Crypto License in Spain: Why Madrid Became Europe’s Quietest Power Move in the MiCA Era

1. The summer the grace period died

Every regulatory transition has a last night. For crypto in Europe it was 30 June 2026. MiCA’s rules for service providers had applied since 30 December 2024, but member states were allowed to let existing operators keep trading on their national registrations for up to 18 months. Spain took the full window. From 1 July 2026 the CNMV’s position fits on a Post-it: only providers that hold the necessary authorization may operate in Spain, as the regulator reminded the market.

What that means in practice is less dramatic than it sounds and more brutal than it reads. A provider without authorization needs a client migration plan: a way for customers to move their crypto to other addresses, their money to a cash account, or the whole book to an authorized firm, with early, repeated communication and a reasonable withdrawal window. ESMA was blunter still: filing an application does not entitle you to keep operating after the deadline. Spanish lawyers writing after the date expect supervisors to use their inspection and sanction powers against anyone who carries on regardless.

Europe did not reach the cliff edge in one place or at one time. The Netherlands closed its window on 30 June 2025, a full year early. Germany’s BaFin shortened its own to 30 December 2025. France, Italy, Malta, Cyprus, Luxembourg and Spain rode the whole 18 months. Poland, meanwhile, still has no implementing law after two presidential vetoes, so its regulator has no legal basis to process a single application, according to ITISPay’s country tracker.

The result is the first honest snapshot of the licensed market. When the transition expired, ESMA’s interim register held 213 authorized providers across 23 jurisdictions; by the end of July the count had reached 321, as we covered in our five-jurisdiction case study. By early October the register listed about 365 entries. That register is the dataset behind this piece — not press releases, not brochures. And what it says is not what most marketing pages repeat.

2. The map: five countries, 58% of the licenses

Sort the register by country and the pattern jumps out. Germany, France, the Netherlands, Cyprus and Malta hold 211 of the 365 entries. Germany alone accounts for 100, and most of those are banks: in September, 60 of its 95 entries were credit institutions, 46 of them cooperative Volksbanks and Raiffeisenbanken. A bank does not apply for a crypto license the way a start-up does; it notifies its supervisor under Article 60 and carries on. Strip the banks out and Germany’s count falls to roughly 35, level with France.

The more interesting column is the one that is not in the chart: how fast each country moved. Take a year-earlier snapshot and the picture is almost comic.

France went from five to 36 in twelve months; Cyprus from one to 24; Malta from five to 23. A year ago the question was whether anyone would get through. Today it is how crowded the room is that you are about to walk into. Further down the table sits the most dramatic fall of all. Lithuania had around 850 registered crypto companies in late 2022; in October 2026 it had six authorized providers. MiCA is not a toll booth. It is a filter, and the filter is fine.

For anyone choosing a home for a licensed business, the register delivers two uncomfortable truths. First, the licenses are concentrated, which means the top five hubs are also where regulators have the longest queues and the most direct competitors. Second, everything below them is wide open: Spain, Luxembourg, the Czech Republic, Ireland, Latvia and Austria each hold between 11 and 15 entries. Those are not obscure jurisdictions. They are the places where being the twentieth applicant is no longer the starting condition.

3. Spain up close: a register built by banks

Spain’s 15 entries tell a specific story. The first two licenses, granted in July 2025, went to Bit2Me and Openbank; Bit2Me promptly billed itself as the first Spanish-speaking fintech authorized under MiCA by the CNMV, according to its own announcement. Five entries are dated 2025 and ten are dated 2026, with the most recent — Basque Pay and Cryptopocket — added on 31 July. Six of the fifteen are banks or bank subsidiaries: BBVA, CaixaBank, Cecabank, Kutxabank, Renta 4 and Openbank. Only Germany has more bank CASPs, and Spain is the only other market with more than three. The other nine are specialists: Bit2Me, DUE, Crossmint, Criptan, Prosegur Crypto, Minos Global, Basque Pay, Iqana and Cryptopocket.

