Crypto regulation in Spain (2025): from registry to MiCA license

Spain is one of the most crypto-active countries in Europe - nearly one in three adults see crypto as the future of finance. This widespread interest has prompted Spanish authorities to establish clear regulations to protect users and bring crypto businesses into compliance. In this post, we’ll explore how Spain’s crypto regulation has evolved – from the Bank of Spain’s crypto registry for exchanges and wallets, to the new MiCA licensing regime in 2025 – and what it all means for everyday crypto users in Spain.

The old regime: Bank of Spain’s crypto registry (2021–2024)

In the wake of EU anti-money laundering directives, Spain introduced a registry for virtual asset service providers (VASPs) under the Bank of Spain in 2021. This meant that any company offering cryptocurrency exchange or custodial wallet services to Spanish customers had to register with the Bank of Spain as an obligated entity under Spain’s AML law (Law 10/2010).

The focus of this registration was anti-money laundering (AML) compliance and management integrity:

• AML Policies and Controls: Applicants had to demonstrate they had “adequate procedures and bodies” in place to prevent money laundering and terrorist financing. Essentially, firms needed robust KYC (Know Your Customer) processes, transaction monitoring, and internal controls to detect illicit activity.

• Fit and Proper Management: Directors and owners had to be of commercial and professional integrity, with no serious criminal records, to be accepted.

It’s important to note what this registry was NOT: it was not a full license or endorsement of the business.

In fact, the Bank of Spain made clear that being registered “did not imply any approval or verification” of a provider’s financial stability, cybersecurity, or fair conduct. The central bank did not supervise these companies’ business models, solvency, or technical security – only their AML compliance and honesty of managers. In other words, a registration was a minimum legal requirement but not a guarantee of safety or quality for consumers.

Early Adopters

Spain’s crypto industry responded swiftly. The first exchange to register was Bit2Me, a domestic crypto platform based in Castellón, which became the first to enter the Bank of Spain’s registry in February 2022. Over the next two years, dozens of other firms followed. These included local startups and also global players – for example, Binance, Crypto.com, and Coinbase obtained registrations to legally offer exchange and wallet services in Spain. (Coinbase announced its Spanish registration in September 2023, enabling it to serve retail and institutional users in Spain within the national legal framework.) By late 2023, the Bank of Spain’s list had grown to include a mix of Spanish fintechs and the Spanish entities of major international exchanges.

 

Enter MiCA: Europe’s comprehensive crypto framework

In 2023, the EU approved the Markets in Crypto-Assets (MiCA) Regulation (Regulation (EU) 2023/1114), marking the first unified crypto regulatory framework across Europe. MiCA came into effect on 30 December 2024, and its goal is to harmonize rules for crypto markets throughout the EU. For Spain, MiCA represented a new era: moving from simple registration to true licensing and supervision of crypto service providers.

So what actually changes with MiCA?

• Licensing of Crypto Service Providers: To operate a crypto exchange, brokerage, custodial wallet service, etc., a firm must now obtain authorization as a Crypto-Asset Service Provider (CASP). In Spain, the National Securities Market Commission (CNMV) is designated as the competent authority to grant these licenses and supervise ongoing compliance. (The Bank of Spain, meanwhile, retains oversight for issuers of stablecoins or e-money tokens under MiCA, given its role in monetary stability.) Crucially, after 30 December 2025, only CASP-authorized providers (by the CNMV or another EU regulator) can legally operate in Spain.

• Broader Scope of Regulation: MiCA brings a much wider perimeter. Activities such as running a crypto trading platform, exchanging crypto for fiat or other crypto, providing custody/wallet services, executing client orders, giving investment-style advice on crypto, or even crypto portfolio management are all classified as ‘crypto-asset services’ and therefore require authorization. This goes well beyond the previous Spanish framework, which basically focused on exchange and custody only.

• Higher Regulatory Standards: Getting a license involves meeting strict requirements. Firms must have adequate capital (between €125,000 and €350,000 minimum, depending on the services), maintain insurance or reserves, and ensure their own funds cover at least a quarter of the previous year’s overheads. On top of that, they need a solid governance setup: directors and senior managers who are ‘fit and proper’, clear lines of responsibility, and effective internal controls. MiCA also expects written, detailed policies for conflicts of interest, cybersecurity, outsourcing, record-keeping and business continuity. In short, it pushes crypto firms to operate much more like regulated financial institutions in terms of risk, oversight and documentation.

