Spain Crypto Licence Requirements in 2026

A Spain crypto (CASP) licence requires a Spanish company with genuine local substance (a registered office, real operating presence and management directing the business from Spain), plus the class-based MiCA capital (€50,000–€150,000). Spain is one of the EU’s largest crypto audiences, its regulator moves on a fast statutory clock, and so far very few providers have been licensed. That combination is a genuine early-mover opening, but the requirements file behind a CASP authorisation is a full financial-services file: the Comisión Nacional del Mercado de Valores (CNMV) wants a real Spanish business with substance, funded capital, vetted people and working AML and ICT-resilience programmes.

This is the checklist our team works from on live applications. It covers each requirement of the 2026 Spanish CASP regime, from a Spanish company with genuine presence and initial capital by service class to fit-and-proper management assessed by the CNMV, an MLRO wired into the Bank of Spain’s AML registry and a DORA-compliant ICT framework, so you can price the licence on what it actually takes.

The company and local substance Spain requires

Everything starts with a Spanish company. The CNMV authorises a Spanish legal entity with genuine substance behind it — there is no remote-only route. The applicant is incorporated in Spain, keeps a registered office there, and runs a real operating presence on the ground. This is the first hard difference from an offshore VASP, and it is the requirement operators most often underestimate when they price Spain on the regulator’s fee alone.

Substance is assessed in the round. The CNMV wants to see that the business is directed and administered from Spain, with the right people performing the core functions locally. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the substance test. For the full picture of what a CASP authorisation buys and how it sits within MiCA in the Spanish market, our flagship Spain crypto licence overview maps the regime end to end.

Capital by service class in Spain

This is the requirement that catches operators pricing Spain on the state fee alone. MiCA sets a minimum capital floor by the service class you run, and Spain applies it directly. Your application must show the safeguards are in place, and you keep them at the higher of the class minimum or a quarter of the previous year’s fixed overheads, using projected overheads until you have a full year. Own funds, an insurance policy or a mix all qualify.

These figures are identical in every EU member state (they come from MiCA, not from Spanish law), so the capital tier is not something you optimise by choosing Spain over another EU jurisdiction. What Spain offers is a fast statutory review and a very large home market against the same requirement. Costs sit outside scope here; for the full year-one build and running costs, see the Spain crypto licence cost guide, and for the capital rules across all three classes our CASP capital requirements primer breaks each one down.

People, governance and fit-and-proper vetting in Spain

Under MiCA the people behind the company are assessed as rigorously as the business itself, and the CNMV runs the vetting. This is not a formality — an unresolved file on any one person holds the whole application.

Fit-and-proper management. The people running the CASP are assessed for competence, integrity and relevant experience. The CNMV expects a board and senior management with genuine financial or crypto backgrounds and a track record in a regulated industry. Directors must demonstrate they can actually run a licensed EU financial-services business.

A dedicated MLRO and governance structure. A money-laundering reporting officer is a condition of the licence, backed by a clear governance structure with defined responsibilities and board-level compliance oversight. The MLRO is accountable for the AML programme, transaction monitoring and reporting — and the AML/CFT function is registered with the Bank of Spain, which keeps the national AML registry even though the CNMV grants the CASP licence itself.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. The CNMV will ask how the owners came by the money funding the company, with documents to back each step. Thin or missing evidence of wealth is one of the most frequent reasons a Spanish file slows down.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme Spain asks for

Alongside people and capital, the CNMV reviews a defined set of documents and policies. Filing with any of these missing, or written for a different business model, is what turns a three-month approval into a queried, drawn-out one. The core pack is:

Three elements deserve emphasis. The AML/CFT policies must be operable documents aligned to the EU’s anti-money-laundering directives and the Travel Rule (the EU Transfer of Funds Regulation obligation to attach originator and beneficiary data to crypto transfers), and the MLRO who runs them is registered with the Bank of Spain. The DORA ICT framework covers ICT risk management, incident reporting, resilience testing and third-party ICT oversight, and it applies to every CASP. And where you issue or admit tokens to trading, a MiCA white paper meeting the regulation’s disclosure standard is required on top of the service authorisation. Custody, safeguarding and complaints-handling policies round out the pack, with strict client-asset segregation for any class that touches custody.

The CNMV clock, transition and passporting

Two dates and one clock frame the requirements. First, the review itself: the CNMV began accepting CASP applications in September 2024 and works to a roughly three-month statutory review once your file is complete, giving applicants ten business days to answer any queries it raises. That is fast by EU standards, but the tight query window also means a file assembled in a hurry gets caught quickly.

Second, the transitional deadline. Spain’s window for previously operating providers was extended to 30 June 2026. Since then, firms without CNMV CASP authorisation have been prohibited from offering crypto-asset services in Spain and must wind down. There is no VASP shortcut left; new entrants apply directly for the full CASP licence. Spain is a large market that has authorised only a handful of CASPs so far, which leaves room for early movers — the CNMV CASP licence deep-dive walks through the process in detail.

Third, the reward for meeting the full requirements: passporting. Once the CNMV grants the CASP licence, it lets you offer crypto services across all 27 EU member states on a notification basis under MiCA Article 65 — one licence, the whole single market, without applying jurisdiction by jurisdiction. That EU-wide reach is precisely what the substance, capital and DORA requirements are the price of.

Assembling the Spain file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: fix your CASP service classes and the matching capital tier first, then incorporate the Spanish company, put the own funds or insurance cover in place and stand up the local office and roles. Assemble every UBO and management fit-and-proper file (source of funds, suitability, experience evidence) in parallel, because they take the longest. Draft the programme of operations, AML/CFT and DORA policies from scratch against your actual operating model. Only then does the CNMV application go in, so the three-month clock starts on a file that is already complete.

None of this amounts to a light registration. The CASP regime asks for a real Spanish company, real capital, vetted people and operable AML and ICT programmes, and in exchange gives you a full EU financial-services credential that passports across 27 markets, carries weight with banks and PSPs, and stakes an early position in one of Europe’s largest crypto audiences. Get the file complete and internally consistent the first time and the CNMV’s three-month window is achievable; file with gaps and the ten-day query cycles push you past it.

Ready to assemble your CASP requirements pack, or want a second opinion on a file you have already started? Our team handles the full Spanish substance, fit-and-proper, AML and DORA build end to end and will review any application against the CNMV’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.