Obtain CNMV-authorised CASP status in Spain under MiCA. RUE supports exchanges, custody providers, brokers, and crypto platforms seeking compliant EU market access.
Prepared by RUE editorial team · Reviewed by Milana · Updated 30 October 2026
Book MiCA Readiness CallSpain MiCA license means CASP authorisation under Regulation (EU) 2023/1114, typically supervised through the CNMV as the key national competent authority for crypto-asset services. RUE helps founders structure the Spanish entity, prepare the application pack, and align AML, governance, safeguarding, and operational controls before filing.
"As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays."
Regulated United Europe (RUE) provides end-to-end support for MiCA license in Spain projects: service perimeter analysis, Spanish company setup, governance design, AML/KYC framework, Travel Rule implementation logic, safeguarding documentation, and CNMV-facing application drafting.
We also support banking readiness, internal controls, outsourcing governance, and post-authorisation compliance so your Spain MiCA license is built for approval and day-to-day operation, not just for filing.
A Spain MiCA license can position your business in a major EU market under a regulator known for formal supervisory standards and institutional credibility.
Once authorised, your CASP may notify cross-border activity and serve clients across the EU single market, subject to MiCA passporting rules.
Spain suits operators prepared to show real governance, effective management, outsourcing oversight, and regulator-facing operational substance.
A properly structured Spanish setup can improve conversations with banks, EMIs, payment providers, and local counterparties compared with unregulated models.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
A MiCA license in Spain is, in substance, a CASP authorisation under Regulation (EU) 2023/1114, not the old AML-only VASP registration model. In 2026, applicants are expected to demonstrate not only minimum capital, but also a credible operating model, fit-and-proper management, AML/CFT controls, safeguarding arrangements, outsourcing oversight, ICT resilience, complaints handling, and a realistic wind-down framework.
The practical review logic is simple: the regulator does not approve a PowerPoint idea. It reviews whether your Spanish entity can actually deliver the crypto-asset services requested, protect clients, monitor abuse and financial crime risk, and remain governable after launch. The exact depth of review depends on your service perimeter, especially where the model includes custody, exchange, execution, operation of a trading platform, or client fiat flows.
MiCA uses standard initial capital thresholds of €50,000, €125,000, or €150,000 depending on the CASP services provided. These are the core reference points for Spain MiCA license planning and are materially more reliable than outdated marketing claims such as €60,000.
Class 1 (€50,000): execution, placing, transfers, reception/transmission, advice and portfolio management. Class 2 (€125,000): Class 1 services plus custody or exchange against funds or other crypto-assets. Class 3 (€150,000): Class 2 services plus operation of a trading platform. The highest applicable class determines the Annex IV minimum.
Under Article 67 MiCA, a CASP must maintain prudential safeguards at least equal to the higher of the applicable Annex IV minimum (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. A provider operating for less than one year uses projected fixed overheads for its first 12 months. The safeguards may consist of qualifying own funds, an insurance policy or comparable guarantee meeting Article 67, or a combination of these. Legal work, staffing, technology, audit, translations and banking onboarding are separate budget items.
You generally need a Spanish legal entity with a registered address, operational accessibility, and a governance model that can be supervised in Spain. A virtual office alone is not a substance strategy.
Regulators usually look for evidence of:
If key functions are outsourced, the Spanish entity must still remain the mind and manager of the business. An outsourcing-heavy model without internal ownership of risk, compliance, and safeguarding logic is a common weakness in CASP applications.
The management body, shareholders, and key function holders must pass a fit-and-proper assessment. The review usually covers reputation, competence, time commitment, conflicts of interest, source of wealth/funds, and prior regulatory or criminal history.
A recurring failure point is appointing prestigious but unavailable directors. Regulators increasingly test whether named individuals can actually challenge management, review incidents, approve policies, and supervise outsourced providers.
A Spain MiCA license application must show an operational AML/CFT framework aligned with Law 10/2010, EU AML expectations, and the Transfer of Funds Regulation (EU) 2023/1113. A generic AML manual is not enough.
In practice, the regulator wants to see how alerts are generated, who reviews them, what the SLA is, how false positives are tuned, and how the firm handles blocked or rejected transfers. This is where many otherwise polished applications become too abstract.