• Investor Protection and Conduct Rules: MiCA also introduces market conduct rules similar to those in securities markets. CASPs must act honestly, fairly, and professionally in clients’ best interests. They owe transparency to users about fees and risks. Market abuse provisions mean exchanges have to monitor and prevent insider trading or market manipulation on their platforms. Advertising crypto services is tightly regulated too – in Spain, mass marketing campaigns reaching over 100,000 people must be pre-approved by the CNMV with a 10-day notice, and all ads must be clear, balanced, and not misleading, with appropriate risk warnings. This is intended to curb the overly bullish or deceptive promotions that were common in the wild west days.

Spain’s Transition: From Registry to License in 2025

To smoothly shift from the old system to MiCA, MiCA’s Article 143 allowed EU states a transitional period for existing crypto businesses. The default EU-wide transitional period is up to 18 months (until mid-2026) for firms to obtain a license. However, Spain decided to fast-track this timeline. Spanish regulators formally chose a 12-month transition – the shortest possible – meaning that the Bank of Spain’s VASP registry was effectively closed to new entrants from 30 Dec 2024, and all crypto providers must be fully licensed by 30 December 2025 to continue operating.

What does this transition mean in practice?

• Registry Abolished: As of 30 Dec 2024, the Bank of Spain stopped registering new crypto companies, and its existing VASP register is now maintained only for information purposes. Businesses that managed to register before that cutoff date can take advantage of Spain’s transitional arrangements.

• Grandfathering for Existing Providers: If a crypto exchange or custodian was already providing services in Spain before MiCA took effect (i.e. before end of 2024), it may continue operating throughout 2025 without a CASP license, provided that it was in compliance with the previous laws. In practice, this largely means those who were on the Bank of Spain’s AML registry (or those offering other crypto services that weren’t covered by that law but were active businesses) can temporarily continue serving clients. They have until Dec 2025 to apply for and obtain a MiCA license (from the CNMV or any other EU authority). During this year, they are expected to prepare all required documentation (business plans, internal policies, audited financials, etc.) and upgrade their compliance structures to meet MiCA’s standards.

• No New Unlicensed Entrants: Any new crypto business that was not active in Spain by end of 2024 does not benefit from the transitional grace period. They must obtain a license first before offering services to Spanish users. Operating without authorization is now illegal (just as offering unlicensed investment services would be). The CNMV has explicitly warned that entities which were not already established by 2024 cannot use another country’s transition period to serve Spain – for example, a foreign exchange that hasn’t been authorized yet cannot “passport” into Spain until it gets a license, and if it isn’t covered by Spain’s own transitional regime it should not be targeting Spanish customers.

• Deadline – End of 2025: When the clock strikes midnight on December 30, 2025, the transitional period in Spain ends. From 31 December 2025 onward, any crypto exchange, broker, or wallet provider serving Spanish users must hold a MiCA CASP license (either from the CNMV or from another EU regulator via passporting). Those who fail to secure a license in time will have to cease operations in Spain or risk enforcement action. The CNMV has indicated it will take over supervision and can sanction firms operating without authorization after that date.

First MiCA Licenses Granted in Spain

Despite the heavy compliance burden, several companies moved quickly and began applying for MiCA licenses as soon as the framework opened. In fact, Spain has already seen some licenses granted in 2025, even ahead of the deadline, signaling which players are leading the pack in compliance.

• BBVA – First License (March 2025): In a symbolic move, the very first MiCA CASP license issued by the CNMV went to BBVA (Banco Bilbao Vizcaya Argentaria), one of Spain’s largest banks, on 5 March 2025. BBVA had been piloting crypto services (like Bitcoin trading and custody for private banking clients through its Swiss subsidiary) and was well-positioned to meet the new requirements. By obtaining the license, BBVA became authorized to offer crypto asset exchange and custody services to its customers in Spain under the MiCA framework. This early approval underscored the regulator’s cautious approach – preferring a trusted, well-resourced institution as the first licensee.

