How to Obtain Mica CASP Authorisation in Spain (CNMV) Step-by-step

Last reviewed: 9 August 2026

Obtaining a MiCA CASP authorisation in Spain is now the gateway for any crypto-asset service provider that wants to operate lawfully in the Spanish market and across the entire EU/EEA single market. Under Regulation (EU) 2023/1114 (MiCA), the Comisión Nacional del Mercado de Valores (CNMV) is the competent authority that grants full CASP authorisation in Spain, replacing the earlier, more limited virtual-asset service provider (VASP) registration that sat with the Banco de España. Whether you are a crypto exchange founder, a digital-custody provider, a wallet operator or a broker seeking EU-wide passporting, CNMV MiCA CASP authorisation is the licence you need.

• Quick answer: A complete CNMV CASP application requires 8–12 document bundles covering governance, capital, AML/CFT, IT security, business plans and outsourcing. Preparation typically takes 3–6 months, with CNMV review adding a further 3–9 months.
• Why this matters now (mid-2026): Firms still relying on transitional Banco de España VASP arrangements face growing enforcement risk. CNMV is actively processing authorisation dossiers, and ESMA’s supervisory briefing on CASP authorisation has set convergence expectations that applicants must satisfy now not later.

Process: How to Obtain CNMV MiCA CASP Authorisation 12-Step Checklist

Prepare the following application bundles before you file with the CNMV. Each step maps directly to the requirements set out in the CNMV Manual for CASP Authorisation and the ESMA supervisory expectations referenced above.

1. Legal entity and governance structure. Establish or confirm a qualifying legal entity with a registered office in Spain (typically a sociedad limitada or sociedad anónima). Prepare updated articles of association, bylaws, shareholder registries, group structure charts, board composition details and delegated-authority frameworks. What CNMV checks: legal form compliance, transparent ownership, clear lines of decision-making authority.
2. Fit-and-proper assessments. Compile detailed dossiers for all senior managers, directors and the designated heads of compliance and AML. Include CVs, professional qualifications, criminal-record certificates and declarations of conflicts of interest. The CNMV expects evidence of sufficient experience and, where relevant, Spanish-language capability for key local roles. What CNMV checks: integrity, competence, time-commitment and absence of disqualifying convictions.
3. Capital and prudential requirements. MiCA prescribes minimum own-funds thresholds that vary by service class (e.g., custody, exchange operation, transfer services). Prepare a capital plan, stress-testing scenarios, projected balance sheets and evidence of capital availability (bank statements, escrow letters). The EBA Q&A on own-funds requirements provides the current supervisory interpretation. What CNMV checks: compliance with MiCA own-funds articles, realism of financial projections, adequacy of capital buffers.
4. Prudential documentation and business continuity. Submit liquidity plans, internal-capital-adequacy-style notes, financial projections for at least three years and a comprehensive business-continuity and disaster-recovery plan. What CNMV checks: resilience in adverse scenarios, consistency with the business plan.
5. AML/CFT programme. Develop a risk assessment specific to your client base and service mix. Include written policies on KYC/KYB onboarding, transaction monitoring, PEP and sanctions screening, suspicious-transaction reporting to SEPBLAC (Spain’s Financial Intelligence Unit) and staff training. Align the programme with Spanish national AML legislation and with MiCA’s Title V provisions. What CNMV checks: comprehensiveness, alignment with risk profile, evidence of operational readiness.
6. IT, cybersecurity and custody controls. Document your cybersecurity framework, custody model (self-custody or delegated), key-management architecture, incident-response procedures and evidence of recent penetration testing. Third-party attestations (e.g., SOC 2 reports) strengthen the application. What CNMV checks: resilience of technology infrastructure, segregation of client assets, auditability.
7. Business plan and product descriptions. Detail every crypto-asset service to be offered, target jurisdictions for passporting, revenue model, fee schedules, marketing strategy and if applicable white papers for any self-issued tokens. What CNMV checks: commercial viability, consumer-protection safeguards, clarity of service boundaries.
8. Outsourcing and contracts. Map all material outsourcing arrangements, supply-chain dependencies and cloud-hosting providers. Provide executed SLAs, vendor-risk assessments and evidence of due diligence on third parties particularly custody sub-providers. The CNMV applies heightened scrutiny where critical or important functions are outsourced. What CNMV checks: control retention, exit strategies, audit rights over vendors.
9. Compliance manuals and internal controls. Submit a written compliance manual, internal-audit plan, record-keeping and data-retention policy and procedures for ongoing transaction reporting. What CNMV checks: completeness, board-level accountability, clear escalation paths.
10. Fees, forms and declarations. Complete the official CNMV filing forms, applicant declarations and pay the applicable administrative fee. Fee schedules should be confirmed directly via the CNMV MiCA portal. What CNMV checks: completeness of declarations, payment verification.
11. Evidence pack and submission checklist. Prepare an indexed document bundle with clearly labelled files, a master evidence index and certified translations of any documents not originally in Spanish. Common items requiring certified translation include corporate certificates from foreign registries, foreign-issued criminal-record checks and auditor reports. What CNMV checks: completeness of the dossier at intake incomplete packs are returned, adding months to the timeline.
12. Post-submission readiness. Before filing, ensure you have a remediation plan for CNMV information requests, capital escrowed and accessible on demand, and a communications plan for staff and stakeholders during the review period. What CNMV checks: responsiveness to supplementary questions, evidence that the entity is operationally ready to launch upon authorisation.

