Crypto License in Portugal 2026

A Portuguese legal entity is the standard entry point. In most cases, founders use an Lda or, for larger governance structures, an SA. The company must be properly registered, obtain NIPC/NIF, complete corporate filings, and disclose beneficial ownership through RCBE.

Substance means more than a registered address. Regulators and banks typically expect:

• a real office or operational base in Portugal;
• local or genuinely available management able to make decisions;
• documented governance, board minutes, and reporting lines;
• service-provider agreements where functions are outsourced;
• evidence that key decisions are not entirely taken from abroad.

A virtual office may support incorporation logistics, but for a regulated crypto business it is rarely sufficient as the full substance solution.

Management suitability is a core approval factor. Founders, directors, senior managers, AML officers, and other control-function holders may be reviewed for competence, integrity, time commitment, and conflicts of interest.

Typical evidence includes:

• detailed CVs with relevant fintech, payments, securities, AML, or crypto experience;
• criminal record certificates and reputation checks;
• references and proof of qualifications;
• organizational chart and role allocation;
• fit-and-proper questionnaires and conflict disclosures.

One recurring issue in Portugal CASP applications is over-concentration of responsibilities in one founder. A regulator will usually expect clear separation between commercial management, compliance oversight, and ICT/security accountability, even if some functions are outsourced under controlled arrangements.

Capital is activity-specific under MiCA logic. There is no single reliable number that fits every Portugal crypto license case. The applicable own-funds expectation depends on the exact crypto-asset services provided, operational risk, client asset exposure, and whether the model includes custody, exchange, platform operation, reception/transmission, execution, or other services.

Applicants should be prepared to show:

• paid-up capital in fiat, not merely wallet balances in crypto;
• clear source of funds trail for founders and investors;
• bank statements, shareholder resolutions, and funding agreements;
• financial projections showing runway for at least the first operating period;
• contingency planning for adverse market and liquidity scenarios.

Where custody or client money touchpoints exist, safeguarding and segregation controls become central. Regulators increasingly ask not only where the funds came from, but whether the capitalization is credible relative to transaction volume, onboarding plans, and technology spend.

AML is still one of the hardest parts of a Portugal crypto authorization. Portuguese law, including Law 83/2017 and subsequent updates, must be read together with the EU framework, FATF standards, and the recast Transfer of Funds Regulation that operationalizes the Travel Rule for crypto transfers.

A workable AML stack usually includes:

• business-wide ML/TF risk assessment;
• CDD, EDD, KYC, and KYB procedures;
• UBO identification and adverse media screening;
• sanctions screening against EU and UN lists;
• blockchain analytics / KYT tooling;
• Travel Rule workflow using structured data standards such as IVMS101;
• suspicious transaction reporting procedures to the competent authorities;
• recordkeeping, training, and independent review.

Generic AML manuals are a common red flag. The framework must reflect the real business model: retail exchange, OTC desk, custody, B2B settlement, broker app, or token distribution all create different risk patterns.

In 2026, saying “we use secure infrastructure” is not enough. Applicants should be ready to document ICT governance in a way consistent with DORA Regulation (EU) 2022/2554, even where the exact applicability analysis depends on the business perimeter and group structure.

Expected controls often include:

• access management and multi-factor authentication;
• segregation between development, testing, and production environments;
• incident response and escalation matrix;
• business continuity and disaster recovery planning;
• outsourcing register and vendor oversight;
• audit logs, SIEM monitoring, and evidence retention;
• wallet architecture controls such as MPC, multisig, key ceremonies, and cold-storage governance;
• GDPR-compliant handling of personal data.

For custody-heavy models, regulators and banking partners increasingly ask who can move assets, how approvals are logged, how recovery works, and how insider risk is controlled.

The business plan must map legal scope to operational reality. A strong application explains exactly which crypto-asset services are offered, to whom, through which channels, with what client journey, and under what control framework.

It should normally cover:

• service perimeter under MiCA and any out-of-scope activities;
• target markets and passporting strategy;
• customer segments and onboarding criteria;
• fee model, treasury policy, and liquidity assumptions;
• outsourcing map and critical third-party dependencies;
• complaints handling and consumer disclosures;
• 3-5 year financial projections with conservative assumptions.

One technical nuance often missed by competitors: if the business combines crypto services with fiat payment flows, the analysis may touch PSD2/e-money issues and require separate structuring rather than a simple CASP-only filing.

Token issuance is not the same as obtaining a Portugal crypto exchange license. If the project issues or markets tokens, the first question is classification: ordinary crypto-asset, EMT, ART, NFT-like structure, or a token that may qualify as a financial instrument.

This matters because:

• MiCA may require a crypto-asset white paper for public offers or admission to trading;
• EMTs and ARTs trigger stricter regimes and additional competent-authority analysis;
• security-like tokens may fall into the CMVM and traditional capital-markets perimeter;
• marketing communications must be fair, clear, and not misleading.

A project can be fully lawful in Portugal and still require a different legal route than a standard CASP. This is one of the most common strategic mistakes in early-stage token launches.

Banking is not automatic after authorization. Portuguese banks, EU banks, EMIs, and PSPs typically run their own risk review in parallel with regulatory analysis. A strong banking file often determines whether launch happens on time.

Typical bank-readiness evidence includes:

• clear ownership and RCBE disclosure;
• AML manual and customer-risk methodology;
• transaction monitoring logic and KYT tooling;
• Travel Rule solution for crypto transfers;
• source-of-funds controls for clients and founders;
• terms of service, complaints handling, and fraud controls;
• forecasted fiat flows, counterparties, and jurisdictions served.

RUE regularly aligns licensing work with crypto business bank account strategy and bank account opening assistance in Portugal so the company does not receive approval but remain commercially blocked.