Regulated United Europe OÜ
Registration number: 14153440
Anno: 16.11.2016
Phone: +372 56 966 260
Email: [email protected]
Address: Laeva 2, Tallinn, 10111, Estonia
MiCA License in Spain 2026
Obtain CNMV-authorised CASP status in Spain under MiCA. RUE supports exchanges, custody providers, brokers, and crypto platforms seeking compliant EU market access.
Book MiCA Readiness Call
Regulator
CNMV
Timeframe
3-6+ months
Cost
from €19,900
Capital
€50k-€150k
Depends on CASP scope, substance, tech stack and dossier readiness.
Why Spain for a MiCA Licence
Spain MiCA license means CASP authorisation under Regulation (EU) 2023/1114, typically supervised through the CNMV as the key national competent authority for crypto-asset services. RUE helps founders structure the Spanish entity, prepare the application pack, and align AML, governance, safeguarding, and operational controls before filing.
As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays.
Regulated United Europe (RUE) provides end-to-end support for MiCA license in Spain projects: service perimeter analysis, Spanish company setup, governance design, AML/KYC framework, Travel Rule implementation logic, safeguarding documentation, and CNMV-facing application drafting.
We also support banking readiness, internal controls, outsourcing governance, and post-authorisation compliance so your Spain MiCA license is built for approval and day-to-day operation, not just for filing.
Recognised EU Regulatory Base
A Spain MiCA license can position your business in a major EU market under a regulator known for formal supervisory standards and institutional credibility.
EU Passporting Potential
Once authorised, your CASP may notify cross-border activity and serve clients across the EU single market, subject to MiCA passporting rules.
Strong Substance Narrative
Spain suits operators prepared to show real governance, effective management, outsourcing oversight, and regulator-facing operational substance.
Banking and Fiat Readiness
A properly structured Spanish setup can improve conversations with banks, EMIs, payment providers, and local counterparties compared with unregulated models.
MiCA Licence in Spain
25,900 EUR
Package includes (8)
- Preparation of necessary documents for registration of a new company in Spain 2026
- Translation of a certificate of no criminal record through a sworn translator
- Payment of state fees related to company registration
- Payment of notary fees related to company registration
- Preparation of compliance documents for MiCA application
- Preparation of a business plan
- Submission of the necessary documents to CNMV
- Recruitment of local MLRO/Compliance officer
Timeframe: From 6 months
Comprehensive Requirements for Spain MiCA License
A MiCA license in Spain is, in substance, a CASP authorisation under Regulation (EU) 2023/1114, not the old AML-only VASP registration model. In 2026, applicants are expected to demonstrate not only minimum capital, but also a credible operating model, fit-and-proper management, AML/CFT controls, safeguarding arrangements, outsourcing oversight, ICT resilience, complaints handling, and a realistic wind-down framework.
The practical review logic is simple: the regulator does not approve a PowerPoint idea. It reviews whether your Spanish entity can actually deliver the crypto-asset services requested, protect clients, monitor abuse and financial crime risk, and remain governable after launch. The exact depth of review depends on your service perimeter, especially where the model includes custody, exchange, execution, operation of a trading platform, or client fiat flows.
Minimum Capital and Own Funds +
MiCA uses standard initial capital thresholds of €50,000, €125,000, or €150,000 depending on the CASP services provided. These are the core reference points for Spain MiCA license planning and are materially more reliable than outdated marketing claims such as €60,000.
- €50,000: lower-risk CASP profiles under the MiCA classification logic;
- €125,000: intermediate service scope;
- €150,000: higher-impact models such as broader execution/platform-type activity.
Initial capital is only the entry threshold. Your company must also maintain adequate own funds on an ongoing basis, document liquidity planning, and show that regulatory capital is not the same thing as launch budget. In practice, founders should budget separately for legal work, staffing, technology, Travel Rule tooling, audit, insurance, translations, and banking onboarding.