Downloadable resource: The CNMV CASP Evidence Matrix (Spain) maps each required document to the corresponding CNMV field, specifies whether a certified translation is needed and provides suggested filenames and typical page counts. See the section below for a preview and download details.

Comparison: CNMV CASP Authorisation vs Banco de España VASP Register

Before MiCA, Spanish crypto firms registered as VASPs with the Banco de España. That register was a national, transitional regime not a full authorisation. Firms wishing to continue operating a broader set of crypto-asset services or to passport into other EU/EEA member states must now obtain CNMV MiCA CASP authorisation. The table below summarises the key differences relevant to a VASP to CASP migration decision.

Industry observers expect CNMV to intensify supervisory pressure on firms that remain solely on the legacy VASP register without progressing their MiCA CASP applications. A comprehensive Bank of Spain VASP → CNMV CASP migration guide is forthcoming and will address transitional timelines and re-filing strategies in detail.

Key Requirements for MiCA CASP Spain Licence Eligibility

Legal Entity and Governance

Applicants must be legal persons established in Spain (or with a Spanish branch for certain third-country firms). The CNMV expects a clear organisational chart with named individuals in key functions at a minimum a CEO, head of compliance, AML officer and IT/security lead. Board members and qualifying shareholders are subject to documented fit-and-proper evaluations, including criminal-record checks and declarations of prior regulatory sanctions.

Prudential and Capital Requirements

MiCA sets minimum own-funds requirements that scale with the services offered. For example, firms providing custody or operating a trading platform face higher capital thresholds than those limited to transfer services. The MiCA Regulation (Title V) specifies the baseline, while the EBA Q&A provides evolving interpretive guidance. Applicants should prepare bespoke capital modelling a topic explored further in the CASP capital modelling guide (forthcoming). Stress-testing scenarios must reflect realistic adverse conditions for the crypto-asset markets in which the firm intends to operate.

AML/CFT Baseline

Spain’s AML/CFT framework requires coordination with SEPBLAC. Applicants must demonstrate an operational transaction-monitoring system, risk-based client onboarding and an established reporting workflow. All AML policies and staff-training materials must be available in Spanish.

IT, Operational Resilience and Custody

The CNMV expects documented cybersecurity policies, evidence of recent penetration tests, segregated custody arrangements for client assets and incident-response plans. For firms using third-party custody providers, a signed outsourcing agreement with audit rights is mandatory.

Certified Translations and Notarised Documents

Non-Spanish documents commonly requiring official (sworn) translation include:

• Corporate certificates certificates of incorporation, good-standing and shareholder registers from foreign registries.
• Criminal-record checks any background checks issued by non-Spanish authorities.
• Audited financial statements if prepared under non-Spanish GAAP.
• Professional qualifications degrees and professional certifications for fit-and-proper dossiers.

