How Is Crypto Regulated in Spain in 2026: Mica, CASP Licensing, CNMV Registration and Transition Deadlines

Understanding how crypto is regulated in Spain has become an urgent priority for every exchange, custodian and token issuer operating in, or targeting, the Spanish market. The EU’s Markets in Crypto-Assets Regulation (MiCA) is now fully applicable, and the Comisión Nacional del Mercado de Valores (CNMV) is the designated national competent authority responsible for authorising Crypto-Asset Service Providers (CASPs). Spain’s transitional period, which allowed legacy operators to continue under pre-MiCA national rules, reaches its end-point on 1 July 2026, meaning platforms that have not secured CNMV authorisation by that date face an immediate prohibition on providing services.

This guide sets out the complete regulatory map, walks through the CASP licence application process step by step, explains stablecoin issuer obligations, and provides a practical timeline so compliance officers, founders and legal teams can act before it is too late.

How Is Crypto Regulated in Spain, Quick Regulatory Map

What the MiCA Directive Covers

MiCA, formally Regulation (EU) 2023/1114, creates a single, harmonised framework for crypto-asset markets across the European Economic Area. It applies to three broad categories of activity. First, the offering and admission to trading of crypto-assets, including the requirement to publish a MiCA white paper. Second, the issuance and redemption of asset-referenced tokens (ARTs) and e-money tokens (EMTs), the two MiCA classifications for stablecoins. Third, the provision of crypto-asset services by CASPs, covering custody, exchange, transfer, portfolio management, advice and order execution. Tokens that qualify as financial instruments, deposits or structured deposits under existing EU legislation remain outside MiCA’s scope, as do most unique, non-fungible digital assets (NFTs) that are not issued in large series.

Spanish National Overlay, CNMV, Bank of Spain and AML

In Spain, crypto regulation operates on two parallel tracks. The CNMV holds primary competence for CASP authorisation, market supervision and enforcement under MiCA. The Bank of Spain retains oversight of anti-money-laundering (AML) and counter-terrorist-financing (CTF) obligations through its registry of virtual asset service providers (VASPs), which was established before MiCA under Spain’s transposition of the Fifth Anti-Money Laundering Directive. MiCA crypto obligations do not automatically replace AML registry duties; industry observers expect both sets of obligations to continue running in parallel, with the Bank of Spain registry remaining relevant for AML-specific reporting even after a CASP secures CNMV authorisation. Spain’s Agencia Tributaria additionally imposes reporting requirements on crypto-asset holders and operators, including the Modelo 721 declaration for overseas crypto holdings.

CASP Licensing in Spain, Step-by-Step Requirements for Applicants

A MiCA licence, formally a CASP authorisation, is the mandatory gateway to lawfully providing crypto-asset services in Spain and, by extension, across the entire EU through passporting. The CNMV CASP licence process mirrors the structure familiar from MiFID investment-firm authorisation, but with crypto-specific documentation and prudential rules. Below are the core CASP license Spain requirements that applicants must address.

Minimum Capital and Prudential Requirements

MiCA sets tiered own-funds thresholds that vary by the type of crypto-asset service provided. The table below summarises the minimum permanent capital requirements drawn from the Regulation’s provisions.

Applicants must maintain own funds at all times equal to the higher of the applicable minimum or one quarter of fixed overhead expenses for the preceding year. The CNMV may also require a higher level of own funds where the risk profile of the applicant justifies it.

Governance and Senior Manager Fit-and-Proper Requirements

Every CASP applying to the CNMV must demonstrate that its management body collectively possesses adequate knowledge, skills and experience to oversee crypto-asset services. Individual directors and senior managers undergo a fit-and-proper assessment covering honesty, integrity, professional qualifications and the absence of criminal convictions relating to financial crime. Applicants are expected to submit detailed CVs, criminal background certificates and a description of the internal governance framework, including clear reporting lines, a compliance function and conflict-of-interest policies. Early indications suggest the CNMV is applying standards comparable to those used for MiFID firm assessments, meaning applicants should expect a rigorous review cycle.

Technical and Operational Resilience Expectations

MiCA places significant emphasis on ICT security and business continuity. CASP applicants must present policies and procedures addressing the following areas:

• ICT risk management. A comprehensive framework covering threat detection, incident response, penetration testing and vulnerability management, aligned with the Digital Operational Resilience Act (DORA) requirements that also took effect for financial entities in the EU.
• Custody and segregation of assets. Clear documentation on how client crypto-assets are safeguarded, segregated from the firm’s own assets and protected in the event of insolvency.
• Business continuity and disaster recovery. Plans ensuring the CASP can restore operations and client access within defined recovery time objectives.
• Outsourcing arrangements. Where critical functions are outsourced (cloud infrastructure, blockchain node operation), the CNMV expects detailed contracts, audit rights and contingency plans covering provider failure.
• AML/KYC programme. Full client on-boarding procedures, ongoing transaction monitoring, suspicious transaction reporting to SEPBLAC (Spain’s Financial Intelligence Unit) and travel-rule compliance for crypto-asset transfers.

