The Banco de España VASP registry closed on December 30, 2024. Every firm registered there must now obtain full CNMV CASP authorization under MiCA — or cease operating in Spain by July 1, 2026.
What Changed
Before MiCA, Spanish crypto firms registered with the Banco de España under anti-money-laundering regulations. This registration covered exchange services between crypto and fiat, and custody of crypto wallets.
That regime is over. MiCA (Markets in Crypto-Assets Regulation) is now the governing framework across the EU. In Spain, the CNMV is the competent authority for CASP authorization. Banco de España VASP registration does not transfer automatically — it is simply gone.
The 85 Firms Already Listed — And Why Most Are Foreign
As of March 2026, the CNMV's public CASP registry lists approximately 85 authorized providers. The list is dominated by EU firms passporting into Spain: Coinbase, Bitstamp, Revolut, Bitpanda, eToro, Trade Republic, N26, and Bybit (via their German entity).
Spanish-native firms on the list? Essentially three: BBVA (a bank), CECABANK (a bank), and BITCOINFORME S.L. (Bit2Me). Renta 4 Banco is also there as an investment bank.
That means virtually every Spanish-native crypto company — exchanges, portfolio tools, custody providers, token platforms — is not yet on the CNMV list. They have fewer than 100 days.
The CNMV CASP Authorization Process
Obtaining CNMV CASP authorization is not a simple form. The process involves:
- Organizational review — governance structure, management fit-and-properness
- Capital requirements — minimum own funds based on services offered
- IT security assessment — operational resilience under MiCA Title V
- Compliance program — AML/CTF procedures, client protection, complaints handling
- Business plan submission — revenue model, risk assessment, custody arrangements
The CNMV review process typically takes 3 to 6 months from a complete application. Firms that have not begun the process are running out of time.
What Happens If You Do Not Apply
The CNMV has been explicit: this is a comply-or-quit framework. Firms that do not obtain CASP authorization by July 1, 2026 must stop providing crypto services to Spanish clients.
The risks include:
- Administrative sanctions for continuing to operate without authorization
- Loss of banking relationships (Spanish banks will require proof of CNMV status)
- Loss of payment processor access
- Reputational damage with institutional and retail clients
The Action Checklist for Spanish Crypto Firms
If your firm was Banco de España registered, here is what you need to do now:
Immediate (this week)
- Determine which MiCA services you provide: custody, exchange, transfer, reception/transmission of orders, placement, advisory
- Identify your capital requirement tier based on services
- Book a pre-application meeting with the CNMV — they offer these for firms beginning the process
Short-term (this month)
- Conduct a gap analysis against MiCA Title V requirements
- Begin documentation of governance and compliance procedures
- Assess whether to apply directly to CNMV or passport from another EU member state
Ongoing through June 2026
- Monitor EBA and CNMV guidance updates — both regulators issue regular clarifications
- Document your compliance posture for banking partners and institutional clients who will request it
- Track your application status with the CNMV and respond promptly to information requests