PORTUGAL Law and Practice Contributed by: Nuno Lima da Luz and Tomás Gomes da Silva, Cuatrecasas
Law 83/2017, and that law defines the covered activi- ties broadly, including exchange services, transfers, and custody/administration (including private key control tools). Portugal’s Law 69/2025 now makes it a very serious offence to provide crypto-asset ser- vices without the due authorisation and sets additional enforceable “substance” style duties (EU seat/man- agement-body residency expectations) for CASPs. Territoriality is addressed directly in Portugal’s MiCA transition rules and in Banco de Portugal ’ s earlier reg- istration perimeter. TheBdP consultation draft on vir- tual asset registration (used to regulate Law 83/2017 registration mechanics) defined when entities are considered to operate “in national territory,” including when they are constituted in Portugal for virtual-asset activities. Under MiCA, foreign entities serving Portu- guese clients can be pulled into EU authorisation and marketing constraints depending on how services are provided and solicited, and the cross-border co-oper- ation design in Law 69/2025 reflects that expectation. Grandfathering exists but is time-limited and con- ditional. MiCA allows CASPs that provided services before 30 December 2024 under national law to con- tinue until 1 July 2026 or until authorisation is granted or refused, and it permits member states to shorten that window. Portugal’s Law 69/2025 adopts a spe- cific transitional regime: only entities that were regis- tered with the BdP as of 30 December 2024 and had started activity (and communicated that fact under BdP Notice 3/2021) may continue the registered activ- ities until 1 July 2026 or MiCA authorisation/refusal, whichever comes first, while registrations of entities that had not started activity by 30 December 2024 are treated as having lapsed at that date. During the tran- sition, Portugal also treats these entities as “CASPs” for travel-rule and AML purposes, which prevents a regulatory vacuum but raises the practical expecta- tion that they must run MiCA-grade compliance uplift programmes well before July 2026. 3.2 Set-Up Requirements Under the pre-MiCA AML registration regime, Portu- gal already imposed structured onboarding expecta- tions for virtual asset activity, including fit-and-proper review and documentation requirements. Law 83/2017 requires prior the BdP registration for virtual asset
activities and provides for competence and suitability assessment as a condition for granting and maintain- ing registration. The law and related BdP materials set out refusal, lapse, and cancellation grounds, including where there is a risk of serious non-compliance with AML/CFT rules, and also provide for lapse if activity is not commenced within a defined time window. This historical structure is relevant because it underpins the transition cohort eligible to operate until 1 July 2026. Post-MiCA, substance and governance expecta- tions become even more operationally demanding, even where the detailed procedural documents are authority-specific. Portugal’s Law 69/2025 makes it a very serious offence for CASPs to breach duties, such as having a registered office in an EU member state where the CASP carries on at least part of its activity, having effective management in the EU, and having an EU-resident management body member. For stable- coin issuers,the BdP describes formal authorisation and notification processes with defined timelines for completeness checks and merit assessment in ART cases, and a pre-notification timing expectation in EMT cases, which effectively forces early build-out of compliance and documentation capacity. Prudential requirements depend strongly on the exact authorisa- tion type (CASP versus ART issuer versus EMT issuer) and on whether the entity is already a bank or elec- tronic money institution, but EBA materials set out extensive prudential-adjacent standards for reserve assets and governance for ART/EMT issuers. Where CASPs are required to hold a dual licence as a PSP, prudential and own funds requirements must be accounted for each licensed entity autonomously, and the own funds used to comply with the requirements of one cannot be used to comply with the other. 3.3 Change of Control Portugal’s MiCA execution law expressly treats change-of-control style events as a serious compli- ance issue. Law 69/2025 classifies as a very serious offence the failure to notify the competent authority of the direct or indirect acquisition or disposal of a quali- fying holding in a crypto-asset service provider. This means M&A involving Portuguese-supervised CASPs must include a regulatory notification and approval
515 CHAMBERS.COM
Powered by FlippingBook