Your exchange blocks withdrawals or asks for taxes: what to do

Yes. The pattern repeats itself: you deposit money, the dashboard shows striking profits and, when you request a withdrawal, an upfront charge appears: taxes, a tasa antiblanqueo (anti-money laundering fee), a liquidity commission, insurance or an "unlocking" fee. If you pay, another one appears. The balance on the screen does not exist: the platform writes it so you keep depositing.

It cannot be a real tax. In Spain, you declare the profit from selling cryptocurrencies in your Renta (income tax return) and pay it to the Agencia Tributaria through the agency's own channels. Exchanges with a headquarters or establishment in Spain report balances and operations to Hacienda (forms 172 and 173), but they do not charge you the tax or condition the withdrawal on paying it. And if the balance existed, any legitimate charge would be deducted from it: whoever asks you for new money to return yours is admitting that yours is not there.

Obtaining payments through deception is a scam: sufficient deception to produce an error in another and induce them to an act of disposal to their own detriment (art. 248 of the Código Penal), punished with prison from 6 months to 3 years, or a fine of 1 to 3 months if the defrauded amount does not exceed €400. The right step is to report it, not to negotiate.

There are variants that impersonate the Agencia Tributaria, the CNMV, the Banco de España or Interpol. No public body asks you via WhatsApp or Telegram to deposit cryptocurrencies to collect what is yours.

From 1 July 2026, providing crypto-asset services in Spain requires authorisation from the CNMV or the passporting of an authorisation from another Union State. On that day, the MiCA transitional period ended (art. 143.3 of Regulation (EU) 2023/1114). Spain announced it would shorten it, but never approved it in the BOE.

Check it in the CNMV crypto-asset provider register and in the ESMA MiCA register, which lists those authorised throughout the Union. Look for the exact company name, not the brand, and confirm that the website you operate on is the registered one. Also check the CNMV list of warned entities.

Clones are common: a website almost identical to that of a known exchange, with another domain. MiCA prohibits anyone who is not authorised from using a name or advertising that suggests they are or creates confusion (art. 59.5). If it does not appear in any register, or the name matches but the website does not, treat it as a fake platform.

If your exchange operated legally before July 2026 and did not obtain authorisation, it can no longer provide services in Spain: ask them in writing how and when you can withdraw your cryptocurrencies and your cash, and do so as soon as possible.

Yes, temporarily and with reason. Exchanges are obliged entities under Ley 10/2010 (the Spanish Anti-Money Laundering Act): they must identify their clients with reliable documents (art. 3) and apply due diligence according to the risk (art. 7), also to old clients when their circumstances change or they make a significant transaction due to its volume or complexity, and whenever there are signs of money laundering.

That is why they can ask you to re-verify your identity, a proof of address, the source of funds (payslips, a property sale deed, statements from the origin account) or the explanation of a transaction. Until you provide it, they may decline to execute the withdrawal.

If they fail to apply these measures, they cannot execute transactions and must end the relationship, without liability "unless there is unjust enrichment" (art. 7.3). That exception matters: the law obliges them to stop operating with you, but it does not authorise them to keep your balance.

What an authorised exchange does not do is charge you to lift the block or ask you for more money to withdraw. Their fees must be published in a prominent place on their website (art. 66.4 MiCA). Always reply from the official application or website, never through a received link, submit the complete documents at once and keep a copy of everything.

Every authorised provider must have an effective, transparent and free complaints procedure, with a template and a register of those they receive (art. 71 MiCA). Delegated Regulation (EU) 2025/294 specifies it: they publish the procedure and the standard template on their website in all the languages in which they market, and they accept complaints by electronic means or on paper.

Upon receiving it, they acknowledge receipt with the name and contact details of the person handling it, the date of receipt and the deadline, and they tell you without delay if they admit it. They cannot ask you for information they already have (art. 5.2) and they reply in writing in the language in which you claimed, if it is one of the ones they use or an official language of the home or host State that is also official in the Union.

The decision arrives reasoned within a maximum of 2 months from when they receive it (art. 6.2). Only in exceptional situations can it be delayed, explaining the reason and giving you a date. If they do not agree with you, or only in part, they must tell you why and what avenues of appeal you have left (art. 6.4).