If your model includes custody or control over client crypto-assets or client fiat, safeguarding design becomes central. The application should explain legal segregation, operational segregation, reconciliation, incident handling, and client disclosure.
Where client fiat is received, firms should also map the safeguarding route, payment partner dependencies, and timing of fund placement. The regulator will usually expect the safeguarding model to be understandable by both compliance and operations teams, not only by engineers.
The regulator expects a licensing-grade description of your ICT environment. In 2026, this means more than saying you use cloud hosting and multi-factor authentication.
DORA applies to crypto-asset service providers authorised under MiCA. The applicant must prepare to meet its applicable ICT risk management, incident reporting, resilience testing and third-party ICT requirements. Proportionality does not remove the need to demonstrate control over vendors, logs and incident response.
The application pack should include a coherent programme of operations and a business plan that match the requested services exactly. The regulator will compare your narrative, policies, org chart, client journey, and financial projections for consistency.
A useful technical nuance: if your platform intends to list third-party crypto-assets, the regulator will often expect a token due diligence process covering MiCA classification, sanctions exposure, liquidity manipulation risk, and whether a crypto-asset white paper exists or should exist.
Banking is not formally part of MiCA authorisation, but a weak banking narrative can undermine the application because it affects safeguarding, client money flows, and operational viability. Spain MiCA license applicants should prepare a bank-ready due diligence pack early.
RUE usually recommends building the banking narrative in parallel with the license file, not after approval. That reduces friction with Spanish and EU banks, especially where the model includes merchant flows, OTC settlement, or high-volume retail onboarding.
Compare Spain with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Spanish crypto companies are generally subject to the ordinary corporate tax framework unless a specific incentive or special regime applies. For most operating companies, the baseline reference point is Corporate Income Tax at 25%. A Spain MiCA license does not create a special tax regime by itself; licensing, AML, prudential, and tax treatment are separate layers and should not be conflated.
Crypto exchanges, brokers, custody providers, and related service companies usually need to analyse taxation across at least five dimensions: corporate income tax, VAT treatment, payroll/social security, transfer pricing for group structures, and indirect/reporting obligations. The tax result depends heavily on the actual service performed, where counterparties are located, whether the firm acts as principal or agent, and whether separate technology, advisory, or white-label services are charged.
Do not rely on generic internet claims that “crypto is tax exempt” or that one VAT result applies to every crypto service. In Spain, tax treatment is fact-sensitive and should be checked against Agencia Tributaria (AEAT), current administrative guidance, accounting treatment, and where relevant, EU case law on financial-service exemptions.
Legal and tax disclaimer: this page is for general information only and is not legal, tax, or investment advice. Tax treatment should be confirmed for the exact business model, client geography, and contractual setup before launch.
A Spain MiCA license is not a one-time approval. After authorisation, your CASP must maintain ongoing prudential, AML, governance, safeguarding, and operational controls under MiCA and related EU and Spanish rules.
Direct answer: a MiCA license in Spain means CASP authorisation under Regulation (EU) 2023/1114, typically handled at national level by the CNMV as the key competent authority for crypto-asset services in Spain.
Important: this page is general information, not legal, tax, or investment advice. Transitional issues and supervisory practice should always be checked against the latest CNMV, BOE, and EUR-Lex materials in 2026.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Define the exact CASP services, exclusions, target markets, token types, custody model, and whether Spain is the right home Member State. This step prevents mis-scoped filings. Typical duration: 1-3 weeks.
Incorporate the Spanish company, structure ownership, prepare UBO disclosures, secure registered office/substance, and align governance with the intended license scope. Typical duration: 2-4 weeks.
Appoint directors and key function holders, define reporting lines, build fit-and-proper files, and allocate AML, compliance, risk, safeguarding, and ICT responsibilities. Typical duration: 2-6 weeks.
Draft the programme of operations, business plan, AML/CFT framework, Travel Rule model, safeguarding policy, outsourcing register, ICT/security pack, financial projections, complaints policy, and wind-down plan. Typical duration: 4-10 weeks.
Submit the completed CASP application pack to the competent authority with supporting forms, annexes, and corporate evidence. Filing quality at this stage strongly affects the number of later RFIs.
