SPAIN Law and Practice Contributed by: Alfonso López-Ibor Aliño, Olivia López-Ibor Jaume and Victoria Moreno Motilva, López-Ibor Abogados
capital requirements and implement appropriate safe- guarding measures for clients’ crypto-assets and funds, including segregation, custody protections, and operational control. The authorisation process involves detailed substan- tive review by the CNMV, including assessment of qualifying shareholders, governance arrangements, senior management, AML/CFT controls, outsourc- ing structures, and operational resilience measures. The process is typically iterative, with the regulator empowered to request additional information and clarifications before granting authorisation. 3.3 Change of Control In Spain, change-of-control transactions involving crypto-asset service providers (CASPs) are subject to mandatory prior supervisory assessment under Regu- lation (EU) 2023/1114 (MiCA), consistent with the har- monised EU framework applicable across regulated financial services. Any direct or indirect acquisition of a qualifying holding – generally starting at thresh- olds of 10%, 20%, 30% or 50% of capital or vot- ing rights, or any transaction resulting in the ability to exercise significant influence over the management of the CASP – triggers a prior notification requirement to the competent authority in Spain, the CNMV. The assessment is carried out under MiCA and the relevant EU implementing and delegated acts gov- erning qualifying holdings. The CNMV must evaluate the proposed acquisition against five statutory criteria: • the reputation of the proposed acquirer; • the suitability of any persons who will direct the business of the CASP following the acquisition; • the financial soundness of the acquirer; • the ability of the target CASP to continue comply- ing with applicable prudential requirements; and • the absence of reasonable grounds to suspect money laundering or terrorist financing risks arising from the transaction. The CNMV conducts its assessment within a maxi- mum statutory period of 60 working days from acknowledgement of a complete notification, dur- ing which it may approve, conditionally approve, or oppose the transaction. The regime is based on EU
maximum harmonisation, meaning member states are generally not permitted to introduce additional sub- stantive assessment criteria. In practice, thorough preparation of the notification file is essential, including full ownership structures, source of funds documentation, and governance impact analysis. Transactions involving non-EU acquirers or complex holding structures typically attract enhanced scrutiny, particularly from an AML/CFT perspective. Completion of a notifiable acquisition without prior approval may result in significant supervisory meas- ures, including suspension of voting rights. 3.4 Passporting Licences obtained in Spain under MiCA benefit from the EU passporting regime, allowing authorised crypto-asset service providers (CASPs) to operate across the European Union without obtaining sepa- rate authorisations in each jurisdiction. Once author- ised by the CNMV, a CASP may provide services in other member states either on a cross-border basis or through the establishment of a branch. The passporting mechanism is based on a harmo- nised notification system rather than separate host state authorisation. The CASP must notify its home competent authority (the CNMV) of its intention to provide services cross-border, including details of the member states concerned, the services to be provid- ed, the intended start date, and any ancillary activities. The CNMV must then transmit this information to the relevant host authorities and EU bodies within a short statutory timeframe. While no additional licences are required in host mem- ber states, CASPs remain subject to ongoing supervi- sion by the CNMV and must comply with applicable non-harmonised local rules, particularly in relation to conduct of business, consumer protection, and AML/ CFT obligations. No additional capital or structural requirements apply for passporting. The key condition is prior authorisa- tion under MiCA in Spain and completion of the cross- border notification process in accordance with Article 65 before commencing activity abroad.
603 CHAMBERS.COM
Powered by FlippingBook