Now look at what they do. Custody and administration appears on 11 of the 15 licenses. That is Spain in miniature of a Europe-wide pattern: in a tally by Coincub, custody was the most common permission on the whole EU register, ahead of transfer services and exchange. The trading-platform permission, by contrast, is rare: only about 20 firms across the EU hold it, and MiCA Watch’s tally showed none in Spain as of August. Read that carefully. Exchanging crypto for funds is a separate, lighter permission, and some Spanish firms hold it. What is missing is a Spanish-licensed venue where buyers and sellers meet. In a country where roughly one in eleven people owns crypto, that is a gap, not a verdict.

Then there is the line that should reorganize your thinking. Most Spanish licensees passport into just one other country; Bit2Me, the outlier, passports into 30. In the other direction, Spain’s customers are already being served by firms licensed in the Netherlands, Germany, Ireland, France and Malta, which use freedom to provide services to sell into the Spanish market. So the real competitive picture is not “Madrid versus Valletta”. It is whether you want to be the local or the visitor, in a market that is the fourth-largest economy in the EU. Locals get the regulator who knows their name, the banks that know their directors and the customers who read the license number in their own language.

It also matters how the supervisor behaves. The CNMV published a dedicated MiCA Q&A in December 2025 covering scope, notifications, conduct rules and the transition, and even addressed when an investment influencer counts as client acquisition. In June 2026 it reshuffled its internal rules so that one directorate handles CASP authorization files while another supervises trading and market abuse, according to a commentary by López-Ibor DPM. A supervisor that publishes its homework is a supervisor you can plan around. Our own guide to getting a crypto license in Spain walks through how that plays out in an application, from the first meeting to passporting.

4. The customer: nine percent and rising

None of this would matter without people to serve. According to a 2024 ECB survey cited by InSpain News, 9% of Spaniards own some form of cryptocurrency, up from 4% in 2022. That puts Spain level with France and Croatia and slightly ahead of Latvia and Austria; Slovenia (15%) and Greece (14%) lead the eurozone. Of the Spanish holders, 57% say they are in it for investment, 19% use crypto for payments, and a further 20% cite both reasons.

The profile matters as much as the headline figure. The Banco de España’s analysis of household crypto holdings found that owners skew young, male, university-educated and financially literate; they describe themselves as risk-tolerant, they also hold shares and funds, and they show no sign of rejecting the traditional financial system. For about 80% of households that held crypto, it made up no more than 10% of their financial portfolio, and only around 0.6% of households held a substantial share of their wealth in it, the central bank reports. This is not a market of gamblers. It is a market of mainstream savers who would, given the choice, prefer to buy through something with a license number.

The tax authority is reaching the same conclusion from the other side. Since 1 January 2026 the EU’s DAC8 directive has obliged crypto-asset service providers to report user data to tax authorities, and Spanish gains are taxed in the savings base at progressive rates running from 19% to as much as 30% for the largest gains, per N26’s April 2026 guide. A taxpayer who knows the revenue office can see every wallet at an authorized platform will, sooner or later, prefer a platform that hands over a clean tax report. That is analysis, not a quotation, but it is the direction in which the incentives point.

Finally, language. Spanish is the thread connecting a European home market to a much larger set of customers elsewhere. A Spanish-speaking support team, Spanish-language terms and a regulator in the same language are not a rounding error in customer acquisition costs. They are a moat that a Maltese brass plate cannot replicate.

5. The clock: two calendars, one of them is yours

Founders ask the same question in the first five minutes: how long will it take? The honest answer is that there are two clocks. The first is the statute. Under Article 63 of MiCA, the supervisor acknowledges your application within five working days, checks it for completeness within 25 working days and then has 40 working days to decide once the file is complete; it can stop the clock once, for up to 20 working days, to ask for more information. Add it up and you get 65 to 85 working days — three to four months.

