Portugal Crypto Licence 2026: The CASP Guide

Portugal spent most of the last decade as Europe’s informal crypto capital — a city full of Web3 founders, a light-touch tax reputation and a Banco de Portugal register that only ever asked for AML compliance. Under MiCA that has grown up. What you apply for in 2026 is a full Crypto-Asset Service Provider (CASP) authorisation that passports across all 27 EU member states, and it comes from an unusual two-regulator setup that catches a lot of applicants off guard.

The confusion we hear most is “who do I actually apply to?” Portugal runs a twin-peaks model: the Banco de Portugal grants the licence and owns the prudential and AML side, while the CMVM co-supervises conduct. That is one file, two supervisors, and a bar considerably higher than the old register ever set — a Portuguese company with real substance, an AML officer, a DORA-compliant technology programme and €50,000 to €150,000 of funded capital by class. This guide explains what a Portugal crypto licence really is now: the twin-peaks regime, the capital, the EU passport, the timeline, the substance, the Lisbon draw, and the tax position that still pulls people in.

What a Portugal CASP licence is — and what it replaced

A Portugal crypto licence is a Crypto-Asset Service Provider (CASP) authorisation under the Markets in Crypto-Assets Regulation — MiCA, Regulation (EU) 2023/1114. It is the single EU credential for firms that provide crypto services: running an exchange, safeguarding client assets, executing and placing orders, operating a trading platform, or advising on crypto-assets.

The word “replaced” matters. Before MiCA, Portugal kept a national VASP register held by the Banco de Portugal that was purely an anti-money-laundering registration that checked your AML controls and nothing else. It carried no capital requirement, no conduct rules and no prudential supervision, which is a large part of why so many crypto teams were comfortable basing in Lisbon. MiCA retired that model across the EU. The CASP authorisation that took its place is a proper financial-services licence, and Portugal’s implementing law, Lei 69/2025, assigns it to two supervisors rather than one. If you have read our VASP, CASP and MiCA explainer, Portugal is the same shift arriving in one of Europe’s most crypto-heavy communities. Anyone still marketing a “Portuguese VASP licence” in 2026 is describing a registration that has already given way to CASP, and the difference is expensive to get wrong.

The twin-peaks model: two regulators, one file

This is the feature that makes Portugal distinctive, and it deserves to be understood before you scope anything. Most EU states hand crypto to a single authority. Portugal splits the job along the classic “twin-peaks” line: prudential supervision on one side, conduct on the other.

In practice you file for authorisation with the Banco de Portugal, which is the competent authority that issues the licence, and the CMVM feeds in a conduct opinion and supervises how you treat clients once you are live. The first full CASP authorisation under this regime was granted in June 2026, which confirmed the process end to end. For an applicant, the lesson is that your file has to satisfy both lenses at once — a programme of operations built only for prudential review will stall on the conduct side. We build to the Banco de Portugal standard and manage the CMVM conduct dimension alongside it rather than as an afterthought.

Capital by service class in Portugal

MiCA sets minimum capital by the class of service you provide, and, as operators often miss, those tiers are identical in every EU country. You do not pick Portugal for cheaper capital; the capital is fixed by the regulation. What Portugal determines is the twin-peaks process around your file. Being in the eurozone keeps the capital, banking and settlement side simple, with no currency conversion between your funding and your obligations.

Two things drive the budget. First, the capital is not a fee. It stays in the business as own funds or is covered by an insurance policy, and it rises to a quarter of last year’s fixed overheads once that is higher than the class floor. Second, the classes are cumulative: an exchange with custody is Class 2 at €125,000, and a full order-book trading venue lands you in Class 3 at €150,000. Most exchange and broker projects sit at €125,000. Scoping the right class before you incorporate is the single decision that most affects your all-in number — our Portugal crypto licence cost breakdown models the full year-one figure with capital included, and the complete document and governance list lives in our Portugal crypto licence requirements guide.

From Portugal, one licence and 27 markets: the EU passport

The reason a CASP licence justifies the substance is the passport. Under MiCA Article 65, once the Banco de Portugal authorises you, you can provide your licensed services into every other EU/EEA member state on a notification basis — the host regulator is notified and you are in. You license once and passport everywhere, instead of applying licence-by-licence across 27 jurisdictions.

