Since 1 July 2026, any business providing crypto-asset services to clients in the European Union must hold a MiCA CASP authorisation – the transitional period has closed with no extensions granted by ESMA. In Portugal, authorisation is supervised jointly by Banco de Portugal and CMVM, depending on the services offered, and a licence obtained here confers full EU passporting rights. Businesses that have not yet secured their licence are exposed to immediate regulatory enforcement and loss of market access across all 27 member states.
Why Portugal Has Become a Focal Point for CASP Authorisation
Portugal entered the MiCA era with an established crypto-asset registration framework already in place under the supervision of Banco de Portugal and CMVM. This institutional continuity gave applicants a clearer conversion pathway compared with jurisdictions that were building supervisory capacity from scratch. At the same time, Portugal's open economy, EU membership, and the practical efficiencies of its supervisory bodies make it a credible and strategically attractive home jurisdiction for firms seeking a single EU authorisation that can then be passported across the single market.
Portugal also benefits from a well-developed legal infrastructure for financial services, a track record in cross-border fund structuring, and close coordination between its competent authorities and European bodies such as EBA and ESMA. For international businesses evaluating where to anchor their MiCA CASP licence, these factors deserve careful weight alongside tax considerations – a dimension explored in our analysis of crypto tax after DAC8 in Portugal.
The Regulatory Framework: Competent Authorities and Their Respective Roles
Under MiCA and its national implementation in Portugal, supervisory responsibility is divided. Banco de Portugal oversees CASPs whose primary activities relate to payment-like or custody functions, while CMVM takes the lead for services more closely aligned with securities or investment activities, such as portfolio management in crypto-assets or operating a trading platform. In practice, many applicants will need to engage with both authorities, and early dialogue is advisable to establish which authority leads the file.
The division of roles also has implications for ongoing compliance obligations, prudential requirements, and the governance structures that applicants must build. Neither authority has indicated any appetite to relax the substantive requirements that MiCA imposes, and both have participated in ESMA's convergence work to ensure consistent application across the EU.
Core Requirements for MiCA CASP Authorisation
MiCA establishes a harmonised set of conditions that every applicant must satisfy regardless of the member state of authorisation. The principal requirements include:
- Legal establishment: The applicant must be a legal person established in Portugal (or in the EU), with genuine substance – real management, decision-making presence, and operational capacity located in the jurisdiction.
- White paper: Where the business involves the issuance or offering of crypto-assets (other than certain exempt categories), a compliant white paper must be prepared, notified, and published in accordance with MiCA's content and liability requirements.
- Governance and fitness: Members of the management body must meet fit-and-proper standards. Policies covering conflicts of interest, remuneration, and internal controls are required.
- Capital requirements: Applicants must demonstrate adequate own funds, the precise level of which depends on the category of CASP services being provided.
- Safeguarding of client assets: CASPs that hold client crypto-assets or funds must implement segregation and safeguarding arrangements that meet MiCA's standards.
- AML/CFT compliance: As crypto-asset businesses, CASPs are subject to anti-money laundering and counter-terrorist financing obligations under Portuguese law, coordinated with the requirements of the applicable EU directives.
- IT and cybersecurity: Applicants must demonstrate resilient operational infrastructure, including business continuity and disaster recovery arrangements.
- Consumer protection policies: Rules on marketing communications, disclosures, and handling of client complaints must be embedded in the firm's procedures before authorisation.
Preparing documentation that genuinely satisfies these requirements – rather than merely ticking formal boxes – is where many applicants encounter difficulty. Supervisors are scrutinising applications for real substance, and requests for supplementary information can delay timelines significantly.
The Authorisation Procedure and Realistic Timelines
Under MiCA, the competent authority has 25 working days to assess whether an application is complete after submission, and a further 40 working days (extendable by an additional 20 working days in complex cases) to make a decision on the merits. These statutory periods run from the date of completeness, not from the date of initial submission – a distinction that has material practical consequences, because the clock does not start until the supervisor is satisfied that all required information has been provided.
In practice, this means that preparation is the principal driver of elapsed time. Firms that submit well-structured, complete applications with credible governance arrangements, substantive business plans, and properly drafted policies tend to move through the process more efficiently. Conversely, gaps in documentation or questions about substance – particularly regarding physical presence and decision-making – can result in multiple rounds of supplementary requests, extending the overall timeline well beyond the statutory minimum.
Applicants should also factor in the time required to prepare the application itself. For a first-time authorisation involving a full suite of CASP services, a well-resourced preparation phase measured in months is realistic. Early engagement with the competent authority, where procedurally available, can help clarify expectations and reduce the risk of avoidable delays.
If your business is currently assessing its authorisation timeline or needs to recover ground after the close of the transitional period, our team can provide an initial review of your position. Please write to info@ferrazwhitmore.com or visit our contacts page.
