MiCA license in Spain

Is a MiCA license required in Spain?

A firm needs authorisation when it professionally provides one or more MiCA crypto-asset services from Spain or actively markets those services to Spanish customers. MiCA’s CASP rules applied from 30 December 2024, but Spain allowed firms covered by its former national registration regime to use a transition. The CNMV confirmed that the Spanish transition ended on 30 June 2026. From 1 July 2026, firms cannot rely on that old transition. The VASP-to-CASP guide explains why a legacy AML registration did not convert automatically.

There are two main routes. A normal crypto company applies for CASP authorisation under Articles 62 and 63. Certain businesses that already hold a qualifying financial licence may use the Article 60 notification route for services equivalent to their existing permission. Examples include credit institutions and investment firms. A former Spanish virtual-asset or AML registration does not, by itself, create a MiCA CASP licence.

Define the service scope first

The authorisation specifies exactly which crypto-asset services the business may provide. The ten services include custody, operating a trading platform, and exchanging crypto-assets for funds or other crypto-assets. They also include executing and transmitting orders, placing crypto-assets, advice, portfolio management and transfer services. The service scope determines the capital class, policies, staffing and technical evidence that the CNMV will expect.

Define the service scope before drafting. An exchange that holds client assets needs different evidence from an advisory-only firm. The CASP licence guide explains all ten services, while the MiCA licence cost guide separates regulatory capital from application and operating costs. If Spain is not fixed as the home state, compare its route with the other 29 EEA jurisdictions.

Core CNMV application requirements

The CNMV publishes a CASP application form and authorisation manual, but the legal requirements come from MiCA and its implementing rules. A complete file normally needs to cover these areas:

• Show that the legal entity has a registered office in its home member state, effective management in the EU and at least one EU-resident director.
• Describe the requested services, operating model, target markets, three-year financial projections and marketing approach in the business plan.
• Document the ownership structure and qualifying shareholders. Show the reputation, relevant knowledge, skills, experience and time commitment of management.
• Define responsibilities, compliance, risk management, internal control, record keeping and conflicts-of-interest procedures.
• Document complaints handling, fair disclosures, pricing, fee information, custody controls and segregation of client crypto-assets and funds.
• Document customer due diligence, monitoring and sanctions processes. The operating model must comply with Spanish AML requirements.
• Document DORA-aligned systems, security, incident management, business continuity, disaster recovery and controlled outsourcing of critical functions.
• Prepare an orderly wind-down plan that protects and returns client assets if services cease or the authorisation is withdrawn.

The licensed entity remains responsible for outsourced work. ESMA’s supervisory guidance expects the entity to retain real decision-making capacity, enough in-country personnel and effective oversight of group companies and third-party providers.

Minimum capital for a Spanish CASP

The table lists the prudential safeguards for Article 63 CASPs. Application and operating costs are separate. Eligible Article 60 financial entities follow their existing sectoral prudential regime because Article 60(10) disapplies Article 67 to that route. For an Article 63 applicant, Article 67 requires the higher of the Annex IV minimum or one quarter of fixed overheads. A firm that has not operated for a full year uses projected fixed overheads for its first 12 months under Article 67(2). The safeguard can be own funds, an insurance policy meeting MiCA’s conditions, or a combination. Fixed overheads can raise a live exchange’s capital requirement above the €150,000 floor.

Spanish CASP application process

1. Confirm that Spain is the firm’s MiCA home state. Then determine whether Article 63 authorisation or Article 60 notification applies.
2. Match every product and customer journey to the MiCA service definitions and capital class.
3. Prepare the programme of operations, governance map, financial information, policies, ICT architecture, outsourcing register and management and shareholder suitability files.
4. Use the current CNMV application form and manual. Check for updated implementing templates before filing.
5. Answer completeness and assessment questions with supporting evidence. Incomplete or inconsistent documents delay the start of the formal assessment period.
6. Complete the final formalities. The CNMV communicates an authorisation to ESMA for the public register. The firm must make the Article 65 notification before it provides cross-border services under the passport.

How long does CNMV authorisation take?

MiCA requires the authority to acknowledge receipt within five working days. The authority then has 25 working days to assess completeness and 40 working days to grant or refuse authorisation after it receives a complete application. The authority must notify the applicant of the decision within five working days.

The 25-day and 40-day periods do not create a guaranteed launch date. The 40-day assessment starts only when the file is complete. The statutory periods exclude preparation, clarifications, remediation and corporate formalities. A project plan must also allow time for governance hires, technical controls, vendor evidence and testing.

Does the license need renewal?

There is no scheduled annual renewal of an Article 63 CASP authorisation in MiCA. The authorisation remains valid while the provider meets its conditions. A provider must keep its governance, prudential safeguards, systems and conduct controls compliant. The provider remains subject to CNMV supervision. Adding a crypto-asset service requires an extension of the authorisation and updated Article 62 information.

Article 64 requires withdrawal in defined situations. The situations include no use of the authorisation within 12 months and no crypto-asset services for nine consecutive months. Irregular authorisation or a failure to meet the conditions can also require withdrawal. A past licence announcement does not prove current compliance. Check the current register status and service scope.

How to verify a Spanish CASP

Start with the CASP register, then confirm the provider, authorising country and permitted services in the official ESMA register. The CNMV’s own crypto-asset service provider page directs users to the EU register and publishes Spanish supervisory information. Match the legal entity name because a group can use different companies in different regions under the same brand.

Frequently asked questions

Primary sources: the CNMV MiCA hub, the CNMV CASP application form and manual, the consolidated MiCA Regulation (Articles 59–67 and Annex IV), and ESMA’s CASP authorisation briefing. Reviewed 11 August 2026. The page gives general information and does not provide legal, tax or licensing advice.