Portugal Crypto Licence Requirements in 2026

A Portugal crypto (CASP) licence requires a Portuguese company with genuine local substance — a registered office, real operating presence and management anchored in Portugal — plus the class-based MiCA capital (€50,000–€150,000). Portugal spent years as Europe’s informal crypto capital — a deep Lisbon Web3 community, a favourable lifestyle and a large Banco de Portugal VASP register that was AML-only. Under MiCA that has matured into a full regime, and the requirements file behind a CASP authorisation is now a real financial-services file, not the light registration Portugal was known for.

This guide is the requirements checklist we work from on our own desk. It covers exactly what the 2026 Portugal CASP regime demands — a Portuguese company with substance, funded capital by service class, fit-and-proper management assessed by the Banco de Portugal with CMVM conduct input, an MLRO, and a DORA-compliant ICT framework — so you can price the licence on what it actually takes. Portugal runs a twin-peaks model, and we scope the file to satisfy both regulators.

The company and local substance

Everything starts with a Portuguese company. The Banco de Portugal authorises a Portuguese legal entity with genuine substance behind it — there is no remote-only route. The applicant is incorporated in Portugal, keeps a registered office there, holds its initial capital in an EEA bank or e-money account, and runs a real operating presence rather than a virtual address. This is the first hard difference from the old AML-only VASP register, and it is the requirement operators most often underestimate.

Substance is assessed in the round. The regulator wants to see that the business is directed and administered from Portugal, with the right people performing the core functions locally. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the substance test. For the full picture of what a CASP authorisation buys and how it sits within MiCA and Portugal’s twin-peaks model, our flagship Portugal crypto licence overview maps the regime end to end.

Capital by service class

This is the requirement that catches operators pricing Portugal on the processing fee alone. MiCA sets a minimum capital floor by the service class you run, and Portugal applies it directly. At application you must fund the initial capital and hold it within the EEA — it is working capital of the business, not a fee. Being in the eurozone keeps capital, banking and settlement simple.

These figures are identical in every EU member state — they come from MiCA, not from Portuguese law — so the capital tier is not something you optimise by choosing Portugal over another EU jurisdiction. What Portugal offers is a credible twin-peaks regulator, the Lisbon ecosystem and a realistic four-to-nine-month timeline around the same requirement. Costs sit outside scope here; for the full year-one build see the Portugal crypto licence cost guide, and for the capital rules across all three classes our CASP capital requirements primer breaks each one down.

People, governance and fit-and-proper vetting

Under MiCA the people behind the company are assessed as rigorously as the business itself, and in Portugal the Banco de Portugal runs the vetting with CMVM conduct input. This is not a formality — an unresolved file on any one person holds the whole application.

Fit-and-proper management. The people running the CASP are assessed for competence, integrity and relevant experience. The regulator expects a board and senior management with genuine financial-services or crypto backgrounds — not a founder team with no regulated-industry track record. Directors must demonstrate they can actually run a licensed EU financial-services business.

A dedicated MLRO and governance structure. A money-laundering reporting officer is a condition of the licence, backed by a clear governance structure with defined responsibilities and board-level compliance oversight. The MLRO is accountable for the AML programme, transaction monitoring and reporting — and must be a real, appointable person, not a name on an org chart.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. You must show not only that the business is funded, but where the money comes from and how the beneficial owners built their wealth. Vague or undocumented wealth is one of the most common reasons a file stalls — the same standard a tier-1 bank applies.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme

Alongside people and capital, the Banco de Portugal reviews a defined set of documents and policies, with the CMVM weighing the conduct dimension. Filing with any of these missing, or written for a different business model, is what turns a four-month approval into a nine-month one. The core pack is:

Three elements deserve emphasis. The AML/CFT policies must be operable documents aligned to the EU’s 5th and 6th anti-money-laundering directives and the Travel Rule — the EU Transfer of Funds Regulation obligation to attach originator and beneficiary data to crypto transfers — because the MLRO is expected to actually run them. The DORA ICT framework covers ICT risk management, incident reporting, resilience testing and third-party ICT oversight, and it applies to every CASP. And the custody, safeguarding, complaints and conflicts procedures sit largely under CMVM conduct oversight, with strict client-asset segregation for any class that touches custody. Where you issue or admit tokens to trading, a MiCA white paper meeting the regulation’s disclosure standard is required on top of the service authorisation.

Transition, passporting and the VASP deadline

Two dates frame the requirements. First, the VASP-to-CASP transition: under MiCA the national VASP registration is being retired, and the transitional window for previously registered providers closes by 1 July 2026 (MiCA Article 143(3)). The old Banco de Portugal register was AML-only and imposed no conduct or prudential requirements, so existing holders must transition to a full CASP authorisation or wind down before then — there is no VASP shortcut left, and no automatic conversion. If you are on the legacy register, our Portugal crypto tax guide also covers how the move to a fully regulated footing changes the picture for a Lisbon-based operation.

Second, the reward for meeting the full requirements: passporting. Once the Banco de Portugal grants the CASP licence, it lets you offer crypto services across all 27 EU member states on a notification basis under MiCA Article 65 — one licence, the single largest regulated crypto market in the world, without applying jurisdiction by jurisdiction. That EU-wide reach is precisely what the substance, capital and DORA requirements are the price of.

Assembling the file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: fix your CASP service classes and the matching capital tier first, then incorporate the Portuguese company, fund the capital in an EEA account and stand up the local office and roles. Assemble every UBO and management fit-and-proper file — source of funds, suitability, experience evidence — in parallel, because they take the longest. Draft the programme of operations, AML/CFT and DORA policies against your actual operating model, not off a template. Only then does the application go to the Banco de Portugal, which decides with a CMVM conduct opinion.

None of this is the light registration Portugal offered before 2025 — and that is the point. The CASP regime asks for a real Portuguese company, real capital, vetted people and operable AML and ICT programmes, and in exchange gives you a full EU financial-services credential that passports across 27 markets and carries weight with banks, PSPs and institutional partners. Get the file complete and internally consistent the first time and the four-to-nine-month window is achievable; file with gaps and it drifts.

Ready to assemble your CASP requirements pack, or want a second opinion on a file you have already started? Our team handles the full Portuguese substance, fit-and-proper, AML and DORA build end to end, manages both the Banco de Portugal and CMVM dimensions, and will review any application against the regulators’ expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.