Passporting: Using Portugal as a Gateway to the EU Single Market
One of MiCA's most commercially significant features is the passporting mechanism. A CASP authorised in Portugal may notify its intention to provide services in other EU member states through a standardised procedure. The notifying firm submits the relevant details to its home supervisor – Banco de Portugal or CMVM – which then communicates the notification to the host state authority. Subject to the applicable deadlines, the firm may begin providing services cross-border without needing a separate authorisation in each member state.
This makes the choice of home jurisdiction a strategic decision, not merely an administrative one. Portugal's supervisory framework, institutional capacity, and the legal clarity available through established local counsel mean that a Portuguese authorisation can serve as the anchor for a firm's entire EU market strategy. For businesses already holding authorisations in other jurisdictions, it is worth considering how a Portuguese CASP licence fits within a broader group structure – including how it interacts with, for example, a French MiCA authorisation held by a related entity.
Typical Pitfalls in the Portuguese Authorisation Process
Experience with regulatory applications in Portugal's financial sector reveals a consistent set of difficulties that affect CASP applicants. These include:
- Insufficient local substance: Supervisors expect genuine decision-making presence in Portugal. Shell structures or arrangements where management functions are entirely outsourced or offshored are likely to face robust scrutiny.
- White paper deficiencies: MiCA's white paper requirements are detailed. Errors in liability disclosures, missing technical information, or inconsistencies between the white paper and the business plan create grounds for the application to be deemed incomplete.
- Underestimating AML/CFT requirements: Crypto-asset businesses face enhanced expectations from Autoridade Tributária and other competent bodies. AML policies that merely replicate standard financial institution templates without being tailored to the specific risks of the CASP's activities are frequently identified as inadequate.
- Governance gaps: Fit-and-proper assessments of management body members are taken seriously. Delays often arise where the documentation supporting the assessment of individual managers is incomplete or where the management structure does not reflect the firm's actual decision-making process.
- Scope miscalibration: Applying for services the firm does not genuinely intend to provide, or failing to capture all intended services within the application, both create problems – the former raising substance questions, the latter requiring subsequent variation of the authorisation.
Cross-Border Structuring and Related Considerations
International businesses approaching the Portuguese market often do so as part of a broader group structure that may include entities in other EU or non-EU jurisdictions. MiCA's passporting framework addresses the intra-EU dimension, but the overall structure needs to be examined carefully from the perspectives of tax, corporate law, and regulatory perimeter.
In particular, the interaction between CASP authorisation and Portugal's approach to capital markets regulation is relevant for businesses whose crypto-asset services have characteristics that could bring them within the scope of instruments also regulated under MiFID II. The firm's capital markets practice in Portugal works in close coordination with our MiCA team on mandates where this boundary requires analysis.
Businesses should also ensure that their Portuguese entity's activities are consistent with their declared tax position, particularly in light of the expanded reporting obligations under DAC8, which significantly altered the information exchange landscape for crypto-asset transactions across the EU.
Self-Assessment Checklist: Is Your Business Ready to Apply?
Before submitting an application for MiCA CASP authorisation in Portugal, it is worth testing your readiness against the following points:
- Has the legal entity been incorporated in Portugal (or in the EU) with appropriate corporate documents in place?
- Is there genuine physical and management substance in the jurisdiction, with locally based senior personnel?
- Have all intended CASP services been identified and mapped against MiCA's service categories?
- Has a compliant white paper been prepared for any crypto-asset issuance or offering activities?
- Are capital adequacy requirements met, and can own funds be evidenced?
- Have fit-and-proper files been assembled for all members of the management body?
- Do AML/CFT policies reflect the specific risk profile of the business and comply with applicable Portuguese law?
- Are IT infrastructure, cybersecurity, and business continuity arrangements documented and tested?
- Have consumer protection disclosures and complaints-handling procedures been drafted?
- Has the passporting strategy for other EU member states been considered and reflected in the business plan?
A negative or uncertain answer on any of these points represents a gap that the competent authority is likely to identify. Addressing these issues before submission is considerably more efficient than responding to supplementary requests once the process has begun.
How Ferraz & Whitmore Approaches MiCA CASP Mandates
Our approach to MiCA CASP licensing in Portugal centres on preparing clients for a process that is substantive rather than purely administrative. We work with clients from the earliest structuring phase, helping to define the appropriate Portuguese entity, map intended services against MiCA categories, and identify the competent authorities whose expectations will govern the application. We coordinate the preparation of all application materials – including white papers, governance documents, AML/CFT policies, and capital adequacy analyses – and manage engagement with Banco de Portugal and CMVM throughout the authorisation process.
Where clients have existing operations in other jurisdictions or are building group structures that include entities authorised in multiple EU member states, we work alongside our colleagues in those jurisdictions to ensure coherence. Our practice is grounded in the regulatory and legal frameworks that apply in Portugal, without overstating what any authorisation process can guarantee in terms of outcome.
To discuss how MiCA CASP authorisation in Portugal fits your business strategy, please contact our team at info@ferrazwhitmore.com or use our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.