Mica CASP Authorisation in Portugal

By Jonathon Richards

– posted 2 hours ago

A practical, step-by-step guide to obtaining a MiCA CASP licence in Portugal regulator contacts, required documents, realistic timelines and next steps to get banking and local counsel.

Regulator: Bank of Portugal & CMVM who to contact
Complete application checklist (PDF)
Estimate your timeline & costs

Quick Summary What Is MiCA CASP and Why Choose Portugal?

What MiCA Covers

If you are exploring a MiCA CASP Portugal strategy, the starting point is the EU-wide framework itself. Regulation (EU) 2023/1114 the Markets in Crypto-Assets Regulation (MiCA) establishes a single authorisation regime for crypto-asset service providers (CASPs) across the European Union. It covers the issuance, offering and trading of crypto-assets, as well as core services such as custody, exchange, portfolio management and transfer of crypto-assets on behalf of clients. Any firm that provides one or more of these services to EU customers must hold an authorisation from a national competent authority or benefit from a valid transitional arrangement.

Portugal’s National Implementation

Portugal completed its national implementation of MiCA through Lei n.º 69/2025, published in the Diário da República on 9 December 2025. This national execution law designates domestic supervisory authorities, establishes filing procedures and sets out penalty regimes applicable to CASPs operating in Portugal. For applicants, the practical effect is straightforward: Portugal now accepts and processes full MiCA CASP authorisation applications, and firms that previously held a VASP registration in Portugal must transition to a full licence within the statutory window or cease providing crypto-asset services.

Market Context and Urgency

The combination of transitional deadlines and Portugal’s growing reputation as a crypto-friendly European jurisdiction has created a concentrated wave of authorisation activity throughout 2026. Media reporting indicates that Portuguese regulators have faced significant application volumes, and industry observers expect processing bottlenecks to persist through the second half of 2026. For exchanges, token projects and VASPs considering Portugal as their home Member State, the message is clear: early, well-prepared applications will gain a material advantage in the queue.

Who Issues CASP Authorisations in Portugal Bank of Portugal vs CMVM

Supervisory Split Prudential vs Conduct Responsibilities

Portugal’s national execution law assigns MiCA supervisory responsibility across two authorities. Understanding this split is critical before you file, because the regulator you engage with first and the portal you submit through depends on the nature of your crypto-asset services.

Aspect	Banco de Portugal	CMVM
Primary role	Prudential supervision	Market conduct supervision
Key responsibilities	Capital adequacy, safeguarding of client funds, operational resilience, AML/CFT oversight	White paper approval, investor protection, market abuse, transparency and disclosure
Authorisation role	Grants CASP authorisation (prudential assessment)	Supervises conduct obligations and crypto-asset offerings post-authorisation
Filing portal	bportugal.pt supervised entities portal	cmvm.pt criptoativos section
Suggested initial contact	Supervisory licensing department; request a pre-filing meeting	Criptoativos / Digital Assets unit; submit preliminary queries via portal

This dual-authority model reflects the broader European approach (paralleling EBA/ESMA responsibilities at EU level) and is codified in Lei n.º 69/2025.

Where and How to File Applications

Applications for a CASP licence Portugal should be submitted through the Banco de Portugal’s supervised-entities portal. Before filing, applicants are strongly advised to request a pre-filing meeting by emailing the licensing department and including a brief summary of the proposed services, corporate structure and target markets. For matters relating to white paper obligations or conduct-related queries, contact the CMVM’s Criptoativos unit via the dedicated portal section. Practical tip: prepare a one-page executive summary of your business model regulators find this useful as a basis for pre-filing discussion.

Practical Tip When to Approach Bank of Portugal vs CMVM

If your primary services involve custody, exchange or transfer of crypto-assets, begin with Banco de Portugal. If you intend to issue or publicly offer a new crypto-asset (and therefore require white paper approval), engage CMVM in parallel. In most cases, applicants will interact with both authorities it is best practice to notify each regulator of your engagement with the other at the outset.

