Spain

Spain has not historically had a single, comprehensive statute setting out an exhaustive definition of cryptoassets as an autonomous legal category. Prior to the application of Regulation (EU) 2023/1114 on markets in cryptoassets (MiCA), the concept was shaped progressively and, inevitably, in a fragmented manner through sector-specific approaches pursuing distinct regulatory objectives.

In that context, the amendments introduced by Royal Decree-Law 5/2021 of 12 March, adopted, at an explanatory level, a characterisation of such assets as digital representations of value or rights capable of being transferred and stored electronically by means of distributed ledger technology or similar technologies.

In parallel, within the anti-money laundering framework, Law 10/2010 incorporated the notion of “virtual currency” as a digital representation of value which is not issued or guaranteed by a central bank or public authority, is not necessarily linked to a legally established currency and does not have the legal status of currency or money, yet is accepted as a means of exchange and may be transferred, stored or traded electronically.

It should also be noted that, prior to MiCA, Spain did not have a specific, differentiated substantive regime for categories now central to regulatory debate, such as stablecoins or non-fungible tokens (NFTs); their legal treatment depended, where applicable, on the extent to which pre-existing regimes applied (for instance, anti-money laundering and counter-terrorist financing (AML/CFT) obligations or administrative criteria on advertising), without a material systematisation.

As previously noted, the Spanish legal system has never articulated, neither prior to nor following the adoption of MiCA, a self-standing and exhaustive statutory framework specifically devoted to cryptoassets.

Before MiCA, Spain’s crypto regulation was primarily AML/CFT-driven: Law 10/2010 (as amended by Royal Decree-law 7/2021) introduced the concept of “virtual currency” and extended AML/CFT obligations to certain crypto service providers. In parallel, investor-protection concerns were addressed through the CNMV’s Circular 1/2022, which set a specific regime for advertising cryptoassets marketed as investment products. Finally, tax rules (notably Law 11/2021 and related reporting duties) significantly expanded transparency and disclosure obligations, treating cryptoassets as economically relevant assets without creating a prudential authorisation framework.

With MiCA, Spain moves to a single, directly applicable EU regime governing:

• issuance and public offers of cryptoassets;
• stablecoins (asset-referenced tokens (ARTs) and electronic money tokens (EMTs)); and
• the authorisation and ongoing supervision of cryptoasset service providers (CASPs), including transitional arrangements for certain existing operators.

Institutionally, before MiCA the Banco de España did not supervise the crypto market as such; its involvement was mainly linked to AML/CFT registration and oversight for certain providers. Under MiCA, supervisory responsibilities are reallocated: the National Securities Market Commission (CNMV) is Spain’s main competent authority for MiCA supervision, without prejudice to the Banco de España’s powers regarding ART/EMT matters, including the ability to adopt measures in relation to compliance with MiCA’s stablecoin titles.

The existence of “prohibited” cryptoassets in Spain cannot be assessed from an ontological perspective, but rather from a functional one. Neither Spanish law nor the MiCA Regulation proscribe categories of cryptoassets by reason of their intrinsic nature; instead, they restrict certain activities or economic functions when carried out without the requisite regulatory authorisation. Prior to MiCA, there was no per se prohibition of cryptoassets in Spain, but rather a fragmented framework, complemented, from 2021 onwards, by registration and AML obligations under the supervision of the Banco de España. Following MiCA, the conceptual approach remains essentially the same, albeit significantly reinforced.

In this context, so-called security tokens are not a self-standing legal category: where, based on their economic substance, they qualify as financial instruments, they fall (both before and after MiCA) under Spanish securities markets law (Law 6/2023, of 17 March, on Securities Markets and Investment Services (Ley de los Mercados de Valores y de los Servicios de Inversión) (LMVSI)/Markets in Financial Instruments Directive (MiFID)) and are therefore excluded from MiCA’s scope. By contrast, e-money tokens could already, pre-MiCA, fall within the functional notion of electronic money and, under MiCA, are expressly classified as EMTs and subject to MiCA’s dedicated regime, without prejudice to the applicable e-money framework. ARTs, which prior to MiCA often sat in a legally uncertain space, are now an autonomous regulatory category subject to authorisation, reserve requirements and prudential obligations. Finally, NFTs are, in principle, outside MiCA in so far as they are genuinely non-fungible, but may be recharacterised on a substance-over-form basis where they replicate features of fungible cryptoassets or qualify as financial instruments, in which case securities markets law would apply.