Realistic Timelines and Typical Fees for CNMV CASP Authorisation

The overall timeline from project kick-off to authorisation typically falls within the following bands (individual cases vary depending on completeness, service complexity and CNMV workload):

• Pre-filing preparation: 3–6 months document collection, capital arrangements, vendor contracts, gap analysis and mock reviews.
• CNMV review phase: 3–9 months from submission of a complete dossier. Complex custody models or novel token structures tend toward the longer end. The CNMV’s MiCA portal notes that timelines depend on the quality and completeness of the application.
• Post-authorisation compliance set-up: 1–3 months finalising systems, reporting connections and staff training before commencing regulated activity.

Indicative fee ranges: CNMV administrative fees plus external legal and advisory costs typically range from approximately €25,000 to €150,000 or more, depending on service scope, entity complexity and the number of jurisdictions targeted for passporting. Official CNMV fees should be confirmed via the regulator’s portal at the time of filing. These figures are indicative and should not substitute a tailored advisory quote.

Common Reasons for Delays and How to Avoid Them

Based on supervisory expectations published by the CNMV and ESMA, the most frequent causes of application delays include:

• Incomplete evidence packs missing documents trigger an information-request cycle that can add months.
• Weak fit-and-proper dossiers CVs lacking detail, missing criminal-record certificates or unexplained employment gaps.
• Insufficient capital plans unrealistic revenue projections or inadequate stress-test scenarios.
• Unclear outsourcing arrangements unsigned contracts, absent SLAs or no vendor-risk assessment.
• Poor AML controls generic policies not tailored to the applicant’s actual risk profile.
• Missing certified translations non-Spanish source documents submitted without sworn translations.

Mitigations: Use the CNMV manual templates, run an independent gap analysis before submission, conduct an internal mock review, and engage local counsel and compliance advisers early. The downloadable Evidence Matrix below is designed to help prevent these common errors.

Downloadable Document and Evidence Matrix

The CNMV CASP Evidence Matrix (Spain) is an editable Excel/PDF checklist that maps every required document to the corresponding CNMV field, specifies the evidence format (original, certified copy, certified translation), suggests filenames and provides typical page counts and redaction guidance. A sample of the matrix rows is set out below:

The matrix also includes a sample submission index page formatted for CNMV filing. An editable version is available for applicants to pre-fill and share with their advisory team.

Engagement Scope and Client Case Study

A typical MiCA CASP advisory engagement in Spain covers four phases: (1) gap analysis and readiness assessment; (2) document drafting, translation coordination and capital structuring; (3) CNMV filing management and information-request handling; and (4) post-authorisation compliance launch. Indicative advisory hours for a mid-sized CASP application range from 400 to 1,200 hours across legal, compliance and technical workstreams. Pricing is scope-dependent and should be discussed on a case-by-case basis.

Case study (anonymised): A European crypto-custody firm previously registered as a VASP with the Banco de España engaged advisers to migrate to full CNMV CASP authorisation. After six months of preparation focused primarily on outsourcing due diligence for a third-party key-management provider and strengthening fit-and-proper dossiers for two newly appointed directors the complete dossier was filed. The CNMV review took five months, with one supplementary information request. The firm received its authorisation and subsequently passported into five additional EEA markets within three months. Total timeline from kick-off to first passported service: approximately fourteen months.

Related Reading and Official Sources

The following resources support this guide and are recommended for applicants preparing a MiCA CASP application in Spain:

• Bank of Spain VASP → CNMV CASP migration guide step-by-step migration checklist for firms transitioning from the legacy register (forthcoming).
• Post-authorisation compliance for CASPs ongoing reporting, AML/CFT, record-keeping and audit obligations (forthcoming).
• CASP capital modelling detailed guidance on own-funds calculations, stress testing and EBA interpretation (forthcoming).
• CNMV CASP filing templates (annotated) annotated cover letters, index pages and sample CV formats for CNMV submission (forthcoming).
• Client case studies: CASP authorisations detailed anonymised timelines and outcomes (forthcoming).

Sources

• Regulation (EU) 2023/1114 (MiCA) EUR-Lex
• CNMV MiCA: Nueva regulación de criptoactivos
• CNMV Manual for CASP Authorisation
• Banco de España Registers (VASP Register & Transitional Notes)
• ESMA Supervisory Briefing on Authorisation of CASPs
• EBA Single Rule Book Q&A on Own Funds and Prudential Requirements