Step-by-Step Application Roadmap How to Obtain a CASP Authorisation in Portugal

The following ten-step roadmap covers the complete journey from initial assessment to post-filing engagement for a MiCA CASP Portugal application.

Pre-assessment and jurisdiction decision. Confirm that Portugal is the optimal home Member State for your authorisation. Consider your corporate footprint, target customer base and passporting strategy. If your operations and management are centred in Portugal, it is likely the natural choice. Remember: your MiCA authorisation in Portugal enables EU-wide passporting, so the jurisdiction decision shapes your entire European market-access plan.
Corporate and establishment requirements. Establish a Portuguese legal entity (typically a sociedade por quotas or sociedade anónima) with a registered office in Portugal. At least part of the management body must be resident in or have a demonstrable connection to Portugal. Register the entity with the Conservatória do Registo Comercial and obtain a Portuguese tax identification number (NIF).
Governance and fit-and-proper assessment. Appoint a board and senior management team that satisfies MiCA’s fit-and-proper criteria. Document governance policies covering decision-making, risk management, internal control and conflicts of interest. Prepare detailed CVs, criminal record certificates and professional reference letters for each proposed director and key function holder.
AML/KYC framework and reporting. Appoint a dedicated AML compliance officer based in Portugal. Prepare a risk-based AML/KYC programme including customer due diligence procedures, transaction monitoring rules, suspicious transaction reporting (STR) mechanisms and a sanctions screening policy. Document training plans and audit schedules.
Prudential requirements: capital, reserves and safeguarding. Calculate the minimum initial capital required for each CASP service you intend to offer (MiCA sets different thresholds depending on service type for example, custody-only services have different requirements than combined exchange and transfer services). Arrange proof of capital (bank statements, auditor confirmation) and establish client fund safeguarding arrangements either through segregated accounts, insurance or a combination as permitted by MiCA and EBA technical standards.
IT security, operational resilience and DORA overlap. Prepare a comprehensive IT security report covering encryption, access controls, business continuity and disaster recovery. Address the Digital Operational Resilience Act (DORA) requirements that apply to CASPs including ICT risk management, incident reporting and third-party ICT provider oversight. Document penetration testing results and remediation logs.
Outsourcing and third-party providers. If you outsource critical or important functions (cloud hosting, custody technology, market data feeds), prepare detailed outsourcing agreements and vendor due diligence files. The regulator will expect documented risk assessments, exit strategies and service-level agreements for each outsourced function.
Compliance manuals, policies and crypto-asset documentation. Compile the full suite of compliance policies: complaints handling, conflicts of interest, market abuse prevention, client communication and if applicable white paper documentation for any crypto-asset you intend to offer to the public. Ensure all documents are available in Portuguese as required.
Filing the application. Submit the completed application pack through the Banco de Portugal portal, including all required forms, signed attestations and supporting annexes. Common attachments include: articles of association, shareholder structure charts, audited financial statements, governance and AML manuals, IT security report, proof of capital and outsourcing agreements.
Post-filing engagement. After submission, expect a completeness check followed by substantive review questions from the regulator. Respond promptly delays in remediation are the single biggest cause of extended timelines. Be prepared for conditions attached to the authorisation (e.g., enhanced reporting obligations during the first year of operations) and pre-authorisation supervisory contact.

Required Documents Checklist

Document category	Specific items
Corporate formation	Articles of association, certificate of incorporation, shareholder register, group structure chart
Governance	Board and senior manager CVs, criminal record certificates, professional references, governance policy manual
AML/KYC	AML/CFT policy manual, risk assessment, CDD procedures, STR process, sanctions screening policy, training plan
Financial & prudential	Audited financial statements, proof of initial capital, safeguarding arrangements, business plan (3-year projections)
IT & resilience	IT security report, business continuity plan, disaster recovery procedures, penetration test results, DORA compliance statement
Outsourcing	Third-party contracts, vendor due diligence reports, exit strategies, SLAs
Compliance & operations	Complaints handling policy, conflicts of interest policy, market abuse prevention, sample client agreements
Crypto-asset specific	White paper (if applicable), token classification analysis, custody procedures documentation

