CMS Expert Guide to Crypto Regulation in Spain

Disclaimer: This chapter was last updated on 5 September 2023 and does not reflect any subsequent developments. The information provided is intended for general informational purposes and should not be construed as legal advice.

1. How is crypto regulated?

AML RegulationFinancial Services Regulation

The Fifth Money Laundering Directive (5MLD) was transposed into Spanish Law through Royal Decree-Law 7/2021, of 27 April (RD-Law 7/2021).

Such RD-Law 7/2021 also introduced the most relevant amendments on Law 10/2010 of 28 April 2010 on the prevention of money laundering and terrorist financing (Law 10/2010) including as obliged entities the exchanges of virtual currency for fiat and e-wallet custodian service providers.

Main financial services regulation: Spanish Law 6/2023 of 17 March on Securities Markets and Investment Services ("LMVSI")

2. Are the following activities regulated or unregulated in your jurisdiction? ― Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking

AML RegulationFinancial Services Regulation

These activities are not regulated in Spain (i.e., there are no specific rules on how the activities may or may not be carried out).

Consequently, until the Regulation on Markets in Cryptoassets (MiCA) comes into force, there is no license required to undertake these activities.

Notwithstanding, in terms of Law 10/2010, Spain has considered that:

  • Cryptocurrency exchanges; and
  • Cryptocurrency custody providers that operate in Spain,

are required to be registered before the “Special Registry of exchange of virtual currency for fiat currency and electronic wallet custodian service providers”, that is under supervision of the Bank of Spain, in accordance with additional disposition two of Law 10/2010 on AML.

Considering the aforementioned, (i) borrowing/lending; and (ii) yield/staking in cryptoassets are not regulated and do not have specific requirements to be met.

These activities are not regulated in Spain for cryptoasset businesses. Nevertheless, in the event that a cryptoasset is considered as a financial instrument, the Spanish and European financial markets regulation shall apply in the performance of such activities. 

The approval and publication of the LMVSI are relevant for those activities related to cryptoassets which are considered securities. In this line, the following points introduced in the LMVSI are key:

  • Inclusion of Distributed Ledger Technology ("DLT") as a valid system for the issuance, registration, transfer or custody of financial instruments, as well as the necessary rules to ensure legal certainty in the representation of tradable securities through market infrastructures based on DLT;
  • Introduction of aspects related to MiCA and the advertising of crypto-assets, as well as the supervisory and sanctioning regime of the crypto-asset market.

3. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?

AML RegulationFinancial Services Regulation

As previously stated, there is currently no license to be obtained in Spain.

Nevertheless, when MiCA comes into force this will change as the issuance of tokens and the cryptoassets service providers activities will be regulated.

In terms of the “Special Registry of exchange of virtual currency for fiat currency and electronic wallet custodian service providers”, the legal frame is 3 months, but the Bank of Spain usually makes additional information requirements in order to restart such time frame. The average is usually around 5-6 months.

N/A

4. What would be the approximate overall cost of obtaining a licence?

AML RegulationFinancial Services Regulation

Please consider our previous answers.

The cost of registration will depend on the type of activity intended to be carried out and will depend on the level of development the entity already has in terms of AML and the effort required to adapt it.

N/A

5. What is the probability (%) of success in obtaining a licence?

AML RegulationFinancial Services Regulation

Please consider our previous answers.

The probability of success will be dependent on the type of activity intended to be carried out (e.g., the requirements for licensing as e-money tokens issuers under MiCA will be one of the most exhaustive and therefore with the most requirements to comply with).

In terms of the “Special Registry of exchange of virtual currency for fiat currency and electronic wallet custodian service providers”, the success rate is quite high (around 70%). However, it should be noted that registration is usually obtained after several requests from Bank of Spain (the average is around 3 requests) in which additional information is sought.

N/A

6. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence

AML RegulationFinancial Services Regulation

Regarding AML there are no additional requirements besides the “Special Registry of exchange of virtual currency for fiat currency and electronic wallet custodian service providers”.

