Crypto License in Spain

Such provisions as crypto regulation Spain MiCA shall provide a single CASP authorization EU. In Spain, the national authorities competent for the authorization and supervision are CNMV. Once authorized, a provider can passport its activities across the EU under its home country’s supervision and subject to notification in the host states.

CASP License in Spain: Key Takeaways

1. Scope. The authorization as a CASP will cover custodial and Spain crypto exchange services, order handling, portfolio management, advice, placement, and operation of a trading platform in Crypto License in Spain.
2. Capital. Mostly, the required minimum initial capital will depend on the nature of the services to be provided, often being fixed at around €50,000, €125,000, or €150,000. In addition, firms shall have own funds equal to at least one quarter of fixed overheads of the preceding year, or where that is higher, an amount equal to the fixed overheads for the previous year.
3. Governance. Fit-and-proper managing, clear organizational structure, effective risk and adherence functions, and robust ICT/security arrangements.
4. Client protection: It involves the usual segregation of client acquisitions, info disclosures, complaints handling, and marketing to be in line with the Spanish advertisement rules for MiCA license Spain.
5. Passporting. CNMV consent implies that the service could be provided across the EU under a simple notification regime.

Crypto Exchange Spain MiCA Operation: Conventional Rules and Dates

1. Cut-off date: This MiCA regulation became effective on 30 December 2024.
2. Transitional period in Spain: Active providers before that date may continue with the operation for a certain period of time, although in all cases, CASP authorization shall be obtained in Spain crypto licence regulation before 30 December 2025 if still active by then or earlier if authorization is granted or refused.
3. New entrants: To start providing in-scope services, firms entering the market after 30 December 2024 need to have CASP authorization.

Have any questions?

Fill out the form and our lawyer will contact you to discuss the details and offer you the best solution for your needs

Send Request

Who Needs CASP Authorization?

You will need crypto license under MiCA if you supply:

1. Holding and administering Spain cryptocurrency license for customers or on behalf of customers in Spain or even targeting the Spanish/EU market. 
2. Exchange services: crypto-fiat and/or crypto-crypto. 
3. Receiving and transmitting orders and working as a recipient or executor for clients. 
4. Managing crypto-asset portfolios. 
5. Offering investment advice in the CASP license in Spain under MICA. 
6. Placing crypto-assets. 
7. Working on a trading platform for cryptocurrencies. 

After VASP to CASP transition, levels of Spain crypto license requirements for each service shall be met in the case where the business model is developed in two or more services.

Funds and prudential demands

1. €50,000 for “light” intermediation, i.e., reception/transmission, advice.
2. €125,000 for exchange services, and for custody/administration of client crypto-assets.
3. €150,000 for operating a trading platform.
4. Own-funds floor: eligible own funds shall not be less than one quarter of the fixed overhead of the undertaking for the preceding financial year in regard to the initial capital threshold of that undertaking.
5. Professional Indemnity /Insurance: Adequate quantum in cover would be taken out by the applicant where relevant, considering the scale and nature of activities.
6. Liquidity and Stress Preparedness. The adoption of internal frameworks on liquidity risk management, including cash-flow planning and stress scenarios, should be accompanied by wind-down arrangements.

Governance, Substance, and People

1. Local substance. A MiCA compliant crypto company established in Spain or in any other Member State of the EU, created in due form, with adequate presence of staff and decision-making located within the EU.
2. Fit-and-proper: Directors and key functionaries have to be of high standing and experience and without any conflicts of interest.
3. Three lines of defense. Three clearly demarcated functions-business roles, risk and compliance functions, and internal audit staff.
4. ICT and Security – Systems underpinned with documented policies and methods in the area of cybersecurity, incident response, data protection, business continuity planning, and controls over outsourcing allowances.
5. Safeguarding. This includes client-asset segregation, reconciliation routines, and custody transparency.