Spanish Company and Real Substance +
You generally need a Spanish legal entity with a registered address, operational accessibility, and a governance model that can be supervised in Spain. A virtual office alone is not a substance strategy.
Regulators usually look for evidence of:
- place of effective management and real decision-making trail;
- board minutes, delegated authority matrix, and local accessibility;
- identified control functions and vendor oversight;
- operational records available for supervisory review;
- credible explanation of why Spain is the home Member State.
If key functions are outsourced, the Spanish entity must still remain the mind and manager of the business. An outsourcing-heavy model without internal ownership of risk, compliance, and safeguarding logic is a common weakness in CASP applications.
Management, UBOs and Fit-and-Proper Review +
The management body, shareholders, and key function holders must pass a fit-and-proper assessment. The review usually covers reputation, competence, time commitment, conflicts of interest, source of wealth/funds, and prior regulatory or criminal history.
- Directors should understand crypto operations, not just general corporate administration;
- UBOs and qualifying shareholders must be fully transparent and documentable;
- an AML/MLRO function must be credible, not nominal;
- compliance and risk responsibilities should be clearly allocated;
- CVs, references, criminal record certificates, and questionnaires must be internally consistent.
A recurring failure point is appointing prestigious but unavailable directors. Regulators increasingly test whether named individuals can actually challenge management, review incidents, approve policies, and supervise outsourced providers.
AML/KYC, Travel Rule and Financial Crime Controls +
A Spain MiCA license application must show an operational AML/CFT framework aligned with Law 10/2010, EU AML expectations, and the Transfer of Funds Regulation (EU) 2023/1113. A generic AML manual is not enough.
- business-wide ML/TF risk assessment tailored to your services and geographies;
- CDD/EDD procedures for retail, corporate, and high-risk clients;
- sanctions screening and adverse media controls;
- transaction monitoring and KYT logic for on-chain activity;
- Travel Rule data exchange workflow, often using IVMS101-compatible tooling;
- controls for unhosted wallets, wallet attribution, and escalation paths;
- recordkeeping, STR reporting logic, and governance around alerts.
In practice, the regulator wants to see how alerts are generated, who reviews them, what the SLA is, how false positives are tuned, and how the firm handles blocked or rejected transfers. This is where many otherwise polished applications become too abstract.
Safeguarding, Custody and Client Asset Protection +
If your model includes custody or control over client crypto-assets or client fiat, safeguarding design becomes central. The application should explain legal segregation, operational segregation, reconciliation, incident handling, and client disclosure.
- segregation of client assets from proprietary assets;
- wallet governance and entitlement mapping;
- daily or near-daily reconciliation logic;
- key management architecture such as MPC, multisig, or HSM-supported controls;
- access control, maker-checker approvals, and privileged access logging;
- breach response, loss allocation logic, and recovery procedures.
Where client fiat is received, firms should also map the safeguarding route, payment partner dependencies, and timing of fund placement. The regulator will usually expect the safeguarding model to be understandable by both compliance and operations teams, not only by engineers.
Technology, ICT Governance and Operational Resilience +
The regulator expects a licensing-grade description of your ICT environment. In 2026, this means more than saying you use cloud hosting and multi-factor authentication.
- system architecture, data flows, and critical vendor map;
- identity and access management, log retention, and privileged access review;
- incident response plan, severity classification, and escalation matrix;
- business continuity and disaster recovery with tested recovery assumptions;
- vulnerability management, patch governance, and penetration testing;
- outsourcing register and exit planning for critical technology providers;
- GDPR alignment for KYC and transaction data handling.
Even where DORA does not apply in the same way as to traditional financial entities, supervisory expectations around operational resilience are materially higher than many crypto founders assume. Weak evidence of control over vendors, logs, and incident handling often triggers RFIs.
Business Plan, Programme of Operations and Financials +
The application pack should include a coherent programme of operations and a business plan that match the requested services exactly. The regulator will compare your narrative, policies, org chart, client journey, and financial projections for consistency.
