Crypto-asset regulation and tokenization in Spain

In Spain, a company planning to issue a digital asset or provide services involving it needs to place its project within both European and national law. The European Markets in Crypto-Assets Regulation, known as MiCA, establishes common rules for the assets and services within its scope. Tokens that qualify as financial instruments fall under securities and investment services legislation.

This distinction determines which requirements need to be examined. Issuing bonds represented by tokens, operating a crypto-asset exchange and providing a payment service may involve different regulatory routes. Understanding the Spanish framework starts with two questions: what right does the asset give its holder, and which activities will each participating company perform? The answers help identify the relevant authorities, permissions and ongoing obligations.

Which rules apply to the asset and the activity

MiCA, Regulation (EU) 2023/1114, is European Union legislation that applies in Spain. Within its scope, it regulates crypto-asset offers, admission to trading and services provided to clients. A project therefore needs to distinguish the role of the issuer or offeror from that of a company providing custody, exchange or advice involving the asset.

The first check is whether the token qualifies as a financial instrument. For example, a token representing a share or bond that meets that classification falls under the European markets in financial instruments framework, known as MiFID II, and Spanish securities legislation. Article 2 of MiCA excludes these instruments from its scope. Digital representation alone does not change their classification.

MiCA also distinguishes categories with different rules. Electronic money tokens, or EMTs, seek to maintain a stable value by reference to one official currency. Asset-referenced tokens, or ARTs, seek stability through other references, including combinations of assets or rights, and are not EMTs. The regulation distinguishes both categories from the other crypto-assets it covers. These legal definitions matter more than the commercial label “stablecoin”.

In practice, this classification needs to be reflected in each company’s responsibilities. For example, developing the smart contract for an issue does not, by itself, amount to custody of client assets. If the supplier retains keys that allow it to control those assets or executes orders on a client’s behalf, the services it actually performs need to be assessed. The contract, technical permissions and operating procedures should describe the same allocation of responsibilities.

What the CNMV and the Bank of Spain supervise

Once the applicable framework is identified, the next step is to determine the competent authority. In Spain, responsibilities depend on the asset and the activity. The National Securities Market Commission, or CNMV, acts in securities markets and in the authorization and supervision of crypto-asset service providers within its remit. Having the same supervisor does not turn these routes into a single permission.

The Bank of Spain has responsibilities for issuers of ARTs and EMTs, without prejudice to the powers of European authorities. It also acts in the payment services sector. This second role matters when an operating model uses electronic money tokens to make payments, because MiCA and payment services rules may need to be assessed together.

Anti-money laundering and counter-terrorist financing have their own supervisory framework. SEPBLAC is Spain’s financial intelligence unit and a supervisory authority in this area. Its role is distinct from authorization of services by the CNMV or the Bank of Spain. Obtaining that authorization does not replace the prevention obligations applicable to the entity.

When selecting an intermediary, a business should check the legal entity that will sign the contract and the services it is entitled to provide. Another group company's license or a well-known brand does not establish that entity's permission. Consulting the registers helps connect the permission to the function the intermediary will perform in the project.

Which requirements a project needs to meet to operate

For professional provision of crypto-asset services within MiCA, the usual category is a crypto-asset service provider, or CASP. Article 59 establishes the requirement for entitlement; authorization is granted under Article 63 and specifies the permitted services. Custody, exchange, execution of orders, advice and portfolio management are separate activities. A platform needs to check that its permission covers each activity it performs.

There is also a route for certain financial entities that are already regulated. Article 60 allows them to provide the services available to their category, subject to the required conditions and notification. A new provider and an existing financial entity may therefore follow different procedures. CASP authorization does not itself settle the requirements for issuing an asset or providing investment services involving financial instruments.

A person offering a crypto-asset to the public has separate obligations. For assets other than ARTs and EMTs, Article 4 generally requires a white paper to be prepared, notified and published, alongside compliance with marketing and conduct rules. Exemptions depend on the offer. The white paper describes the project, rights and risks; notification does not amount to prior approval by the supervisor, as Article 8(3) makes clear.

ARTs and EMTs have different issuer requirements. Article 16 provides for specific authorization of ART issuers or a route for credit institutions, with defined exemptions. For EMTs, Article 48 generally requires the issuer to be authorized as a credit institution or electronic money institution, as well as notifying and publishing a white paper. CASP authorization for custody or exchange does not, by itself, entitle a business to issue these tokens.

The change from Spain's previous system matters when comparing providers or reading older documents. According to the CNMV, the transitional period ended on 1 July 2026. Registration with the Bank of Spain under the former regime no longer allows services to continue on its own. Operating in other Member States also requires the cross-border procedure under Article 65 of MiCA, within the scope of the relevant authorization. The CNMV has published an authorization application manual and a notification template for financial entities, which should be reviewed before preparing the file.

Payments involving EMTs require an additional check. PSD2 is the second European Payment Services Directive. The Bank of Spain reminds affected providers that they also need to examine payment authorization. Its March 2026 communication refers to European Banking Authority opinions from June 2025 and February 2026. The 2 March deadline concerned applications by providers already offering the affected services; conditions for continuation must be checked for the particular case, without assuming a permanent waiver.

How securities tokenization works in Spain

Where a project represents transferable securities through tokens, the central question is how investors' rights are created, recorded and transferred. Articles 5 to 8 of Law 6/2023 on Securities Markets and Investment Services provide for representation using distributed ledger technology, or DLT, referred to as TRD in Spanish. The issue needs documentation specifying the securities' characteristics and how their register operates.

For example, a tokenized bond issue needs to specify the issuer, repayment obligation, interest and transfer restrictions. Issuing the bonds does not, by itself, turn the issuer into an investment firm; placement, advice or trading undertaken by intermediaries must be assessed separately. In a property-related project, the token may represent a debt claim or another contractual right without automatically conferring ownership of the property. Our analysis of MiFID II and tokenization develops this distinction.

The entity responsible for registration and record-keeping, known as ERIR, administers the securities register and identifies holders. For securities not traded on DLT market infrastructures, the CNMV’s questions and answers require an entity authorized to provide securities custody. Under Law 6/2023, that role may be performed by a credit institution, an investment firm in the form of a broker-dealer (sociedad de valores) or a broker (agencia de valores) authorized to provide custody under Article 126(a), with the corresponding registration in the ERIR register provided for in Royal Decree 815/2023. ERIR describes a function, rather than a separate category of financial institution or an endorsement of the issue’s economic terms. Our guide to the ERIR in Spain explains that role and its relationship with the issuer.

If the project includes trading or settlement infrastructure, the European DLT Pilot Regime also needs to be assessed. It provides permissions and possible exemptions for specified infrastructures. Spain already has a trading and settlement system authorized by the CNMV under that regime, so a secondary market route exists; for securities admitted to those infrastructures, responsibility for the ERIR functions lies with the authorized infrastructure itself rather than with a separate entity. Spain's sandbox under Law 7/2020 serves a different purpose, allowing limited tests under a protocol. Its Article 4(2) states that access to this testing environment does not authorize the start of an activity or the indefinite provision of services.

Which obligations continue after authorization

Compliance needs to be built into everyday operations. Depending on the service, this means organizing custody, handling complaints, managing conflicts of interest and maintaining business continuity. Product design therefore requires responsibilities to be allocated between the participating entities and reflected in contracts and procedures. Outsourcing a technology function or appointing a custodian requires checking which obligations each party retains.

Law 10/2010 establishes anti-money laundering and counter-terrorist financing obligations. From 1 October 2026, the amendment introduced by Royal Decree-Law 25/2026 replaces former point (z) of Article 2, which covered virtual currency exchange and custodian wallet providers, with crypto-asset service providers, as defined in Article 1(6), which excludes advice. That exclusion does not prevent an entity from falling within scope through other activities. Because Article 2(4) treats the obliged entities in point (z) as financial institutions, that classification now extends to these providers. The amendment also adjusts the correspondent relationship rules in Article 13 and the penalty regime. Each company’s position under Article 2 needs to be checked and, as this is a Royal Decree-Law, its parliamentary validation monitored.

For an obliged entity, identifying the client is only part of the work. It must also identify the beneficial owner, understand the purpose of the relationship, monitor transactions and apply risk-based internal controls. Articles 17 and 18 govern special examination and reporting to SEPBLAC where there are grounds for suspicion. A platform therefore needs to assign responsibility for reviewing alerts, documenting decisions and making reports; purchasing a verification tool does not, by itself, resolve those responsibilities.

Client identification and transaction monitoring also need to account for asset transfers. Regulation (EU) 2023/1113 requires transfers within its scope to be accompanied by information about the originator and beneficiary. This obligation, known as the Travel Rule, includes specific conditions for transfers involving self-hosted addresses. Service design therefore needs to establish which information is collected and how it is transmitted.

Tax compliance will be added to financial compliance. The EU administrative cooperation directive applicable to crypto-assets, known as DAC8, was due to be transposed by 31 December 2025. In Spain, the state bill that would have implemented it lapsed on 6 October 2026 without being adopted, and only Navarre has incorporated it into its foral tax regime. Any new legislative process should be monitored, as it will affect client onboarding and record-keeping systems.

On the technology side, the Digital Operational Resilience Act, DORA, sets requirements for in-scope entities covering risk management, incident reporting and oversight of information and communication technology suppliers. A smart contract audit may form part of the technical work, but covers only part of these obligations. Similarly, authorization does not guarantee recovery of invested capital or make a product suitable for every client.

Royal Decree 813/2026, published on 8 October, also amends the anti-money-laundering implementing regulations. It requires customer identification and identity verification for all crypto-ATM transactions, without the amount threshold that applies to other occasional transactions, and adjusts conditions for remote identification. It generally enters into force on 28 October 2026; the changes concerning the use of electronic identification means will apply eighteen months after its publication. Affected operations should build both dates into their implementation timetable.

What to define before starting a project

Before seeking advice, prepare a description of the right the token will represent, the issuing entity and the intended investors or users. Also establish who will receive funds, who will control keys and how transfers will be executed. This information helps distinguish the issuer’s obligations from those of intermediaries and the functions the technology supplier can perform. A change to any of these decisions may also change the regulatory assessment.

This guide supports that initial assessment. Tax treatment, complete issuance documentation and conditions attached to individual authorizations require a specific evaluation. The linked official sources allow readers to check the rules discussed; the Spain chapter in Chambers 2026 provides complementary professional analysis. The ongoing European review should also be monitored: on 4 December 2025 the Commission put forward a proposal for a regulation, COM(2025) 943, that would reform the DLT Pilot Regime and transfer to ESMA the authorization and supervision of crypto-asset service providers, except credit institutions and entities covered by Article 60. It remains a proposal going through the legislative process and is not law in force. The next step is to assess the particular operating model and its contracts before making the service available to clients.

To understand how this framework applies to your project, discuss your case with our team.