 53, and 66) applies directly to Spanish CASPs.^[1] A CASP’s information to clients, including marketing communications, must be fair, clear, and not misleading, and marketing must be identified as such (Article 66(2)); marketing of an offer or admission to trading of crypto-assets other than asset-referenced or e-money tokens must also state that no competent authority has reviewed or approved it (Article 7).^[1] The CNMV repealed its national Circular 1/2022 on crypto-asset advertising with effect from 28 December 2024, because MiCA now sets common EU rules, but Article 247 of the LMV still lets it subject crypto advertising to authorisation or other control and, under Article 246, act to stop or correct unlawful advertising.^[2][26] Google Ads accepts ads for crypto exchanges and software wallets targeting Spain only from advertisers authorised as a CASP under MiCA and certified with Google.^[27]

ICT Risk Management & Operational Resilience

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) applies to all CASPs authorised under MiCA.^[16] DORA has been applicable since 17 January 2025. The CNMV is the enforcement authority for DORA compliance among Spanish CASPs. Non-compliance carries significant penalties under the DORA enforcement regime.

Incident Reporting

Major ICT-related incidents must be reported to the CNMV within strict deadlines:

Digital Resilience Testing

All CASPs must conduct general resilience testing under DORA Articles 24–25, including vulnerability assessments and penetration testing. Threat-led penetration testing (TLPT) under Articles 26–27 applies only to entities identified by the CNMV as significant. TLPT frequency is at least every 3 years. Microenterprises are explicitly excluded from TLPT. Most smaller and mid-size CASPs will not be designated for TLPT but must still conduct general testing.

Third-Party ICT Risk

CASPs must maintain a register of all ICT third-party service providers, including cloud providers, blockchain infrastructure providers, and custody technology vendors. Contractual arrangements must include audit rights, termination provisions, and data localisation specifications.

Wallet and Key Management

CASPs providing custody services must implement segregated hot/cold wallet architectures, multi-signature authorisation for material transactions, key generation in secure environments, and documented key backup and recovery procedures.

Banking

Banking access for crypto-asset businesses connected to Spain is shaped by two factors: the general caution of European banks toward the sector, and the practical reality that a Spanish CASP must satisfy MiCA’s client-money safeguarding rules. Spain’s large domestic banks remain selective with crypto operators, though a CNMV authorisation improves credibility over the legacy registry status.

For client-fund safeguarding under MiCA Article 70, a CASP that is not itself a credit institution, EMI or payment institution needs an account with a credit institution or a central bank: this is the harder of the two accounts to obtain. Spanish and EU credit institutions apply lengthy enhanced due diligence to crypto businesses, so applicants should budget 2–4 months for safeguarding-account setup and begin the process in parallel with the authorisation rather than after it. Operators already holding a banking or EMI relationship are at a clear advantage.

An operator authorising in another EU member state and serving Spanish clients by passport faces the same Article 70 safeguarding obligation, but can satisfy it through a credit-institution relationship in its home jurisdiction. Banking depth is therefore a legitimate jurisdiction-selection criterion: some EU member states have markedly deeper crypto-accommodating banking and EMI ecosystems than others.

Banking access is a binding constraint, not an afterthought: a crypto authorisation without functioning banking is of little practical use. Independent specialists in the partner network arrange banking and EMI relationships for operators authorised in the EU jurisdictions they cover, across institutions covering EU banks, EMIs, and crypto-native rails. Banking for licensed crypto operators →

FATF Status & International Standing

Spain does not appear on any FATF list. It is absent from both the FATF list of Jurisdictions under Increased Monitoring (the “grey list”) and the list of High-Risk Jurisdictions subject to a Call for Action (the “black list”), and has never been listed under either. As an EU member state, Spain is likewise outside the scope of the EU list of high-risk third countries, which by definition covers non-EU jurisdictions only.

Spain is a founding member of the FATF and is assessed by the FATF directly rather than by a FATF-style regional body. Its most recent full Mutual Evaluation, adopted in December 2014, rated Spain among the strongest-performing jurisdictions for AML/CFT effectiveness at the time; follow-up reports in 2018 and 2019 re-rated it upwards, and it remains in regular follow-up.^[17] Spain’s AML framework is set by Law 10/2010, supervised by SEPBLAC, and updated in line with successive EU AML directives.

