How to Obtain a MiCA CASP Licence in Spain: Step-by-Step Guide

To provide crypto-asset services to clients in Spain, a firm must hold a MiCA CASP authorisation granted by the CNMV (Comisión Nacional del Mercado de Valores) or, where relevant, coordinated with Banco de España. The MiCA transitional period ended on 1 July 2026, after which ESMA confirmed there would be no extensions; operating without authorisation from that date is unlawful across the EU, including Spain. This guide sets out the legal basis, the step-by-step procedure, the documents required, realistic timelines, cost drivers, and the most common errors made by foreign applicants.

Why Spain and Why Now

Spain has emerged as a materially active jurisdiction for crypto-asset businesses seeking a MiCA passport into the EU. The CNMV had an established virtual asset service provider (VASP) register under pre-MiCA rules, which means the supervisory relationship between the regulator and many crypto firms is not new. However, MiCA introduces a fundamentally different and more demanding authorisation framework, and firms that previously relied on a lighter-touch VASP registration cannot treat that registration as a substitute for full CASP authorisation.

On 17 April 2026, ESMA confirmed in a public statement that the transitional grandfathering window would not be extended beyond 1 July 2026. A further ESMA statement on 23 June 2026 was explicit: unauthorised CASPs must immediately stop onboarding new clients and cease marketing, restrict ongoing activity to selling or transferring existing assets or closing positions, and wind down in an orderly manner. By 12 August 2026, the ESMA public register recorded 325 authorised CASPs across the EU. Firms that are not on that register and still serve EU retail or professional clients face enforcement risk in every member state where those clients are located.

Legal Basis: MiCA and Spanish Transposition

The primary legal instrument is Regulation (EU) 2023/1114 (MiCA), which is directly applicable across all EU member states without the need for national transposition into law. Spain does, however, need to designate its competent authority, set procedural rules for the application process, and align its AML/CFT supervisory framework. The CNMV acts as the lead competent authority for MiCA CASP authorisations in Spain; Banco de España has a coordinating role for certain payment and e-money adjacent services. Where national implementation details beyond the directly applicable MiCA text remain subject to Spanish administrative rules, applicants should treat those specifics as potentially evolving and seek current confirmation from the CNMV.

MiCA's AML/CFT requirements interact with the EU's Transfer of Funds Regulation and with Spain's own anti-money-laundering rules administered in part by AEAT (Agencia Estatal de Administración Tributaria) for tax-related reporting obligations. A robust AML/CFT programme is not a box-ticking exercise: the CNMV will scrutinise the governance structure, the beneficial owner chain, and the adequacy of internal controls before issuing an authorisation.

Step-by-Step: The CASP Authorisation Procedure in Spain

Step 1 – Determine Scope and Service Classification

MiCA defines ten categories of crypto-asset service. Before building your application, you must identify precisely which services you intend to provide. The scope you declare determines the minimum capital requirement, the insurance or guarantee obligation, the organisational requirements, and the sections of the application form that the CNMV will assess. Providing services beyond your authorised scope post-authorisation is itself a breach of MiCA.

Step 2 – Establish or Designate a Spanish Legal Entity

A CASP authorisation in Spain must be sought by a legal entity registered in Spain and entered in the Registro Mercantil. Branches of third-country firms cannot hold a MiCA authorisation in their own right; the authorisation attaches to the EU-incorporated entity. For groups structuring their EU presence, Spain offers the option of incorporating a Sociedad Anónima (SA) or Sociedad de Responsabilidad Limitada (SRL), with the choice having implications for minimum share capital, governance formality, and investor rights. The entity must have its registered office and, in practice, genuine substance in Spain.

Step 3 – Build the Governance and Compliance Framework

The CNMV expects to see a credible governance structure before it will grant authorisation. This means:

• Management body: sufficient members with demonstrated experience in financial services or crypto-asset markets; fit and proper assessments will be conducted.
• Beneficial owner disclosure: full transparency of the ownership chain, including any ultimate beneficial owners holding qualifying stakes, with supporting identity documentation and source-of-wealth information.
• AML/CFT programme: a written policy, a designated compliance officer, customer due diligence procedures, transaction monitoring, and a suspicious transaction reporting chain aligned with both MiCA and Spain's AML framework.
• Internal audit and risk function: proportionate to the scale and complexity of the intended business, but the CNMV will expect a meaningful separation of functions even in smaller applicants.
• Business continuity and ICT security plans: MiCA imposes specific ICT and operational resilience requirements; these must be documented.

