SPAIN Law and Practice Contributed by: Alfonso López-Ibor Aliño, Olivia López-Ibor Jaume and Victoria Moreno Motilva, López-Ibor Abogados
5. Decentralised Finance 5.1 Ability to Use DeFi
tional activity connected to Spain must ultimately be attributable to identifiable natural or legal persons. In practice, DeFi projects with links to Spain are there- fore commonly structured through traditional legal entities, such as limited liability companies, founda- tions, or foreign entities, which act as operational, development, governance, or interface vehicles in connection with the protocol. There are no capital or substance requirements for establishing a DeFi protocol as such, as the develop- ment of decentralised software is not regulated. How- ever, where an entity performs activities that qualify as crypto-asset services under MiCA – such as custody, exchange, execution of orders, or portfolio manage- ment – full CASP authorisation requirements apply. These include minimum own funds, governance and internal control standards, operational substance, and AML/CFT obligations. 5.3 Liability Spain has not yet developed DeFi-specific case law or regulatory enforcement addressing harm caused by decentralised protocols. Accordingly, account- ability and liability are assessed through general civil, administrative, and financial regulatory principles, with authorities focusing on whether any identifiable actor exercises effective control or intermediates user access. Spanish regulators and courts apply a substance- over-form approach. Where a protocol is genuinely decentralised and lacks an identifiable issuer, opera- tor, or controlling governance structure, enforcement is constrained by the requirement to attribute liability to a natural or legal person. From a civil-law perspective, both contractual and non-contractual (tort) liability may arise where users interact through identifiable intermediaries. Where corporate structures are involved, directors’ liability rules may also be engaged in cases involving gov- ernance failures, inadequate controls, or misleading conduct. Although Spain has not issued landmark judicial decisions addressing harm caused purely by autono- mous DeFi protocols, regulators are likely to approach
Spain does not recognise DeFi as a standalone regulatory category, and there is no specific regime expressly permitting or prohibiting decentralised finance. Instead, Spanish supervision follows a func- tional, activity-based approach, whereby DeFi-related activities are assessed under existing frameworks such as MiCA, MiFID II, payment services regulation, and AML/CFT rules where relevant. Fully decentralised protocols with no identifiable issuer, operator, or controlling governance body may, depending on the factual structure, fall outside the scope of regulated financial services. However, this does not create a regulatory safe harbour. Where a person or entity exercises effective control, provides a user interface, or intermediates access to a protocol, that party may be deemed to be providing regulated crypto-asset services under MiCA, triggering authori- sation and full compliance obligations. CeFi firms operating in Spain – whether authorised domestically or passporting under MiCA – may inter- act with DeFi protocols, but only within the scope of their regulated activities. Where DeFi functionality is embedded into client-facing products, firms must ensure compliance with MiCA governance, custody, conflict-of-interest, and AML/CFT requirements. Regulators focus on risks including loss of custody and control, smart contract vulnerabilities, govern- ance attacks, valuation and liquidity uncertainty, and reduced traceability in permissionless systems. Firms are expected to conduct enhanced technical and AML due diligence, ensure robust client disclosures, and maintain full regulatory accountability even where execution is decentralised or automated. 5.2 DeFi Structures Spain does not recognise DeFi or decentralised autonomous organisations (DAOs) as distinct legal or regulatory categories, and there is no specific legal framework governing their organisation or operation. DAOs do not have legal personality under Spanish law. Accordingly, any governance, treasury, or opera-
605 CHAMBERS.COM
Powered by FlippingBook