Crypto License in Spain

The first question here is where virtual asset service provider (VASP) status now sits under the new EU rules, and the second is what the National Securities Market Commission (CNMV) looks for in an applicant. Who is entitled to file, which corporate form repays the trouble, how much capital each activity type demands, what the tax bill comes to: those are the questions answered here. There is also the practice side, which no rulebook prints: what works, what draws a refusal, and which route ends in a license rather than an open-ended wait.

Crypto License in Spain: The Rebuild MiCA Forced, and the Doors Behind It

December 30, 2024 is the date to hold onto. From that day forward a provider trades lawfully only once the CNMV, Spain's securities market commission, has entered it on the register. Spain reached that point ahead of most of the bloc by aligning early with MiCA. For founders who want a crypto license in Spain, and a business trading under European law behind it, that date is where the planning starts.

Before it, the Bank of Spain ran supervision. The mandate moved because MiCA treats digital assets the same way everywhere, and a rulebook that used to differ from border to border now reads identically across the Union. Entrepreneurs gain predictability from that, which in commercial terms means thinner legal risk and more room to scale.

The procedure turns on one status. Its full name is crypto-asset service provider, shortened everywhere to CASP. The category is wide. It reaches exchanges and custody houses, and it reaches advisers, brokers, and anyone issuing or placing tokens. Hold the status and the whole EU opens to you lawfully.

Nothing of the old regime survives except the vocabulary. Applicants who once met a declarative procedure now meet a barrier that admits no workaround, and only a company registered in Spain gets to file at all. Nor does the regulator stop at the ownership form: it weighs compliance procedures, the shape of the ownership structure, the origin of the capital and how well the team is prepared.

Nobody works the old way now, with the new rules left out of account. Handle it as a combined legal and organizational project rather than a formality, see it through, and what the company holds at the end is the EU single market, cross-border service rights included.

The result functions as a passport. One permission, and 27 member states open lawfully. An application earns approval through detail. An applicant who files sloppy paperwork, or treats anti-money laundering (AML) protocols, financial reserves and IT security casually, gets the file back refused, or buried in months of re-examination.

A founder cannot negotiate the sequence from a standing start. Spain company registration leads, with the form settled ahead of everything else: Sociedad Anónima (SA) or Sociedad Limitada (SL). Filing with the CNMV makes sense only afterwards. Applicants budget anything from several weeks to six months, and where a case lands inside that range depends on which license class it needs and on how carefully the paperwork was put together.

The CNMV review works as a filter. The regulator leaves quasi-offshore schemes on one side of it; on the other stands a business with a transparent structure, filed tax returns and an appetite for working by the rules. Everyone scaling lawfully goes through it, and the exchange, the P2P platform, the custody service and the crypto wallet feel it hardest.

Clients from the CIS countries treat a Spanish crypto exchange license as the replacement for offshore VASP registrations, which no longer open bank accounts and keep losing standing. European accounts, auditors, integration with payment systems: those come with the European route and not with the other one.

Getting a CASP License in Spain: The Route MiCA Rewrote

Providers filed with the central bank until MiCA arrived at the close of 2024 and handed the portfolio to the CNMV, a body whose working life has been the securities market. A company chasing a MiCA crypto license now meets a stricter model, more structured, built to EU standards.

The primary commercial advantage lies in the comprehensive operational scope granted by a single authorization. A holder may exchange crypto-assets, keep them in custody, receive and transfer them, and issue tokens, though nothing short of the complete requirement set earns that scope. The reform raises the bar on security and transparency, and it protects consumers and the market by doing so. Offshore structures had loopholes to work with; the regulation has closed them.

Underneath sits one concept. Read CASP as a legal entity seated in the Union and intending to serve clients in digital assets. Every activity type it wants comes with a permission of its own, applied for and granted separately. Run an exchange and a custody desk on a single document and the regulator will disagree, unless the application has named both lines from the start.