- service perimeter and regulatory classification memo;
- target markets, client types, and distribution channels;
- token admission/listing or asset selection methodology where relevant;
- revenue model, fee model, and outsourcing dependencies;
- 3-year financial projections with assumptions and stress cases;
- complaints handling, conflicts of interest, and market abuse controls;
- wind-down plan explaining how clients are protected if the business exits.
A useful technical nuance: if your platform intends to list third-party crypto-assets, the regulator will often expect a token due diligence process covering MiCA classification, sanctions exposure, liquidity manipulation risk, and whether a crypto-asset white paper exists or should exist.
Banking, Fiat Rails and Source-of-Funds Narrative +
Banking is not formally part of MiCA authorisation, but a weak banking narrative can undermine the application because it affects safeguarding, client money flows, and operational viability. Spain MiCA license applicants should prepare a bank-ready due diligence pack early.
- clear explanation of fiat inflows, outflows, and settlement routes;
- source-of-funds and source-of-wealth documentation for founders and funding rounds;
- description of payment service providers, EMIs, or acquiring partners;
- transaction flow maps by customer type and geography;
- AML controls around fiat-to-crypto and crypto-to-fiat conversion.
RUE usually recommends building the banking narrative in parallel with the licence file, not after approval. That reduces friction with Spanish and EU banks, especially where the model includes merchant flows, OTC settlement, or high-volume retail onboarding.
Jurisdiction Comparison
Compare Spain with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Taxation of Crypto Companies in Spain
Spanish crypto companies are generally subject to the ordinary corporate tax framework unless a specific incentive or special regime applies. For most operating companies, the baseline reference point is Corporate Income Tax at 25%. A Spain MiCA license does not create a special tax regime by itself; licensing, AML, prudential, and tax treatment are separate layers and should not be conflated.
Core tax position for CASP businesses in Spain
Crypto exchanges, brokers, custody providers, and related service companies usually need to analyse taxation across at least five dimensions: corporate income tax, VAT treatment, payroll/social security, transfer pricing for group structures, and indirect/reporting obligations. The tax result depends heavily on the actual service performed, where counterparties are located, whether the firm acts as principal or agent, and whether separate technology, advisory, or white-label services are charged.
- Corporate Income Tax: standard reference rate is 25% for most companies;
- VAT: some exchange-related services may be exempt under financial-services logic, but advisory, software, SaaS, token design, or ancillary services may not be;
- Withholding / cross-border structuring: depends on treaty position, legal form, and payment type;
- Accounting and annual reporting: Spanish companies must maintain proper books, file annual accounts, and keep tax records consistent with the regulatory perimeter described to the CNMV;
- Payroll and management presence: local staff and directors can create additional labour and social contribution obligations.
Practical caution for crypto founders
Do not rely on generic internet claims that “crypto is tax exempt” or that one VAT result applies to every crypto service. In Spain, tax treatment is fact-sensitive and should be checked against Agencia Tributaria (AEAT), current administrative guidance, accounting treatment, and where relevant, EU case law on financial-service exemptions.
Legal and tax disclaimer: this page is for general information only and is not legal, tax, or investment advice. Tax treatment should be confirmed for the exact business model, client geography, and contractual setup before launch.
Corporate Income Tax
Standard corporate tax for most Spanish companies
25%
Corporate Income Tax
Standard corporate tax for most Spanish companies
The standard reference rate for Spanish corporate income tax is 25% for most companies. Taxable profit is determined under Spanish accounting and tax rules, with adjustments for deductible and non-deductible items, transfer pricing, and losses. A licensed CASP should ensure that its accounting model, revenue recognition, and token/fiat treatment are documented consistently with its regulatory business model.
