Spain crypto licensing in 2026 means MiCA-based CASP authorization, not a generic VASP filing.
RUE structures the legal, AML, governance and application package for Spain.
Prepared by RUE editorial team · Updated 30 October 2026
Request a licensing roadmapIn 2026, a crypto license in Spain usually means authorization as a Crypto-Asset Service Provider under Regulation (EU) 2023/1114 (MiCA). That is different from the legacy Spanish VASP registration model historically associated with Banco de España. Founders, exchanges, custodial wallet providers, brokers and crypto advisory businesses must first classify the exact service perimeter before preparing an application.
Spain is commercially relevant because a properly authorized CASP can use EU passporting mechanics and because the jurisdiction combines a large domestic market, strong banking and payments infrastructure, and a regulator environment where substance, AML controls and governance quality matter more than low-entry marketing promises. This page is an information resource updated for 2026 and does not replace individual legal or tax advice.
RUE supports Spain projects through regulatory scoping, company setup coordination, AML and Travel Rule framework design, application drafting, regulator Q&A support, banking preparation and post-license compliance planning. Where needed, we align Spain workstreams with MiCA, tax, accounting and operational policies across the group.
A Spain CASP strategy is built around MiCA authorization and post-authorization cross-border service planning within the EU, rather than around outdated VASP-only positioning.
CNMV, Banco de España, SEPBLAC and AEAT each have different roles. Spain is workable when the business model is classified correctly from day one.
Spain suits businesses ready to evidence AML governance, UBO transparency, complaints handling, outsourcing controls, Travel Rule implementation and ICT security architecture.
For groups targeting Spain, Portugal and Spanish-speaking markets, a Spanish operating company can align regulatory credibility with commercial expansion and local hiring.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
A Spain crypto license application is won or lost on classification, governance and evidence. In practice, the applicant must show that its business model fits a defined MiCA service perimeter, that the company has adequate prudential resources, that controllers and managers pass fit-and-proper review, and that AML, ICT and outsourcing controls are operational rather than merely drafted.
The exact burden depends on the service mix. A custody-heavy model, a trading platform, or a structure with complex outsourcing and cross-border onboarding will usually face deeper scrutiny than a narrow advisory model. EMT and ART projects require separate analysis because they are not simply another version of a standard CASP file.
The applicant normally uses a Spanish company form such as SL or SA, with registration formalities, tax identification, beneficial ownership transparency and a credible operating setup. A registered address alone is not the same as real substance.
The file must specify which MiCA services are requested, for example custody and administration, exchange of crypto-assets for funds, exchange of crypto-assets for other crypto-assets, transfer services, execution of orders, reception and transmission of orders, placing, portfolio management or advice on crypto-assets.
Directors, senior managers and qualifying shareholders should be ready to disclose identity, professional background, integrity evidence, group structure and source-of-funds information. International groups often need apostilled and translated records.
The company needs a risk-based AML system aligned with Law 10/2010, Royal Decree 304/2014 and Regulation (EU) 2023/1113. This includes customer due diligence, KYB, sanctions and PEP screening, suspicious activity escalation, recordkeeping and Travel Rule data transmission logic.
MiCA capital expectations depend on the class of services applied for. Spain is not a one-number jurisdiction. The correct threshold and own-funds logic must be mapped to the requested CASP services and the operating model, especially where client assets or client funds touch the setup.
Applicants should evidence wallet architecture, key management, access control, logging, incident handling, vendor due diligence, cloud outsourcing governance, business continuity and recovery planning. For custody models, technical controls are a core licensing issue, not an annex.
The application package should cover complaints, conflicts of interest, client disclosures, risk warnings, order handling and safeguarding. Marketing must comply with the applicable MiCA requirements and other relevant law. CNMV Circular 1/2022 was repealed with effect from 28 December 2024 by Circular 1/2024.
Compare Spain with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Spain tax analysis must separate company taxation, VAT treatment, individual taxation and reporting duties. For a Spanish crypto business, the starting point is the standard corporate tax framework, but the tax result depends on the exact activity: exchange, brokerage, custody, advisory, software, token issuance support or treasury operations do not always produce the same treatment.
The general corporate income tax rate is 25%. VAT treatment is service-specific. Certain crypto exchange activities may fall within VAT-exempt financial-service logic, while consulting, software integration, white-label technology, API access, analytics, licensing and some support services may be taxable. The legal and accounting qualification of tokens, fees and treasury holdings should be reviewed before launch.
Individuals are taxed under separate rules. Capital gains and income treatment depend on the nature of the transaction, holding structure and taxpayer profile. Reporting obligations, valuation methodology, transaction records and cross-border asset disclosures should be reviewed against current AEAT guidance. For deeper tax implementation, see our dedicated page on Spain crypto tax and accounting support at accounting services.