File on the Request (key components)

1. To get a CASP license in Spain, include all that is needed to present a complete, coherent application file to the CNMV. This normally incorporates:
2. Corporate Pack: constitutional documents; group chart; disclosures on shareholding and control; ultimate beneficial owners.
3. Program of Operations: Detailed description of services, target consumers, distribution channels, and the nature of services to be cross-border in design.
4. Governance Framework: Board and Committees; roles and responsibilities, evidence of fitness and propriety.
5. Risk & Compliance: Risk inventory; Market, Operational, AML/CTF, ICT, and Conduct Risk policies; Compliance Monitoring Plan.
6. Capital and Financials: Initial capital proof, projections, calculation of fixed overhead methodology, own funds, wind-down plan.
7. Safeguarding of Client Assets: Model for segregation, wallet architecture, reconciliations, access controls. ICT & Outsourcing: Map of systems, register of services, vendor due diligence, SLAs, exit strategies.
8. Customer Documents: T&Cs, risk disclosure, fee schedule, complaints policy, and workflow for handling complaints.
9. Marketing Policy: The measures that are in place are framed in such a way that it would ensure fair and clear advertisement and communication of the promotional offers that should not be misleading under the laws and rules of Spain.

Ongoing obligations after authorization

1. Reporting to CNMV: periodic activity and prudential returns, incident notifications, governance changes, and significant outsourcing updates.
2. Conduct of business: best execution (where applicable), conflicts of interest management, inducements controls, and transparent pricing.
3. Complaints handling: accessible channels, defined SLAs, root-cause analysis, and remediation.
4. Record-keeping: robust logs enabling audit and supervisory review.
5. Marketing compliance: pre-clear internal controls for campaigns, disclaimers, and channel governance.

Implementation roadmap (practical steps)

1. Check on the eligibility. Align your services with MiCA categories and confirm the minimum threshold of funds it falls under.
2. Entity and Substance. Set up or adapt an EU vehicle; appoint or resize significant compliance, risk, MLRO, technology roles.
3. Policies. Prepare and tailor policies on government risk, AML/CTF, ICT, safeguarding, conflicts, complaints, and outsourcing.
4. Operational model. Finalize custody architecture, Cryptocurrency exchange license in Spain, liquidity arrangements, platform controls together with flows for onboarding clients, and KYC/EDD.
5. Financial readiness. Capital injection, overheads estimation, definition of treasuring and liquidity rules, and designing wind-down scenarios.
6. Request preliminaries: Prepare the CNMV pack with annexes and approvals at board level. Ensure that your disclosures and marketing material are up to date.
7. Supervisory engagement. Respond to information requests, system presentations, and operational readiness tests.
8. Go-live and passporting. Post-authorization, inform the host states to start supplying services across the EU.

Operations in Spain

1. Diversity in Advertising: Make sure that all advertisement campaigns and influencers follow Spanish standards regarding cryptocurrency advertisement, particularly clearness in risk and protection of the target audience. 
2. AML/CTF Co-operation: Harmonize the internal AML controls relating to customer due diligence, ongoing monitoring, and questionable activity reporting. 
3. Complaints and language. The client-facing documentation and complaints channels to be provided must be adapted to Spanish retail users where relevant.

At Eternity Law, we deliver practical crypto license application support built around regulatory strategy rather than formal submission alone. As a multidisciplinary crypto law firm, we provide bespoke crypto licensing legal services that align business intent with supervisory expectations at an early stage. Our tailored MiCA legal services focus on structuring governance, capital logic, and compliance architecture to withstand regulatory review across the EU. Through in-depth CASP compliance services, we design sustainable AML/KYC-models, transaction controls, IT-governance, and reporting systems fit for long-term supervision. 

Ongoing crypto regulation consulting from Eternity Law helps clients navigate regulatory change, supervisory dialogue, and cross-border exposure without operational disruption. With advanced CASP passporting legal support, licensed frims can lawfully extend activities into multiple EU-jurisdictions while preserving consistency. Each project is led by an experienced crypto lawyer from Eternity Law, ensuring defensible authorization, reduced regulatory risk, and stable market positioning for digital asset businesses.

FAQ

Have any questions?

Fill out the form and our lawyer will contact you to discuss the details and offer you the best solution for your needs

Send Request