Step 4 – Prepare the Application File

The MiCA application file is a substantial document set. The CNMV follows the ESMA templates and guidelines for the content of authorisation applications. A well-organised file typically contains:

• Completed CNMV application form and covering letter.
• Programme of operations (business plan, financial projections, intended markets and client types).
• Proof of minimum own funds or professional indemnity insurance/equivalent guarantee.
• Description of governance arrangements and organisational structure.
• Beneficial owner register and supporting KYC documentation for all qualifying shareholders.
• AML/CFT policies and procedures manual.
• Custody and safeguarding arrangements (if custody services are included in scope).
• Complaints handling procedure.
• Conflicts of interest policy.
• ICT and cybersecurity documentation.
• Certified extract from the Registro Mercantil confirming entity registration.

Documents originating outside Spain may need to be apostilled or officially translated. The CNMV communicates formally in Spanish; while working-level contact with staff can sometimes proceed in English, the application file itself should be in Spanish or accompanied by certified translations.

Step 5 – Submit to the CNMV and Manage the Review Process

Once the application file is complete, it is submitted formally to the CNMV. Under MiCA, the competent authority has 25 working days to assess whether the application is complete. If it is deemed incomplete, the clock stops and the applicant has a defined period to remedy the gaps. After the completeness check, the substantive assessment period begins: MiCA provides a maximum of 40 working days for the CNMV to reach a decision, with the possibility of one extension of up to 20 additional working days in complex cases. These are MiCA-mandated timelines; national administrative practice may also involve pre-submission dialogue with the CNMV, which is strongly recommended and can shorten the formal review phase.

Step 6 – Address Requests for Information

It is virtually certain that the CNMV will issue at least one request for further information or clarification during the review. Prompt, precise and complete responses are critical. Delayed or partial responses reset parts of the timeline and signal to the regulator that the applicant's internal processes may lack rigour. Assign a dedicated internal contact point and ensure that external legal advisers have clear authority to respond on behalf of the applicant.

Step 7 – Authorisation, Registration and Passporting

If the CNMV grants authorisation, the firm is added to the ESMA CASP register. From that moment, it may provide the authorised services in Spain and, through the MiCA passporting mechanism, notify other EU member states where it wishes to operate without requiring a separate full authorisation in each. The passport notification procedure under MiCA involves submitting a notification to the CNMV, which then informs the host-state authority; the host state has a defined period within which it may object on limited grounds.

If you are mapping your MiCA authorisation strategy across multiple EU jurisdictions, our team can advise on whether a Spanish authorisation or a Portuguese one better fits your operational and commercial model. For the Portuguese route, see our overview at MiCA licensing in Portugal. To discuss your specific situation, contact us at info@ferrazwhitmore.com or visit our contacts page.

Realistic Timelines

Foreign applicants frequently underestimate the total elapsed time from the decision to apply to the moment of authorisation. The formal CNMV review clock (completeness check plus substantive assessment) is defined by MiCA, but it does not begin until the application is filed – and filing a submission-ready application typically takes considerably longer than anticipated. A realistic project timeline for a new entrant with no prior CNMV relationship would include:

• Entity incorporation and substance establishment: variable, but the Registro Mercantil process for a new Spanish entity typically takes several weeks once all notarised documents are in order.
• Pre-submission preparation (governance framework, compliance programme, documentation drafting): commonly three to six months for a first-time applicant, depending on the complexity of the business model and the availability of experienced internal resources.
• Pre-submission dialogue with CNMV: the CNMV has signalled willingness to engage in pre-filing meetings; scheduling and conducting these adds weeks but is strongly advisable.
• Formal review period: up to 65 working days under MiCA, plus time spent responding to information requests (which pauses the clock).

In aggregate, a well-prepared applicant should budget for a total elapsed time of six to twelve months from initial preparation to authorisation. Poorly prepared applications have taken longer and some have been rejected, requiring a restart.

