Disclaimer: This chapter was last updated on 4 December 2025 and does not reflect any subsequent developments. The information provided is intended for general informational purposes and should not be construed as legal advice.

1. How is crypto regulated?

Jurisdiction-specific MiCAR implementation and deviations Any other regulation

The Fifth Money Laundering Directive (“5MLD”) was transposed into Spanish Law through Royal Decree-Law 7/2021, of 27 April (“RD-Law 7/2021”).

Such RD-Law 7/2021 also introduced the most relevant amendments on Law 10/2010 of 28 April 2010 on the prevention of money laundering and terrorist financing (Law 10/2010) including as obliged entities the exchanges of virtual currency for fiat and e-wallet custodian service providers.

Security tokens: Spanish Law 6/2023 of 17 March on Securities Markets and Investment Services ("LMVSI").

Tax: Law 11/2021, of July 9, on measures to prevent and combat tax fraud, transposing Council Directive (EU) 2016/1164, of 12 July 2016, establishing rules against tax avoidance practices that directly affect the functioning of the internal market, amending various tax and gambling regulation rules which incorporates the Thirteenth Additional Provision to Law 35/2006, of 28 November 2006, on Personal Income Tax and partially amending the laws on Corporate Income Tax, Non-Resident Income Tax and Wealth Tax requiring the reporting of balances in virtual currencies on an annual basis.

2. What are the steps taken by the regulator to adopt MiCAR?

The Spanish National Securities Commission (“CNMV”) has already published (i) an Authorisation Request form and Handbook for Crypto-Assets Service Providers or CASPs license (including EU passporting notifications); and (ii) a Request form and Sample Notification for other financial institutions already authorised.

For VASPs that have been registered with the Bank of Spain before 30 December 2024, they may continue to provide services until June 2026 (or until they are granted or denied authorization as a CASP under MiCA).

The only reference to MiCA in Spanish legislation is found in Law 6/2023, which includes a sanctioning regime for non-compliance with MiCA regulation obligations.

3. Are the following activities regulated or unregulated in your jurisdiction? Direct sales of tokens by issuers Exchange (buy/sell) Custody (hold) Borrowing/lending Yield/staking services. Staking on proof of stake consensus mechanisms.

Jurisdiction-specific MiCAR implementation and deviations Any other regulation

Direct sales of tokens by issuers (considered as P2P transactions); (ii) Borrowing and lending; (iii) Yield and staking services; and (iv) Staking on proof of stake consensus mechanisms are unregulated activities in Spain.

Regarding NFTs, they are not considered virtual currencies under Law 10/2010 and MiCAR and consequently their exchange and/or custody are unregulated activities under Spanish Law.

We understand that Law 10/2010 will be modified in order to include CASPs under MiCA as obliged subjects.

Security tokens: Security tokens are considered financial instruments and therefore the Spanish and European financial markets regulation shall apply in the performance of such activities.

The approval and publication of the LMVSI meant: (i) the inclusion of Distributed Ledger Technology ("DLT") as a valid system for the issuance, registration, transfer or custody of financial instruments; (ii) introduction of aspects related to MiCAR and the advertising of crypto-assets; and (iii) the supervisory and sanctioning regime of the crypto-asset market.

4. Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis? 

Jurisdiction-specific MiCAR implementation and deviations Any other regulation
Please refer to the MiCAR section.  

Security tokens: MiFID II requirements apply for reverse solicitation of entities outside the EU. 

Upmost, the LMVSI allows investment firms authorised in another Member State to act in Spain under the Freedom to Provide Services, so a firm registered outside Spain can provide services on an active solicitation as long as it applies to its regulator to be passported to Spain.

5. How long would establishing a cryptoasset business/ obtaining a licence in your jurisdiction take?

Please refer to article 63 of MiCA Regulation in relation to the assessment of the application for authorisation and grant or refusal of authorisation.

The establishment of a cryptoasset business/obtaining a licence in Spain will depend on the type of activity intended to be carried out and will depend on several other factors, therefore, it shall be determined on a case-by-case basis. 

6. What would be the approximate overall cost of obtaining a licence?

Please consider our previous answers.

The cost of registration will depend on the type of activity intended to be carried out and will depend on the level of development the entity already has in terms of AML and the effort required to adapt it.

Additionally, the CNMV has not yet made public the specific fees for the authorization of CASP. 

7. What is the probability (%) of success in obtaining a licence?

Please consider our previous answers.

The likelihood of success will be dependent on the type of activity intended to be performed. 

This shall be considered on a case-by-case basis, as depending on the characteristics and the activities to be performed, the success factor could vary. 

8. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business?

Jurisdiction-specific MiCAR implementation and deviations Any other regulation
Please refer to section 2, the Handbook published by the CNMV and the regulatory expectations. 

Implications of the use of DLT in securities markets:

The LMVSI brings relevant developments to promote the use of DLT or other similar technologies for the issuance, registration, transfer or administration of all financial instruments, as it is set out in Article 2.1 of the LMVSI. 

In particular, DLT-based systems will have to: 

  • Ensure the integrity and immutability of the emissions that take place within them;
  • Directly and indirectly identify the holders of rights in tradable securities; and
  • Determine the nature, characteristics and number of the securities.

Moreover, Security Token Offerings ("STOs") can be carried out without a prospectus, if they comply with the requirements set forth in the LMVSI. However, as a new feature of the LMVSI, in cases where transferable securities are represented by DLT-based systems, it will always be necessary that an entity is responsible for the administration of the registration and registration of securities represented by DLT. 

These entities are called ERIR and they need to hold a MiFID custody license.

Changes to the crypto-asset market

The LMVSI includes a new sanctions regime which includes serious infringements through an express reference to the regime of sanctions relating to cryptoassets included in MiCA. Therefore, the LMVSI directly applies MiCA with regards to the sanction regime.

In addition, the LMVSI extended the scope of action of the CNMV in this market. Thus, Article 247 of the LMVSI establishes that the CNMV may subject to authorisation and control the advertising of cryptoassets presented as investment objects which, as they are not considered tradable securities, could be excluded from the activities contained in this law.

Nevertheless, according to the LMVSI, the Bank of Spain will exercise the supervision, inspection, and sanctioning functions in relation to the obligations laid down in MiCA regarding issuers of electronic money tokens and asset-referred tokens