Spain: Consumer Protection

On custody, MiCA prohibits authorised CASPs from outsourcing or delegating custody services to entities that are not themselves authorised as CASPs, closing off a route by which client assets might otherwise be routed to unsupervised third parties. MiCA-authorised firms are further required to provide transparent complaint-handling procedures and access to comprehensive product information -- a protection that, notably, does not extend to firms operating outside MiCA authorisation, reinforcing the practical stakes of the licensing-perimeter closure described elsewhere this cycle. Finally, CASPs providing advice or portfolio-management services must comply with MiCA Article 81 suitability requirements, including obtaining, verifying and periodically updating client information, per ESMA's 2025 suitability and periodic-statement guidelines.

Taken as a whole, this module describes a reasonably mature and actively enforced set of protections, with EU-level guidance from ESMA, EBA and EIOPA doing much of the work of operationalising specific requirements such as suitability assessment and consumer warnings.

Outlook

Core consumer-protection provisions are expected to remain stable, with continued EU-level guidance refining specific obligations such as suitability assessment rather than the underlying MiCA text changing. The most consequential dynamic to watch is the interaction between this module and the closure of the transitional licensing window: because several of these protections -- complaint-handling standards in particular -- are explicitly tied to MiCA-authorised status, the population of firms still winding down outside authorisation represents a corresponding population of consumers newly outside these protections.