The second clock is yours, and it starts earlier. The statutory window opens only when the file is complete, and completeness is the point. Before filing you need a Spanish operating company with real substance, a management body that passes fit-and-proper review, a programme of operations with a multi-year financial plan, an AML manual aligned with Spanish Law 10/2010 and the SEPBLAC’s expectations, an ICT framework that stands up under DORA, custody and safeguarding arrangements, a penetration test, and the regulatory capital sitting in a bank account. Practitioners tend to quote four to six months end to end for a well-prepared Spanish file; we use the same range on our Spain CASP page. Applicants who treat the CNMV’s questions as hostile get long pauses. Those who treat them as a code review get short ones.

Two comparisons put this in perspective. France’s AMF publishes a flat €10,000 fee, which MiCA Watch notes the CNMV does not match with a published CASP schedule, so budget conservatively. And Germany’s BaFin gives applicants four weeks to supply missing documents and rejects those that remain incomplete: a reminder that “complete” means complete everywhere in Europe.

6. The price of admission

Regulatory capital is the first number everyone looks up, and the least interesting. MiCA sets three tiers of minimum own funds in Annex IV, and you are placed in a tier by the most demanding service you provide. The rule that catches people: custody is not in the cheapest class.

The permanent minimum is the higher of those amounts or one quarter of the previous year’s fixed overheads, under Article 67 of MiCA, with the tiers published in ESMA’s interactive rulebook. Capital is a one-off cheque. The line items that keep CFOs awake are the recurring ones, and here are the indicative first-year ranges used in 2026 planning for a Spanish set-up, excluding regulatory capital:

Notice what dominates: people and software, not paperwork. A properly staffed compliance function costs more than the license itself, which is exactly why the register has only 15 Spanish names rather than 150. The expensive mistake is not paying too much for the application. It is under-budgeting for year two. If you are weighing structures for the holding and group tax position, our note on tax structuring for crypto businesses is a sensible companion, since the headline corporate rate in Spain is 25%.

7. Spain versus the field

Every jurisdiction sells a story. The register tells you what each has actually been good at. Here is the head-to-head, with the honest caveat that no single column decides a decision.

Germany is the bank club. A hundred entries sounds like a bonanza until you realize that most are credit institutions, including 46 cooperative banks; BaFin shortened the transition to 30 December 2025, and a wave of 16 authorizations arrived that month, according to MiCA Watch. For a non-bank, Germany means a serious regulator and an incumbent-heavy market. France is the rulebook hub. The AMF publishes its fee, went from five entries to 36 in a year and added 12 in June 2026 alone. The Netherlands was the earliest to close its window and, with 28 entries, remains the home base of choice for firms that want to passport widely.

Malta has the experience and the ecosystem: auditors, lawyers, banks that know the paperwork. It added 18 entries in a year, but growth has flattened since the summer. The 35% headline corporate tax is softened by a shareholder refund system, which is a reason to talk to a tax adviser before comparing it with anything. Our Malta crypto license overview covers that structure. Cyprus was the fastest climber: from one entry to 24, helped by CySEC’s requirement that applicants file a MiCA application by 27 February 2026 to keep transitional status. Corporate tax rose to 15% in 2026, still among the lowest in the euro area; see our Cyprus CASP guide. The catch is queue length: a crowded supervisor is a slower one.

Lithuania is the cautionary tale and the proof of concept in one. Roughly 850 companies were registered in the old regime; six are authorized today. The Bank of Lithuania did not change the rules; it enforced them. If you are comparing Baltic options, the Lithuania license page explains where the bar actually sits. Luxembourg (13 entries, up from three, with bank CASPs including Standard Chartered and Swissquote) leans institutional. The Czech Republic went from zero to 12 in a year, after requiring operators to file by 31 July 2025 to qualify for transitional protection. And Poland is the footnote everyone should read: no domestic law, no CASPs, no path, yet between 169 and 176 foreign CASPs have passported in. That is the clearest illustration of why a home-state license is not a vanity item.