Industry observers expect that CNMV review timelines for complete CASP applications will run between three and six months. Incomplete filings, particularly those lacking technical-resilience documentation, are the most common cause of delay.

CNMV CASP Licence, Registration, Authorisation and Supervisory Expectations

The CNMV receives and assesses all CASP authorisation applications for Spain. The process follows the procedure set out in Title V of MiCA: the applicant submits a dossier to the CNMV; the CNMV has 25 business days to confirm completeness; once complete, the CNMV has up to 40 business days to issue a draft decision; and ESMA is consulted before the final authorisation is granted or refused. If the CNMV does not meet its statutory deadlines, the application is not deemed approved by silence, applicants must receive an express decision.

In practice, the CNMV has encouraged prospective applicants to engage in informal pre-application dialogue to identify gaps in documentation early. Applicants should note that the CNMV coordinates with ESMA and may consult other national competent authorities where the CASP intends to passport services across borders. Once authorised, the CASP is entered into the ESMA register of authorised CASPs, which becomes the definitive public record for MiCA-licensed crypto exchanges operating in the EU.

Post-Authorisation Obligations, Reporting, Audits, AML/CTF and Governance Changes

Holding a CNMV CASP licence is the beginning, not the end, of the compliance journey. Authorised CASPs must comply with ongoing obligations that include:

• Periodic prudential reporting. Regular own-funds calculations and submission of financial statements to the CNMV.
• External audits. Annual financial audits by an approved statutory auditor, with the audit report filed with the CNMV.
• AML/CTF compliance. Continuous transaction monitoring, suspicious activity reporting to SEPBLAC, and annual internal AML audits.
• Material governance changes. Any change to the management body, significant shareholders, or the scope of authorised services must be notified to the CNMV in advance and may require a new assessment or an amendment to the licence.
• Consumer-facing disclosures. Prominent risk warnings on marketing materials and client-facing platforms, including the specific wording prescribed by MiCA for non-guaranteed crypto-assets.
• Record-keeping. All orders, transactions and services must be documented and retained for a minimum of five years, accessible to the CNMV upon request.

Failure to comply with post-authorisation requirements exposes CASPs to administrative sanctions, including fines and, in serious cases, revocation of authorisation.

Transitional Rules, Timelines and Immediate Actions for 2026

The question of how crypto is regulated in Spain during the transition from national rules to MiCA is the most time-sensitive issue for existing operators. MiCA included a transitional period allowing Member States to grant existing service providers continued operating rights, subject to conditions and a firm cut-off date. Spain has adopted a transitional arrangement under which providers already registered or authorised under national law could continue operating, provided they notified the CNMV and applied for full CASP authorisation within prescribed windows.

Critical action: Any platform that has not received CNMV CASP authorisation by 1 July 2026 will be prohibited from offering crypto-asset services in Spain. The likely practical effect will be a mandatory wind-down period in which the provider must stop on-boarding new clients, return customer funds and crypto-assets, and notify existing users.

Platforms that were operating lawfully under the Bank of Spain VASP registry before 30 December 2024, and that notified the CNMV within the prescribed window, are permitted to continue providing services during the transition. However, transitional status does not guarantee eventual authorisation, the CNMV may refuse the CASP application on substantive grounds.

For operators still in the application pipeline, the immediate actions are clear:

• Confirm transitional eligibility. Verify with the CNMV that your notification was received and accepted.
• Complete the CASP dossier. Ensure all governance, capital, technical resilience and AML documentation is submitted.
• Prepare a contingency plan. If authorisation is unlikely before the deadline, plan customer notification, asset return procedures and an orderly wind-down.
• Engage specialist legal counsel. Navigating CNMV engagement, ESMA consultation and cross-border passporting requires experienced regulatory advisors.

Stablecoins, ART and EMT Issuer Obligations Under MiCA in Spain

MiCA introduces specific regulatory categories for stablecoins that have been applicable since 30 June 2024. Asset-referenced tokens (ARTs) are crypto-assets that purport to maintain a stable value by referencing multiple currencies, commodities or other assets. E-money tokens (EMTs) reference a single official currency and function similarly to electronic money. The MiCA directive subjects both types to issuer-level regulation that is considerably more demanding than the rules for ordinary crypto-assets.

ART issuers must obtain authorisation from the CNMV (or the relevant NCA in their home Member State) before offering tokens to the public or seeking admission to trading. The application requires the publication of a detailed MiCA white paper, the establishment and maintenance of a reserve of assets backing the token on a one-to-one basis, and compliance with governance, disclosure and redemption-rights obligations. Where an ART is deemed “significant”, based on thresholds including customer base, market capitalisation and transaction volume, supervision shifts to the European Banking Authority (EBA) and additional prudential requirements apply.