Until the end of 2024, Spain did not have a specific “crypto licence” as such. There was no prior authorisation regime for token issuers (beyond general transparency and information requirements), and financial intermediaries were generally only required to notify the CNMV when offering cryptoassets.

MiCA sets a single EU rulebook for crypto. CASPs must have strong governance and controls, adequate prudential safeguards, proper safeguarding/segregation of clients’ cryptoassets and funds, resilient ICT and business-continuity arrangements, and effective conflict-of-interest and ML/TF risk controls.

In Spain, CASP authorisations are filed with the CNMV (application form/manual available). The CNMV is the MiCA-competent authority, without prejudice to the Bank of Spain’s powers for EMT/ART issuers. For CASP licensing under MiCA, the competent authority follows a short, staged timetable: it acknowledges receipt within five working days, then performs a completeness check within 25 working days. Once the file is complete, it must take the authorisation decision within 40 working days. The clock can be paused only in limited cases if the authority requests additional information.

According to the CNMV’s official register, at the beginning of 2026 there are approximately 89 cryptoasset service providers authorised to operate in the Spanish market. However, virtually no foreign company has chosen Spain as its MiCA authorisation jurisdiction; all authorisations granted directly by the CNMV correspond to Spanish entities, such as BBVA, Cecabank, Openbank, Renta 4 Banco and Bit2Me.

Prior to MiCA, the advertising of cryptoassets in Spain was governed by a mixed national framework. On the one hand, Royal Decree-law 5/2021 introduced Article 240 bis into the Securities Market Law (LMV), expressly empowering CNMV to regulate the advertising of cryptoassets offered or presented as an investment. This statutory mandate gave rise to CNMV Circular 1/2022 (10 January 2022), the first regulatory instrument in Europe specifically devoted to the advertising of cryptoassets. That circular applied to any advertising addressed to Spanish investors in which a cryptoasset was promoted, either explicitly or implicitly, as an investment opportunity.

In parallel, the general advertising framework continued to apply in full. Law 34/1988 on General Advertising and Law 3/1991 on Unfair Competition expressly prohibit unlawful advertising practices (including misleading or covert advertising), and any cryptoasset advertising campaign was required to comply with those rules.

In practice, the CNMV acted as an active and interventionist supervisor. It issued public warnings highlighting the risks associated with cryptoassets (notably, in 2021, it publicly reproached Andrés Iniesta following a tweet promoting cryptocurrencies) and initiated enforcement actions. In December 2023, the CNMV announced the opening of its first sanctioning proceeding for infringement of Circular 1/2022.

As noted above, MiCA has been applicable in Spain since 30 December 2024. On that same date, CNMV Circular 1/2024 (published on 27 December 2024) repealed the former Circular 1/2022, thereby formally bringing the national regime to an end. From that point onwards, the relevant European provisions apply directly.

Before MiCA, Spain did not recognise a horizontal “crypto” financial licence for custodians. Providers offering custodian wallet services and/or fiat-to-crypto exchange were required to enrol in the Banco de España register established under Law 10/2010. That register was AML-driven and non-prudential: it did not entail solvency supervision or conduct-of-business oversight, and the Banco de España expressly clarified that registration did not amount to authorisation or regulatory approval of the activity.

MiCA introduces a pan-European, directly applicable regime under which “custody and administration of cryptoassets on behalf of clients” becomes a regulated cryptoasset service requiring authorisation as a CASP, subject in Spain to the CNMV as the general competent authority (or via EU passporting with European Securities and Markets Authority (ESMA) registration). The Banco de España’s AML register becomes essentially informational until the end of the transitional period (1 July 2026).