This section is informational only and is not individual tax advice.
A Spain CASP license is not a one-time filing. The operating model must remain compliant with MiCA, AML rules, Travel Rule obligations, internal governance and technical control expectations.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Classify the exact business perimeter first. RUE maps the planned services against MiCA CASP categories, checks whether EMT, ART, payments or securities rules may also apply, and identifies the regulator-facing risk points.
Set up the Spanish legal entity, tax registration, corporate documents, beneficial ownership records and governance baseline. Company formation can be quick, but substance and banking readiness should be designed at the same time.
Prepare the business plan, AML manual, risk assessment, Travel Rule procedure, governance file, complaints handling, conflicts policy, ICT security documentation, outsourcing register and fit-and-proper materials.
Open or prepare banking and payment rails, define fiat settlement flows, wallet architecture, custody controls, vendor stack, sanctions screening and reporting logic. This step often determines whether launch is operationally realistic.
File the application with the competent authority for the relevant regime. The review usually includes completeness checks, substantive questions and requests for clarification or remediation.
Respond to follow-up questions on service perimeter, governance, shareholders, AML controls, outsourcing, technology and safeguarding. Review time depends heavily on document quality and business-model complexity.
After authorization, implement ongoing compliance, staff training, reporting, Travel Rule operations, incident handling, policy updates and, where relevant, EU passporting notifications for cross-border services.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
In 2026, it usually means CASP authorization under MiCA, not a generic VASP registration. The correct answer depends on the business model. Exchange, custody, order execution, transfer services, portfolio management and advice on crypto-assets can fall under the MiCA CASP regime, while EMT, ART or tokenized financial instruments may follow separate regulatory lanes.
CNMV is the key authority for MiCA-era CASP matters in Spain. SEPBLAC is central for AML/CFT supervision and suspicious transaction reporting logic. Banco de España remains relevant in legacy and adjacent contexts, especially where payment or e-money issues intersect. AEAT handles tax administration.
Yes, non-residents can structure a Spain application, but substance still matters. The regulator will look beyond nationality and focus on governance, UBO transparency, operational readiness, local corporate setup, control over outsourced functions and the credibility of the Spanish operating model. A foreign-owned company with real governance can work; a shell setup usually will not.
You need more than a mailing address if the model requires real substance. A registered office is a corporate formality, but the licensing assessment is broader. The applicant should be able to evidence effective management, operational control, document retention, compliance oversight and a credible local setup proportionate to the services requested.
Yes, a properly authorized CASP can use MiCA passporting mechanics across the EU. That does not mean instant unrestricted activity everywhere without procedure. Cross-border service rollout should follow the applicable notification and operational steps, and the business should ensure its AML, disclosures, language, complaints handling and support model are scalable across target states.
A realistic timeline is usually several months, not a universal one-month filing. In many cases, the full project runs around 2-6+ months when company setup, document preparation, regulator review and remediation are counted together. Complex custody, multi-service exchange or cross-border retail models can take longer.
There is no single universal capital number for all Spain crypto businesses. Under MiCA, capital depends on the class of CASP services requested. That is why online summaries often conflict. The correct threshold should be mapped to the actual service mix, and founders should distinguish regulatory own funds from legal and compliance fees.
The legacy VASP context is not the main answer for most 2026 licensing questions. Spain moved into the MiCA era, so businesses should first assess whether they now require CASP authorization or another regime. Referring to Banco de España registration alone is usually incomplete for a current launch strategy.
Yes, AML and Travel Rule controls are core obligations, not optional add-ons. Spain-facing crypto businesses should be prepared for customer due diligence, KYB, UBO checks, sanctions and PEP screening, transaction monitoring, suspicious activity escalation and Travel Rule data handling under Regulation (EU) 2023/1113. These controls should be visible in procedures and systems.
Review marketing under the applicable MiCA provisions and other relevant advertising law. The mass-campaign prior-notification regime in CNMV Circular 1/2022 is no longer in force; that circular was repealed with effect from 28 December 2024.
The core file usually includes corporate documents, shareholder and UBO records, fit-and-proper evidence, a business plan, AML manuals, risk assessment, Travel Rule procedure, ICT security documents, outsourcing records and conduct policies. International groups often also need apostilles, sworn translations and source-of-funds evidence for controllers.
Yes. RUE assists with Spain crypto license strategy, MiCA scoping, company setup coordination, compliance document drafting, banking preparation, tax and accounting coordination, and post-license structuring. Related pages include CASP license, MiCA license in Spain, bank account in Spain and contact us.
