Crypto License in Spain 2026: MiCA, CASP and the Crypto Asset Reset
"Crypto license in Spain" used to mean one specific thing. A Bank of Spain registration under Royal Decree-Law 7/2021. It let a firm exchange virtual currencies for fiat, or hold crypto for clients. Useful, narrow, AML-flavoured. Now historical. The register stopped taking new entries on 30 December 2024. That was the day the Markets in Crypto Assets (MiCA) regulation's crypto asset service provider rules began to apply across the European Union (EU). From the same morning, the only crypto licence that actually opens doors is a CASP authorisation issued by the Comisión Nacional del Mercado de Valores. Spain has been unusually generous on the runway. Legacy firms have until 30 June 2026 to switch across. Past that date, only CNMV-authorised firms, or those passported in from another EU state, may legally serve Spanish clients. What follows walks through the reset — who the regulator is now, what the new licence requires, what it costs, how long it takes, and how Spain looks next to its EU neighbours.
From a Bank of Spain VASP register to a MiCA CASP licence in Spain
The old "crypto licence in Spain" was a registration, never a licence in the prudential sense. Royal Decree-Law 7/2021 transposed the EU's Fifth Anti-Money-Laundering Directive. It handed the Bank of Spain one narrow task. Keep a public list of virtual asset service providers that exchanged crypto for fiat, or held crypto wallets on behalf of clients. By early 2026 the list had grown to roughly 130 to 140 names. Some were large international exchanges; some were one-person bureaux. An AML measure, then. And one of the cheaper ways into Europe.
MiCA changed the category. Title V rules on crypto-asset service providers took effect on 30 December 2024. Spain transferred competence the same morning, from the Bank of Spain to the Comisión Nacional del Mercado de Valores. CNMV, for short. The National Securities Market Commission. The legacy register went quiet on the same date and is now informational only. So the body that supervises Spain's stock exchanges and listed companies now supervises crypto-asset firms as well, and signs off on every legitimate CASP.
This is not a rename. The old register was an anti-money-laundering precaution; the new authorisation is a full prudential and conduct licence — EU-passportable, with capital, governance and operational-resilience requirements bolted in. A firm that was perfectly compliant with the Bank of Spain regime in 2024 may now look thinly capitalised and operationally fragile against the CASP rules, because those rules were written for investment firms, not for AML registrants.
Three Spanish authorities remain in the picture, and it is worth knowing which one calls when the phone rings.
| Authority | Role in the new regime |
|---|---|
| CNMV | Authorises and supervises CASPs under MiCA Title V; runs the crypto-advertising regime. |
| Banco de España | Supervises e-money tokens and asset-referenced tokens (MiCA Titles III–IV); holds the legacy VASP archive. |
| SEPBLAC | Spain's financial intelligence unit; receives suspicious-activity reports and monthly threshold filings. |
Who needs a cryptocurrency license in Spain, and who doesn't
MiCA names ten regulated cryptocurrency services. If you offer any of them to Spanish or EU residents from Spain, you need a CASP authorisation. The obvious ones are there: running crypto exchanges or a trading platform, providing custody, executing client orders, and the reception and transmission of orders, including for initial coin offerings. The less obvious ones count just as much: managing a portfolio of crypto-assets, giving investment advice on them, placing them, and even doing nothing more than transferring crypto on a client's behalf. Touch any of these as a business and the licence is no longer optional.
Firms already supervised under European prudential rules get a quieter route. Banks, MiFID investment firms, e-money and payment institutions, and UCITS managers may notify the CNMV 40 working days before they start CASP activity, rather than running a fresh authorisation. The path is short because the supervisor has already seen most of what it needs, which is also why six of the first eleven authorised Spanish CASPs are banks.
Pure NFT marketplaces and decentralised protocols sit outside CASP scope, at least for now, unless their tokens fall under MiCA's broad crypto-asset definition. Miners, validators and pure blockchain infrastructure operators are similarly not CASPs, although the licensed crypto companies around them often run digital asset custody and digital wallet services under separate rules. Anyone with an EU-resident customer base should still watch DAC8, the tax-reporting layer described later in this article. It does not need a licence to bite.
CNMV requirements for obtaining a CASP license: what's in the file
What the CNMV wants on its desk is a programme of operations: every service the firm intends to sell, the business model behind each one, and the resourcing plan to actually deliver them. Spanish applications routinely run past 100 pages, with supporting binders running further still. The file is not a form to fill in. It reads as a working business plan and business model for the company you intend to be, written for a reader who will ask "why" on every other page.
