Crypto-asset regulation and tokenization in Portugal

A business issuing an asset or providing crypto-asset services from Portugal must separate token classification from provider permission. The December 2025 national laws specify the roles of Banco de Portugal and CMVM under MiCA, which was already applicable.

In practice, the application must address organization and resources alongside conduct and client protection. Former virtual-asset registration no longer provides continuity, and Portugal FinLab can help orient a project without replacing authorization.

How MiCA and Portugal’s 2025 laws fit together

The MiCA Regulation applies directly in Portugal. Law 69/2025 of December 22 establishes authorities, procedures and national implementing measures. Its publication must be distinguished from the start of MiCA's general application on December 30, 2024. A token's classification determines whether this framework or, for example, financial instruments legislation applies.

Article 30 of the Portuguese law provided a limited transition for certain registered entities whose activity had started and been notified by December 30, 2024. This route ended no later than July 1, 2026. It did not cover every registered company or convert former registration, focused on anti-money laundering, into European CASP authorization.

How Banco de Portugal and CMVM coordinate supervision

Banco de Portugal and the Comissão do Mercado de Valores Mobiliários, CMVM, share supervision under Article 2 of Law 69/2025. Banco de Portugal has responsibilities for ARTs, EMTs and certain provider matters. The CMVM handles offerings of other crypto-assets, market abuse and conduct and client protection requirements. Responsibilities must be assessed by activity and obligation.

Article 6 provides for both authorities' involvement in CASP applications and Article 60 notifications. Banco de Portugal forwards notifications and applications to the CMVM within two business days; the CMVM has ten business days to give its view on the completeness of the file in matters within its remit and fifteen, from when Banco de Portugal informs it that the application is complete, to give its opinion on granting or refusal, and its silence is deemed to mean no objection. These internal deadlines are not a promise that a license will be obtained. Article 7 also requires both authorities to publish an up-to-date list of authorized entities, specifying the services of each.

Which entitlement permits each service

Professional provision of services within MiCA requires one of the entitlements under Articles 59 and 60. CASP authorization must cover each intended service. Certain financial entities can use the notification route within statutory equivalences and conditions. An application alone does not permit services to begin or indefinitely preserve activities previously covered by transitional arrangements.

Cross-border business requires the applicable European procedure and compliance with the scope of permitted services. A company combining custody, transfers, securities intermediation and payments must analyze each function. Incorporating a Portuguese company, opening an account or holding former national registration does not replace that analysis. The law also classifies a lack of local substance as a very serious offense: the registered office must be in a Member State where at least part of the business is carried out, effective management must be in the European Union and a member of the management body must reside there.

Portugal FinLab allows businesses to raise questions about innovative financial projects with supervisors. It offers a channel for clarifying a solution's regulatory treatment. Participation must not be described as product approval or permission to serve clients. Statutory conditions and the formal authorization procedure remain decisive.

What tokenized asset issuance must establish

A token qualifying as a financial instrument falls outside MiCA and requires assessment of securities, offering and investment services rules. The EU DLT Pilot Regime provides specific permissions for trading and settlement infrastructures. Its existence does not make every Portuguese platform an authorized infrastructure or give every issuance the effects of legally registered securities.

Before issuance, investor rights, the obligated entity, representation and transfer of the instrument and enforcement must be defined. A property structure must distinguish ownership of the property from a company interest or a debt claim. Technical token records alone do not resolve the underlying asset's corporate, contractual or registration formalities.

Organizing transfers, conduct and complaints

Law 70/2025, also dated December 22, amends Law 83/2017 and adopts measures relating to Regulation 2023/1113 on transfer information. It transposes amendments to the anti-money laundering directive introduced by that regulation. Describing it as transposing the entire EU regulation is technically inaccurate. Operations must incorporate applicable due diligence and transfer controls. For tax purposes, Law 26/2026 of June 3, which transposes with effect from January 1, 2026, the EU directive on administrative cooperation as applied to crypto-assets (DAC8), requires crypto-asset service providers within its scope to carry out due diligence procedures and to report information on their customers' transactions for the previous year by May 31 each year.

MiCA requires governance, asset safeguards, conflict management and procedures suited to the services. Portuguese legislation adds two specific requirements. For advisory staff, Article 8 requires firms to define responsibilities, demonstrate qualifications, assess knowledge and competence at least annually and record that analysis in compliance reports, and the CMVM may request the documentation. Article 11 requires membership of at least two alternative dispute resolution entities within three months of starting business, notification to the CMVM within fifteen days and handling of cross-border disputes through FIN-NET.

Technology resilience, external providers and client information need assessment from the design stage. Provider authorization does not guarantee an issuer's solvency or remove product risks. Law 69/2025 itself also amends the annex to the complaints book regime to expressly include crypto-asset service providers and issuers of asset-referenced and e-money tokens.

Preparing a Portuguese authorization application

The file should explain which services are sought from Banco de Portugal and which conduct and safeguarding controls CMVM will assess. Assign owners and evidence to each duty, including the annual competence assessment of advisory staff, membership of dispute resolution entities and the complaints book.

For issuance, establish investor rights, the relevant register and transfer rules. Where the token is a financial instrument, prepare the offer and related services under that framework, assessing the DLT Pilot Regime only where an infrastructure requires its permission.

To understand how this framework applies to your project, discuss your case with our team.