Since 30 December 2024, providing crypto-asset services in the European Union requires authorisation as a CASP (Crypto-Asset Service Provider) under the MiCA Regulation — and in Spain the licence is granted and supervised by the CNMV. The Spanish transitional period ended on 30 December 2025: anyone operating today without authorisation — their own or passported from another Member State — is outside the framework.
Tool: check in 6 questions whether your activity needs authorisation with our “Do you need a CASP licence?” test.
What a CASP is and which services the authorisation covers
Regulation (EU) 2023/1114 (MiCA) defines ten crypto-asset services, including custody and administration on behalf of clients, exchange of crypto-assets for funds or other crypto-assets, execution and reception/transmission of orders, portfolio management, advice, transfer services and operating a trading platform. Providing any of them professionally in the EU requires being an authorised CASP (Title V, Articles 59 to 64).
Who does not need a CASP licence
Two exclusions draw the perimeter. The first is about the product: security tokens are not MiCA crypto-assets — they are financial instruments under MiFID II and Spanish Law 6/2023, and their issuance and registration follow a different path (ERIR, prospectus), which we cover in our security tokens service.
The second is about the entity: already-regulated firms (credit institutions, investment firms and other financial-sector entities) may provide equivalent crypto-asset services through a prior notification to the supervisor (Article 60), without going through the full authorisation.
The process before the CNMV
Applications in Spain are filed with the CNMV as competent authority. The file requires, among other things: a programme of operations, minimum own funds depending on the class of services (EUR 50,000, 125,000 or 150,000 under Annex IV of MiCA), fit-and-proper requirements for directors and qualifying shareholders, governance and business continuity, segregation and custody of clients’ crypto-assets, conflicts-of-interest policy and AML procedures. Real timelines depend on how complete the file is: the clarification phase is where applicants lose months.
The transitional period is over
MiCA allowed each Member State a transitional regime for firms already operating under national law before 30 December 2024. Spain set it at 12 months: it ended on 30 December 2025. The Bank of Spain’s national registry of virtual-asset providers no longer enables operations: operating today requires CASP authorisation or a regulated-entity notification. We keep the full calendar in our MiCA deadline tracker for Spain.
The European passport
A CASP authorisation obtained in one Member State passports across the whole EU: a provider authorised elsewhere can operate in Spain after notification, and vice versa. That turns the choice of jurisdiction into a strategic decision — cost and timeline of the file versus target market — best taken with the whole map in view.
Where we fit
We are not a law firm: we are the technical team that builds and operates the infrastructure the application describes — custody, segregation, order records, KYC/AML integration — working alongside the client’s legal counsel. If you are assessing whether your model needs a CASP licence or can be structured differently, start with the test or book a call with our blockchain consulting team.