Portugal#
MiCA (Regulation (EU) 2023/1114), implemented nationally via Lei n.º 69/2025, applies directly and is fully in force. Supervisory responsibility splits between CMVM (CASP authorisation/conduct, Titles II & VI) and Banco de Portugal (ART/EMT issuer authorisation and prudential supervision, Titles III & IV), confirmed via ESMA's Article 93 competent-authority list. Despite the regime being fully in force and the Article 143(3) grandfathering window having closed on 1 July 2026 per ESMA's public statement, Portugal's ESMA interim register showed zero authorised CASPs as of mid-2026, versus 57 in Germany and 26 each in France and the Netherlands.
The regime's practical bite, however, diverges sharply from its formal completeness. As of mid-2026, Portugal's entry in ESMA's interim MiCA register showed zero authorised CASPs, against 57 in Germany and 26 each in France and the Netherlands. This finding rests on a single T4 news source (The Block), corroborated by two further T4 outlets (Incrypted, Cointelegraph) reporting the same cross-EU register figures; absent a directly cited T1/T2 primary source, the crypto guardrail Confidence Floor caps this claim at Probable rather than Confirmed, and that downgrade has been applied and carried through composition unchanged.
Compounding the authorisation gap, MiCA's Article 143(3) transitional (grandfathering) provision — which had permitted pre-existing Portuguese virtual-asset service providers to continue operating pending authorisation or its refusal — formally closed on 1 July 2026, per ESMA's 23 June 2026 public statement. Any legacy entity that has not by now secured MiCA authorisation is required to have wound down crypto-asset services in Portugal. Given the mid-2026 zero-authorisation count, this creates a live supervisory and market-access uncertainty: it is not established from current sourcing whether any legacy entities continued operating past the deadline, nor what enforcement posture CMVM or Banco de Portugal has taken toward them. That question remains open in the gaps register rather than resolved here.
Outlook
The immediate forward marker is enforcement follow-through: whether CMVM and Banco de Portugal move visibly against any unauthorised legacy operators now that the transitional window has closed, and whether Portugal's authorisation count moves off zero as pending applications (if any) clear. The current record also flags, but does not resolve, whether Portugal's Banco de Portugal/CMVM dual-authority model should eventually be treated as a JID-split candidate analogous to the Netherlands' DNB/AFM structure — a pipeline-wiring question for a later cycle, not a judgment this composition makes. Confidence on the authorisation-throughput figure should be expected to firm toward Confirmed only once a T1/T2 primary citation to the live ESMA register is obtained.
Crypto Licensing
The defining fact for crypto licensing in Portugal is the expiry of the transitional regime created by article 6 of Lei n.º 69/2025, the statute implementing the Markets in Crypto-Assets Regulation domestically. That provision allowed entities registered with Banco de Portugal before 30 December 2024, and that had already commenced duly-notified virtual-asset activity, to continue operating until 1 July 2026 or the date of a final Markets in Crypto-Assets authorisation decision, whichever occurred first. That deadline has now passed, and the transitional carve-out is closed as a matter of law.
The practical consequence of that closure is now visible in supervisory data. The European Securities and Markets Authority maintains an interim register of authorised crypto-asset service providers across the Union, and the version of that register dated 7 October 2026 shows only a single Portugal-supervised entity holding completed authorisation. This is a strikingly small number set against the hundreds of authorisations recorded bloc-wide, and it is the clearest available evidence of how the Portuguese authorisation pipeline has handled the population of firms that relied on the now-closed transitional cover. The regime's substantive legal architecture is otherwise settled and not in question: Banco de Portugal and the Comissão do Mercado de Valores Mobiliários have clearly delineated supervisory competence, and the licensing requirement itself, as a matter of law, is neither new nor ambiguous.
What is ambiguous is enforcement and compliance behaviour among the population of firms that no longer benefit from transitional cover but have not yet secured full authorisation. Portuguese commentary describes operating as a crypto-asset service provider without authorisation, once the transitional window has closed, as a contraordenação muito grave, a very serious administrative offence under the domestic regulatory-offence taxonomy. That characterisation is sourced to commentary rather than to a primary statement of the applicable fine schedule, and the precise monetary range attaching to that offence category for unauthorised post-deadline activity has not been independently located. Similarly, the own-funds and prudential-capital figures that apply to firms going through the Portuguese authorisation process under Markets in Crypto-Assets article 67 and Annex IV have not been confirmed from a primary source; the transitional-deadline finding itself, by contrast, is corroborated between a Tier 3 legal-commentary source and the Tier 1 designation of competent authorities under the same statute, which supports treating it as a confirmed rather than merely probable fact.
