MiCA license in Spain (CASP): CNMV requirements and timelines

A MiCA license in Spain is the CASP authorization granted by the CNMV under Article 63 of Regulation (EU) 2023/1114, and the Spanish transitional period for firms already operating ended on July 1, 2026. The legal clock is set by MiCA (Article 63): 25 working days to confirm the application is complete and 40 working days to decide once it is, with a single pause of up to 20 working days if the CNMV asks for more information; the CNMV's authorization manual adds that any significant change to the application restarts the 40-day period. The file must prove minimum capital of €50,000, €125,000 or €150,000 depending on the services (Annex IV), fit and proper directors and shareholders, substance in the EU and anti-money laundering controls.

Tool: check in 6 questions whether your activity needs authorization with our “Do you need a CASP license?” test.

What a CASP is and which services the authorization covers

Regulation (EU) 2023/1114 (MiCA) defines ten crypto-asset services, including custody and administration on behalf of clients, exchange of crypto-assets for funds or other crypto-assets, execution and reception/transmission of orders, portfolio management, advice, transfer services and operating a trading platform. Providing any of them professionally in the EU requires being an authorized CASP (Title V, Chapter 1, Articles 59 to 65).

Who does not need a CASP license

Two exclusions draw the perimeter. The first is about the product: security tokens are not MiCA crypto-assets — they are financial instruments under MiFID II and Spanish Law 6/2023, and their issuance and registration follow a different path (ERIR, prospectus), which we cover in our security tokens service. More on this in regulated tokenization in Spain.

The second is about the entity: already-regulated firms (credit institutions, investment firms and other financial-sector entities) may provide crypto-asset services (credit institutions, any of them; the others, only those MiCA treats as equivalent to their existing authorization) through a prior notification to the supervisor (Article 60), without going through the full authorization.

The process before the CNMV

Applications in Spain are filed with the CNMV as competent authority. The file requires, among other things: a program of operations, minimum prudential safeguards depending on the class of services (EUR 50,000, 125,000 or 150,000 under Annex IV of MiCA, or one quarter of the previous year's fixed overheads if higher, Article 67), fit-and-proper requirements for directors and qualifying shareholders, governance and business continuity, segregation and custody of clients’ crypto-assets, conflicts-of-interest policy and AML procedures. Real timelines depend on how complete the file is: if information is missing, the CNMV sets a deadline to provide it, and the 40-working-day assessment period only starts once the application is complete (Article 63).

The transitional period is over

MiCA allowed each Member State a transitional regime for firms already operating under national law before December 30, 2024. Spain applied the maximum of 18 months: it ended on July 1, 2026, according to the CNMV. The Bank of Spain’s national registry of virtual-asset providers no longer enables operations: operating today requires CASP authorization or a regulated-entity notification. We keep the full calendar in our MiCA deadline tracker for Spain.

The European passport

A CASP authorization obtained in one Member State passports across the whole EU: a provider authorized elsewhere can operate in Spain after notification, and vice versa. That turns the choice of jurisdiction into a strategic decision — cost and timeline of the file versus target market — best taken with the whole map in view.

Requirements checklist to obtain a CASP license in Spain

The CNMV assesses the application against Title V of MiCA. In practice the file has to prove seven things:

1. A legal entity with substance in the EU: registered office in Spain, where it must carry out at least part of its crypto-asset services, effective management in the Union and at least one director resident in the EU (Article 59(2)); a firm with its registered office in another Member State applies to that state's supervisor (Article 62(1)).
2. Minimum capital, by class of service: €50,000 for class 1 services (advice, reception and transmission of orders, execution, placing, portfolio management, transfers), €125,000 for class 2 (custody and administration, and exchange of crypto-assets for funds or for other crypto-assets, on top of class 1) and €150,000 for class 3 (operating a trading platform, on top of class 2) — or one quarter of the previous year's fixed overheads, whichever is higher. Prudential safeguards can be held as own funds, an insurance policy, or a combination.
3. Fit and proper management and shareholders: good repute, knowledge and experience of the directors, and identification of anyone holding a qualifying stake of 10% or more.
4. Governance and internal control: program of operations, organizational chart, internal control and risk management, ICT security and business continuity (aligned with DORA), and procedures for conflicts of interest and complaints handling.
5. Safeguarding of clients' funds and crypto-assets: segregation policy, custody arrangements and, for custody services, the custody policy MiCA requires.
6. AML/CTF framework: CASPs are obliged entities under Spanish Law 10/2010 (except those that only provide advice), with SEPBLAC as AML supervisor; the file must describe KYC, monitoring, reporting and the compliance function.
7. Service-specific conduct rules: each service in the MiCA catalog carries its own requirements (execution policy and best execution, market-abuse detection for trading platforms, disclosure duties for advice, and so on).

Timeline. MiCA gives the competent authority 25 working days to confirm the file is complete and 40 working days to assess it; only the first request for additional information, made no later than the 20th working day of the assessment, suspends that period, for up to 20 working days (Article 63(12)); later requests do not stop the clock. Real timelines depend mostly on the quality of the initial file, because the 40-day period only starts once the application is complete. Costs. Beyond any CNMV fee (its manual names the applicant as liable under Law 16/2014, but the consolidated text of that law does not yet set an amount for CASP authorization), budget for the capital, the advisory and technical work, and — recurring, not one-off — the compliance function. The figures above are the MiCA baseline; check the current CNMV guidance before filing.

If you are comparing jurisdictions, the number of authorized CASPs, the transitional period and the supervisor of each Member State are in MiCA license by country.

Where we fit

We are not a law firm: we are the technical team that builds and operates the infrastructure the application describes — custody, segregation, order records, KYC/AML integration — working alongside the client’s legal counsel. If you are assessing whether your model needs a CASP license or can be structured differently, start with the test or book a call with our blockchain consulting team.

Marketing a licensed crypto business is regulated too: see the crypto advertising rules in Spain.