Expect an initial completeness review often modelled around roughly 25-30 working days, followed by substantive questions and clock-stop periods if information is missing. Real timing depends on dossier quality and responsiveness.
Once the file is considered complete, substantive review may run around 40 working days under the MiCA framework, with possible extensions or additional questions. Governance, safeguarding, AML, outsourcing and financial consistency are typical focus areas.
After authorisation, the CASP enters the relevant public register and may notify cross-border services into other EU states. Go-live should follow only after banking, safeguarding, operations and compliance controls are fully ready.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
There is no practical difference in ordinary market usage. When people say MiCA license in Spain, they usually mean CASP authorisation under Regulation (EU) 2023/1114. “MiCA license” is commercial shorthand; “CASP authorisation” is the more precise legal term. The key point is that this is a full authorisation regime, not a simple registration.
The relevant national competent authority in Spain is the CNMV. For CASP authorisation strategy, you should treat the Comisión Nacional del Mercado de Valores (CNMV) as the core regulator. ESMA does not issue the license. ESMA supports EU-level convergence and public registers, but the authorisation itself is national.
Yes, non-EU founders can use a Spanish company to apply, provided the structure is transparent and fit for supervision. The key issues are not nationality, but ownership transparency, source of funds, fit-and-proper suitability, governance quality, and substance in Spain. Non-EU ownership often triggers deeper due diligence, so the funding trail and management model must be especially clean.
You need real substance, not just a mailing address. A registered office is necessary, but a “virtual office” alone is usually not enough if the rest of the file shows no effective management, no local oversight, and no operational accessibility. The regulator will look at decision-making, governance presence, outsourcing control, and whether the entity can actually be supervised in Spain.
Under Article 67 MiCA, a CASP must maintain prudential safeguards at least equal to the higher of the applicable Annex IV minimum (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. A provider operating for less than one year uses projected fixed overheads for its first 12 months. The safeguards may consist of qualifying own funds, an insurance policy or comparable guarantee meeting Article 67, or a combination of these.
A realistic range is usually 3-6+ months, and complex cases can take longer. Timing depends on entity readiness, quality of the application pack, fit-and-proper documentation, and how many RFI rounds occur. A common workflow is: company setup and preparation first, then completeness review, then substantive review, then approval and post-licensing operational readiness.
Yes. Once authorised in Spain as a CASP under MiCA, your company may use the MiCA passporting mechanism to provide services across the EU, subject to the required notification process. Passporting gives access to the 27 EU Member States, but local rules on tax, consumer law, marketing, and data protection may still need separate attention.
No. Legacy VASP registration and MiCA CASP authorisation are not equivalent. The old regime was primarily AML-focused and does not replace the need for a proper MiCA authorisation if your business now falls within the CASP perimeter. Transitional issues should be checked against the latest CNMV and BOE materials in 2026.
The core obligations are customer due diligence, sanctions screening, transaction monitoring, suspicious activity escalation, recordkeeping, and Travel Rule compliance. Under Regulation (EU) 2023/1113, CASPs must capture and transmit originator and beneficiary data for relevant crypto transfers. In practice, firms often use vendor solutions compatible with IVMS101 and combine them with blockchain analytics and KYT tools.
Operating without the required authorisation creates serious regulatory, banking, and enforcement risk. Consequences can include cease-and-desist orders, administrative sanctions, inability to maintain banking or payment relationships, reputational damage, and personal exposure for directors. The exact sanctions depend on the legal basis used and the facts of the case, so unlicensed operation should never be treated as a temporary shortcut.
No. DeFi and NFTs require separate classification analysis. Some arrangements may fall outside MiCA, but many projects use those labels too broadly. Fractionalised NFTs, standardised token series, custodial interfaces, or client-facing intermediation can still trigger MiCA or other financial-services analysis. A classification memo is strongly recommended before launch.
Yes. Regulated United Europe supports clients with service perimeter analysis, Spanish company setup, governance design, application drafting, AML/Travel Rule framework, safeguarding documentation, banking-readiness planning, and regulator-facing support. We also coordinate related legal, tax, accounting, and compliance workstreams through our broader EU licensing practice.