Local registration comes before everything. A company reaches its MiCA license in Spain only once it exists in the country, and applications from foreign legal entities get nowhere with the CNMV. Corporate group affiliation provides no shortcut: a foreign parent operating through Spanish branches remains ineligible to apply directly. The regulator is protecting accountability that lands locally, and supervision that actually reaches the business.

The applicant is judged on how closely its internal structure tracks the regulatory requirements. Several areas get checked, and each of them carries weight.

• Internal controls that actually work, with a compliance function staffed to run them
• The IT architecture set out in full, down to how client data and digital assets are kept safe
• Share capital sized to whichever activity the applicant has chosen to pursue
• Management whose professional record and business reputation will both stand up
• Obligations under the anti-money laundering and counter-terrorist financing rules (AML/CFT), discharged across the business
• Ownership traced all the way through to the ultimate beneficial owners

Registration as a provider, and the permit behind it, become available only once a company meets every one of those conditions. Send in an incomplete package, or one assembled to tick boxes, and suspension or refusal follows almost as a matter of course.

Filing runs through the CNMV's electronic portal. In go the business plan, the internal policies and the compliance procedures. The applicant sends the financial model with them, along with a technical description of the platform and the details of owners and managers. Applicants who expect to clear the review add a roadmap forecasting the client base, the turnover and the operational risks.

At that depth of detail the regulator is buying preparation, legal and operational, not a folder. Businesses unready for scrutiny rarely survive the procedure. Businesses that treat the license as a long-term investment come out with a competitive advantage and a foothold in Europe's crypto market.

A company complies with the regulation by licensing under the new EU standards, and those standards reach automated transaction monitoring, internal audit and real-time contact with regulators. Minimalist offshore registration belongs to a closed era. In Spain, regulation stopped being declarative and started to bite.

Crypto Company in Spain: Form, Capital, Documents

Licensing has a prerequisite. A founder moves nowhere without a registered crypto company in Spain, because CASP status is closed to anyone lacking one: the regulation requires a legal entity seated on Spanish soil, both for admission to licensing and for integration with European financial institutions.

Founders pick between the SL and the SA in practice. Scale decides it, together with investor requirements and projected turnover. Where the shareholder structure is complex, anyone planning to be licensed and to push into the EU market often finds the SA the more flexible vehicle. Simplicity and speed of administration pull startups and mid-sized projects toward the SL.

Then there is share capital, a criterion in its own right. Founders put in a minimum of EUR 3,000 for an SL and EUR 60,000 for an SA, but the license works to a different measure, and the capital has to match the class of crypto activity chosen. The MiCA threshold settles the figure, not the floor in the Spanish Civil Code.

Declared capital is not paid capital. Statutory capital must be fully deposited into a Spanish corporate account, as a pure paper entity will not pass regulatory scrutiny and financial viability requires formal proof. Files meet that filter early, ahead of almost everything else in the CASP dossier.

Substance comes next. A MiCA license in Spain rests on local substance: an address on the register, premises in use, and a director resident in the country. Each earns its keep twice, once for supervision and again when tax reporting starts. The company keeps compliance, AML and internal control inside the Spanish jurisdiction as well, and the regulator does not accept them being run from elsewhere.

An applicant pairs standard corporate documents with a separate package for the license, and six of them carry the weight. The escritura de constitución, the company charter, sets out the form, the objects and the split of the shares. The CIF/NIF registration certificate carries proof of legal-entity status. A bank certificate of the capital contribution proves the money was actually placed, while an office lease or a service address agreement documents physical presence. Appointing the director and the officers settles control and management. The company builds its CNMV file on the AML policy and the internal regulations.

Sequence matters: the company first, the CNMV dossier second. A missing signature, or a company object worded loosely in the charter, is enough to stall a review. Crypto companies in particular gain from advisers who have run this exact procedure before.

A founder treats registration as the key to the license, not a formality. The supervisor weighs the fit between the business structure and European law, not merely the fact of incorporation, so the road to a licensed operation begins with a corporate shell that is legally sound long before anything gets filed.