Timeline & Common Delays Realistic Milestones and 2026 Bottlenecks

Typical Timeline

Phase	Activities	Estimated duration
Preparation	Entity formation, policy drafting, capital arrangement, IT readiness	2–4 months
Pre-filing	Pre-filing meetings, regulator queries, gap remediation	1–2 months
Filing & completeness check	Submission, regulator acknowledges receipt, initial completeness review	1–2 months
Substantive review	Regulator Q&A rounds, remediation requests, additional evidence	3–6 months
Decision	Authorisation granted (with or without conditions) or refused	1–2 months
Total (end-to-end)		8–16 months

Realistic 2026 Processing Expectations

Given the surge in applications triggered by transitional deadlines, industry observers expect Portuguese regulators to apply particularly careful scrutiny throughout 2026. Common causes of delay include incomplete governance documentation, inadequate client fund safeguarding arrangements, weaknesses in AML/KYC frameworks and unclear IT resilience strategies. Applications that arrive without a complete document pack or that fail the initial completeness check are likely to be deprioritised in the queue.

Practical Mitigation Steps

Pre-filing meetings: Always request a meeting with the Banco de Portugal licensing team before submitting. This allows you to clarify expectations and identify potential gaps early.
Templates and standardised documents: Use industry-standard governance and AML templates adapted for MiCA, reviewed by local counsel.
Staged submissions: Where regulators permit, consider submitting core documents first and supplementary materials on an agreed schedule this demonstrates progress and engagement.

Passporting & EU Single-Market Implications

How Authorisation in Portugal Enables EU-Wide Passporting

A key advantage of MiCA CASP Portugal authorisation is the ability to passport services across all EU and EEA Member States without obtaining separate licences. Under MiCA’s passporting provisions, once authorised in Portugal, a CASP may notify its home authority (Banco de Portugal) of its intention to provide services in other Member States. The home authority then communicates this to the host-state regulator within a defined notification period. Following this process, the CASP may commence cross-border operations.

Interactions with Host Member State Rules

Although passporting eliminates the need for a separate authorisation, host Member States retain certain conduct and consumer-protection powers. CASPs must comply with local marketing rules, language requirements and any specific host-state obligations relating to investor protection. It is essential to map these requirements for each target market before launching cross-border operations.

Banking & Operations in Lisbon Practical Tips and Partner Introductions

Practical Realities of Opening Bank Accounts

Securing banking relationships remains one of the most challenging aspects of establishing a crypto business in Portugal. Commercial banks apply enhanced due diligence to CASP applicants, and KYC expectations include full corporate documentation, source-of-funds evidence, business plan presentations and increasingly proof of regulatory status or a credible pending application. Applicants should expect the banking onboarding process to take two to four months and should approach multiple banks in parallel.

Suggested Approach for Exchanges and Token Projects

Prepare a detailed bank memo that includes: a clear description of your business model, your regulatory status (or application timeline), your AML/KYC framework summary, projected transaction volumes and a named compliance contact. Present this memo to compliance-ready relationship managers at Portuguese commercial banks. Having local counsel make an introduction significantly improves response rates and accelerates the onboarding conversation. Intro available via the GLE network.

Operational Set-Up in Lisbon

Beyond banking, crypto companies establishing a Lisbon crypto hub presence should plan for the following operational requirements:

Office space: A physical registered office in Portugal is required. Lisbon and Porto offer flexible co-working and serviced-office options suitable for initial operations.
Payments and payroll: Register with Portuguese tax authorities, set up local payroll for resident employees and establish payment processing arrangements. Intro to local payroll providers available via GLE network.
Tax registrations: Obtain corporate income tax (IRC) and VAT registrations. Portugal crypto tax and VAT basics should be addressed with a local tax adviser.
Local vendors: Key partner types include local counsel, payments integrators, custody technology providers and compliance monitoring platforms. Intro available via GLE network for each category.

Fees, Costs and Sample Budgets

Three Sample Scenarios

The total cost of obtaining a CASP licence Portugal varies significantly depending on the complexity of your services, corporate structure and readiness level. The following table provides indicative ranges for three common scenarios.