The analytical question this authorisation gap raises is not one of misconduct but of supervisory capacity and pacing. A jurisdiction can have an entirely clear and legally settled licensing requirement while still facing a bottleneck in the administrative machinery that turns applications into grants. Whether the single-authorisation count reflects genuinely modest applicant volume in Portugal specifically, or a backlog at one or both of the two competent authorities, cannot be determined from the evidence available. Either reading has implications for any firm relying on, or seeking to rely on, a Portugal-granted Markets in Crypto-Assets authorisation and its associated passporting rights across the Union.
Outlook
The single metric worth tracking forward is movement in the Portugal-supervised authorisation count on the ESMA interim register. A rise toward a figure more proportionate to the market that previously operated under transitional registration would suggest the October snapshot reflected a processing lag rather than a durable constraint; a count that remains flat across further register updates would strengthen the case that this is a structural capacity issue at Banco de Portugal and the Comissão do Mercado de Valores Mobiliários. Two specific evidentiary gaps remain open for a future cycle: the precise contraordenação fine schedule applicable to unauthorised post-deadline crypto-asset-service activity, and the own-funds figures actually applied through the Portuguese authorisation process under Markets in Crypto-Assets article 67 and Annex IV. Neither gap affects the confirmed status of the transitional-deadline finding itself, which rests on corroborated evidence.
3 earlier distinct update(s)
Crypto Licensing
Portugal's crypto-asset licensing regime is governed by Lei n.º 69/2025, which implements the Markets in Crypto-Assets Regulation domestically and designates Banco de Portugal as the authorising authority for crypto-asset service providers. Banco de Portugal communicates its authorisation, extension, reduction and revocation decisions to the Comissão do Mercado de Valores Mobiliários, and the two authorities are under a joint statutory obligation to publish and keep updated a list of entities authorised or otherwise entitled to provide crypto-asset services in Portugal. This authorisation requirement and the associated publication duty have been in force since 2 July 2026 and represent the settled core of Portugal's licensing architecture.
The defining event of this reporting period is the lapse, on 1 July 2026, of the MiCA transitional regime that had permitted continuity of operation for pre-existing virtual-asset service providers. Under that transitional arrangement, entities registered with Banco de Portugal as of 30 December 2024, with activity duly commenced and formally notified, were entitled to continue operating under the prior regime until 1 July 2026 or until Banco de Portugal granted or refused their MiCA authorisation application, whichever occurred first. This transitional permission is corroborated independently by Banco de Portugal's own press release confirming the same cutover date and legal basis, giving this finding a Confirmed confidence rating grounded in primary-source agreement. With the window closed, no further transitional carve-out exists: an entity providing crypto-asset services in Portugal today must either hold a final MiCA authorisation or be in the formal process of a pending application that was lodged while transitional protection still applied.
The operative transparency mechanism accompanying this framework, the jointly published Banco de Portugal/Comissão do Mercado de Valores Mobiliários list of authorised and transitionally-permitted entities, is reported to have included eight entities meeting the specified transitional conditions as of one recent check shortly after 10am on a Wednesday. This figure should be read as a single-point-in-time snapshot rather than a stable count, since authorisation decisions continue to be processed and the list is designed to be kept current rather than fixed.
Separately, minimum own-funds requirements applicable to crypto-asset service providers in Portugal follow MiCA's tiered structure: €50,000 for advisory and order-reception-and-transmission services, €125,000 for custody and exchange services, and €150,000 for operating a trading platform, with an alternative floor of one quarter of the preceding year's fixed overheads where that figure is higher. These capital tiers are sourced from commentary restating the MiCA Annex IV framework as applied in Portugal rather than from a Banco de Portugal primary document, and should be read as probable rather than confirmed pending a primary-source citation.
Penalty exposure under the regime is reported as substantial: very serious infractions, including unauthorised provision of crypto-asset services, market manipulation, and the provision of false or misleading information, carry fines of up to €2.5 million for natural persons and up to €5 million for legal persons. The precise statutory article establishing this penalty tier has not been independently pinpointed this cycle, so this figure likewise carries a probable rather than confirmed confidence rating.
The practical reality accompanying this now-fully-operative legal framework is a reported gap between legal force and administrative processing capacity. Industry commentary indicates that firms with MiCA authorisation applications under review have faced processing delays, creating a period of practical uncertainty for entities whose prior transitional protection has lapsed but whose final authorisation status remains pending. This is a capacity observation rather than a legal one: the authorisation requirement itself is settled and enforceable, but the administrative apparatus processing applications against that requirement is, per industry reporting, running behind the volume of applications before it.