Cost Drivers

MiCA does not prescribe a fixed application fee; the CNMV's fee schedule for MiCA applications is subject to Spanish administrative rules and should be confirmed directly with the authority. Beyond the regulatory fee, the principal cost drivers for a Spanish CASP authorisation are:

• Legal and compliance advisory fees: drafting governance documents, AML/CFT policies, the programme of operations, and the full application file is the most significant cost item for most applicants.
• Compliance officer and management body recruitment or secondment: the CNMV expects genuine substance; engaging qualified individuals who can pass fit-and-proper assessment takes time and budget.
• Professional indemnity insurance or own-funds requirement: the quantum depends on the services authorised; this is a direct regulatory cost that must be funded from the outset.
• Translation and notarisation: for foreign-origin corporate documents and beneficial owner materials, this can be a meaningful cost, particularly for groups with complex ownership structures.
• Ongoing compliance infrastructure: AML/CFT transaction monitoring systems, ICT security tooling, and regulatory reporting capabilities must be in place before authorisation, not after.

Common Errors by Foreign Applicants

Based on the pattern of difficulties seen across MiCA jurisdictions, the following errors are disproportionately common among non-Spanish groups applying through Spain:

• Filing too early with an incomplete file: the completeness clock stops and restarts; each incomplete filing delays the process and creates an unfavourable impression with the CNMV.
• Underestimating the beneficial owner documentation burden: groups with multi-layer holding structures, trusts, or offshore vehicles need to allow substantial time to compile and certify the required chain-of-ownership documentation.
• Treating the AML/CFT programme as a template exercise: the CNMV will assess whether the programme is calibrated to the firm's actual risk profile. Generic policies that are not tailored to the specific client base, geographic reach, and service model are routinely questioned.
• Assuming the pre-MiCA VASP registration carries over automatically: it does not. A fresh MiCA authorisation is required.
• Ignoring the substance requirement: having a registered address with no genuine management or operational presence in Spain is a recognised risk factor; the CNMV has been attentive to substance issues in its review practice.
• Proceeding without Spanish-language legal support: formal CNMV correspondence is in Spanish; misreading a request for further information or missing a response deadline has material procedural consequences.

Firms that encountered difficulties with MiCA authorisation in other EU member states should also review the recent regulatory developments documented in our alert on the end of the MiCA transition in Malta, as the supervisory approach adopted by competent authorities across member states has been converging.

Decision Checklist: Is Spain the Right Base for Your CASP Authorisation?

Before committing to Spain as your MiCA home jurisdiction, consider the following:

• Does your target client base have a material Spanish or Iberian component, making local presence commercially logical as well as regulatory?
• Do you have, or can you credibly recruit, management body members with appropriate financial services experience who are willing to be based or demonstrably active in Spain?
• Is your group structure sufficiently transparent to satisfy the CNMV's beneficial owner requirements within a reasonable timeframe?
• Do you have the internal or external resource to prepare a complete, Spanish-language application file within your intended timeline?
• Have you factored the ongoing supervisory relationship with the CNMV – annual reporting, change notifications, passporting maintenance – into your operational budget and staffing?
• If you also need AML compliance support across the broader EU, is your group's compliance architecture capable of supporting a multi-jurisdiction framework? Our AML compliance practice in Germany provides a reference point for the German requirements, which interact with Spanish frameworks for groups operating across both markets.

After Authorisation: Ongoing Obligations

Obtaining the CASP authorisation is the start of the regulatory relationship, not its conclusion. Authorised CASPs in Spain must maintain continuous compliance with MiCA's organisational, conduct-of-business, and prudential requirements. Material changes to the business – new services, new ownership, changes to the management body, significant outsourcing arrangements – require prior notification to or approval from the CNMV. Annual reports, periodic prudential returns, incident notifications under MiCA's ICT requirements, and suspicious transaction reports under AML/CFT obligations are standing commitments. The CNMV retains the power to suspend or withdraw authorisation where ongoing obligations are not met; supervisory convergence across the EU means that an enforcement action in Spain will be visible to other member states' regulators.

Firms that are currently operating under the ESMA wind-down conditions issued on 23 June 2026, or that are in the early stages of planning a Spanish CASP authorisation, are encouraged to seek specialist advice promptly. The window for orderly wind-down or transition is finite, and the CNMV's workload in processing applications means that early engagement gives a meaningful advantage. Write to us at info@ferrazwhitmore.com or use our contacts page to arrange an initial discussion.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.