Spain

The most consequential development this cycle concerns the closure of MiCA's transitional, or 'grandfathering', arrangements. ESMA's April 2026 statement confirmed that the EU-wide transitional period under MiCA closed on 1 July 2026, meaning any crypto-asset service provider still operating without MiCA authorisation is now in direct breach of EU law rather than merely operating under a lapsing dispensation. Layered onto this is a national-level correction of particular note: earlier reporting had suggested Spain intended to shorten its own national grandfathering period below the eighteen-month maximum permitted under MiCA Article 143(3), with some accounts citing a twelve-month window ending as early as December 2025. This was flagged internally as an unresolved hedge pending primary confirmation. A Challenger-driven correction this cycle resolved the ambiguity: ESMA's own updated list of Member State grandfathering periods, published 1 December 2025, confirms that Spain in fact extended its national window to the full eighteen months, closing 30 June 2026 -- essentially converging with, rather than undercutting, the EU-wide 1 July 2026 deadline. This claim is retained at Probable confidence rather than upgraded to Confirmed, reflecting that it rests on a single tier-three secondary legal-commentary source rather than a directly retrieved Spanish transposition instrument; that underlying transposition text itself remains an open sourcing gap.

Supervisory posture has also hardened in parallel. CNMV has stated publicly, and repeated to industry press, that no exceptions or extensions will be granted to firms -- including named large exchanges -- that fail to secure MiCA authorisation ahead of the deadline, and that it is actively coordinating an orderly wind-down process for unauthorised operators still active in the Spanish market. This is treated as a non-binding supervisory statement of intent rather than a formal legal instrument, and is recorded without a regulatory_stage designation accordingly, consistent with its non-normative character.

Together, these three data points -- the EU-wide closure, the corrected national closure date, and CNMV's enforcement posture -- describe a single coherent narrative: Spain's crypto-licensing perimeter is now closed on both the European and national tracks, and the operative question going forward is one of enforcement and wind-down execution rather than further rule-making.

Outlook

The immediate forward-looking signal is enforcement follow-through: how CNMV's stated 'no exceptions' posture is applied in practice to firms that missed the deadline, and whether an orderly wind-down process materialises in observable regulatory action. On the evidentiary side, the leading open item is direct retrieval of Spain's actual national MiCA transposition statute or royal decree, which would allow the national grandfathering finding to be upgraded from Probable to Confirmed and would close the residual sourcing gap noted this cycle. The unresolved question of whether the CNMV/Banco de Espana dual-authority structure warrants a formal split-jurisdiction record is a registry-level decision rather than a substantive regulatory development, and is noted here for operator attention rather than resolved.

Two further boundary categories round out the classification picture. Non-fungible tokens are generally treated as falling outside MiCA's scope altogether, on the basis that they represent unique, non-fungible digital assets rather than fungible crypto-assets -- with the important exception that NFTs issued in large series or collections are treated as falling back within scope, since such issuance patterns are considered to exhibit fungible-asset characteristics in substance. Separately, crypto-assets that independently qualify as financial instruments under MiFID II -- so-called security tokens -- are excluded from MiCA entirely and instead governed under existing Spanish securities law, with CNMV retaining supervisory competence via its established securities-law mandate rather than its MiCA mandate. This boundary is informed by ESMA's 2025 classification and suitability guidance, which operationalises how firms and supervisors should treat instruments sitting near the MiCA/MiFID II perimeter.

This taxonomy is treated as settled EU law directly applicable in Spain, and none of the underlying claims this cycle indicate imminent change to the classification boundaries themselves. The residual areas of interpretive nuance -- the large-series NFT exception and the MiFID II security-token carve-out -- are both sourced to Probable rather than Confirmed confidence, reflecting that boundary application to specific token designs is inherently more fact-dependent than the core taxonomy itself.

Outlook

No change to the underlying classification framework is indicated this cycle; the taxonomy is expected to remain the stable reference point against which new token designs are assessed. The two areas most likely to generate future interpretive activity are the large-series NFT threshold, where issuers structuring large collections may test the boundary of the exclusion, and the MiFID II/MiCA security-token perimeter, where ESMA's ongoing guidance work suggests continued refinement of boundary cases rather than a wholesale reclassification of any category.

This is treated as a legitimate reflection of an EU-wide supervisory gap rather than a Spain-specific regulatory failure: the same absence of dedicated on-chain-activity rules is visible at the EU level, and Spain's position simply mirrors that broader gap. The confidence attached to these findings is correspondingly Probable-to-Uncertain rather than Confirmed, and each is recorded as a negative finding -- an absence of regulation -- rather than as a substantive rule, which is why none of these claims carry a regulatory_stage designation; the underlying activities remain, in effect, unaddressed by any binding instrument at the national level.

Outlook

This module is expected to remain a genuine supervisory gap rather than an area of imminent Spanish rule-making, absent a dedicated national initiative or a binding EU-level instrument specifically addressing staking, DeFi or validator-level activity. Given the thinness of the evidentiary base -- three negative findings sourced to EU-level EBA/ESMA material rather than Spain-specific sourcing -- this module's findings should be treated as provisional and revisited should a dedicated Spanish on-chain-activity rulemaking effort emerge.