VAT on Crypto Services
Depends on the exact service and contractual role
Exempt / 21%
VAT on Crypto Services
Depends on the exact service and contractual role
Some crypto exchange services may fall within VAT exemption logic similar to financial services, but this does not automatically cover every crypto-related activity. Technology licensing, consulting, white-label services, software subscriptions, data services, and certain platform fees may be taxable at the standard Spanish VAT rate of 21%. A line-by-line VAT mapping is recommended before invoicing clients.
Withholding and Cross-Border Payments
Depends on treaty network and payment character
Case-specific
Withholding and Cross-Border Payments
Depends on treaty network and payment character
Payments of dividends, interest, royalties, or service fees to non-residents may trigger withholding analysis depending on domestic law, treaty relief, beneficial ownership, and anti-abuse rules. This matters for founder structures, holding companies, and IP/licensing arrangements used by crypto groups operating across several EU and non-EU jurisdictions.
Payroll and Social Contributions
Applies where local employees or directors are engaged
Variable
Payroll and Social Contributions
Applies where local employees or directors are engaged
If your Spain MiCA license structure includes local staff, directors, compliance officers, or operations personnel, payroll tax and social security obligations arise under Spanish labour and tax rules. Substance planning should therefore be coordinated with employment, immigration, and budget assumptions from the start.
Annual Accounts and Tax Filings
Mandatory bookkeeping and periodic filings
Ongoing obligation
Annual Accounts and Tax Filings
Mandatory bookkeeping and periodic filings
Spanish companies must maintain accounting records, prepare annual accounts, and submit tax returns in line with statutory deadlines. For CASPs, a recurring practical issue is ensuring that accounting descriptions, revenue categories, and client-asset treatment do not contradict the regulatory file submitted to the CNMV or AML documentation used for banking.
Transfer Pricing
Relevant for group structures and related-party services
Arm’s length
Transfer Pricing
Relevant for group structures and related-party services
If the Spanish entity buys software, compliance support, liquidity access, marketing services, or management services from related parties, transfer pricing rules apply. This is especially relevant where founders use a Spanish licensed entity with development, treasury, or IP functions elsewhere in the group.
Regulatory and Operating Cost Layer
Not a tax, but a core budget category founders miss
€120k+ / year
Regulatory and Operating Cost Layer
Not a tax, but a core budget category founders miss
Beyond tax, founders should budget for annual compliance and operating costs: MLRO/compliance staffing, legal support, accounting, audit, Travel Rule vendor, blockchain analytics, cybersecurity tooling, insurance, and banking fees. For many small-to-mid CASPs, this layer can easily exceed €120,000-€300,000+ per year depending on scale and service complexity.
Compliance & Ongoing Obligations
A Spain MiCA license is not a one-time approval. After authorisation, your CASP must maintain ongoing prudential, AML, governance, safeguarding, and operational controls under MiCA and related EU and Spanish rules.
Regulatory Reporting
- Periodic regulatory reporting to the competent authority as applicable to the CASP model
- Annual audited financial statements and corporate filings
- Incident and material change notifications where required
- Recordkeeping supporting supervisory inspections and RFIs
- Updates to passporting notifications for cross-border activity changes
AML/KYC and Travel Rule
- Customer due diligence and enhanced due diligence on a risk basis
- Ongoing transaction monitoring and blockchain analytics review
- Sanctions screening of customers, wallets, and counterparties
- Travel Rule data capture and transmission under Regulation (EU) 2023/1113
- Suspicious transaction/internal escalation and reporting workflows
Safeguarding and ICT Controls
- Segregation and reconciliation of client assets and relevant fiat balances
- Wallet governance, key management, and privileged access controls
- Cybersecurity policy, logging, and incident response testing
- Business continuity and disaster recovery maintenance
- Outsourcing register and oversight of critical technology vendors
Governance Maintenance
- Ongoing fit-and-proper suitability of directors and key function holders
- Board review of compliance, risk, complaints, and incidents
- Policy updates for MiCA, AML, GDPR, and operational changes
- Notification of ownership, management, or scope changes
- Wind-down readiness and periodic control testing
RUE handles compliance for you. Our team provides ongoing compliance support, including AML officer services, regulatory reporting, and policy updates. We ensure your license stays in good standing year after year.
