CNMV CASP Licence: The 2026 Spain Guide

If you are searching for a “CNMV CASP license”, you are looking at one of the more interesting positions in the EU right now: one of Europe’s largest crypto audiences, a regulator that moves to a fixed statutory clock, and — so far — very few licensed providers. This guide sets out exactly what a CNMV CASP authorisation is, how the Spanish process runs, which services fall into which capital class, and why the window that is open in 2026 is a genuine, time-limited opportunity rather than a marketing line.

In our practice, the teams that win Spain treat the CASP as what it is — a supervised financial-services licence with capital, substance and a technology-resilience programme — and move before the field fills out. The ones who miss it either wait for the deadline to force their hand or assume Spain will license as slowly as its market is large. Both are mistakes. Below is the version we scope from.

What a CNMV CASP authorisation actually is

CASP stands for Crypto-Asset Service Provider. It is the single licence created by MiCA — the EU’s Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 — for any business that provides crypto-asset services to third parties. Before MiCA, each member state ran its own registration. In Spain that meant a VASP registry kept by the Bank of Spain, which handled anti-money-laundering registration but was never a full operating licence. MiCA replaced that patchwork with one harmonised authorisation.

In Spain, the Comisión Nacional del Mercado de Valores (CNMV) is the national competent authority that grants and supervises CASPs. This is the same securities regulator that oversees Spain’s investment firms and markets, and it treats a CASP the same way — as a supervised financial-services licence, not a company registration. One point that trips people up: the Bank of Spain retains the AML/VASP registry alongside the CNMV’s authorisation role, so the two institutions have distinct jobs in the Spanish system. If the vocabulary is new, our explainer on VASP, CASP and MiCA unpacks how these terms fit together, and the Spain crypto licence pillar covers the jurisdiction end to end.

The three service classes and their capital

MiCA does not charge one flat capital figure. It bundles the regulated crypto services into three capital classes, and your minimum own-funds requirement is fixed by the highest-class service you provide. Because these thresholds live in the regulation itself, they are identical in Spain and in every other EU state — you do not shop between EU countries for cheaper capital.

The dividing lines are worth reading carefully. The moment you hold client assets — custody, wallets, safeguarding — or run an exchange desk, you are in Class 2 at €125,000. The moment you operate the matching venue itself — a trading platform with an order book — you are in Class 3 at €150,000. A pure advisory or order-routing model that never touches client crypto can sit in Class 1 at €50,000. Most businesses people casually call “a crypto exchange” turn out to be Class 2 or Class 3 once you map what they actually do. Our CASP capital requirements piece breaks the tiers down further, and the Spain crypto licence cost guide models what those figures mean once state fees, substance and the compliance build are added in.

How the CNMV process runs — and the fast clock

This is where Spain gets genuinely attractive. The CNMV began accepting CASP applications in September 2024 and works to a roughly three-month statutory review once your file is complete. Within that window it can raise queries, and you are given ten business days to respond to each one — a tight turnaround that rewards teams who have their answers ready and punishes files assembled on the fly.

That statutory clock only starts when the CNMV accepts a complete application, so the real timeline is front-loaded into preparation. In practice: scope your service classes and capital, incorporate the Spanish company and fund it, build the programme of operations, the AML/CFT policies and the DORA framework, then file. The three-month review sits on the end of that, which is why we plan for three to five months end to end on a well-run file. The lesson from the whole MiCA rollout is the same everywhere — the regulator’s clock is fast, the applicant’s preparation is what decides the calendar.

EU-27 passporting and the early-mover window

Two things make Spain worth a serious look right now, and they compound. The first is structural: under MiCA Article 65, an authorised CASP does not re-apply market by market. It notifies the CNMV of the host states and services it intends to offer, the CNMV forwards that notification to the competent authorities in those states, and after a short notice period the firm can operate there. One CNMV authorisation, up to 27 markets, on a notification basis — the entire European single market from a single licence and a single lot of capital.

The second is timing. Spain is one of the EU’s largest and most active crypto audiences, yet by mid-2026 only a handful of CASPs had been authorised. A big home market plus a thin field of licensees is exactly the setup that rewards moving early: you establish a brand, banking relationships and a regulated track record while the competitive field is still forming, rather than fighting for attention once it fills out. That combination is rare — most large EU markets are either slow to license or already crowded — and it is the specific reason we single Spain out.

DORA, AML and the substance the CNMV expects

A CASP is a supervised licence, so the obligations run well past day one, and the CNMV assesses them before it grants anything. Two frameworks sit underneath every Spanish CASP.

AML/CFT. You need a dedicated anti-money-laundering officer, customer due-diligence, transaction monitoring and suspicious-activity reporting aligned to the EU’s 5th and 6th AML directives, plus the Travel Rule — originator and beneficiary data attached to crypto transfers under the EU Transfer of Funds Regulation. In Spain this connects to the Bank of Spain’s AML registry as well as the CNMV’s conduct supervision, so the AML build has to satisfy both institutions.

DORA. The Digital Operational Resilience Act — Regulation (EU) 2022/2554 — has applied to CASPs since 17 January 2025. It requires an ICT risk-management framework, incident classification and reporting, resilience testing, and oversight of your third-party technology providers. A CASP file submitted without a credible DORA programme is incomplete, and it is one of the most common reasons applications stall across the EU.

Underneath both sits substance. A CNMV CASP applicant is a Spanish company with genuine local presence — a registered office, real operating footing, fit-and-proper management the regulator can assess, and a resident-anchored AML function. On top of everything sit MiCA’s own conduct rules: client-asset safeguarding and segregation, conflict-of-interest management, disclosures and complaints handling. This is not an offshore registration with a nameplate; the CNMV tests for real substance, and thin structures get sent back.

The upside for the extra rigour is real. A CNMV CASP carries weight with banks, PSPs, auditors and institutional counterparties in a way an offshore registration never did, it opens the whole EU by notification, and — for now — it plants you in a very large market before most competitors have arrived. That is a durable, passportable EU credential with a first-mover premium attached, and for a serious crypto business that is precisely the point.

If you are deciding between service classes, weighing Spain against another EU home, or timing your file against the June 2026 deadline, we will map it to where your users and your capital actually sit and quote the real number. Book a free consultation and we will scope your CNMV CASP file end to end.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.