Filing for CASP is the logical next move. A founder who lays groundwork here still shortens the wait and cuts both risk and lost time.

CASP License Requirements in Spain: Who, When and on What Grounds

Anyone starting lawful work in the crypto sector should know what a CASP license in Spain will demand of an applicant. The demands are heavy. Registering a company is the smallest part of them, since a whole set of regulatory and operational standards travels with the file. Nothing gets granted automatically, and the CNMV review reaches the documents, the qualifications of the staff and the commercial model itself.

A company that means to be licensed shows three things: a professional management structure, an internal control system fit for the job, and resources deep enough to hold up. File without that preparation and rejection or drawn-out correspondence usually follows. The Spanish regulator has no patience for applications sent in to see how the system reacts.

The regulator starts from minimum share capital, a resident office and an operating team. Every applicant also builds and puts in place an AML policy, risk-assessment procedures and internal compliance regulations, all of it traveling alongside the filing and all of it checked against the MiCA standards. They are the base layer, and a small operating volume excuses nobody from them.

A company proves its reputation and staying power as well, and the CNMV weighs the legal and the financial side together. It traces where the capital came from and what links run to other jurisdictions. Then it turns to the shape of the ownership, what the key managers have done before, and how the project stands up technically.

• Whether the capital stands up against the operations projected
• A business plan that runs three to five years out, in detail
• A corporate structure that holds together, beneficial owners, participants and branches alike
• Cyber-defense procedures, and the IT security system underneath them
• Managers and compliance officers qualified for the roles they hold
• An office that operates and management that sits locally
• AML/CFT procedures complete and running

Plan for one more thing. The CNMV can come back for further information, sit the management down for an interview, and trace where the funds originated. Cooperation is not optional: refuse it, or answer halfway, and the process usually ends there.

Sitting on the register buys no trading rights. It buys a right to file, and nothing further. Serving clients in crypto-assets waits on two events, the grant of the license and the appearance of the authorization on the CNMV website.

Assessment runs service by service. The regulator measures exchange of digital assets on one risk scale and custody on another, so the permission has to match the real volume and character of the operations.

Startups have to get the permission type right, and so do companies entering the EU market for the first time. A wrong choice there carries cross-border risk: other member states retain the right to restrict the activity even where the license itself is valid. Strategy counts as much as law here: how the market reads, how the model earns, where the growth comes from later.

Satisfy every condition and the right to serve clients arrives, in Spain and past its borders, under the European passporting regime. One license carries its holder abroad. The holder registers nowhere else in the bloc. An applicant reaches that point only by handling the licensing procedure well.

Financial Conditions of the License: CASP Classes and Minimum Capital

MiCA unified the financial model of licensing across the Union, so applicants intending to provide crypto services lawfully in Spain should read the capital requirement early. The specific scope of intended operations directly dictates the minimum capital a provider must hold. A company achieves nothing by declaring it, and the money reaches the corporate account before the application goes in.

The reserve behind a MiCA crypto license climbs with operational risk and with liability to clients. Part regulatory formality, part protection mechanism, it shields users when a provider becomes insolvent, gets hacked, or has its activity suspended by the authorities.

The regulation splits providers into classes, one per market segment, and the table below pairs each activity with the capital it demands:

Precision about the intended activity pays before the filing stage. A move from one class to another later means filing afresh, reworking the compliance models and amending the charter, which is why the scaling path costs less when it goes into the business plan from the start.

Custody carries the heaviest requirement. Where crypto custody services are the main line of business, a crypto custody license raises the bar, because the custodian holds user funds and secures the IT infrastructure, and the CNMV asks for insurance coverage or another liability guarantee beyond the capital itself.

Exchange work needs its own permission, and with it the fixed capital sum plus reliable mechanisms for verifying counterparties and sources of funds. AML checks and account freezes landed on exchange services in the past, and stricter criteria have followed them since.

