MiCA licence in Spain: CASP authorisation by the CNMV

The case, in five lines

What is brought

Application to the CNMV for authorisation as a crypto-asset service provider (CASP) (articles 59, 62 and 63 MiCA), or a notification if you are already an authorised financial entity (article 60), and passporting by notification (article 65). If refused, an optional recurso de reposición (an administrative appeal to the authority that issued the decision) and a judicial review appeal; if proceedings are opened for unauthorised activity, defence in the sanctioning proceedings.

Before which court

The CNMV (Comisión Nacional del Mercado de Valores, the Spanish securities regulator), the competent authority for crypto-asset service providers (article 251.h of Ley 6/2023, the Securities Markets and Investment Services Act); the Banco de España (the Spanish central bank) is the competent authority for issuers of asset-referenced tokens and e-money tokens. CNMV decisions are administratively final (article 23 of Ley 6/2023) and are challenged before the Sala de lo Contencioso-administrativo (Contentious-Administrative Chamber) of the Audiencia Nacional (the National High Court), with no need for a prior attempt at negotiation, which article 5 of Organic Law 1/2025 requires only in civil cases.

Deadline

The CNMV has 25 working days to check that the application is complete and 40 working days, once it is, to decide; the clock can be stopped once, for up to 20 working days, if it requests information (article 63 MiCA). You have one month for reconsideration or two months for the judicial review appeal from the day after notification, a strict time bar (article 46 LJCA, the Contentious-Administrative Jurisdiction Act). Very serious infringements become time-barred five years after the activity ends (article 311 of Ley 6/2023).

Who can bring it

The applicant must be a company domiciled in Spain, an SL or an SA (private or public limited company), that intends to provide any of the ten services in article 3.1.16 MiCA on a professional basis and has a director resident in the Union (article 59.2). The financial entities in article 60 only notify; intragroup services (article 2.2.a) and services a third-country firm provides at the client's own exclusive initiative (article 61, reverse solicitation) fall outside the regime. Any appeal is brought by the applicant.

Financial risk

A refusal ends the project in Spain and is reported to ESMA (the European Securities and Markets Authority). Operating without authorisation is a serious infringement, or a very serious one if not occasional: fines of up to 5,000,000 euros or 5% of turnover if higher, 700,000 euros for individuals and temporary disqualification of directors (articles 307 and 323 of Ley 6/2023). The regulatory cost is ongoing: own funds of 50,000 to 150,000 euros, or a quarter of fixed overheads if higher, or an insurance policy. Losing the appeal usually means an adverse costs order.

First, which service you provide and on which asset

Article 59 of MiCA prohibits providing crypto-asset services in the Union without authorisation, except for the financial entities that notify under article 60. There are ten services, exhaustively listed in article 3.1.16: custody, operating a trading platform, exchange, execution of orders, placing, reception and transmission of orders, advice, portfolio management and transfers. The authorisation specifies the services granted, and adding another requires an extension of the authorisation (article 59.8).

The first trap is the asset. MiCA does not apply to crypto-assets that are financial instruments (article 2.4), to unique and non-fungible ones (article 2.3) or to services provided only within the group (article 2.2.a). If your token is a security or a derivative, you need authorisation as an investment firm, and operating without it is a very serious infringement in every case (article 289 of Ley 6/2023).

If you issue tokens, the white paper for a crypto-asset other than an asset-referenced or e-money token is not approved: it is notified to the CNMV at least 20 working days in advance (article 8). Issuers of asset-referenced tokens need authorisation, supervised in Spain by the Banco de España, and the white paper is approved as part of it (article 21). E-money tokens may only be issued by credit institutions or electronic money institutions (article 48), and since March 2026 transferring or holding them in custody for clients requires, subject to exceptions, a payment services licence, whether your own or a partner's.

What the CNMV requires of the company: substance, fit and proper standards and own funds

Article 59.2 requires what many foreign founders discover too late: a registered office in a Member State where part of the services is provided, effective management in the Union and a director resident there. The Spanish company cannot be a letterbox for other markets: it must also serve clients in Spain. It may be an SL or an SA, and the CNMV accepts a suitable coworking space.

The fit and proper assessment is made person by person. Directors must have no criminal record and no commercial, insolvency, financial, money laundering or fraud penalties, and must collectively have adequate knowledge and commit sufficient time (articles 62.3 and 68.1). Shareholders holding 10% or more must be of good repute (article 68.2), and the CNMV must refuse if the laws of a third country applicable to the applicant's close links prevent supervision (article 63.8).

Own funds are not a one-off contribution: article 67 requires holding at all times the higher of the Annex IV minimum and one quarter of the previous year's fixed overheads. The Annex sets 50,000 euros for class 1 (orders, placing, transfers, advice and portfolio management), 125,000 if custody or exchange is added and 150,000 if there is also a trading platform. With three million euros of projected fixed overheads, 750,000 euros are needed (article 67.2), in Common Equity Tier 1 capital or through insurance.