However, in order to successfully comply with this registration, there are some documentation requirements to be met:

  • To fill in the corresponding form according to the intended activity (a) exchange of virtual currencies for fiat currencies (CRIPTO01); and/or (b) custody of electronic wallets (CRIPTO03). 
  • To fill in a general form (CIPTO005) corresponding to suitability assessment for the applicant legal entity and, a suitability assessment form for each of the natural persons effectively managing the entity, signed by each of them.
  • Criminal record certificate of the applicant legal entity and of each of the natural persons who effectively manage the entity.
  • Copy of the national identity card/NIE/NIF/foreign identification document of the legal entity applying for registration and, in addition, of all the natural persons who effectively manage the entity.
  • Anti-Money Laundering and Terrorist Financing Manual, including certain specific information such as customer admission policy; description of customers who may entail a higher-than-average risk and the measures to be taken to mitigate it; due diligence procedure; internal information flows; functioning of internal control bodies, among others.
  • Risk analysis policy, including certain specific information such as identification and assessment of risks based on types of customers, countries or geographic areas, products, services, operations and distribution channels; information on the business model, services offered and characteristics of the entity; foreign exchange flows, whenever carried out; any other factors that may be considered to be risk factors.

Finally, no physical presence is required to successfully comply with the registration.

Advertising of cryptoassets:

Spanish National Securities Market Commission (CNMV) Circular 1/2022, relating to the advertising of cryptoassets presented as investments defines the objective and subjective scope of cryptoasset advertising, establishes the criteria to be followed when promoting these assets, and provides for a supervisory regime including prior notification of such advertising activity.

All advertising of cryptoassets made by a natural or legal person to investors, including potential investors, in Spain in which such assets are implicitly or explicitly offered or marketed as an investment are subject to this Circular.

This is presumed to be the case when the purchase of cryptoassets is promoted, or where reference is made to current or future profitability, price or value of such cryptoassets, suggesting them to be an investment opportunity, even when they can be used as a medium of exchange.

Certain advertising activities are excluded from the scope of the Circular, such as the advertising of cryptoassets (i) that cannot be, due to their nature, the object of investment, (ii) that are considered financial instruments, (iii) that are considered as utility tokens, and provided that no revaluation expectations are offered and where the volume and conditions offered are consistent with the inherent rights associated with the cryptoasset in question, (iv) that are considered as NFTs which are not offered as a mere investment.

The Circular also does not apply to (i) white papers of new cryptoasset issuances, (ii) corporate advertising campaigns with generic information about the cryptoasset provider, including sports sponsorships, (iii) presentations to analysts or institutional investors; (iv) independent analyst publications that are not sponsored or promoted; and (v) advertising for cryptoasset courses or workshops that encourage investment in cryptoassets and are not offered free of charge or for a symbolic price.

The CNMV will carry out an ex-post control, excluding mass advertising campaigns (those aimed at more than 100,000 people through any advertising medium) which will be subject to ex-ante supervision, with the CNMV requiring at least ten working days prior notification of the campaign before it is launched. 

Implications of the use of DLT in securities markets: 

The LMVSI brings relevant developments to promote the use of DLT or other similar technologies for the issuance, registration, transfer or administration of all financial instruments, as it is set out in Article 2.1 of the LMVSI.

In particular, DLT-based systems will have to:

  • Ensure the integrity and immutability of the emissions that take place within them;
  • Directly and indirectly identify the holders of rights in tradable securities; and
  • Determine the nature, characteristics and number of the securities.

Moreover, Security Token Offerings ("STOs") can be carried out without a prospectus, if they comply with the requirements set forth in the LMVSI. However, as a new feature of the LMVSI, in cases where transferable securities are represented by DLT-based systems, it will always be necessary to determine which entity is responsible for the administration of the registration and registration of securities represented by DLT.

Changes to the crypto-asset market

The LMVSI includes a new sanctions regime which includes serious infringements through an express reference to the regime of sanctions relating to cryptoassets included in MiCA. Therefore, the LMVSI directly applies MiCA with regards to the sanction regime.

In addition, the LMVSI extended the scope of action of the Spanish National Securities Market Commission ("CNMV") in this market. Thus, Article 247 of the LMVSI establishes that the CNMV may subject to authorisation and control the advertising of crypto-assets presented as investment objects which, as they are not considered tradable securities, could be excluded from the activities contained in this law.

Nevertheless, according to the LMVSI, the Bank of Spain will exercise the supervision, inspection, and sanctioning functions in relation to the obligations laid down in MiCA regarding issuers of electronic money tokens and asset-referred tokens.

Portrait ofJaime Bofill
Jaime Bofill
Partner
Madrid
Portrait ofRicardo Plasencia
Ricardo Plasencia
Partner
Madrid
Marisa Ruiz Campos
Sara Piñero Mosquera
Lola Ferrer-Cazorla Fernández