Passporting Across the EU From a Spain CNMV Licence
Once the CNMV grants CASP authorisation under Article 62 MiCA, a firm wishing to provide services cross-border submits a passporting notification to the CNMV under Article 65(1). That notification must specify the host member states targeted, the exact crypto-asset services to be offered in each, and the intended start date. No separate application to the host regulator is required — the passport is a notification mechanism, not a second authorisation.
Under Article 65(2), the CNMV then forwards the complete notification to the single points of contact of each host NCA, to ESMA, and to EBA within 15 working days of receipt. Only after the CNMV has communicated that forwarding to the CASP — which it must do without delay under Article 65(3) — may the firm begin providing services in the host member state. The operative trigger is the date of that CNMV communication to the CASP, not the date the firm submitted its notification. A firm that treats its own submission date as day zero risks providing services in a host jurisdiction before that host NCA has been informed — a material compliance breach. Host NCAs are notified, not consulted; they cannot block or delay the passport.
The passport covers only those services explicitly authorised by the CNMV. A CNMV licence scoped to custody and exchange cannot be passported to include portfolio management unless CNMV has authorised that service on the home licence. The geographic reach extends beyond the EU's 27 member states: Norway, Iceland, and Liechtenstein are covered as EEA contracting parties. For a full treatment of notification mechanics, scope limitations, and host-NCA obligations, see our MiCA CASP EU passporting guide. Firms that already hold a CNMV licence and are evaluating multi-market rollout should map their intended service scope against Annex IV class before filing — passporting a narrower scope than the home authorisation is permitted; passporting a broader one is not.
Total Cost Estimate and Pre-Application Readiness Checklist
Cost planning for a Spanish CASP licence requires separating one-time application costs from ongoing compliance infrastructure. On the capital side, the floor is set by MiCA Annex IV and Article 67: €50,000 for firms offering only advisory, portfolio management, order reception and transmission, order execution, placing, or transfer services (Class 1); €125,000 once custody, administration, or crypto-to-fiat/crypto-to-crypto exchange is added (Class 2); €150,000 for operating a trading platform (Class 3). These are minimums — if 25% of projected fixed overheads (the Fixed Overheads Requirement under Article 67) exceeds the Annex IV floor, the higher figure applies. Early-stage firms with lean cost bases typically find the Annex IV floor controls; scaling firms with significant staffing costs should model both tests. Legal and advisory fees for a full-scope application — covering the Article 62 dossier, AML/CFT policies, governance documentation, DORA ICT risk framework, and SEPBLAC interface — typically run €40,000–€100,000 depending on complexity and whether external counsel drafts in Spanish from scratch. Ongoing compliance costs add materially: a local compliance officer, a designated AML officer for SEPBLAC reporting, Travel Rule counterparty infrastructure, and DAC8 tax reporting systems (mandatory in Spain from 1 January 2026) all carry recurring costs. For a lean exchange model in its first year, a realistic total-cost range is €200,000–€400,000 — indicative, not a quote.
Before submitting to the CNMV, confirm each item on this readiness checklist:
- Spanish legal entity incorporated (S.A. or S.L.)
- Initial capital on deposit and confirmed against Annex IV class and the 25% FOH test
- Annex IV service class documented and consistent with intended licence scope
- Management team assessed for fitness and propriety under
Article 81 MiCA - AML/CFT policy drafted; SEPBLAC registration plan confirmed
- DORA ICT risk documentation prepared (
Regulation (EU) 2022/2554) - DAC8 reporting infrastructure scoped and vendor engaged
- Travel Rule counterparty testing initiated (
Regulation (EU) 2023/1113) - Full application dossier drafted in Spanish and reviewed against
Commission Delegated Regulation (EU) 2025/305
Gaps in any of these areas are among the most common reasons CNMV dossiers are returned incomplete. For the failure modes that derail applications before they reach substantive review, see the seven biggest MiCA compliance mistakes. For DORA-specific ICT obligations that now apply to authorised CASPs, see our DORA compliance guide for CASPs.
Frequently asked questions
Who is the competent authority for CASP licensing in Spain under MiCA?
The CNMV (Comisión Nacional del Mercado de Valores) is Spain's designated NCA for authorising and supervising CASPs under MiCA. The Banco de España supervises EMT and ART issuers. The Banco de España closed its pre-MiCA VASP registry to new applications on 30 December 2024; its register is now a historical record only.
Can a firm that was never on the Banco de España registry still use Spain's transitional period?
Yes, with conditions. Firms that provided services such as portfolio management or investment advice — which were never required to register with Banco de España — may still benefit from the transitional period running to 1 July 2026, but only if they can document through evidence that they were actively providing those services before 30 December 2024. The CNMV has explicitly clarified this position.
What is the minimum capital required to get a CASP licence in Spain?
Under MiCA Article 67 and Annex IV, the required own funds equal the higher of the Annex IV fixed minimum or 25% of fixed overheads. The Annex IV floor is €50,000 for firms offering only advice, portfolio management, RTO, execution, placing, or transfer services (Class 1); €125,000 if the firm also offers custody/administration or crypto-exchange services (Class 2); and €150,000 for operating a trading platform (Class 3). In practice, most operationally active firms will find the 25% FOH test exceeds the Annex IV floor.
How long does the CNMV take to process a CASP authorisation application?
MiCA sets a 25-working-day completeness check and a 60-working-day review period from the date the application is deemed complete. In practice, Q&A rounds extend total processing to 6–9 months for well-prepared files. The CNMV has scaled its crypto unit and processes at a steady cadence, broadly in line with Malta and Cyprus.
How does EU passporting work after receiving a CNMV licence?
Once authorised, the CASP notifies CNMV under Article 65(1) listing host member states and services. CNMV must forward that notification to host NCA single points of contact, ESMA, and EBA within 10 working days (Article 65(2)). CNMV then notifies the CASP of the communication. The CASP may begin operating in host member states from the date it receives that notification, or at the latest from the 15th calendar day after it submitted its notification to CNMV — whichever is earlier. Host NCAs are informed, not asked: they cannot block passporting. The passport covers all 27 EU member states plus Norway, Iceland, and Liechtenstein (EEA).
Does Spain's CASP licence cover DAC8 tax reporting obligations?
No — DAC8 is a separate obligation from MiCA authorisation. Spain transposed DAC8 (Council Directive 2023/2226) effective 1 January 2026, requiring CASPs to automatically report user transaction data (sales, exchanges, transfers — no minimum threshold) to the Agencia Tributaria. MiCA authorisation does not satisfy DAC8; CASPs need a dedicated reporting infrastructure running in parallel.