For a crypto operator, the practical reading is that Spain carries strong international standing: a CNMV authorisation is a reputable, EU-grade credential with no FATF or EU watchlist baggage. Spain is also within scope of the EU’s new AML package, including the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) and the new EU Anti-Money Laundering Authority (AMLA), which will progressively harmonise AML supervision across member states.^[9] This standing is one reason Spanish-market access is commercially attractive. The same standing is available from any reputable EU member state: an operator authorised elsewhere reaches Spanish clients on the same regulatory footing, without inheriting a jurisdiction-specific reputational discount.

MiCA Passporting and EU Market Access

MiCA passporting is the headline commercial value of any CASP authorisation. Under Article 65, a Spanish CASP notifies the CNMV of its intention to provide cross-border services or establish a branch in other EEA member states. After receiving all Article 65 information, the CNMV must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP. The CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the Article 65 information. No separate authorisation or additional capital is required from host countries.^[1] Both routes are covered: freedom to provide services (cross-border without establishment) and the right of establishment (opening a branch). Host NCAs cannot block either route except in extraordinary circumstances.

The MiCA passport extends across the full EEA. EEA jurisdictions Iceland, Liechtenstein, and Norway sit inside the MiCA passport via EEA Joint Committee Decision No 41/2025 of 20 February 2025 (with supplementary RTS via JCD 138/2025 of 13 June 2025); three non-EU/non-EEA jurisdictions in geographical Europe sit outside the passport regime, so their own rules decide whether serving local clients needs a local licence or registration: the United Kingdom, Switzerland, and Gibraltar.^[18]

Article 61 reverse solicitation is third-country-only and does not apply to an EU-authorised CASP marketing to other EU/EEA Member States: passporting via Article 65 is the operative pathway. The ESMA Guidelines on reverse solicitation (26 February 2025) are framed for non-EU operators serving EU clients on a strictly unsolicited basis, with any further same-type marketing confined to the context of the original transaction. See the dedicated reverse solicitation guide for the third-country compliance pattern.^[19]

The ESMA Interim MiCA Register has been operational since 30 December 2024, published as CSV files updated weekly.^[8] Spanish CASPs are listed in the CNMV register and propagated to the ESMA register on authorisation.

Advantages and Limitations

Spain offers a credible MiCA route into one of the EU’s largest crypto markets, with strong international standing and full passporting. The limitations are real: a slow authorisation pipeline, a Spanish-language process, and standard Western-EU tax and cost levels.

• ✓ Full MiCA passporting across the EEA. A single CNMV authorisation grants cross-border service provision and branch establishment rights across the 27 EU Member States, reaching Iceland, Liechtenstein, and Norway through EEA Joint Committee Decision No 41/2025.
• ✓ Large domestic market. About 49.6 million people, the EU’s fourth-largest population, plus a natural Spanish-language bridge to Latin America.
• ✓ MiCA capital requirements applied directly, no national overlays. Spain follows prudential safeguards of at least the higher of the EUR 50,000/125,000/150,000 Annex IV class floor and 25% of previous-year fixed overheads (projected first-12-month overheads for a new firm), met by qualifying own funds, insurance or a comparable guarantee, or a combination.
• ✓ Strong international standing. FATF founding member, never grey- or black-listed, and a reputable, EU-grade authorisation credential.
• ✓ Clear two-regulator architecture. The CNMV handles CASPs and the Banco de España handles ART/EMT issuers, giving stablecoin and token projects a defined supervisory home.
• ✓ Indefinite authorisation with no renewal. MiCA CASP authorisation does not expire and carries no renewal fee.
• × Slow start to authorisations. Only five Spanish entries on the ESMA register are dated before December 2025; most of the 15 listed on 24 September 2026 are dated June and July 2026. Mitigation: prepare a complete, well-evidenced application and plan for the upper end of the timeline.
• × Spanish-language process. The CNMV operates primarily in Spanish. Mitigation: engage Spanish-speaking compliance counsel for drafting and correspondence.
• × Standard Western-EU cost and tax base. 25% headline corporate tax and higher salaries than the Baltics. Mitigation: the 2026 micro-enterprise (19%/21%) and small-company (23%) rates or the 15% new-company rate may apply.
• × Banking remains selective. Spanish banks are cautious with crypto, and client-fund safeguarding needs a credit-institution or central-bank account unless the CASP is itself a bank, EMI or payment institution. Mitigation: begin banking setup in parallel with the application.
• ✓ Access to independent specialists in Spain. Jagelski & Partners scopes the CNMV CASP route in writing and introduces an independent specialist for entity formation, authorisation, banking, and ongoing compliance. Where a Spanish presence is not needed, the comparison below maps the other EU routes.

