SPAIN Law and Practice Contributed by: Alfonso López-Ibor Aliño, Olivia López-Ibor Jaume and Victoria Moreno Motilva, López-Ibor Abogados
4. Cross-Border Services 4.1 Marketing
asset service provider (CASP) – whether licensed by the CNMV or passporting into Spain from another EU member state – remains fully responsible for all regu- lated services performed under its licence, regardless of any outsourcing or branding arrangements. MiCA establishes a strict outsourcing framework requiring CASPs to retain full accountability and ensure that outsourcing does not result in the delegation of responsibility, the alteration of client relationships, or the weakening of supervisory oversight. In particular, outsourcing must not prevent competent authorities from effectively supervising the CASP, and firms must maintain adequate resources, expertise, and access to information to manage outsourced functions. In practice, external firms may provide technology, interfaces, or distribution capabilities, while the CASP must retain effective control over regulated activities, including compliance and risk management. Howev- er, ultimate responsibility for regulatory obligations, including AML/CFT compliance, remains with the CASP at all times. Spanish regulators apply a substance-over-form approach when assessing white-label structures. Where the arrangement results in the outsourc- ing entity effectively performing regulated services independently, or where the CASP lacks meaningful operational control, authorities may recharacterise the structure as unauthorised provision of crypto-asset services. There is no specific white-label licensing regime under MiCA. Outsourcing arrangements are permitted pro- vided they are supported by robust contractual safe- guards, ongoing oversight, and adequate governance and contingency planning, ensuring that the CASP retains genuine operational substance and control over the services provided. Accordingly, white-label models are generally viable only where supported by robust contractual arrange- ments, effective governance, ongoing oversight, and a demonstrable operational role retained by the author- ised CASP.
In Spain, the cross-border provision of crypto-asset services is regulated under MiCA. EU-based CASPs authorised in another member state may provide ser- vices into Spain under the passporting regime. No separate authorisation from the CNMV is required. Incoming CASPs must nonetheless comply with appli- cable conduct-of-business, consumer protection, and AML/CFT rules on an ongoing basis. For non-EU firms, access to the Spanish market is materially more restricted. Third-country entities can- not passport into Spain and must either obtain author- isation within the EU or operate through an authorised EU CASP. Direct provision of services to Spanish cli- ents without authorisation would be in breach of the MiCA authorisation requirement, particularly where there is active solicitation through Spanish-language marketing, targeted advertising, or local onboarding processes. The principal exemption available to third-country firms is reverse solicitation which applies where a client initiates the relationship entirely on its own exclusive initiative. ESMA has issued supervisory guidelines, which are expected to be followed by competent authorities, adopting a strict interpretation of this exemption. Solicitation is interpreted broadly and in a technology-neutral manner, and includes digital marketing, social media activity, and platform- based promotion. Disclaimers alone are not sufficient to establish reverse solicitation in practice. Regarding marketing and disclosure, MiCA harmo- nises requirements. All communications must be clearly identifiable as advertising, fair, clear and not misleading, and consistent with the relevant white paper. Competent authorities, including the CNMV, may require correction or withdrawal of non-compliant communications. 4.2 White Labelling Under MiCA in Spain, white-label and regulatory host- ing arrangements are not expressly prohibited, but they do not allow an unlicensed entity to circumvent authorisation requirements. The authorised crypto-
604 CHAMBERS.COM
Powered by FlippingBook