The custodian is liable for losses caused by incidents attributable to the CASP, up to the market value at the time of loss; MiCA does not provide deposit-guarantee coverage or require compulsory insurance for custody. MiCA is technologically neutral (no “cold storage” mandate), but requires a custody policy, risk-minimising procedures, and robust internal controls. AML “travel rule” obligations apply under Regulation (EU) 2023/1113. For stablecoins, ART reserve assets must be held with an independent custodian (an authorised CASP, credit institution, or investment firm); EMT issuers may custody/transfer only their own EMTs, subject to notification. In Spain, ART/EMT issuers are supervised by the Banco de España.

In Spain, CASPs are subject to anti-money laundering obligations under both national and European legislation. Pursuant to Law 10/2010 on the Prevention of Money Laundering and Terrorist Financing, as amended by Royal Decree-Law 7/2021, providers of exchange services between cryptoassets and fiat currency, as well as custodial wallet providers, are classified as obliged entities. As such, they are required to apply customer due diligence measures (Know Your Customer (KYC)), keep records, and report any transactions they consider suspicious or irregular to the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offence (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias, SEPBLAC). In addition, since the entry into force of MiCA, CASPs must obtain authorisation from the CNMV before commencing any cryptoasset-related activities. CASPs that were already operating prior to the application of MiCA benefit from a transitional and adaptation period, provided that they had been registered in the Bank of Spain’s register of providers of virtual currency exchange services for fiat currency and custodial wallet services.

Furthermore, MiCA, applicable from 30 December 2024, establishes a harmonised framework for CASPs across the EU. Although MiCA does not replace anti-money laundering legislation, it complements and clarifies it by imposing authorisation, corporate governance and transparency requirements, thereby strengthening the implementation of AML/CFT controls in cryptoasset services. Spain also applies the EU “travel rule” to cryptoasset transfers, requiring CASPs to collect and transmit information on the originators and beneficiaries of such transactions.

In Spain, cryptoassets are not considered legal tender but are treated as property (intangible assets) under tax and general legal frameworks. For tax purposes, virtual currencies are classified as intangible assets that can be exchanged for other assets, services, or rights, although they lack the status of currency of legal tender.

Spanish law does not expressly differentiate between legal ownership and beneficial ownership of a cryptoasset. In practice, the person controlling the private keys is generally regarded as the owner, unless acting as a custodian on behalf of a third party. Control of a cryptoasset is typically determined by possession of the cryptographic keys that permit its disposal and transfer. However, due to the absence of mandatory identification mechanisms (such as KYC) in self-custody wallets, such control should align with a lawful and traceable origin of the funds used to acquire the cryptoasset in order to substantiate effective ownership.

No specific licence is required solely to hold or transfer cryptocurrencies. Nonetheless, providing services related to cryptoassets — such as exchange, custody, or other regulated activities — may trigger compliance obligations under various legal regimes, including anti-money-laundering rules and, prospectively, MiCA and associated licensing requirements.

Under the Spanish legal system, there is currently no specific regulatory framework or registration or recognition regime for decentralised autonomous organisations (DAOs). A DAO that operates exclusively through blockchain technology, without adopting a legally recognised legal form, is not considered an entity with its own legal personality under Spanish law. Consequently, a fully decentralised DAO cannot be classified as a commercial company or any other type of legal person. In practice, where several individuals organise themselves through a DAO without incorporating a legal entity, such a structure may be treated as a civil partnership, with the resulting assumption of personal and potentially unlimited liability by its participants in respect of the activities carried out and obligations incurred.

From a tax perspective, the Spanish Tax Agency has addressed this issue in binding ruling V2479-22, dated 1 December 2022, concerning the provision of services to a DAO. In that ruling, the Tax Agency concluded that such services must be invoiced applying the general VAT rate, on the grounds that the DAO lacks legal personality, a defined territorial location, and a tax identification number, as stated in the ruling.

Under Spanish law, cryptoassets are generally characterised as intangible property forming part of the debtor’s estate and, where they belong to the insolvent (whether an individual or a company), they are brought into the insolvency estate and subjected to the ordinary Spanish insolvency rules on inventory, realisation and distribution, without a bespoke statutory framework for “crypto insolvencies”.