Disclosure obligations run in parallel with these prudential requirements: issuers must publish and maintain a MiCA-compliant crypto-asset white paper and marketing communications, and are exposed to liability for damages caused by incorrect information contained in that white paper. A further tier of the regime applies specifically to ARTs or EMTs that are designated 'significant' under the EU stablecoin framework -- those judged, broadly, to pose systemic-scale risk by virtue of their size or interconnectedness -- which face enhanced prudential requirements, including additional own-funds requirements and interoperability obligations, applicable to any such token issued or circulating in Spain. This significance-designation layer is sourced to a single tier-three BIS publication rather than a primary EU or Spanish supervisory source, and no specific effective date is attached to it in the evidence retrieved this cycle, reflecting that it functions as a standing structural feature of the regime rather than a dated rule change.

Outlook

The core stablecoin framework is stable and fully operational, with no indication of imminent change to issuance, reserve, redemption or disclosure requirements. The significance-designation tier is the most likely locus of future regulatory attention, particularly should any ART or EMT circulating in Spain approach the scale thresholds associated with systemic designation; confirming the precise mechanics and any Spain-specific application of that designation against a primary EU or Banco de Espana source remains an open verification item.

On custody, MiCA prohibits authorised CASPs from outsourcing or delegating custody services to entities that are not themselves authorised as CASPs, closing off a route by which client assets might otherwise be routed to unsupervised third parties. MiCA-authorised firms are further required to provide transparent complaint-handling procedures and access to comprehensive product information -- a protection that, notably, does not extend to firms operating outside MiCA authorisation, reinforcing the practical stakes of the licensing-perimeter closure described elsewhere this cycle. Finally, CASPs providing advice or portfolio-management services must comply with MiCA Article 81 suitability requirements, including obtaining, verifying and periodically updating client information, per ESMA's 2025 suitability and periodic-statement guidelines.

Taken as a whole, this module describes a reasonably mature and actively enforced set of protections, with EU-level guidance from ESMA, EBA and EIOPA doing much of the work of operationalising specific requirements such as suitability assessment and consumer warnings.

Outlook

Core consumer-protection provisions are expected to remain stable, with continued EU-level guidance refining specific obligations such as suitability assessment rather than the underlying MiCA text changing. The most consequential dynamic to watch is the interaction between this module and the closure of the transitional licensing window: because several of these protections -- complaint-handling standards in particular -- are explicitly tied to MiCA-authorised status, the population of firms still winding down outside authorisation represents a corresponding population of consumers newly outside these protections.

At the EU level, the DAC8 crypto-asset reporting directive requires crypto-asset service providers across Member States, including Spain, to collect and report detailed user and transaction data to national tax authorities from 1 January 2026, with a compliance grace period running to 1 July 2026. This claim is sourced to a single tier-four news article rather than a primary EU or AEAT source, and is noted internally as sitting below the evidentiary bar ordinarily required to sustain Confirmed-tier confidence on its own; it is carried through unchanged from the Interpreter cycle pending further corroboration, and should be read with that caveat in mind. Separately, gains realised by Spanish tax-resident individuals on disposal of crypto-assets are understood to be treated as capital gains within the general scope of Spain's Personal Income Tax Law (Ley 35/2006, IRPF), consistent with the general characterisation of crypto-assets as property rather than currency for domestic tax purposes.

Two further areas remain open sourcing gaps rather than confirmed findings: Spain-specific VAT (IVA) treatment of crypto-asset exchange services, and Spain-specific withholding-tax rules applicable to crypto-asset transactions. Neither has been independently verified against a primary Spanish or EU source in this research pass; the only source reached for both was the AEAT electronic-office portal homepage, with no specific ruling or circular retrieved.

Outlook

Tax treatment is, by a clear margin, the thinnest-evidenced module in Spain's baseline this cycle, and this thinness reflects a structural feature of the crypto tax-research estate generally rather than a Spain-specific gap. The leading verification priorities going forward are direct retrieval of an AEAT circular or Order HFP/886/2023 text confirming the Modelo 721 instrument's precise scope, and a primary AEAT source addressing VAT and withholding treatment of crypto-asset transactions. The DAC8 grace-period expiry on 1 July 2026 is a further near-term marker meriting confirmation from a higher-tier source than currently available.

A further point of adjacency concerns sanctions: EU financial sanctions regimes, as implemented domestically in Spain, apply to crypto-asset transfers in the same manner as other financial transfers, and no crypto-specific derogation from general EU sanctions law was identified. This finding is carried here as subscribed-adjacent context rather than as original sanctions or AML analysis; the substantive treatment of this material sits with financial-integrity's monitoring, consistent with the routing already reflected in this cycle's cross-monitor flags.

Outlook

The core cross-border transfer framework is stable and unlikely to change materially in the near term, since it derives from directly applicable EU regulation rather than Spanish national instruments. The two negative findings -- no distinct national reporting threshold and no distinct national capital control -- should be read as confirmation of regulatory completeness at the EU level rather than as open questions requiring further Spanish-specific research, though continued monitoring of any future Spain-specific implementing measures remains warranted.