Passporting is the practical gap between a Portuguese CASP and an offshore registration. The offshore route makes you legal where it is issued, while the CASP reaches the whole single market from one file. It also carries weight with the parties who decide whether you can actually operate: banks that hold your funds, the EMI and payment-institution partners that provide your fiat rails, auditors and institutional counterparties. A licence backed by a national central bank and a securities regulator opens doors an offshore permit never will.

Timeline, substance and the Lisbon draw

A realistic working range for a Portuguese CASP is four to nine months on a complete, well-prepared file, and longer where the model is complex or the banking and outsourcing arrangements are unresolved. The clock that matters is not the regulators’ queue but your own preparation: the classes are scoped, the Portuguese company is incorporated and capitalised, the programme of operations and the AML, DORA, safeguarding and outsourcing policies are drafted to standard, and management is genuinely fit-and-proper. Thin files stall in review questions, and with two supervisors the back-and-forth compounds, which is where most of the timeline risk sits.

The substance itself is where the modern Portugal licence separates hardest from the old register. A CASP authorisation requires a Portuguese company with genuine local substance (a registered office and a real operating presence that a nominee shell cannot provide), with MiCA’s prudential safeguards in place and management the Banco de Portugal assesses as qualified. On top of the entity you run a live compliance function: a dedicated MLRO and AML/CFT policies aligned to the EU’s 5th and 6th AML directives, the EU Transfer of Funds Regulation (the Travel Rule) for originator and beneficiary data, and suitability and source-of-funds checks on shareholders and UBOs. Since 17 January 2025, MiCA firms must also run a DORA-compliant ICT programme (operational resilience, incident reporting, resilience testing and third-party ICT oversight), which for a crypto business means serious custody, key-management and cybersecurity controls. None of this existed under the AML-only register, and it is exactly what gives the CASP licence its standing.

What Portugal adds on top of a standard MiCA build is genuine ecosystem. Lisbon has a deep Web3 community, a real talent pool and an events calendar that make it one of Europe’s most natural places to base founders and staff, and the quality of life is a real recruitment advantage. That combination of a credible twin-peaks licence and a place people actually want to live is Portugal’s distinctive pitch among EU hubs.

Tax, and who Portugal suits

Portugal’s crypto tax reputation still pulls teams in, but it is no longer the zero-tax haven of the early days. In broad terms, short-term individual gains on crypto held under a year are taxable, longer-held positions have historically enjoyed more favourable treatment, and income earned as a business is taxed as business income. The detail moves, so treat this qualitatively and take current advice before you plan around it — our dedicated Portugal crypto tax guide sets out the position for individuals and companies and points to the official source. The important framing for a licensed operator: your CASP is a corporate authorisation, and personal crypto tax and corporate tax are separate questions, and you should model them together while keeping them distinct.

So who is it for? Portugal suits operators who genuinely need the EU market, want a credible central-bank-plus-securities-regulator credential, and value basing where the crypto community lives — exchanges, custodians, brokers, trading platforms and OTC desks that can meet the capital and substance bar. If your market is global or non-EU, an offshore or Gulf regime is often faster and cheaper, and no single licence covers every market, so many groups run an EU CASP for Europe and a separate licence for the rest of the world.

The Portugal trade-off

A Portuguese file answers to two supervisors, the Banco de Portugal on prudential and AML questions and the CMVM on conduct, which is why it takes four to nine months and why the compliance and DORA programme has to satisfy both for as long as you hold the licence. Once it is granted you have EU-wide passporting from one authorisation.

If a full EU crypto licence is where your project is heading, we run the entire file, from the Portuguese company, substance and management through the AML and DORA framework, the Banco de Portugal application and the CMVM conduct dimension to the crypto-friendly banking around it. State costs and our fees appear as separate lines. See the scope on our Portugal crypto licence page, then book a free consultation and we’ll model the real year-one economics (the right service class, the capital, the tax picture and whether Portugal or a neighbour fits your plan) before you commit a euro.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.