EMT issuers must be authorised as a credit institution or electronic money institution under existing EU law. They must likewise publish a white paper, maintain reserves in segregated custody accounts, and grant holders a permanent redemption right at par value. MiCA compliant stablecoins are the only tokens that may legally claim price stability to the public within the EU, non-compliant issuers face enforcement.

The CNMV has signalled that it will closely monitor the marketing and distribution of stablecoins in Spain, particularly where tokens are offered to retail clients. Issuers and CASPs that list or facilitate trading in ARTs or EMTs should verify that all white paper, reserve and disclosure requirements are met before making these tokens available on Spanish platforms.

CASP vs VASP vs Pre-MiCA Registrations, Practical Comparison

Operators often confuse the legacy VASP registration at the Bank of Spain with the new CNMV CASP authorisation. The table below clarifies the differences and explains when each regime applies.

The key takeaway for operators is that a crypto license in Spain now means CNMV CASP authorisation. Legacy VASP registration alone is insufficient to continue operating after 1 July 2026, although AML obligations under the Bank of Spain framework are likely to persist alongside MiCA duties.

What to Do If You Are Unlicensed or Face Enforcement

Platforms that reach the transition deadline without CASP authorisation face immediate legal exposure. The CNMV has enforcement powers under MiCA that include administrative fines, cease-and-desist orders, and public censure. Early indications suggest that unlicensed providers operating after the cut-off will be treated as conducting unauthorised financial activity, a classification that carries severe penalties under both EU and Spanish law.

If your platform is approaching the deadline without authorisation, the following steps should be taken urgently:

• Cease on-boarding new clients. Stop accepting new customer registrations to limit further regulatory exposure.
• Notify existing users. Issue clear written communication explaining that services will be discontinued, setting out the timeline for asset withdrawal.
• Safeguard and return client assets. Ensure all client crypto-assets and fiat balances are identifiable, segregated and returned promptly.
• Document everything. Maintain a full audit trail of the wind-down process, regulators will review this if enforcement proceedings follow.
• Seek immediate legal advice. Engage a regulatory lawyer with CNMV experience to assess whether late filing, appeal or voluntary cooperation can mitigate sanctions.

Practical CASP Application Checklist for Spain

The following numbered checklist summarises the documentation and actions required to submit a complete CNMV CASP application. Applicants should treat this as a project plan and engage legal counsel to guide each step.

1. Determine which crypto-asset services fall within MiCA’s scope and identify the corresponding minimum capital tier.
2. Incorporate or confirm a legal entity established in Spain (or another EU Member State, if passporting into Spain).
3. Prepare governance documentation: organisational chart, board composition, fit-and-proper assessment files for all directors and senior managers.
4. Draft and evidence the AML/KYC programme, including SEPBLAC reporting procedures, client on-boarding workflows and transaction-monitoring systems.
5. Compile the ICT risk management framework, business continuity plan, disaster recovery procedures and outsourcing arrangements.
6. Prepare a custody and asset-segregation policy, demonstrating how client assets are protected.
7. Calculate and evidence the minimum own-funds requirement, supported by audited financial statements or a credible funding plan.
8. Draft the client-facing risk disclosures and marketing compliance policies required under MiCA.
9. Submit the complete dossier to the CNMV via its electronic registry, referencing the MiCA authorisation procedure.
10. Respond to any CNMV information requests within the statutory deadlines and engage in the ESMA consultation phase as required.

The CNMV’s dedicated MiCA section on its website provides forms, guidance documents and contact information for prospective applicants.

Conclusion, How Is Crypto Regulated in Spain and What to Do Next

The answer to how crypto is regulated in Spain in 2026 is unambiguous: MiCA is in force, the CNMV is the gatekeeper, and the transitional window closes on 1 July 2026. Every operator providing crypto-asset services to Spanish clients, whether headquartered in Spain or passporting from another Member State, must hold CASP authorisation or cease operations. Stablecoin issuers face additional ART or EMT obligations that have been live since mid-2024. The dual-track nature of Spanish regulation means AML duties at the Bank of Spain persist alongside MiCA prudential requirements at the CNMV.

The time to act is now. Operators should review their CASP application status, confirm transitional eligibility with the CNMV, and engage qualified legal counsel to navigate the authorisation process. Waiting until the final weeks before the deadline creates unacceptable risk, both to business continuity and to client assets. Professional regulatory guidance is strongly recommended.

Sources

1. CNMV, MiCA / Crypto Assets Thematic Page
2. ESMA, Markets in Crypto-Assets Regulation Overview
3. EUR-Lex, MiCA Regulation (EU) 2023/1114 Full Text
4. Agencia Tributaria, MiCA Analysis (April 2026)
5. Squire Patton Boggs, MiCA Legal Framework Compliance Guide
6. CMS Expert Guide, Crypto Regulation Spain
7. Lopez-Ibor Abogados, Spain MiCA Commentary
8. Alonsosala, MiCA Unlicensed Crypto Exchanges Spain
9. TaxDown, Cryptocurrency Taxes in Spain