Spain Crypto Licence 2026: The CNMV CASP Guide

If you want a full EU crypto licence in one of the bloc’s largest markets, and you want it before the field crowds, Spain is the jurisdiction most operators are not yet looking at, which is exactly why it is worth a look. A CASP authorisation from the CNMV under MiCA passports across all 27 EU member states, and the Spanish regulator runs a roughly three-month statutory review, which is fast for Europe. Yet by mid-2026 only a handful of providers had been licensed, in a country with one of the biggest crypto user bases on the continent.

That mix of a very large home market, a quick regulator and a thin field of licensees is rare in EU crypto licensing, and it gives early movers a genuine window. This guide explains what a Spain crypto licence actually is in 2026: the regulator, the capital, the passport, the fast timeline, the substance, the deadline, and the trade-off you are signing up for.

What a Spain CASP licence is and who issues it

A Spain crypto licence is a Crypto-Asset Service Provider (CASP) authorisation, granted by the Comisión Nacional del Mercado de Valores (the CNMV) under the Markets in Crypto-Assets Regulation, MiCA, Regulation (EU) 2023/1114. It is the single EU credential for firms that provide crypto services: running an exchange, safeguarding client assets, executing or receiving orders, operating a trading platform, or advising on crypto-assets.

One structural point trips up newcomers, so it is worth stating plainly. In Spain, authorisation and anti-money-laundering supervision sit in two different institutions. The CNMV is the national competent authority that grants the CASP licence and supervises conduct. The Bank of Spain (Banco de España) retains the AML/VASP registry that predated MiCA. That division matters for how the file is built and where obligations land, and it is one of the things a first-time applicant most often gets wrong. MiCA itself replaced the patchwork of national VASP registrations across the EU with this one harmonised licence, the same shift we cover in our VASP, CASP and MiCA explainer, now playing out in Spain. The CNMV began accepting CASP applications in September 2024, so this is a live regime that has been processing real files since then.

Capital by service class in Spain

MiCA sets minimum capital by the class of service you provide, and the point operators most often miss is that those tiers are the same in every EU country. You do not choose Spain for cheaper capital; the capital is fixed by the regulation. You choose Spain for the market size, the fast regulator and the room still open. What the application determines is which class, or classes, your business falls into.

Two details catch operators out. First, the capital is not a fee. Held as own funds it stays in the business; MiCA also allows an insurance policy in its place. Second, the classes are cumulative: an exchange that also holds client crypto is a Class 2 business at €125,000, and a full order-book trading venue is Class 3 at €150,000. Most exchange and broker projects land at €125,000. Scoping the correct class before you incorporate is the single decision that most shapes your budget. Our Spain crypto licence cost breakdown models the full year-one number with the capital included, and the deeper eligibility detail sits in our Spain crypto licence requirements guide.

From Spain, one licence and 27 markets: the EU passport

The reason a CASP licence is worth the substance behind it is the passport. Under MiCA Article 65, once the CNMV authorises you, you can provide your licensed services into every other EU/EEA member state on a notification basis: once the regulator in each host country is notified, you can serve that market. You license once in Spain and passport everywhere, instead of applying licence-by-licence across 27 jurisdictions.

Compared with an offshore VASP, which makes you legal in one place, a Spanish CASP opens all 27 member states from one file and comes with a very large domestic audience. It also carries weight with the parties that decide whether you can actually operate: the banks that hold your funds, the EMI and PI partners that provide your fiat rails, auditors and institutional counterparties. Those counterparties treat a CNMV authorisation very differently from an offshore permit.

Timeline: a fast statutory clock

Speed is Spain’s quiet advantage. The CNMV works to a roughly three-month statutory review once it has a complete file, and gives applicants ten business days to answer any queries it raises during that review. Several larger EU regulators routinely run longer, so a three-month clock in a market this size is a real edge, and part of what makes the early-mover case credible rather than theoretical.

The caveat, as always, is “complete file”. The clock that matters is not the regulator’s queue but your own preparation. Before the CNMV’s three months even begin, the service classes need to be scoped, the Spanish company incorporated and capitalised, and the programme of operations together with the AML/CFT, DORA and safeguarding policies drafted to CNMV standard, with management that is genuinely fit-and-proper. Where the ten-business-day query window bites is on thin files: a poorly prepared application generates rounds of questions, each on a short clock, and that is where timeline risk actually lives, far more than in the regulator’s own pace. The deep process detail, including how the CNMV runs its review, is in our CNMV CASP licence guide.

The real substance requirement in Spain

This is where the modern Spanish licence separates hardest from the old idea of a light crypto registration, and where the real work goes. A CASP authorisation requires a Spanish company with genuine local substance: a registered office and a real operating presence in Spain rather than a nominee shell. MiCA’s prudential safeguards must be in place, and management is assessed by the CNMV as qualified and fit-and-proper, with relevant financial-services or crypto experience and clean source-of-funds and suitability checks on shareholders and UBOs.

On top of the entity, you need a live compliance function. A dedicated AML/MLRO role and AML/CFT policies aligned to the EU’s 5th and 6th anti-money-laundering directives, the EU Transfer of Funds Regulation (the Travel Rule) for originator and beneficiary data on transfers, and the interface with the Bank of Spain AML registry. And since 17 January 2025, MiCA firms must run a DORA-compliant ICT programme (operational-resilience governance, incident reporting, resilience testing and third-party ICT oversight), which for a crypto business also means serious custody, key-management and cybersecurity controls, plus full GDPR compliance for personal and transaction data. None of this existed under the old registration model, and it is exactly what gives the CASP licence its standing. Building it properly is a project in itself, and the banking around it (crypto-friendly banks and EMI/PI partners for your fiat rails) is usually the hardest single piece.

The deadline, and who Spain suits

The date that mattered was 30 June 2026, the extended outer limit of Spain’s transitional window. Since it passed, providers without CNMV CASP authorisation have been prohibited from offering crypto services in Spain and must wind down, with no route back to the old regime. A proper file (company, capital, substance, AML and DORA) takes months to assemble before the regulator’s three-month clock even starts, so every month of delay pushes back the date you can lawfully serve Spanish clients.

So who is it for? Spain suits operators who want a large, active home market and a credible route to establishing there before the field crowds: exchanges, custodians, brokers, trading platforms and OTC desks that can meet the capital and substance bar. If your audience is global or non-EU, an offshore or Gulf regime is often faster and cheaper, and no single licence covers every market, so many groups run an EU CASP for Europe and a separate licence for the rest of the world.

The Spain trade-off

The CNMV’s three-month statutory review is quick by European standards, but it starts only once the file is complete, and the capital, substance and AML and DORA programme behind that file take months to put in place. For that you get the EU single market from one authorisation and a large domestic audience.

If a full EU crypto licence in a major market is where your project is heading, we run the entire file (the Spanish company, the substance and management, the AML and DORA framework, the CNMV application and the crypto-friendly banking around it), with our fees and the state costs shown separately. See the scope on our Spain crypto licence page and read the process detail in our CNMV CASP licence guide, then book a free consultation and we’ll model the real year-one economics, covering the right service class, the capital, and whether Spain or a neighbour fits your plan, before you commit a euro.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.