Four pillars carry most of the weight. The first is governance, because the CNMV will not authorise a firm whose leadership it cannot place. So the file must contain identity and fitness checks for every shareholder above 10 per cent, for every director, for every key function holder, and it must contain board minutes, conflict-of-interest policies, a complaint-handling procedure, and a written business-continuity plan. The second pillar is capital, which we will cover in its own section below. The third is anti–money laundering: an internal control body, an appointed AML officer, a named SEPBLAC liaison, and a manual that maps cleanly to Spain's Law 10/2010, together with know your customer and customer due diligence procedures that the regulator can stress-test on the day.
The fourth pillar is operational resilience, where most files come back marked up. DORA, the EU's Digital Operational Resilience Act, sets the bar. Applicants must show how their information and communication technology is governed, tested and protected against third-party concentration risk. ESMA's July 2025 peer review told national supervisors to scrutinise this chapter in particular, and to handle late filers — companies trying to slip in just before the grandfathering deadline — with what the regulator politely called "considerable caution".
Paperwork is rarely what stops a file. Substance is. From the applications I have seen advisers walk through with prospective founders, the chapters that come back covered in red ink are almost always the operational-resilience plan and the section describing the independence of the MLRO. Compliance with MiCA requirements is decided on those two chapters more than on any other, and the CNMV has shown no appetite for accepting hand-waving on either.
Capital and cost requirements for a crypto business in Spain
MiCA sets three capital tiers. They are the same in every EU country, and they look deceptively gentle.
| CASP class | Minimum capital | Services covered |
|---|---|---|
| 1 | EUR 50,000 | Reception and transmission of orders, placement, advice, portfolio management, transfers |
| 2 | EUR 125,000 | Exchange of crypto for fiat or other crypto; execution of orders |
| 3 | EUR 150,000 | Operation of a trading platform; custody and administration of crypto-assets |
Read on its own, the table suggests that even a venue-grade crypto exchange could launch with EUR 150,000 in the bank. That reading is wrong. MiCA also requires own funds equal to at least a quarter of the previous year's fixed overheads. So an exchange running EUR 5 million in annual costs has a floor of EUR 1.25 million; an exchange at EUR 20 million has a floor of EUR 5 million. Whichever number is larger is the prudential capital the firm must hold. The minimums in the table are exactly that, minimums, and most platforms outgrow them in their first calendar year.
The Spanish side then adds a stack of unavoidable spend. Setting up a Sociedad Limitada (the Spanish private limited company / limited liability company form) or Sociedad Anónima and registering with the Registro Mercantil typically costs EUR 3,000 to 10,000. Notary fees, sworn translations and apostilles run another EUR 2,000 to 5,000. Legal and consultancy fees on the application itself land between EUR 30,000 and EUR 80,000. A Class 1 advisory book sits at the lower end. A full trading-platform package eats the upper end. A physical office in Spain is required for any company in Spain registered to carry out CASP activities in Spain. Virtual offices do not survive the substance review. Add an MLRO salary, DORA testing, a first-year supervisory fee and professional indemnity insurance, and the realistic year-one all-in budget for a small Spanish CASP sits in the EUR 100,000 to 250,000 range, on top of the capital itself.
Competitor pages tend to quote the minimum capital number and leave it there. The honest answer is the overhead floor plus the run-rate — founders who go in expecting otherwise spend their first six months arguing about the budget instead of writing the file.
Timeline for crypto licensing in Spain: three to five months
The Spanish licensing procedure follows MiCA's statutory clock in two stages, beginning the moment you apply for a CASP license and submit the file. The CNMV has 25 working days to confirm that the application is complete; if it is not, the clock pauses while the applicant fills the gaps. Once completeness is confirmed, the substantive assessment runs for another 40 working days, with a 20-working-day extension available for complex cases. On paper, that is roughly three months.
In practice, according to the April 2026 Legasset register tracker, firms that obtain a crypto license through the CNMV land authorisation in three to five months from kick-off. That puts the CNMV among the faster national supervisors in the EU. The 2025 ESMA footnote still applies: late filers hoping to scrape through before the grandfathering deadline will find the pace much slower, and the regulator has every right to let them wait.
The 30 June 2026 cliff for legacy VASPs in Spain
Spain's transitional regime is the longest in the EU, but it nearly was not. The original plan was twelve months of grandfathering, with legacy VASPs sunsetting on 30 December 2025. Late in 2025 ESMA flagged a cliff-edge risk: too many firms, too few authorisations, the lights about to go off all at once. Madrid extended the runway by six months. From 1 July 2026, only CNMV-authorised firms or EU-passported CASPs may serve Spanish customers, and that is the end of the conversation.
The numbers against that wall look thin. By 12 April 2026 only eleven firms held a full Spanish CASP authorisation: six banks (BBVA, Cecabank, Openbank, Renta 4, CaixaBank, Kutxabank) and five fintechs, led by Bit2Me. The legacy register at its peak held more than ten times that number. The bottleneck is operational, not legal. Some legacy firms are exiting, quietly. Others are folding into a CASP already authorised in another member state and passporting back in. A handful are racing to file, although the CNMV has signalled that arrivals close to the deadline will not be waved through.