The application file: what the CNMV actually reads

Article 62.2 lists what the application must contain, Commission Delegated Regulation (EU) 2025/305 fleshes it out and the CNMV publishes an authorisation manual. What carries weight is the programme of operations, stating where and how each service will be marketed, together with corporate governance, risk and anti-money laundering controls, business continuity, systems, segregation and complaints handling. If you repurpose an existing company, audited accounts for the previous quarter are required.

Custody is where most applications stall. Article 75 requires a contract with each client, a register of positions and crypto-assets segregated on the distributed ledger and beyond the reach of the provider's creditors; the provider is liable for their loss up to their market value and must return crypto-assets, not euros. Client funds must be placed with a credit institution or a central bank by the end of the next working day (article 70.3), and sub-custody is only possible with authorised providers (article 75.9).

In addition, DORA (the Digital Operational Resilience Act) requires the authorised provider (article 2 of Regulation 2022/2554) to have an ICT risk framework for which its management body is accountable and a register of ICT contracts (articles 5, 6 and 28); failing to have them is a very serious infringement (article 308 of Ley 6/2023). The travel rule requires originator and beneficiary information to be transmitted and an assessment of whether a self-hosted address receiving a transfer of more than 1,000 euros is owned or controlled by the client (article 14 of Regulation 2023/1113).

The real timeline: the 40 days only run once the application is complete

Article 63 sets the timetable: 25 working days to check that the application is complete and 40, once it is, for a fully reasoned decision. If something is missing, the CNMV sets a deadline to provide it and may refuse to keep reviewing an incomplete application (article 63.3). Filing a half-finished application to buy time achieves the opposite: the substantive clock never starts.

Within those 40 days, the CNMV may request information up to the twentieth working day. The clock is suspended until you reply, never for more than 20 working days, and further requests do not suspend it (article 63.12), so every reply must be prepared as if it were the last. And silence is not a licence: the Regulation requires an express, reasoned decision.

Once authorisation is granted, the CNMV requires the corporate formalities to be completed before activity begins; it then informs ESMA and the entity may start operating. The authorisation is withdrawn if not used within twelve months or if no services are provided for nine consecutive months (article 64.1). And anyone later acquiring a qualifying holding must notify the CNMV in advance, and the CNMV has 60 working days to assess the acquisition (article 83).

Grandfathering is over: operating without a licence since July 2026

Article 143.3 allowed firms providing services under national law before 30 December 2024 to continue only until 1 July 2026, or until the decision if earlier; in Spain the transitional period ran until that date. The Banco de España register was an anti-money laundering registration, not a licence, and a pending application gives no cover: anyone without authorisation on 1 July had to stop.

Serving Spanish clients from the foreign parent is not a way out. The reverse solicitation exemption in article 61 disappears as soon as the firm, or anyone on its behalf, solicits clients in the Union by any means, advertising included, and no contractual clause can preserve it. Nor, according to ESMA, may unlicensed agents be used, and in the CNMV's view professional client acquisition is reserved for authorised entities.

Ley 6/2023 classifies breaches of the MiCA authorisation rules as serious infringements, and carrying on unauthorised activities other than on a merely occasional or isolated basis as very serious (article 307): fines of up to 5,000,000 euros or 5% of turnover if higher, 700,000 euros for individuals and a temporary ban on holding management positions (article 323). What almost nobody has spotted: article 307 predates the final text of MiCA and cites its articles using the numbering of the draft, a mismatch that is examined closely in any sanctioning proceedings.

The EU passport: the whole Union on a Spanish licence

Article 59.7 allows an authorised provider to operate throughout the Union, through a branch or under the freedom to provide services, which requires no physical presence in the host Member State. Under article 65, you notify the CNMV of the Member States, the services and the start date; the CNMV forwards this within ten working days and you may start on receiving its confirmation or, at the latest, on the fifteenth calendar day.

The passport does not put you beyond the reach of other supervisors: if the host authority finds persistent irregularities, it may stop you from operating there (article 102). Choosing your home Member State does not change the rules, which are the same across the Union; what it changes is the supervisor, the language and where you must provide part of your services. And a refusal does not stay in Madrid: the CNMV reports it to ESMA (article 63.13).

Financial entities that are already authorised do not apply for a licence: they notify the CNMV, 40 working days in advance, of the services equivalent to those they already provide (article 60), with essentially the same supporting documentation. The CNMV has made clear that an EAFN (empresa de asesoramiento financiero nacional, a Spanish national financial advisory firm) is not an investment firm and cannot use that route: it needs the full licence.

