Since July 1, 2026, only firms authorized under Regulation (EU) 2023/1114, known as MiCA (Markets in Crypto-Assets), may provide crypto-asset services in Spain. That day marked the end of the transitional period that let providers already operating legally before December 30, 2024 keep serving clients, and the Bank of Spain closed its old register of virtual currency exchange and custody providers.
What MiCA Is and When It Applies
MiCA is Regulation (EU) 2023/1114 of the European Parliament and of the Council of May 31, 2023 on markets in crypto-assets. It applies directly in every Member State, with no need for national transposition. It was phased in:
| Date | What happens |
|---|---|
| June 30, 2024 | The titles on asset-referenced tokens and e-money tokens (stablecoins) apply. |
| December 30, 2024 | The rest of the regulation applies, including the authorization of crypto-asset service providers (CASPs). |
| July 1, 2026 | The Article 143(3) transitional period ends across the EU, Spain included. |
What the Transitional Period Was and Why It No Longer Protects Anyone
Article 143(3) of MiCA allowed providers that were serving clients under national law before December 30, 2024 to continue until July 1, 2026, or until they were granted or refused authorization, whichever came first. Each country could shorten that window; according to the Q&A published by the CNMV (Spain's securities market regulator), Spain kept the maximum period, until July 1, 2026.
In 2026, ESMA (the EU's securities markets authority) warned that from that date any firm providing crypto-asset services to EU clients without a MiCA license is in breach of EU law and must stop offering them. Being listed in the old Bank of Spain register, now kept only as a historical record, is not the same as MiCA authorization.
What Changes for You as an Exchange User
Using an authorized provider gives you access to MiCA's protection and supervision framework. The CNMV points out that anyone dealing with an unauthorized firm will not have that protection. The obligations MiCA places on crypto-asset service providers include, among others:
- Acting honestly, fairly and professionally in the client's best interest, giving fair, clear and not misleading information, and warning clients about the risks of crypto-asset transactions (Art. 66).
- Safeguarding clients' ownership rights over their crypto-assets and funds, especially in the event of insolvency, and preventing their use for the provider's own account (Art. 70). Providers that offer custody must also keep clients' crypto-assets segregated from their own, including legally (Art. 75(7)).
- Having effective and transparent complaint-handling procedures, free of charge for clients (Art. 71).
- Identifying, managing and disclosing conflicts of interest (Art. 72).
An authorization granted in one Member State also allows a provider to serve the rest of the EU through the so-called passport: the provider tells its home authority in which countries it wants to operate and may start once that authority confirms the notification or, at the latest, 15 calendar days after submitting it (Art. 65). That is why your exchange can be authorized in another country and still operate legally in Spain.
If you keep stablecoins on your exchange, note also that on October 8, 2026, ESMA published an opinion stating that authorized providers should not provide services in e-money tokens or asset-referenced tokens (so-called stablecoins) that do not comply with MiCA. For existing balances they may only offer, temporarily, selling, conversion, withdrawal, transfer or custody, and supervisors should require the situation to be remediated no later than three months after publication, that is, around January 8, 2027.
On complaints, on October 15, 2026, the CNMV opened a public consultation on a draft circular that would extend its complaints procedure to complaints against crypto-asset service providers; comments can be sent until November 16, 2026. In any case, the first step is the provider's own complaints procedure (Art. 71).
How to Check If Your Exchange Is Authorized
Under Article 59 of MiCA, these services may only be provided by firms authorized as crypto-asset service providers and by certain already-regulated entities (such as banks, investment firms or e-money institutions) that notify under Article 60. The CNMV recommends checking the ESMA and CNMV registers to confirm your provider holds the required authorization.
- Identify the legal entity. The platform's terms and conditions name the company that provides your service and its country. The brand name is not enough: one group may have several companies.
- Check ESMA's interim register. ESMA's MiCA page publishes the register of authorized CASPs (interim MiCA register), downloadable as a CSV file. Search for the company name or its LEI code and check its home country and authorized services.
- Review the countries served. The register shows in which Member States the provider has notified that it will offer services; make sure Spain is listed.
- Check the CNMV. Look up the firm in the CNMV list of crypto-asset service providers or its entity search, which also shows public warnings about unauthorized firms.
- If it does not appear, the CNMV says you should ask the firm for its migration plan and the options it offers.
What to Do If Your Provider Is Not Authorized
According to the CNMV statement of June 15, 2026, providers that did not obtain authorization had to have an effective migration plan: allowing clients to move their custodied crypto-assets to other addresses and their funds to cash accounts, with a reasonable withdrawal period. They may also agree to transfer clients to another authorized provider, which each client must accept and which requires going through identity verification again. Assets not withdrawn by the end of the period may be transferred to authorized firms, with notice to those affected.
If you hold balances on a platform in this situation, save your statements and transaction history before withdrawing: you will need them for your tax return and to prove the source of funds to a bank.
Practical Checklist
- I have identified the company that provides my service and its country.
- I have found it in ESMA's CASP register, with the services I use.
- Spain is among the countries where it provides services.
- I have checked that it does not appear in the CNMV warnings.
- I have downloaded statements and transaction history.
- If it is not authorized, I have requested its migration plan and know the withdrawal deadline.
Sources
- Regulation (EU) 2023/1114 (MiCA), EUR-Lex
- ESMA: Article 143, transitional measures
- ESMA: MiCA page and interim CASP register
- ESMA: statement on the end of transitional periods (2026)
- CNMV: list of crypto-asset service providers
- CNMV: entity search
- CNMV: MiCA questions and answers (in Spanish)
- CNMV: statement on the end of the transitional period, 06/15/2026 (in Spanish)
- Bank of Spain: note on the closure of the register (in Spanish)
- ESMA: opinion on non-MiCA-compliant stablecoins (October 8, 2026)
- CNMV: consultation on the draft complaints circular (October 15, 2026, in Spanish)
Disclaimer: this content is for information only and does not constitute legal, financial or tax advice. Always verify the information in the official registers and consult a professional about your specific situation.