A company enters more cheaply only inside the low-risk classes, advisory work and token issuance among them, and licenses of that kind carry no right to keep client assets or convert funds. Weigh that while settling the model and the direction of travel.

Applying to the CNMV: The Process, Stage by Stage

Company registered, capital paid in, documents assembled: the moment has come to apply for the crypto license in Spain. The old registration procedures were loose. A structured process replaced them. It runs under close regulatory control and leaves far less to chance. Every application goes to the CNMV, and every contact with it happens digitally, through a secure online portal.

With the formal package an applicant answers only part of what the regulator wants. Evidence that the company is genuinely ready to operate at European standard is the rest of it, which is why preparing to file takes at least as long as filing.

The regulator weighs four things, and each has to meet its requirement: the business model, the technical architecture, financial stability, internal control procedures. The structured filing sequence outlined below provides a practical operational roadmap for prospective applicants.

Five stages stand between an applicant and approval obtained through Spain.

Budget three months of review before the MiCA license in Spain arrives. Applicants see six months wherever the package raises questions, so a file worked through properly beforehand is what keeps a timetable intact.

Content weighs as heavily as form. The legal documents matter and so does the commercial substance, the monetization model, the risk calculation and the structure of turnover, because what the regulator reads is a financial institution, not a technology platform.

Anyone running a crypto service has to prove they can live under European oversight. Reporting arrives on schedule, the regulators stay in contact, the consumer-protection system takes the firm in, and the data-storage rules hold.

Specialist help is close to indispensable. Most successful applicants lean on advisers who have been through comparable procedures, and that involvement both speeds the filing and heads off the errors that turn into refusals.

Documentary control follows the whole application, and seven items make up the mandatory package. The registration certificate opens it, followed by proof that the capital went in, then the charter with the internal regulations attached. Next come the policies on risk management and on AML/CFT, alongside a business plan running three years and an account of the technical architecture. Last go the biographies of the key people, each carrying a criminal-record certificate.

An applicant needs transparency and internal logic in the documents behind a filing. The regulator finds its grounds for refusal in any mismatch between the charter and the operating model.

Crypto Tax in Spain: How the Fiscal System Works

Licensing settles one problem and opens the next: fitting the business into the local tax system. Spain carries a reputation for high taxes, yet the regime it offers technology and financial companies is reasonably flexible. No company gets relief by default, though, so build a transparent fiscal strategy at the outset, detail included, to stay clear of fines and sanctions.

Three things fix the tax base: what the entity is in law, where it carries on business, and what kind of services it sells. Then comes registration. Every company holding CASP status signs on with the Agencia Tributaria, the Spanish tax agency, within 30 days of its first commercial activity. Skip it, or let the returns slide, and an automatic audit arrives with the license at risk.

Crypto tax in Spain comes in several mandatory components. Value added tax runs at 21%, though operations in unclassified tokens fall outside it. Corporate tax, the Impuesto de Sociedades, takes 25%, and a new company can see that cut to 15% over its first two years.

Corporate tax in Spain repays attention. All profit earned on Spanish territory falls under it, digital-asset operations included, and a gain on tokens can enter the tax base even where nothing was ever realized into fiat. Security tokens are the clearest case.

Reporting is continuous rather than annual. A CASP company files quarterly, its annual financial statements go to audit, and deviations in transaction volume, operating expenses that look unjustified, or receipts from unregulated sources will open an automatic investigation at the tax service.

Conclusion

Crypto companies now find durable growth only through the regulated market, and that route has stopped being one strategic option among several. Licensing in Spain today means satisfying MiCA and unlocking every one of the 27 member states at once, and a sensible timeframe is achievable where the preparation and the support behind it are competent.

Systematic work is the discipline for anyone planning a crypto license in Europe, from incorporation through to the dialogue with the regulator. Meeting the CNMV requirements on time, and keeping the business structure transparent, is what opens the door to lawful operation and to the trust of partners.