Spain vs other EU countries: legal framework compared
MiCA harmonised the capital and the rulebook, so the differences between EU jurisdictions are no longer found in the statutory text. They sit in the tempo of the national supervisor, the working language of the file, and the surrounding tax regime.
| Jurisdiction | Regulator | Capital range | Realistic timeline | English | Corporate tax |
|---|---|---|---|---|---|
| Spain | CNMV | EUR 50–150k | 3–5 months | Partial | 25% |
| France | AMF and ACPR | EUR 50–150k | 6–9 months | Yes | 25% |
| Germany | BaFin | EUR 50–150k | 6–12+ months | Yes | ~30% effective |
| Lithuania | Bank of Lithuania | EUR 50–150k | 3–6 months | Yes | 15% |
| Malta | MFSA | EUR 50–150k | 6–9 months | Yes | 5% effective |
| Netherlands | AFM and DNB | EUR 50–150k | 6–9 months | Yes | 25.8% |
Spain sells two things to founders: speed and access. The CNMV's review pace is in the same bracket as Lithuania's, the country opens onto a Spanish-language market of more than 500 million speakers, and from Madrid the path into Latin American banking flows is shorter than from anywhere else in the bloc. The drag is real too. CNMV correspondence is often in Spanish, the corporate tax rate sits above Lithuania's and Malta's, and opening a Spanish bank account for a crypto-native firm is the part of the project nobody plans enough time for.
On speed-to-licence, Spain has become one of the EU's more pragmatic options, and is considered one of the faster CASP regimes alongside Lithuania. The wider league table tells its own story. Germany leads Europe with 53 authorised CASPs as of mid-April 2026, then the Netherlands at 25, France and Norway tied at 13, Malta at 12, Spain at 11, Lithuania at 10, Austria at 9. Across 23 countries the EU-EEA total stood at 199.
AML, money laundering and DAC8 reporting
Regulatory compliance does not end the moment the CASP licence lands. Spain's Law 10/2010 governs anti–money laundering and terrorist financing duties for crypto firms, with SEPBLAC supervising. Authorised CASPs file monthly reports on individual transactions above EUR 30,000, maintain Travel Rule compliance on transfers including those to and from self-hosted wallets, and submit suspicious-activity reports on demand. None of that is optional, and SEPBLAC has shown that it audits.
A new layer kicked in on 1 January 2026. DAC8, the eighth amendment to the EU's Directive on Administrative Cooperation, asks CASPs to collect reportable transaction data on EU-resident users from that date, with the first reports due between January and 30 September 2027. Spain layers DAC8 on top of existing tax forms 172, 173 and the foreign-crypto declaration form 721 for holdings above EUR 50,000. Two reporting universes, one set of clients, very little time to build the pipes.
Enforcement is the part that founders underestimate. In November 2025 the CNMV fined X (formerly Twitter) EUR 5 million for hosting unauthorised crypto promotions from "Quantum AI", the largest crypto-related platform sanction in Spain to date. A month later the BOE published a EUR 30 million SEPBLAC fine against CaixaBank for AML deficiencies. Individual fines for promoting crypto without CNMV-aligned disclosures run as high as EUR 300,000 per offence. The lesson is hard to miss: the CNMV is willing to reach for the platform that hosted the ad, not just the firm that wrote it.
What the Spanish crypto CASP licence buys licensed crypto companies
A single Spanish authorisation passports into the rest of the EU under MiCA Article 65, giving access to 27 EU member states and three EEA economies. The passport covers the wide range of crypto services MiCA actually defines, which is most of what a normal exchange or broker does. Of the 199 authorised CASPs as of April 2026, 171 had already activated the passport, an 86 per cent rate. For a firm targeting the Spanish-speaking world, the licence is also a regulatory home base for Latin American operations that ultimately route flows back into Europe.
The caveats matter. Host-state regulators retain consumer-protection powers and can still act against marketing or distribution breaches inside their borders. Stablecoin issuance is not part of a CASP licence; it requires a separate authorisation from the Bank of Spain under MiCA Titles III and IV. And CNMV Circular 1/2024 sets advertising rules that even authorised firms must respect.
Conclusion
The crypto license in Spain that founders chased a year ago no longer exists in that form. What is available now does something larger: the licence in Spain allows a single authorisation to operate across the EU, on terms that are demanding but predictable. The trade is real capital and real substance against a fast NCA and a long transitional runway that closes on 30 June 2026. Spain is not the cheapest seat in Europe, nor the most English-friendly. For founders who want speed, Spanish-language reach and an EU passport in one package, the CNMV's door is one of the more pragmatic ones in the bloc.