• Foreign Crypto Firms Authorized: At the same time as BBVA’s approval, the CNMV also granted licenses to a handful of foreign crypto companies that had applied in Spain. Notably, OKX – a major international crypto exchange – and Zillion Bits (among others) received authorization, operating via locally incorporated entities (with headquarters in Malta, Germany, and other jurisdictions). These approvals made headlines because they showed that Spain is open for business under MiCA not just for domestic firms but also for global crypto players seeking an EU base. The presence of Malta- and Germany-based companies on Spain’s roll highlights how MiCA allows a firm to choose its preferred European jurisdiction for licensing. Spain’s combination of a clear process and a large market likely attracted these firms to seek the CNMV’s authorization.

• Bit2Me – First Spanish Crypto Exchange (July 2025): By mid-2025, the wave of licensing picked up for native crypto companies. On 28 July 2025, Bit2Me – the same exchange that was first on the old Bank of Spain registry – announced it had secured its MiCA license from the CNMV, becoming the first Spanish-founded crypto platform to be fully authorized. This license grants Bit2Me a European passport to operate across the EU, a significant step in its growth. Bit2Me’s CEO celebrated the milestone as proof of their commitment to transparency and security under the new regulatory framework. The timing was auspicious: crypto markets were booming (Bitcoin had recently hit new highs around $120k, as per summer 2025 reports), so Bit2Me’s license came just as retail interest was surging again – reassuring its 1.2 million users that it meets Europe’s highest standards.

• Other Notable Approvals: The CNMV’s third and fourth licenses went to traditional finance players branching into crypto: Cecabank, a Spanish custodial bank, received a license in July 2025 to offer institutional crypto custody services, and Openbank, Santander’s digital banking arm, was authorized around the same time to expand its crypto investment product offerings under MiCA. By that summer, at least four MiCA licenses had been granted by Spain (BBVA, Cecabank, Openbank, and Bit2Me). More applications were (and are) in the pipeline – including those from other Spanish fintechs and international exchanges like Binance and Coinbase, which will likely choose a favorable EU jurisdiction to get their CASP licenses (Spain being one contender, given Coinbase’s existing presence via the old registry). Across Europe by late 2025, dozens of crypto companies have obtained MiCA licenses in various EU countries (over 50 by some counts), and thanks to passporting, any one of those licenses can be passported to serve customers in all other member states. This means Spanish crypto users can expect a wider selection of regulated platforms to choose from, as foreign-licensed exchanges enter Spain’s market (and vice versa, Spanish licensed firms can expand EU-wide).

What It Means for Crypto Users in Spain

For everyday people in Spain who buy, sell, or hold crypto, these regulatory developments have several important implications:

1. Use platforms that are actually allowed to operate: If a platform is licensed, or it was properly registered before the deadline, you’re in safer territory. If it wasn’t, it may not be supposed to serve Spanish clients anymore. CNMV (for Spain) and ESMA (for the EU) will publish public lists of authorized crypto providers.

2. MiCA gives you more protection, but it doesn’t remove crypto risk: A MiCA-licensed provider has to hold capital, separate client assets, have decent management, and accept being supervised. But it’s still crypto: prices can crash, there’s no deposit guarantee, and even regulated platforms can get hacked or go insolvent. Regulation lowers the risk, it doesn’t delete it. So the basic rule still applies: only put in what you can afford to lose.

3. Expect clearer information and less hype: Under MiCA, licensed platforms have to be more transparent about fees, products and risks. Advertising in Spain will also be more controlled, so you should see fewer “guaranteed profit” style promotions and more balanced messaging.

4. More EU options, not just Spanish ones: Once a provider gets licensed in any EU country, it can offer services across the EU. So you’ll start seeing more serious, EU-licensed platforms operating in Spain, not just local exchanges. More competition should mean better services and pricing.

5. Tax and Legal Clarity: Although not the focus of this post, it’s worth noting that with formal regulation comes clearer tax and legal expectations. Crypto profits in Spain are subject to capital gains tax (19–23% for residents, depending on the amount), and failing to report crypto holdings (such as in overseas exchanges) can lead to hefty fines (Spain has been aggressive about tax declarations for crypto in the past). By using registered platforms, you are more visibly operating in the legal zone, which can make things like getting tax reports or legal recourse easier.

If you have questions about a crypto provider’s status or need guidance on navigating the new regulations, feel free to reach out to Zenblock. We’re here to help users and businesses understand and comply with Spain’s crypto regulations in this new MiCA era.