How a CASP authorisation is applied for in Spain

This is not legal advice. The page summarises articles of Regulation (EU) 2023/1114 and official pages. It does not assess a file, a legal form or whether an application will succeed. That belongs to the CNMV and to whoever advises the applicant.

Authorisation as a crypto-asset service provider, where the registered office is in Spain, is sought from the competent Spanish authority. The CNMV’s MiCA page says that, to provide crypto-asset services in the Union, the provider must be a legal person or other undertaking authorised under Article 63, or one of the financial entities Article 60 allows to provide those services by notification. The same page assigns provider authorisation to the CNMV or to another European authority. The map of home authorities is in MiCA licence by country. What the authorisation covers, once granted, is in the licence guide. Here is the skeleton of the application, not the form.

Article 59: do not provide services without authorisation

Article 59, in the EUR-Lex text, opens the authorisation chapter. A person shall not provide crypto-asset services in the Union unless they are a legal person or other undertaking authorised as a CASP under Article 63, or a credit institution, central securities depository, investment firm, market operator, electronic-money institution, UCITS management company or alternative investment fund manager allowed to provide those services under Article 60. A CASP authorised under Article 63 must have its registered office in a member state where it carries out at least part of its services, its place of effective management in the Union and at least one director resident in the Union. A person who is not a CASP must not use a name or a communication suggesting that it is one.

Article 60 is the notification route for those firms that already hold another authorisation. It is not the ordinary route for a company set up to be an exchange. That route is the Article 62 application.

Article 62: the application

Paragraph 1 says legal persons or other undertakings that intend to provide crypto-asset services submit their application to the competent authority of their home member state. For a CASP, home is the state of the registered office. If that office is in Spain, the authority is the one Spain has designated; the CNMV is the authority that explains this on the page linked above and the one named on ES-home rows in CASPS.csv.

Paragraph 2 lists the contents. They include, among other things, the legal and commercial name, the legal entity identifier, the website, an email, a telephone number and the physical address; the legal form; the articles of association where they exist; a programme of operations setting out the services to be provided and where and how they will be marketed; a description of governance, internal control and risk management; and information on the members of the management body and on shareholders with qualifying holdings, including the absence of a record that the article spells out. ESMA draws up implementing technical standards for the forms. This page does not reproduce that form. The one that counts is the one the authority publishes.

Article 63: completeness and the decision

Article 63 requires the authority to acknowledge receipt in writing promptly and in any event within five working days. Within twenty-five working days it assesses whether the application is complete by checking that the information in Article 62(2) has been submitted. If it is not, the authority sets a deadline for what is missing and may refuse to review an application that stays incomplete. Once it is complete, the authority notifies the applicant. Before granting or refusing, it consults other authorities in the group situations paragraph 5 lists, and it may consult the anti-money-laundering authorities.

Paragraph 9 gives forty working days from the complete application to assess whether the applicant complies with the Title and to adopt a reasoned decision granting or refusing authorisation, notified within five working days. Paragraph 10 requires refusal where there are objective and demonstrable grounds that the management body threatens sound management, that its members do not meet Article 68, that shareholders with qualifying holdings are not of sufficiently good repute, or that the applicant fails or is likely to fail the Title. During the assessment the authority may request further information, no later than the twentieth working day; the period is suspended until the reply, for at most twenty working days. Within two working days of a grant, the authority sends ESMA the register information. A new authorisation therefore does not appear on this site the same day: it appears when the file we read carries it.

After the decision

Granting the authorisation is not yet providing services in other countries. Article 65 requires the passport notification, set out in the passport guide. Adding services later is requested from the same authority, updating the Article 62 information, and is handled under Article 63. Withdrawal is Article 64: among other cases, not using the authorisation within twelve months, renouncing it, or not providing services for nine consecutive months. A provider whose authorisation is withdrawn must have procedures for the timely and orderly transfer of clients’ crypto-assets and funds to another provider.

A firm that was on the Law 10/2010 register has not, by that entry, filed this application. The register closed and was not this authorisation: the Bank of Spain register. A firm that relied on the transitional period has the 1 July 2026 boundary in the guide to that period. The services the application must name, letter by letter, are in CASP services.

Common questions