Where wallets are held with an exchange‑type platform, the terms and conditions must be analysed in each case: if there is a true transfer of title to the platform, the cryptoassets form part of its estate and the user is treated merely as an unsecured insolvency creditor; if, conversely, the relationship is one of custody or deposit, the user may bring a vindicatory claim and keep the assets outside the platform’s insolvency estate.

As regards priority and security, cryptoassets are, in principle, subject to the general regime applicable to movable or incorporeal property: they may secure obligations (for example, by way of a pledge over private keys or over the client’s position vis‑à‑vis an exchange), provided that the usual requirements of specificity and, where applicable, publicity vis‑à‑vis third parties are met, although practical issues remain as to perfection, control over wallets and enforceability.

For realisation, the insolvency practitioner (or a foreign trustee seeking recognition in Spain) may use the standard liquidation tools: private sale on centralised markets, auction, or transfer as part of a business or asset package under a court‑approved liquidation plan, evidencing title and ensuring traceability of the blockchain transactions.

In terms of recovery tools, the usual insolvency and civil law mechanisms (avoidance actions, interim measures over wallets and exchange accounts, attachment and enforcement over cryptoassets, cross‑border cooperation and, in cases involving criminal conduct, coordination with asset recovery offices) are key to locating, preserving and monetising cryptoassets for the benefit of creditors.

Under Spanish law, smart contracts are, in principle, capable of being legally enforceable, not as a consequence of their technological form, but in so far as they are subsumable within the general system of contract law. Spanish law does not recognise smart contracts as an autonomous legal category. Rather, smart contracts are assessed through a functional and technologically neutral approach, whereby legal enforceability depends on whether the underlying arrangement satisfies the requirements for the existence and validity of a contract.

From a normative standpoint, Spanish law expressly recognises the legal effectiveness of contracts concluded by electronic means. Law 34/2002 on Information Society Services and Electronic Commerce (LSSI) establishes that contracts entered into electronically produce full legal effects, provided that the requirements for their validity are met. This rule operates in conjunction with the principle of freedom of form enshrined in Article 1278 of the Spanish Civil Code, pursuant to which contracts are binding in whatever form they are concluded, unless the law requires a specific form for their validity. Consequently, the fact that contractual terms are expressed and executed through computer code does not, per se, preclude their enforceability.

As with any contract under Spanish law, a smart contract must satisfy the essential elements set out in Article 1261 of the Civil Code: consent, object and cause.

A victim of crypto fraud in Spain can combine criminal and civil/insolvency routes: typically, by filing a criminal complaint for fraud or related offences and joining as a private prosecutor to seek compensation, while in parallel (or alternatively) pursuing civil claims for contractual and tortious liability or unjust enrichment, including against intermediaries such as exchanges where there is a sufficient legal and factual nexus.

In that context, Spanish courts may grant urgent interim relief, including orders to freeze bank accounts and crypto wallets, block balances held with exchanges active in Spain and preserve digital evidence, often supported by forensic tracing to link addresses and transactions to identifiable persons or service providers.

Spanish procedural law does not use common law terminology such as “freezing order” or “proprietary injunction”, but, in functional terms, a victim can obtain equivalent interim measures and third‑party disclosure, for example: court orders to exchanges or payment institutions to identify account holders and beneficiaries, to block or transfer crypto balances, and to disclose transaction histories, including via European Investigation Orders or letters rogatory where the platforms are abroad.

Service of claims and orders will generally follow the ordinary civil or criminal procedural rules (judicial notifications within Spain, and EU or international instruments for cross‑border service), and once a judgment is obtained, enforcement may target cryptoassets as attachable property: the court can require the debtor to disclose wallets and credentials, direct attachments to exchanges with a Spanish or EU presence, and, where possible, realise the assets through sale so as to convert them into fiat to satisfy the judgment.

