PORTUGAL Law and Practice Contributed by: Nuno Lima da Luz and Tomás Gomes da Silva, Cuatrecasas
vices without authorisation or to suggest authorisa- tion when it is absent. This creates a direct risk that a “white-label partner” is, in substance, an unauthorised CASP if it performs core service functions (custody, exchange execution, platform operation) rather than merely providing technology to an authorised entity. Operationally, white-label arrangements also raise outsourcing and conflict-of-interest concerns, which are prominent in EU supervisory work on CASP authorisation and conduct. ESMA stakeholder advice discusses the importance of understanding corporate structures and the failures that contributed to CASP collapses, as well as the need for segregation and robust controls, all of which become harder when service delivery is split among multiple entities. For Portugal-specific planning, firms should assume reg- ulators will look through branding to real control of client assets, transaction execution, and compliance systems, and they should structure the relationship so that the authorised entity retains sufficient control to meet its governance and monitoring obligations. DeFi is not “banned” as a concept in Portugal, but regulatory obligations can arise depending on whether a regulated service is being provided and whether it is partially centralised. ESMA stakeholder materi- als, referencing MiCA’s Recital 22, state that partially decentralised services are in MiCA scope while fully decentralised services are not, and also note that dis- tinguishing the two is not straightforward. This implies that many real-world “DeFi” offerings that have iden- tifiable operators, front-ends, fee capture, or govern- ance control points may be treated as in-scope. 5. Decentralised Finance 5.1 Ability to Use DeFi For CeFi firms using DeFi rails (for example, routing trades or liquidity management through protocols), the principal concerns are client asset segregation, con- flict management, and operational risk. MiCA custody rules emphasise segregation and insolvency protec- tion for client assets held in custody by CASPs, which becomes harder if assets are deployed into smart contracts where legal and operational segregation is less clear. The firm must also ensure that risk dis-
closures and consent processes appropriately reflect smart-contract risk, oracle risk, MEV and execution uncertainty, and the possibility that protocol govern- ance changes can alter risk exposures. In practice, supervisors are likely to test whether “DeFi use” is consistent with the firm’s ability to return client assets promptly and to maintain surveillance systems appro- priate to its service commitments. 5.2 DeFi Structures Portuguese corporate structuring for DeFi commonly tries to balance decentralisation narratives with legal accountability and operational control, but the pre- cise “market standard” cannot be confirmed from the permitted official sources. What is clear is that MiCA is entity-based, and ESMA stakeholder mate- rials highlight that MiCA’s regime is oriented toward identifiable entities and authorisation processes, even as DeFi challenges that model. As a result, a purely “DAO-only” model can create regulatory ambiguity if any identifiable party effectively provides services or controls a front-end that targets EU users. Where a DeFi operation is partially centralised or has an operating entity that provides services to clients, Portuguese licensing and substance requirements can become relevant by analogy to CASP expectations. Portugal’s Law 69/2025 creates enforceable duties for CASPs around EU management location and gov- ernance composition, which signals that regulators expect accountable governance anchored in the EU. Even if a protocol is decentralised, any Portuguese operating company involved in custody, brokerage, or client interfacing may face MiCA-triggered licens- ing needs. Practical set-up planning therefore focuses less on “capital requirements for a DAO” and more on whether any entity is performing a regulated function and how that entity can meet governance, risk, and compliance expectations. 5.3 Liability Portuguese judicial materials demonstrate that cryp- to-assets can be treated as objects of legal action (seizure, return, forfeiture), but there is limited publicly accessible, crypto-specific Portuguese jurisprudence in the permitted sources addressing DeFi protocol lia- bility as such. What can be stated confidently is that Portuguese courts have engaged with crypto-assets
517 CHAMBERS.COM
Powered by FlippingBook