Cost category	Light (single service, simple structure)	Standard (2–3 services, moderate complexity)	Complex (full service suite, multi-jurisdictional group)
Legal & compliance fees	€40,000–€70,000	€80,000–€150,000	€150,000–€300,000+
Regulatory filing costs	Variable (confirm with regulator)	Variable	Variable
Minimum capital requirement	€50,000–€125,000	€125,000–€150,000	€150,000+
IT security & DORA compliance	€15,000–€30,000	€30,000–€80,000	€80,000–€200,000
Banking onboarding costs	€5,000–€10,000	€10,000–€25,000	€25,000–€50,000
Estimated total	€110,000–€235,000	€245,000–€405,000	€405,000–€700,000+

Near-Term Variable Costs That Commonly Surprise Applicants

Remediation requests: Regulators may require additional policies, updated IT reports or restructured governance arrangements each round generates additional legal and consulting fees.
Increased capital during negotiations: Depending on the risk profile of your services, regulators may impose higher capital buffers than the statutory minimums.
Local auditor fees: Portuguese auditors (ROC Revisor Oficial de Contas) must review financial statements, and crypto-sector engagements command premium fees due to the specialised nature of the work.

Downloadable Checklist & Next Steps

Download our free Portugal CASP application checklist (PDF) a printable one-page document covering pre-filing steps, the complete document list, suggested file-naming conventions, regulator contact details, a high-level timeline and a sample budget breakdown. Also included: a sample table of contents for a MiCA governance pack.

For applicants ready to move forward: a tailored CASP pre-assessment includes a document gap analysis against MiCA and Portuguese national requirements, a personalised timeline estimate based on your current readiness level and a curated shortlist of local counsel and banking partners matched to your service profile and budget.

Sources

FAQs

How do I apply for a MiCA CASP authorisation in Portugal?

Start with a pre-assessment to confirm you qualify as a CASP, prepare governance, AML/KYC, IT/security and capital documentation, then submit the application to the competent authority (Banco de Portugal or CMVM depending on service). Expect a completeness check followed by a substantive review period.

Which regulator issues CASP licences in Portugal — Bank of Portugal or CMVM?

Portugal assigns supervision across Banco de Portugal (prudential tasks) and CMVM (market conduct). Application and reporting routes depend on the service mix; consult the national execution law and both regulators for specifics.

What documents and capital requirements are needed for a CASP application in Portugal?

Applicants must provide incorporation documents, CVs of senior managers, governance policies, AML manual, IT security report, proof of required initial capital and client fund safeguarding arrangements. Exact capital thresholds vary by the crypto-asset service being offered — see the checklist table above.

How long does a CASP authorisation take in Portugal and what causes delays?

Typical end-to-end timelines range from eight to sixteen months depending on complexity. Common delays include incomplete submissions, AML framework gaps, safeguarding weaknesses and 2026 processing bottlenecks due to high application volumes across Portuguese regulators.

Can a Portugal CASP licence passport services across the EU?

Yes — MiCA authorisation in Portugal enables EU-wide passporting under specified notification procedures. You must notify Banco de Portugal of your intent to serve other Member States and comply with host-state conduct and consumer-protection rules.

How do exchanges and token projects open bank accounts in Portugal under MiCA?

Prepare a detailed bank memo covering your business model, regulatory status, AML programme summary and projected volumes. Approach multiple Portuguese commercial banks in parallel, and use local counsel or a professional network to facilitate introductions to compliance-ready relationship managers.

What happens if my CASP application is refused or delayed?

If refused, the regulator provides written reasons; applicants typically have the right to appeal through administrative channels. If delayed, the most effective remedy is proactive engagement — respond swiftly to regulator queries and consider requesting a progress meeting.

Do I need a Portuguese resident director or local office?

Yes — MiCA and Portuguese national law require a registered office in Portugal. At least part of the management body should be resident in or demonstrably connected to Portugal. A physical office address is necessary for regulatory correspondence and supervisory purposes.