A good complaint is specific: your user identifier, date and amount of each requested withdrawal, asset and network, destination address or IBAN, hash if the transaction went out, KYC documents submitted and when, and a closed request: that they execute the withdrawal or tell you in writing the reason and the exact list of missing documents.

At Managora we do this with the Claim against a cryptocurrency exchange or platform service: we check if the provider is authorised under MiCA, we submit the complaint to their complaints service and, if they reject it or do not reply in time, to the CNMV Complaints Service. You can see the updated amount in the service file. If the platform is not authorised or asks you for taxes to withdraw, that service is not for you: it is a scam.

The next step is the CNMV Complaints Service, which handles complaints against authorised or passported crypto-asset providers. It is free and requires having claimed to the provider beforehand: you can go there if they deny it or if 1 month passes without resolving it (art. 30.3.a of Ley 44/2002), even though the provider has up to 2 months to decide. It is submitted with the official form, through the electronic headquarters or on paper, with the previous complaint and the reply if there was one.

Their resolution is not binding: it does not force the exchange to pay nor is it executed like a court ruling. Even so, it carries weight with a supervised provider and is good evidence if you later have to sue.

The civil route to claim the balance becomes time-barred 5 years from when compliance can be demanded (art. 1964 of the Código Civil), and before suing you must try an appropriate means of dispute resolution; if you are a consumer, the complaint to the provider or the CNMV already counts as such (seventh additional provision of Ley Orgánica 1/2025). That lawsuit is not included in our standard services: if your case justifies it, the firm studies it and quotes it separately.

The Financial Customer Defence Authority is not yet operational: it is still a draft bill. And if the platform is not authorised, the CNMV does not resolve complaints against it, although it can receive the communication to warn the public: your case is handled as a scam, with the bank and the police report.

Do not pay anything else, even if they tell you it is the last charge. Call your bank today: if you paid by bank transfer, ask for a fraud recall; with a card, a chargeback. From 9 October 2025, the bank must check the beneficiary's name against the IBAN before a transfer in euros: if they did not offer you that service or it failed, they are liable to you; if they warned you that it did not match and you authorised it anyway, they are not liable through that route.

If you paid in cryptocurrencies, note down the destination address and the hash of each transfer. If the money ended up in an identifiable exchange or bank, they can be required to keep the data and consider blocking that account.

Then, report it: at a police station, at a Guardia Civil station, at the duty court or online with subsequent ratification. We draft the report for you with the ordered evidence (Online report to the Policía Nacional or Guardia Civil service). Managora does not handle criminal cases: neither querellas (criminal complaints filed as a party to the proceedings) nor criminal defence.

If you prefer us to handle the whole front, the Claim plan after an investment, trading or cryptocurrency scam service includes analysis and chronology with the evidence, the letter to your bank, the requirement to the receiving bank or exchange for the block and data retention, the drafted police report, the communication to the CNMV if the entity is not authorised and guidance for your income tax return. You can see the updated amount in the service file. We do not promise you will recover the money: we tell you what can be claimed, from whom and in what timeframe.

Beware of the second wave: "recovery agencies" or fake officials who know your case and ask for an upfront commission to return your money. It is the same scam in another disguise.

The legitimate withdrawal fee exists: it is published on the provider's website (art. 66.4 MiCA), it is known before requesting the withdrawal and it is deducted from the outgoing amount, sometimes with the network cost. It is not paid separately, nor to another wallet, nor in another currency.

In your income tax return, according to binding consultation V0648-24 of the Directorate-General for Taxes, it depends on the context: if the withdrawal occurs when selling for euros or swapping, and the expense is inherent to that transaction and you pay it, it counts towards the acquisition or transmission value; if you only move cryptocurrencies between two of your wallets from different providers, it is irrelevant for IRPF (personal income tax) purposes.

With more than €50,000 in cryptocurrencies held in custody outside Spain on 31 December, you must also submit form 721, which is informative. And if you lost money on a fake platform, whether that loss counts in your income tax return depends on each case: we explain it in the guide How to declare money lost in a scam on your income tax return.