Spain vs. EU Routes

Because the same MiCA passport reaches Spanish clients from any EEA member state, the practical question is rarely “Spain or nothing”: it is whether a domestic Spanish presence is worth a Spanish-language process, or whether an English-language or lower-tax EU authorisation that passports into Spain serves the goal better.

For each jurisdiction below, Jagelski & Partners scopes your written brief and introduces an independent specialist, including for the direct CNMV CASP route in Spain. Each route offers MiCA passporting into Spain; on our planning ranges only Lithuania (4–8 months) starts earlier than Spain (5–9 months), so the case for the others is language, ecosystem, or tax rather than speed.

Compare every crypto jurisdiction side by side →

The key point is: Spain’s main draw is domestic brand presence in a large market. A jurisdiction with an English-language process (Cyprus, Malta) or a deep fintech ecosystem (Lithuania) reaches exactly the same Spanish clients by passport, though on our planning ranges Cyprus and Malta take longer than Spain.

Beyond the direct Spanish route, Jagelski & Partners can introduce independent crypto licensing specialists in Lithuania, Estonia, Latvia, the Czech Republic, Cyprus, and Malta: company formation, licence application, banking introductions, and post-licensing compliance, each with Article 65 passporting into Spain. A CASP authorised in any EEA member state serves Spanish retail and institutional clients on identical terms to a Spanish-authorised provider, supervised by its home authority, while the CNMV as host authority can take precautionary measures under MiCA Article 102. See the full Cyprus CASP licensing guide →

When Spain Is the Right Choice

Consider a direct Spanish authorisation if: a visible domestic CNMV authorisation is commercially important for a Spanish-facing retail brand; the business is already established in Spain with Spanish-speaking compliance staff; or the operation benefits from proximity to the Spanish and Latin American markets and is comfortable with a Spanish-language authorisation process.

Otherwise, where English-language proceedings (Cyprus 8–14 months, Malta 9–18 months on our planning ranges) or Lithuania’s 4–8 month range are the priority, a jurisdiction plus passporting reaches the same clients.

Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.

Common Mistakes With the Spanish Regime

Most errors around Spain are strategic rather than procedural: they stem from misreading the transitional timeline or assuming a Spanish authorisation is the only way to reach Spanish clients. The most frequent missteps are below.

• Assuming the transition is still running. Spain’s transitional period, first set at 12 months to 30 December 2025 and then run to the full 18 months, ended on 1 July 2026; a provider without a CNMV authorisation, a MiCA passport, or an Article 60 notification can no longer rely on it.
• Assuming a Spanish authorisation is required to serve Spanish clients. Under MiCA Article 65 a CASP authorised in any EEA member state passports into Spain on identical terms to a Spanish-authorised provider.
• Treating the legacy registry as a licence. The Banco de España virtual currency registry is an AML measure that is now informational only and does not convert to MiCA status. Registry entries bought time during the transition; they were never authorisations.
• Underestimating the Spanish-language process. The CNMV operates primarily in Spanish. Applicants without Spanish-language compliance capability face slower drafting and correspondence and a higher risk of information-request cycles.
• Inadequate source-of-funds evidence for beneficial owners. As across the EU, qualifying shareholders (10%+) must evidence the legitimate origin of capital in depth. Tax returns, bank statements, and a multi-year record are the starting point, not a single certificate.
• Ignoring the advertising rules. MiCA’s marketing-communication rules apply to every CASP marketing to Spanish clients, and Article 247 of the LMV lets the CNMV subject crypto advertising to further control; its national Circular 1/2022 was repealed from 28 December 2024. Marketing into Spain must comply regardless of where the CASP is authorised.

Frequently Asked Questions

References