If the CNMV refuses: the appeal, and how the case is won before it starts

Article 63.10 only allows refusal on objective and demonstrable grounds: that the management body threatens sound and prudent management or exposes the firm to a serious money laundering risk, that directors or qualifying shareholders are not fit and proper, or that the entity does not comply, or is likely not to comply, with the Regulation. A refusal based on generic suspicions is not the fully reasoned decision required by article 63.9.

The CNMV's decision is administratively final (article 23 of Ley 6/2023): you may seek optional reconsideration (recurso de reposición) within one month or appeal to the Sala de lo Contencioso-administrativo of the Audiencia Nacional (the National High Court, under the fourth additional provision of the LJCA) within two months from the day after notification or after the decision on reconsideration (article 46 LJCA), a strict time bar in which August does not count. No prior attempt at negotiation is needed, since Organic Law 1/2025 confines that requirement to civil cases: a client's claim against the custodian before the Tribunal de Instancia (the first-instance court) would require one.

The court defers to the supervisor's technical discretion and reviews the facts, the reasoning and any manifest error: the case is won in the administrative file, with every request answered with evidence and on time. If the refusal rests on a real deficiency, it is usually faster to fix it and reapply, or to withdraw the application before a decision; if it rests on a legal error, such as misclassifying the asset, you appeal while preparing the new application.

How we run the case, step by step

1. 1

   We classify your services and your assets

   We map your model onto the ten services in article 3.1.16 MiCA, rule out any token being a financial instrument or an e-money token and determine your Annex IV class: that tells you whether you need a licence, whether a notification is enough or whether you need a different authorisation.

2. 2

   We design the structure and the substance in Spain

   A Spanish company, a director resident in the Union, a team and control functions with a genuine local presence, transparent ownership up to the ultimate beneficial owner and own funds calculated on the higher of the two tests in article 67.

3. 3

   We prepare a complete file from day one

   We draft the programme of operations, the article 62 policies (custody, conflicts of interest, complaints handling, business continuity, outsourcing, anti-money laundering and the travel rule), the DORA documentation and the fit and proper files for directors and qualifying shareholders.

4. 4

   We file and handle all dealings with the CNMV

   We file a complete application and answer every request with evidence and on time: the maximum suspension is 20 working days and later requests no longer stop the clock.

5. 5

   We finalise the authorisation and activate the passport

   We complete the corporate formalities, check the entry in the ESMA register and notify the CNMV of the host Member States, the services and the start date under article 65.

6. 6

   If the application is refused or sanctioning proceedings are opened, we act in time

   We record the date of notification, calculate the one-month deadline for reconsideration and the two-month deadline for the appeal to the Audiencia Nacional, and assess whether it is better to fix the deficiency and reapply. In sanctioning proceedings, the defence starts the moment they are opened.

The law that applies

• Arts. 59 y 65 del Reglamento (UE) 2023/1114 (MiCA). Crypto-asset services may be provided in the Union only by providers authorised under article 63, which need a registered office where they provide part of their services, effective management in the Union and a resident director, or by the entities in article 60; an authorised provider may operate across the Union by notification. 32023R1114
• Art. 60 del Reglamento (UE) 2023/1114. Credit institutions, central securities depositories, investment firms, electronic money institutions, fund managers and market operators may provide services equivalent to those they are already authorised for by notifying 40 working days in advance. 32023R1114
• Arts. 62 y 63 del Reglamento (UE) 2023/1114. They set the content of the application and its review: 25 working days to check it is complete, 40 from then for a fully reasoned decision, a maximum suspension of 20 and refusal only on objective and demonstrable grounds. 32023R1114
• Art. 67 y anexo IV del Reglamento (UE) 2023/1114. The provider must at all times hold prudential safeguards equal to the higher of 50,000, 125,000 or 150,000 euros, depending on its services, and one quarter of the previous year's fixed overheads, in Common Equity Tier 1 capital or through insurance. 32023R1114
• Art. 143.3 del Reglamento (UE) 2023/1114. Firms providing services under national law before 30 December 2024 could continue until 1 July 2026 or until the decision, if earlier; Member States could disapply or shorten that period. 32023R1114
• Arts. 23 y 251 de la Ley 6/2023. The CNMV supervises compliance with MiCA, except for issuers of e-money tokens and asset-referenced tokens, which fall to the Banco de España; its decisions are administratively final and are challenged before the contentious-administrative courts. BOE-A-2023-7053
• Arts. 307 y 323 de la Ley 6/2023. They classify the MiCA breaches they list as serious and, among other cases, carrying on unauthorised activities other than occasionally or in isolation as very serious: fines of up to 5,000,000 euros or 5% of turnover, 700,000 euros for individuals and a temporary ban on holding management positions. BOE-A-2023-7053
• Art. 46 de la Ley 29/1998 (LJCA). A judicial review appeal must be filed within two months from the day after notification of the administratively final act or, if reconsideration was sought, from the day after its express or deemed decision. BOE-A-1998-16718

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions