# Crypto-asset regulation and tokenization in Portugal

> **Is crypto legal in Portugal?** Yes. Businesses have regulated routes to operate with crypto-assets, under predictable rules. Law 69/2025 implements MiCA and allocates supervision between the BdP and CMVM. In the Metlabs Regulatory Index it scores 89/100 and ranks 22 of 76 countries assessed (assessed October 3, 2026).

- **Author:** Javier Yáñez López, Legal & Regulatory at Metlabs
- **Last reviewed:** 2026-10-15
- **Latest regulatory change:** 2026-07-01
- **Metlabs Regulatory Index:** 89/100, rank 22 of 76 countries assessed
- **Web version:** https://metlabs.io/en/blockchain-regulation/portugal/

Portugal applies MiCA through responsibilities shared between Banco de Portugal and the CMVM under Law 69/2025. Former virtual asset activity registration ceased to provide a transitional route on July 1, 2026. Projects must distinguish service authorization, token issuance and transactions in financial instruments, with additional anti-money laundering and transfer obligations.

A business issuing an asset or providing crypto-asset services from Portugal must separate token classification from provider permission. The December 2025 national laws specify the roles of Banco de Portugal and CMVM under MiCA, which was already applicable.

In practice, the application must address organization and resources alongside conduct and client protection. Former virtual-asset registration no longer provides continuity, and Portugal FinLab can help orient a project without replacing authorization.

## How MiCA and Portugal’s 2025 laws fit together

The [MiCA Regulation](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica) applies directly in Portugal. [Law 69/2025 of December 22](https://diariodarepublica.pt/dr/detalhe/lei/69-2025-992098939) establishes authorities, procedures and national implementing measures. Its publication must be distinguished from the start of MiCA's general application on December 30, 2024. A token's classification determines whether this framework or, for example, financial instruments legislation applies.

Article 30 of the Portuguese law provided a limited transition for certain registered entities whose activity had started and been notified by December 30, 2024. This route ended no later than July 1, 2026. It did not cover every registered company or convert former registration, focused on anti-money laundering, into European CASP authorization.

## How Banco de Portugal and CMVM coordinate supervision

Banco de Portugal and the Comissão do Mercado de Valores Mobiliários, CMVM, share supervision under Article 2 of Law 69/2025. Banco de Portugal has responsibilities for ARTs, EMTs and certain provider matters. The CMVM handles offerings of other crypto-assets, market abuse and conduct and client protection requirements. Responsibilities must be assessed by activity and obligation.

Article 6 provides for both authorities' involvement in CASP applications and Article 60 notifications. Banco de Portugal forwards notifications and applications to the CMVM within two business days; the CMVM has ten business days to give its view on the completeness of the file in matters within its remit and fifteen, from when Banco de Portugal informs it that the application is complete, to give its opinion on granting or refusal, and its silence is deemed to mean no objection. These internal deadlines are not a promise that a license will be obtained. Article 7 also requires both authorities to publish an up-to-date list of authorized entities, specifying the services of each.

## Which entitlement permits each service

Professional provision of services within MiCA requires one of the entitlements under Articles 59 and 60. CASP authorization must cover each intended service. Certain financial entities can use the notification route within statutory equivalences and conditions. An application alone does not permit services to begin or indefinitely preserve activities previously covered by transitional arrangements.

Cross-border business requires the applicable European procedure and compliance with the scope of permitted services. A company combining custody, transfers, securities intermediation and payments must analyze each function. Incorporating a Portuguese company, opening an account or holding former national registration does not replace that analysis. The law also classifies a lack of local substance as a very serious offense: the registered office must be in a Member State where at least part of the business is carried out, effective management must be in the European Union and a member of the management body must reside there.

[Portugal FinLab](https://www.portugalfinlab.org/before-applying) allows businesses to raise questions about innovative financial projects with supervisors. It offers a channel for clarifying a solution's regulatory treatment. Participation must not be described as product approval or permission to serve clients. Statutory conditions and the formal authorization procedure remain decisive.

## What tokenized asset issuance must establish

A token qualifying as a financial instrument falls outside MiCA and requires assessment of securities, offering and investment services rules. The [EU DLT Pilot Regime](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/dlt-pilot-regime) provides specific permissions for trading and settlement infrastructures. Its existence does not make every Portuguese platform an authorized infrastructure or give every issuance the effects of legally registered securities.

Before issuance, investor rights, the obligated entity, representation and transfer of the instrument and enforcement must be defined. A property structure must distinguish ownership of the property from a company interest or a debt claim. Technical token records alone do not resolve the underlying asset's corporate, contractual or registration formalities.

## Organizing transfers, conduct and complaints

[Law 70/2025, also dated December 22](https://diariodarepublica.pt/dr/detalhe/lei/70-2025-992098940), amends Law 83/2017 and adopts measures relating to Regulation 2023/1113 on transfer information. It transposes amendments to the anti-money laundering directive introduced by that regulation. Describing it as transposing the entire EU regulation is technically inaccurate. Operations must incorporate applicable due diligence and transfer controls. For tax purposes, [Law 26/2026 of June 3](https://files.diariodarepublica.pt/1s/2026/06/10700/0001000066.pdf), which transposes with effect from January 1, 2026, the EU directive on administrative cooperation as applied to crypto-assets (DAC8), requires crypto-asset service providers within its scope to carry out due diligence procedures and to report information on their customers' transactions for the previous year by May 31 each year.

MiCA requires governance, asset safeguards, conflict management and procedures suited to the services. Portuguese legislation adds two specific requirements. For advisory staff, Article 8 requires firms to define responsibilities, demonstrate qualifications, assess knowledge and competence at least annually and record that analysis in compliance reports, and the CMVM may request the documentation. Article 11 requires membership of at least two alternative dispute resolution entities within three months of starting business, notification to the CMVM within fifteen days and handling of cross-border disputes through FIN-NET.

Technology resilience, external providers and client information need assessment from the design stage. Provider authorization does not guarantee an issuer's solvency or remove product risks. Law 69/2025 itself also amends the annex to the complaints book regime to expressly include crypto-asset service providers and issuers of asset-referenced and e-money tokens.

## Preparing a Portuguese authorization application

The file should explain which services are sought from Banco de Portugal and which conduct and safeguarding controls CMVM will assess. Assign owners and evidence to each duty, including the annual competence assessment of advisory staff, membership of dispute resolution entities and the complaints book.

For issuance, establish investor rights, the relevant register and transfer rules. Where the token is a financial instrument, prepare the offer and related services under that framework, assessing the DLT Pilot Regime only where an infrastructure requires its permission.

## Key takeaways

- Law 69/2025 is dated December 22, 2025, and implements a directly applicable EU regulation.
- Banco de Portugal handles CASP applications with CMVM involvement within its responsibilities.
- Former virtual asset registration does not replace MiCA entitlement as of July 2026.
- Portugal FinLab provides regulatory dialogue; participation does not amount to authorization.
- Providers must join two dispute resolution entities within three months of starting business.

## Regulatory milestones

- **2024-12-30** — General MiCA application. General application of the EU regulation begins, distinct from subsequent national implementing measures. (source: [ESMA · MiCA](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica))
- **2025-12-22** — Publication of Laws 69/2025 and 70/2025. National measures on MiCA and on anti-money laundering and transfer information are published. (source: [Portugal · Law 69/2025](https://diariodarepublica.pt/dr/detalhe/lei/69-2025-992098939), [Portugal · Law 70/2025](https://diariodarepublica.pt/dr/detalhe/lei/70-2025-992098940))
- **2026-07-01** — End of former registration transition. The Article 30 maximum period for continuing activities under former registration expires. (source: [Portugal · Law 69/2025](https://diariodarepublica.pt/dr/detalhe/lei/69-2025-992098939))

## Frequently asked questions

### Is CASP authorization sought from Banco de Portugal or the CMVM?

Law 69/2025 provides for Banco de Portugal to receive applications and notifications and communicate the file to the CMVM for examination within its remit. The project scope also determines other applicable procedures.

### Is former virtual asset registration still sufficient?

No. The transition ended no later than July 1, 2026. A current MiCA entitlement and the particular services covered must be verified.

### Do inter-supervisor deadlines establish the total licensing period?

No. Article 6 regulates communications and opinions between Banco de Portugal and CMVM. Those deadlines form part of the procedure and do not guarantee an authorization date. Portugal · Law 69/2025.

### Did registration without starting business provide transitional access?

Law 69/2025 requires activity to have started and been notified by December 30, 2024. Article 30 expressly distinguishes registrations of firms that did not meet that condition. Portugal · Law 69/2025.

### Does Law 70/2025 transpose the entire EU Transfer Regulation?

No. It adopts domestic measures relating to the Regulation and transposes the amendments it makes to the anti-money laundering Directive. The two instruments should be distinguished. Portugal · Law 70/2025.

## How to cite this guide

Yáñez López, J. (2026, October 15). Crypto-asset regulation and tokenization in Portugal. Metlabs. https://metlabs.io/en/blockchain-regulation/portugal/