In Spain, the taxation of cryptoassets is governed by the general tax rules, as there is no specific tax regime applicable to them. Nevertheless, the Spanish State Tax Agency has issued numerous binding rulings that shape the official administrative interpretation of the taxation of cryptoassets. For personal income tax purposes, gains derived from the exchange of cryptocurrencies are classified as capital gains, included in the savings tax base and taxed at the progressive rates currently in force (19%–30%). Where cryptoassets are received as consideration for mining activities, airdrops, or other similar arrangements, they are treated as income attributable to the general tax base, valued in euros at the time of receipt and subject to the applicable general tax rates (18%–44%). Companies operating with cryptoassets are subject to corporate income tax on the profits obtained at the general rate of 25%.

From a value added tax (VAT) perspective, exchanges between cryptoassets and fiat currency are, as a general rule, exempt from VAT. The use of cryptocurrencies as a means of payment in the acquisition of goods or services gives rise to VAT only on the goods or services supplied, and not on the cryptoasset itself. However, the recent binding ruling V0935-25, dated 27 May 2025, introduces an administrative criterion suggesting the potential application of indirect taxation to certain transfers of cryptoassets.

In addition, taxpayers are subject to significant reporting obligations. Spanish tax residents must declare gains derived from cryptoassets in their personal income tax return, report holdings of cryptocurrencies located abroad through Form 721 when the applicable thresholds are exceeded, and include cryptocurrencies in the wealth tax return, for which specific reporting boxes are provided. Likewise, cryptoasset service providers are required to report annually to the tax authorities on their customers’ balances and transactions through Forms 172 and 173.

Cryptoasset businesses in Spain must comply with Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights, as there is no crypto-specific privacy regime. Platforms that process users’ personal data are subject to the EU General Data Protection Regulation (GDPR) and the corresponding national legislation. They are required to implement appropriate measures to safeguard customer data, to process such data lawfully (for example, for KYC procedures required by law), and to respect data subjects’ rights, including protection against data breaches (such as hacking), unlawful disclosure to third parties, and the rights of erasure and/or rectification. Where a personal data breach occurs, the platform must notify the Spanish Data Protection Agency (AEPD) and the affected users, in accordance with the GDPR, and file the corresponding report with the competent law enforcement authorities.

With regard to cybersecurity, crypto platforms are expected to comply with general information security standards. Under EU legislation, as from January 2025, the Digital Operational Resilience Act (DORA) will apply to cryptoasset service providers, imposing requirements relating to ICT risk management, incident reporting, and operational resilience similar to those applicable to the financial sector. In the absence of sector-specific legislation, personal and transactional data are protected under these general data protection and cybersecurity frameworks.

Spain has not enacted specific regulations or legal definitions for activities like staking, yield farming, or other decentralised finance (DeFi) services. These activities are largely unregulated and are not explicitly classified as investment products or securities under Spanish law. In practice, if a staking or yield program has a central operator promising returns or pooling investors’ assets, authorities could consider it an investment activity subject to regulation. However, purely decentralised staking — where individuals interact directly with blockchain protocols without intermediaries — currently falls outside regulatory oversight.

There are no specific licensing or registration requirements for DeFi or staking platforms in Spain at present, aside from compliance with general laws (for example, anti-money laundering rules if applicable). Nor is there any special consumer protection for users of such services. Spanish regulators (CNMV and Bank of Spain) have warned that these services operate in a legal grey area, without the safeguards of regulated financial products. Future EU rules may address DeFi more explicitly, but for now these activities remain essentially unregulated.

There are several legal and regulatory initiatives in progress related to cryptoassets. MiCA applies from late 2025, and Spain has designated the CNMV to supervise the new licensing regime for crypto service providers under MiCA.

On the tax front, Spain is transposing the EU DAC8 Directive (to take effect in 2026) to require crypto service providers to report customers’ crypto holdings and transactions for tax purposes. This will significantly enhance tax transparency concerning cryptoassets.

Regulators are also examining currently unregulated areas. European authorities are discussing whether additional rules (a potential “MiCA 2”) are needed for decentralised finance (DeFi) and assets like NFTs. Additionally, the Bank of Spain and the European Central Bank are exploring a potential digital euro (central bank digital currency). Overall, further regulatory changes are expected as the cryptoasset landscape evolves.