Contact us for compliance support →
Last reviewed: March 2026
MiCA license in Spain: executive summary
Direct answer: a MiCA license in Spain means CASP authorisation under Regulation (EU) 2023/1114, typically handled at national level by the CNMV as the key competent authority for crypto-asset services in Spain.
- Who needs it: exchanges, brokers, custodians, trading platforms, execution providers, portfolio managers, transfer services and crypto advice models that fall within MiCA CASP services;
- Main regulator: CNMV for authorisation and conduct supervision; SEPBLAC remains central for AML/CFT supervision logic; Banco de España still matters for legacy VASP context, banking ecosystem and payment infrastructure relevance;
- Capital: standard MiCA thresholds are €50,000, €125,000, and €150,000 depending on service scope;
- Timeline: realistic preparation and review often takes 3-6+ months, depending on dossier quality and RFI rounds;
- EU access: after authorisation, a Spanish CASP may use passporting mechanisms to provide services across the EU.
Important: this page is general information, not legal, tax, or investment advice. Transitional issues and supervisory practice should always be checked against the latest CNMV, BOE, and EUR-Lex materials in 2026.
📝 Check Your Eligibility
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Step 1 of 5
What type of crypto services will you provide?
Exchange (fiat ↔ crypto)
Custody & Wallet Services
Transfer & Payment Services
Advisory / Portfolio Management
Multiple / All of the Above
Step 2 of 5
What is your target market?
European Union only
EU + Global markets
Global (non-EU priority)
Step 3 of 5
Do you already have a registered company in the EU?
Yes, in this jurisdiction
Yes, in another EU country
No, I need to register one
Step 4 of 5
What is your available budget range?
Under €20,000
€20,000 – €50,000
€50,000 – €100,000
Over €100,000
Step 5 of 5
When do you plan to launch?
As soon as possible (1–3 months)
Within 6 months
Within a year
Just exploring options
This Jurisdiction Is a Great Fit!
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Step-by-Step Licensing Process
Step 1
Scope Mapping
Define the exact CASP services, exclusions, target markets, token types, custody model, and whether Spain is the right home Member State. This step prevents mis-scoped filings. Typical duration: 1-3 weeks.
Step 2
Spanish Entity Setup
Incorporate the Spanish company, structure ownership, prepare UBO disclosures, secure registered office/substance, and align governance with the intended licence scope. Typical duration: 2-4 weeks.
Step 3
Governance & Hiring
Appoint directors and key function holders, define reporting lines, build fit-and-proper files, and allocate AML, compliance, risk, safeguarding, and ICT responsibilities. Typical duration: 2-6 weeks.
Step 4
Dossier Preparation
Draft the programme of operations, business plan, AML/CFT framework, Travel Rule model, safeguarding policy, outsourcing register, ICT/security pack, financial projections, complaints policy, and wind-down plan. Typical duration: 4-10 weeks.
Step 5
Application Submission
Submit the completed CASP application pack to the competent authority with supporting forms, annexes, and corporate evidence. Filing quality at this stage strongly affects the number of later RFIs.
Step 6
Completeness & RFIs
Expect an initial completeness review often modelled around roughly 25-30 working days, followed by substantive questions and clock-stop periods if information is missing. Real timing depends on dossier quality and responsiveness.
Step 7
Substantive Review
Once the file is considered complete, substantive review may run around 40 working days under the MiCA framework, with possible extensions or additional questions. Governance, safeguarding, AML, outsourcing and financial consistency are typical focus areas.
Step 8
Approval & Passporting
After authorisation, the CASP enters the relevant public register and may notify cross-border services into other EU states. Go-live should follow only after banking, safeguarding, operations and compliance controls are fully ready.
Frequently Asked Questions
Main Services
Terms of Cooperation
Regulated United Europe