So where does Spain win? Not in any one column. It wins on the combination: a large home market, permission lanes that are still mostly empty, a supervisor that has authorized both banks and start-ups, a headline tax rate that is middling and a statutory clock that is no worse than anyone’s. Compared with the Netherlands or Germany it is less crowded; compared with Malta or Cyprus it has a far bigger domestic market; compared with Lithuania it has a track record of approving independent firms. For neighbours in the Iberian region, our Portugal crypto license page sets the alternative against this one.

8. Beyond the EU: the three flags that still matter

A fair market study should look outside the bloc, and we did. Dubai’s VARA, Hong Kong’s SFC (which lists 13 licensed trading platforms) and Switzerland’s FINMA remain the non-EU regimes that serious operators compare with MiCA. Each wins in its own geography: VARA for the Gulf and South Asia flows, the SFC for Greater China, FINMA for banking-grade credibility. But if your customers are in Madrid, Barcelona and Valencia, Dubai is a conference trip, not a business model. For a head-to-head across all five regimes, read our case study of five flags and one license and the global crypto licensing landscape 2026. If the EU route is the one you are taking, the MiCA CASP overview and our MiCA regulation guide set out the shared rules.

9. Field notes: six ways a Spanish application goes sideways

The register records who succeeded. It does not record the files that stalled. Experienced advisers will tell you the same recurring themes, and we have set them out here for anyone building a file from scratch.

Notice the pattern. None of these is exotic. All of them are failures of sequencing: doing the visible work first (the website, the brand, the launch party) and the structural work (substance, controls, banking) last. The applications that clear quickly are the ones that run the unglamorous workstreams in parallel from week one, and then keep them alive after approval through ongoing compliance reporting. Before filing, many founders also commission a legal opinion on the service perimeter, which settles whether a product needs a CASP authorization at all.

10. Who should choose Spain — and who should not

After all of this, the practical question: which flag for which business?

If Spain is on your shortlist, the requirements, step-by-step timeline and costs are laid out on our crypto license in Spain page, and the wider EU picture sits in our guide to choosing the right crypto license jurisdiction. The honest recommendation of this study is simple: do not choose a hub by the loudest brochure. Choose it by where your customers, your banks and your supervisors can live in the same sentence.

Frequently asked questions

Do I need a crypto license in Spain to serve Spanish customers?

Yes. Since the end of Spain’s transitional period on 30 June 2026, only providers authorized under MiCA may offer crypto-asset services in Spain. You can hold the authorization from the CNMV directly, or serve Spanish customers under a passport from another EU member state, but an unauthorized firm cannot operate on a national registration alone.

Who regulates a CASP in Spain?

The CNMV authorizes and supervises crypto-asset service providers. The Banco de España supervises issuers of asset-referenced and e-money tokens, and the SEPBLAC oversees anti-money-laundering compliance.

How long does CASP authorization in Spain take?

The statutory clock is 65 to 85 working days after a complete filing: 25 for the completeness check, 40 for the decision and one pause of up to 20. Add the preparation phase and practitioners typically quote four to six months end to end.

How much capital does a Spanish crypto license require?

Minimum own funds are €50,000, €125,000 or €150,000 depending on the services, or a quarter of the previous year’s fixed overheads if higher. Custody and exchange put you in the €125,000 class; operating a trading platform puts you in the €150,000 class.

Can a Spanish CASP serve the whole EU?

Yes, through MiCA passporting, but only for the services named in the authorization, and only after the passport notification is made. Most Spanish licensees currently passport into a single other country.

Is Spain better than Malta or Cyprus for a crypto license?

It depends on the business. Spain offers a large home market and a less crowded register; Malta offers an experienced ecosystem; Cyprus offers a lower headline tax. Our table in section 7 sets out the trade-offs, and the Spain page shows what a Spanish application involves.