Since 30 December 2024, providing crypto-asset services in the European Union requires authorisation as a CASP (Crypto-Asset Service Provider) under the MiCA Regulation — and in Spain the license is granted and supervised by the CNMV. The Spanish transitional period ended on 30 December 2025: often searched for as a «MiCA license», the formal figure is CASP authorisation — and anyone operating today without it — their own or passported from another Member State — is outside the framework.
Tool: check in 6 questions whether your activity needs authorisation with our “Do you need a CASP license?” test.
What a CASP is and which services the authorisation covers
Regulation (EU) 2023/1114 (MiCA) defines ten crypto-asset services, including custody and administration on behalf of clients, exchange of crypto-assets for funds or other crypto-assets, execution and reception/transmission of orders, portfolio management, advice, transfer services and operating a trading platform. Providing any of them professionally in the EU requires being an authorised CASP (Title V, Articles 59 to 64).
Who does not need a CASP license
Two exclusions draw the perimeter. The first is about the product: security tokens are not MiCA crypto-assets — they are financial instruments under MiFID II and Spanish Law 6/2023, and their issuance and registration follow a different path (ERIR, prospectus), which we cover in our security tokens service.
The second is about the entity: already-regulated firms (credit institutions, investment firms and other financial-sector entities) may provide equivalent crypto-asset services through a prior notification to the supervisor (Article 60), without going through the full authorisation.
The process before the CNMV
Applications in Spain are filed with the CNMV as competent authority. The file requires, among other things: a programme of operations, minimum own funds depending on the class of services (EUR 50,000, 125,000 or 150,000 under Annex IV of MiCA), fit-and-proper requirements for directors and qualifying shareholders, governance and business continuity, segregation and custody of clients’ crypto-assets, conflicts-of-interest policy and AML procedures. Real timelines depend on how complete the file is: the clarification phase is where applicants lose months.
The transitional period is over
MiCA allowed each Member State a transitional regime for firms already operating under national law before 30 December 2024. Spain set it at 12 months: it ended on 30 December 2025. The Bank of Spain’s national registry of virtual-asset providers no longer enables operations: operating today requires CASP authorisation or a regulated-entity notification. We keep the full calendar in our MiCA deadline tracker for Spain.
The European passport
A CASP authorisation obtained in one Member State passports across the whole EU: a provider authorised elsewhere can operate in Spain after notification, and vice versa. That turns the choice of jurisdiction into a strategic decision — cost and timeline of the file versus target market — best taken with the whole map in view.
Requirements checklist to obtain a CASP license in Spain
The CNMV assesses the application against Title V of MiCA. In practice the file has to prove seven things:
- A legal entity with substance in the EU: registered office in Spain (or in another Member State where at least part of the business is carried out), effective management in the Union and at least one director resident in the EU.
- Minimum capital, by class of service: €50,000 for class 1 services (advice, reception and transmission of orders, execution, placing, portfolio management, transfers), €125,000 for class 2 (custody and administration, and exchange of crypto-assets for funds or for other crypto-assets, on top of class 1) and €150,000 for class 3 (operating a trading platform, on top of class 2) — or one quarter of the previous year's fixed overheads, whichever is higher. Prudential safeguards can be held as own funds, an insurance policy, or a combination.
- Fit and proper management and shareholders: good repute, knowledge and experience of the directors, and identification of anyone holding a qualifying stake of 10% or more.
- Governance and internal control: programme of operations, organisational chart, internal control and risk management, ICT security and business continuity (aligned with DORA), and procedures for conflicts of interest and complaints handling.
- Safeguarding of clients' funds and crypto-assets: segregation policy, custody arrangements and, for custody services, the custody policy MiCA requires.
- AML/CTF framework: Spanish CASPs are obliged entities under Law 10/2010, supervised by SEPBLAC; the file must describe KYC, monitoring, reporting and the compliance function.
- Service-specific conduct rules: each service in the MiCA catalogue carries its own requirements (execution policy and best execution, market-abuse detection for trading platforms, disclosure duties for advice, and so on).
Timeline. MiCA gives the competent authority 25 working days to confirm the file is complete and 40 working days to assess it; the clock stops whenever the CNMV requests additional information, so real timelines run longer and depend mostly on the quality of the initial file. Costs. Beyond the CNMV's own fees, budget for the capital, the advisory and technical work, and — recurring, not one-off — the compliance function. The figures above are the MiCA baseline; check the current CNMV guidance before filing.
Where we fit
We are not a law firm: we are the technical team that builds and operates the infrastructure the application describes — custody, segregation, order records, KYC/AML integration — working alongside the client’s legal counsel. If you are assessing whether your model needs a CASP license or can be structured differently, start with the test or book a call with our blockchain consulting team.
Marketing a licensed crypto business is regulated too: see the crypto advertising rules in Spain.