Spain Crypto Licence 2026: The Definitive CNMV CASP Guide

If you want a full EU crypto licence in one of the bloc’s largest markets — and you want it before the field crowds — Spain is the jurisdiction most operators are not yet looking at, and that is precisely its appeal. A CASP authorisation from the CNMV under MiCA passports across all 27 EU member states, and the Spanish regulator runs a roughly three-month statutory review, which is fast for Europe. Yet by mid-2026 only a handful of providers had been licensed, in a country with one of the biggest crypto user bases on the continent.

In our practice, that mix — a very large home market, a quick regulator and a thin field of licensees — is the rarest thing in EU crypto licensing: a genuine early-mover window that is still open. This is the definitive guide to what a Spain crypto licence actually is in 2026 — the regulator, the capital, the passport, the fast timeline, the substance, the deadline, and the honest trade-off you are signing up for.

What a Spain CASP licence is — and who issues it

A Spain crypto licence is a Crypto-Asset Service Provider (CASP) authorisation, granted by the Comisión Nacional del Mercado de Valores — the CNMV — under the Markets in Crypto-Assets Regulation, MiCA, Regulation (EU) 2023/1114. It is the single EU credential for firms that provide crypto services: running an exchange, safeguarding client assets, executing or receiving orders, operating a trading platform, or advising on crypto-assets.

One structural point trips up newcomers, so it is worth stating plainly. In Spain, authorisation and anti-money-laundering supervision sit in two different institutions. The CNMV is the national competent authority that grants the CASP licence and supervises conduct. The Bank of Spain (Banco de España) retains the AML/VASP registry that predated MiCA. That division matters for how the file is built and where obligations land, and it is one of the things a first-time applicant most often gets wrong. MiCA itself replaced the patchwork of national VASP registrations across the EU with this one harmonised licence — the same shift we cover in our VASP, CASP and MiCA explainer, now playing out in Spain. The CNMV began accepting CASP applications in September 2024, so this is a live regime processing real files, not a framework still waiting to open.

Capital by service class

MiCA sets minimum capital by the class of service you provide, and — this is the point operators most often miss — those tiers are the same in every EU country. You do not choose Spain for cheaper capital; the capital is fixed by the regulation. You choose Spain for the market size, the fast regulator and the room still open. What the application determines is which class, or classes, your business falls into.

Two things matter in planning. First, the capital is funded, not a fee — it stays in the business as working capital, held in a bank or e-money account within the EEA, not paid away to the regulator. Second, the classes are cumulative: an exchange that also holds client crypto is a Class 2 business at €125,000, and a full order-book trading venue is Class 3 at €150,000. Most exchange and broker projects land at €125,000. Scoping the correct class before you incorporate is the single decision that most shapes your budget — our Spain crypto licence cost breakdown models the full year-one number with the capital included, and the deeper eligibility detail sits in our Spain crypto licence requirements guide.

One licence, 27 markets: the EU passport

The reason a CASP licence is worth the substance behind it is the passport. Under MiCA Article 65, once the CNMV authorises you, you can provide your licensed services into every other EU/EEA member state on a notification basis — the regulator in each host country is notified, and you are in. You license once in Spain and passport everywhere, instead of applying licence-by-licence across 27 jurisdictions.

That is the single biggest upgrade in crypto licensing to date, and it is why an EU CASP is not comparable to an offshore registration. An offshore VASP gets you legally live in one place; a Spanish CASP gets you the entire European single market — the largest regulated crypto market in the world — from one file, with a very large domestic audience built in. It also carries weight with the parties that decide whether you can actually operate: the banks that hold your funds, the EMI and PI partners that provide your fiat rails, auditors and institutional counterparties. A CNMV authorisation opens doors an offshore permit never will.

Timeline: a fast statutory clock

Speed is Spain’s quiet advantage. The CNMV works to a roughly three-month statutory review once it has a complete file, and gives applicants ten business days to answer any queries it raises during that review. Several larger EU regulators routinely run longer, so a three-month clock in a market this size is a real edge — and part of what makes the early-mover case credible rather than theoretical.

The caveat, as always, is “complete file”. The clock that matters is not the regulator’s queue but your own preparation. Before the CNMV’s three months even begin, the service classes need to be scoped, the Spanish company incorporated and capitalised, and the programme of operations together with the AML/CFT, DORA and safeguarding policies drafted to CNMV standard, with management that is genuinely fit-and-proper. Where the ten-business-day query window bites is on thin files: a poorly prepared application generates rounds of questions, each on a short clock, and that is where timeline risk actually lives — not in a slow regulator, but in an underbuilt submission. The deep process detail, including how the CNMV runs its review, is in our CNMV CASP licence guide.

The real substance requirement

This is where the modern Spanish licence separates hardest from the old idea of a light crypto registration, and where the real work goes. A CASP authorisation requires a Spanish company with genuine local substance — a registered office and a real operating presence in Spain — not a nominee shell. Initial capital is funded into an EEA account, and management is assessed by the CNMV as qualified and fit-and-proper, with relevant financial-services or crypto experience and clean source-of-funds and suitability checks on shareholders and UBOs.

On top of the entity, you need a live compliance function. A dedicated AML/MLRO role and AML/CFT policies aligned to the EU’s 5th and 6th anti-money-laundering directives, the EU Transfer of Funds Regulation — the Travel Rule — for originator and beneficiary data on transfers, and the interface with the Bank of Spain AML registry. And since 17 January 2025, MiCA firms must run a DORA-compliant ICT programme — operational-resilience governance, incident reporting, resilience testing and third-party ICT oversight — which for a crypto business also means serious custody, key-management and cybersecurity controls, plus full GDPR compliance for personal and transaction data. None of this existed under the old registration model, and it is exactly what gives the CASP licence its standing. Building it properly is a project in itself, and the banking around it — crypto-friendly banks and EMI/PI partners for your fiat rails — is usually the hardest single piece.

The deadline, and who Spain suits

The one date everyone needs on the wall is 30 June 2026 — the extended outer limit of Spain’s transitional window. After it, providers without CNMV CASP authorisation are prohibited from offering crypto services in Spain and must wind down; there is no route back to the old regime. Because a proper file — company, capital, substance, AML and DORA — takes months to assemble before the regulator’s three-month clock even starts, the practical deadline to begin is well before that cut-off. Acting now is not urgency for its own sake; it is arithmetic.

So who is it for? Spain suits operators who want a large, active home market and the fastest credible route to establishing there before the field crowds — exchanges, custodians, brokers, trading platforms and OTC desks that can meet the capital and substance bar. If your audience is global or non-EU, an offshore or Gulf regime is often faster and cheaper, and no single licence covers every market — many groups run an EU CASP for Europe and a separate licence for the rest of the world.

The honest trade-off

Spain is not a cheap, fast registration, and it would be dishonest to sell it that way. A modern CASP file costs real money in capital and substance, requires a live AML and DORA programme you maintain for as long as you hold the licence, and — even with a three-month statutory review — takes several months once you count preparation. What it buys is the entire EU single market from one authorisation, a very large domestic audience, a CNMV credential that unlocks banking an offshore permit cannot, and a rare early-mover window that a slower or smaller market would not offer.

If a full EU crypto licence in a major market is where your project is heading, we run the entire file — the Spanish company, the substance and management, the AML and DORA framework, the CNMV application and the crypto-friendly banking around it — with our fees and the state costs shown separately, never blended. See the scope on our Spain crypto licence page and read the process detail in our CNMV CASP licence guide, then book a free consultation and we’ll model the real year-one economics — the right service class, the capital, and whether Spain or a neighbour fits your plan — before you commit a euro.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.