Outlook
The central forward-looking question is how quickly the backlog of pending MiCA authorisation applications clears, now that the transitional safe harbour that had covered pre-existing virtual-asset service providers has lapsed. The jointly published Banco de Portugal/Comissão do Mercado de Valores Mobiliários authorised-entities list is the most direct available indicator of that clearance rate, though its update cadence and the stability of the entity count it reports have not been independently tracked across multiple points in time this cycle. No further legal change to the licensing framework itself is indicated; the open variable is administrative throughput against an already-settled legal requirement, a distinction that matters for any entity assessing its own authorisation timeline against the now-closed transitional window.
Crypto Licensing
Portugal's crypto-asset licensing regime is now structurally settled around Banco de Portugal as the primary authorising and prudential authority, a correction to an earlier interpretive framing that had placed CMVM as primary. The governing instrument is Regulation (EU) 2023/1114 (MiCA) as implemented through Lei n.º 69/2025. The national transitional regime, which had allowed pre-existing virtual-asset service providers registered with Banco de Portugal to continue operating pending full authorisation, closed on 1 July 2026. At that deadline, only Bison Bank held a full Crypto-Asset Service Provider authorisation, meaning the transition produced an authorisation bottleneck: other firms that had relied on the transitional window faced the prospect of lapsing into unauthorised status if they had not secured full authorisation by the deadline.
This is a core-authorisation regime that is in force, but the transition has not yet produced a settled multi-firm authorisation base. The open question for the current period is whether Banco de Portugal has issued further full CASP authorisations since the July 2026 deadline; the available record does not establish this either way, leaving the single-authorisation-holder position as the most recent confirmed state.
Crypto Licensing
CASP authorisation in Portugal is now required under MiCA (Regulation (EU) 2023/1114), administered through coordination between Banco de Portugal and CMVM under the domestic implementation, Law No. 69/2025. CMVM acts as the securities-markets competent authority for CASP conduct and prudential supervision. Entities that were registered with Banco de Portugal for virtual-asset activity as of 30 December 2024, with their activity duly notified, may continue operating under transitional arrangements only until 1 July 2026, or until MiCA authorisation is granted or refused, whichever occurs first. This transitional-deadline finding is sourced directly to Banco de Portugal's own authorisation guidance and is the single most consequential near-term compliance date facing Portugal's crypto sector.
Outlook
The 1 July 2026 cutover is the item to watch: whether previously-registered entities secure full MiCA authorisation, are refused, or exit the Portuguese market before the deadline will be the clearest observable signal of how the transitional regime resolves in practice.
Sources and findings (9)
- T1 · ESMACrypto-asset service providers (CASPs) operating in Portugal — MiCA authorisation, with ongoing supervision split: CMVM (CASPs, Titles II & VI) and Banco de Portugal (ART/EMT issuer authorisation & prudential supervision, Titles III & IV) retrieved M5 binding in force new
- T1 · Assembleia da República / Diário da RepúblicaLei n.º 69/2025 (Portugal's national MiCA implementing law) — Banco de Portugal and CMVM, per MiCA Article 94, including a sanctions regime for crypto-asset market abuse retrieved M5 binding in force new
- T1 · ESMAMiCA Article 143(3) grandfathering clause (Portugal) — 1 July 2026, or grant/refusal of MiCA authorisation if earlier — this transitional window has now concluded per ESMA's public statement of 23 June 2026; unauthorised legacy entities must wind down crypto-asset services in Portugal retrieved M4 non-binding updated
- T4 · The BlockPortugal (MiCA-authorised CASP count) — mid-2026, per ESMA's interim MiCA register, versus Germany (57), France and Netherlands (26 each) retrieved M5 non-binding updated
- T3Portugal MiCA transitional regime — Entities previously registered with Banco de Portugal under the pre-MiCA virtual-assets AML regime could continue operating under a transitional regime until 1 July 2026, or until a final MiCA authorisation decision, whichever occurred first retrieved M4 binding in force
- T4Portugal CASP authorisation regime — Operating as a crypto-asset service provider in Portugal without MiCA authorisation after 1 July 2026 is prohibited; firms relying on the old Banco de Portugal registration are treated as trading unlicensed retrieved M4 binding in force
- T3 · Ana Pimenta AdvogadosLei n.º 69/2025, art. 6.º — Entities registered with Banco de Portugal before 30 Dec 2024 and that had commenced duly-notified activity could continue virtual-asset activities until 1 July 2026 or final MiCA authorisation decision, whichever occurred first. retrieved M5 binding in force
- T3Portugal MiCA implementing regime — Operating as a crypto-asset service provider in Portugal without MiCA authorisation after the end of the transitional period is treated as a contraordenação muito grave (very serious administrative offence). M4 binding in force
- T2Lei n.º 69/2025 — Very serious infractions (including unauthorised provision of crypto-asset services, market manipulation, false/misleading information) carry fines up to €2.5m (natural persons) / €5m (legal persons) retrieved M4 binding in force