SPAIN Law and Practice Contributed by: Alfonso López-Ibor Aliño, Olivia López-Ibor Jaume and Victoria Moreno Motilva, López-Ibor Abogados
and co-ordination with other EU competent authori- ties via ESMA, including supervisory convergence efforts and information exchange. Practical enforce- ment against entities operating from outside the EU without authorisation remains limited, reflecting juris- dictional constraints inherent to decentralised and cross-border markets. Looking ahead, the regulatory stance is expected to become more assertive, with increased supervi- sory co-ordination at EU level and a stronger focus on authorisation compliance, market conduct, and investor protection. The establishment of the EU Anti- Money Laundering Authority (AMLA), with responsi- bilities over AML/CFT supervision of certain obliged entities including CASPs, is also expected to reinforce the cross-border enforcement framework. 3. Licensing and Set-Up Requirements 3.1 Licensing Requirements The primary trigger for licensing in Spain is the provi- sion of crypto-asset services falling within the scope of MiCA on a professional basis. Regulated activities include custody and administration of crypto-assets, operation of trading platforms, exchange services between crypto-assets and fiat currency or between crypto-assets, execution of orders, placement, trans- fer services, and the provision of advice or portfolio management in relation to crypto-assets. The mere use of blockchain technology, without the provision of regulated services, does not itself trigger a licensing requirement. MiCA operates on an EU-wide basis through a system of authorisation and passporting. Firms authorised in one EU member state may provide services across the EU, including Spain, without requiring additional local authorisation. Entities established outside the EU must obtain authorisation in an EU member state in order to provide crypto-asset services within the Union. In assessing territorial nexus, factors such as targeted marketing to Spanish clients, use of Span- ish language communications, and the location of effective management or operational control may be relevant in determining whether activities are deemed to be carried out in Spain.
Transitional (grandfathering) provisions apply to enti- ties previously registered under pre-MiCA national AML regimes. These firms may continue operating until July 2026 while seeking full MiCA authorisation. During this transitional period, however, they are sub- ject to limitations, including the inability to exercise passporting rights and constraints on expanding the scope of services. Full authorisation is required to access the EU single market on a cross-border basis. 3.2 Set-Up Requirements In Spain, CASP authorisation under MiCA is granted by the CNMV as the competent authority, with the Bank of Spain acting as the competent authority for certain EMT-related aspects. Applications must be submitted in accordance with the harmonised requirements set out in MiCA and relevant ESMA technical standards, and must demonstrate full compliance across organ- isational, governance, prudential, and operational dimensions before authorisation is granted. From a substance perspective, applicants must estab- lish a clear organisational structure with well-defined lines of responsibility, effective risk management and internal control frameworks, business continu- ity arrangements, and ICT and cybersecurity policies consistent with the Digital Operational Resilience Act (DORA). Regulators assess whether meaningful decision-making, oversight, and control functions are effectively located within the EU, and structures that resemble shell or purely booking entities are unlikely to meet supervisory expectations. On personnel, MiCA requires that members of the management body and holders of key control func- tions – including compliance, risk management, and AML – satisfy fit and proper requirements and pos- sess appropriate knowledge, skills, and experience. While no formal local staffing quotas apply, authori- ties assess whether governance arrangements ensure effective oversight and accountability within the juris- diction. Prudential requirements are calibrated to the servic- es provided, with minimum own funds ranging from EUR50,000 for advisory or order execution services to EUR150,000 for custody and exchange services. CASPs must maintain ongoing compliance with these
602 CHAMBERS.COM
Powered by FlippingBook