Spain: Crypto Licensing

Crypto Licensing

Spain's crypto-asset licensing regime is anchored in Regulation (EU) 2023/1114 (MiCA), supervised domestically by the CNMV. The national transitional period that MiCA allowed member states to offer to already-operating providers ended on 1 July 2026, having exercised the regulation's maximum 18-month transitional option under article 143(3). Since that date, only entities holding CNMV authorisation or an EU passport issued by another MiCA-competent authority may lawfully provide crypto-asset services in Spain. This core authorisation architecture is settled and in force, and no development this cycle disturbs it.

What has changed sits in the implementing detail layered on top of that settled regime. Real Decreto 813/2026 introduces a new precondition for CASP authorisation: applicants must obtain a prior report from SEPBLAC before CNMV can grant MiCA authorisation. The decree's own preamble connects this change to Spain's forthcoming FATF mutual evaluation, framing the SEPBLAC gateway as part of a broader pre-emptive tightening of the country's AML architecture ahead of that review. This requirement is enacted but not yet effective; it is scheduled to take legal effect on 28 October 2026. Separately, the same decree mandates identity verification for every transaction at a crypto-asset ATM or kiosk, regardless of the transaction amount, closing an anonymity gap that previously allowed small-value crypto-ATM transactions to proceed without identification. This duty carries an 18-month transitional period, becoming fully applicable on 8 April 2028.

An open question from this cycle is whether the SEPBLAC prior-report requirement reaches back to CASPs already authorised under the existing regime, or applies only to new applicants submitting authorisation requests after the rule's effective date. This was not established in the material reviewed this cycle, and it matters directly to the group of banks and fintechs reported to already hold CNMV authorisation.

Outlook

The 28 October 2026 effective date for the SEPBLAC gateway and the 8 April 2028 end of the crypto-ATM transitional period are the two concrete dates to track. Beyond those, the retroactivity question for already-authorised CASPs is the clearest gap likely to be resolved as CNMV or SEPBLAC issue further implementing guidance, and would materially affect compliance planning for the firms already holding authorisation.

Crypto Licensing

Spain's application of the Markets in Crypto-Assets Regulation's national transitional arrangement for pre-existing crypto-asset service providers, under Article 143(3), ended on 30 June 2026. The CNMV confirms that Spain had decided to apply this transitional period through that date, giving providers already operating in the Spanish market before MiCA's full application a defined window to secure CNMV authorisation rather than face immediate cessation of activity. That window has now closed.

From 1 July 2026, the practical consequence is that any crypto-asset service provider operating in Spain without CNMV authorisation under MiCA no longer has a lawful basis to onboard new customers or market its services, and is expected to take immediate steps to wind down its EU activities in an orderly manner. ESMA has stated this expectation directly, and frames it with two elements held together: orderly cessation of unauthorised activity, and active safeguarding of client interests together with mitigation of risks to market integrity during that process. The pairing matters because it signals that supervisory attention is directed not only at the authorisation gap itself but at how an exit is managed — stranded client assets or abrupt service interruption during wind-down would themselves be a supervisory concern distinct from the underlying authorisation question.

This development sits within the crypto licensing module because it concerns market access and authorisation status directly: the transitional period functioned as a grandfathering mechanism, and its expiry removes that accommodation rather than altering the underlying authorisation requirement, which has applied under MiCA since the regulation's entry into application. The regulatory stage for this requirement is properly characterised as in force, since the operative deadline — 30 June 2026 — has passed and the obligation to be authorised, or to be winding down, is now the live legal position rather than a forward-looking one.

What the available evidence does not establish is the on-the-ground compliance picture following the deadline: how many previously-unauthorised providers have completed wind-down, how many have since obtained authorisation, and how many continue to operate despite the expired transitional status. That gap is a function of what has been reliably retrievable to date, not a finding about market conditions, and is not asserted either way here.

Outlook

The legal position is now settled: MiCA authorisation is required for crypto-asset service provision in Spain, the prior transitional accommodation has expired, and both the CNMV and ESMA have articulated an active expectation of authorisation or orderly exit. Future periods should be watched for any CNMV disclosure of authorised-entity counts or enforcement activity against providers that remain unauthorised, since that is the information that would convert the current legal expectation into an observable compliance outcome.

Crypto Licensing

Spain's crypto-asset licensing regime completed its most consequential transition to date on 1 July 2026, when the MiCA transitional period for legacy virtual-asset service providers closed. The CNMV's own FAQ documentation states directly that the transitional period concludes on this date, and from that point forward only CNMV-authorised crypto-asset service providers, or those authorised in another EU member state and passported into Spain, may lawfully provide crypto-asset services in the jurisdiction. This is a confirmed, in-force change with direct primary-source support, and it represents the culmination of the phased MiCA rollout rather than a discrete new development layered onto a stable base.

The practical consequence for the licensing architecture is significant. Prior to this cliff, Spain operated a dual-track system in which the Banco de España maintained a register of virtual-currency-exchange and custodial-wallet providers that allowed firms to operate on a transitional basis while full MiCA authorisation was pending. That legacy register is now, on the evidence available this cycle, a wound-down list: it no longer confers an independent licence to provide crypto-asset services in Spain. Any firm that continues to rely on legacy Banco de España registration alone, without having separately obtained CNMV CASP authorisation, sits outside the lawful operating perimeter as of the transitional close-out. This shifts Spain's authorisation architecture from the prior dual Banco de España/CNMV structure to a single CNMV gate, a structural narrowing of the licensing pathway rather than a mere administrative housekeeping change.

A genuine gap remains in the evidence base: whether any specific legacy registrant failed to secure CNMV CASP authorisation before the cliff and is currently operating unlawfully was not established this cycle. This is not a finding one way or the other, simply an unresearched question, and it should not be read as either confirming or ruling out non-compliant legacy operators in the current Spanish market. The token-classification framework that governs what falls within this licensing perimeter, MiCA's asset-referenced-token, e-money-token and other-crypto-asset taxonomy, applies directly in Spain without a national variant, meaning the classification question and the licensing question sit within the same directly-applicable EU legal framework rather than diverging at the national level.

Outlook

The central open question for the licensing module going into the next cycle is enforcement follow-through: whether the CNMV, now sole gatekeeper, identifies and acts against any legacy registrant that failed to transition into full CASP authorisation before 1 July 2026. Because the underlying instrument is the directly-applicable MiCA regulation rather than a Spain-specific transitional rule subject to further domestic amendment, the single-gate architecture established this cycle should be read as a durable feature of the Spanish market rather than a temporary state pending further legislative action. Confirmation of the post-cliff compliance picture, and any CNMV enforcement action against non-compliant legacy operators, would be the most consequential development to track next.

Crypto Licensing

Spain's crypto-asset service provider licensing regime completed its MiCA transition this cycle. As of 1 July 2026, all crypto-asset service providers operating in Spain must hold full CNMV authorisation under MiCA Title V; legacy Bank-of-Spain VASP registration alone is no longer sufficient. Spain adopted the maximum eighteen-month transition window running to 1 July 2026, notwithstanding earlier signals from Spanish authorities that they might shorten it to 31 December 2025. The comply-or-quit deadline has now passed.

Outlook

The traffic-light posture is amber pending clarity on CNMV's enforcement approach toward providers that have not completed authorisation; watch for the first enforcement actions against stragglers as the clearest signal of how strictly the deadline will be policed.