Portugal crypto license 2026 — CMVM CASP authorisation
Portugal positioned itself early as a crypto-friendly EU jurisdiction under a light Banco de Portugal VASP register. MiCA changed that: the CMVM now authorises and supervises CASPs with investment-firm-style rigour, while Banco de Portugal keeps AML oversight. The 12-month VASP transition closed end-2025.
Why the CMVM, not the Banco de Portugal, now grants the licence
Portugal entered the MiCA era with a sizeable crypto-asset service-provider register already run by the Banco de Portugal. That register was AML-only — it satisfied the EU obligation to capture crypto-asset business but imposed no substantive conduct or prudential requirements, which is exactly why Portugal read as a friendly, low-friction EU home for a while. Law 27/2024 ended that for new entrants by designating the CMVM, the securities market regulator, as the competent authority for CASP authorisation, prudential supervision, and conduct supervision.
The Banco de Portugal kept AML supervision, recognising the register infrastructure it already had in place. So Portugal runs a two-supervisor model: a CASP files the authorisation dossier with the CMVM but includes a separate AML programme that the Banco de Portugal reviews. It is not unique — Spain splits the same way between its markets and AML authorities — but it does demand careful coordination on a single file.
The transition closed, and the substance bar is real
Entities on the Banco de Portugal VASP register had a 12-month transitional window to file a CASP authorisation application with the CMVM, and that window closed at the end of 2025. The transition was never automatic: a register entry conferred no presumption of CMVM authorisation, and a transitioning entity had to produce the same governance, ICT, prudential, AML, and consumer-protection documentation as a fresh applicant. By mid-2026 the transitional regime is closed and the CMVM is in steady state, with new entrants filing fresh applications.
The substance expectation is not a formality. The CMVM wants a registered office in Portugal rather than a postal address, at least one senior manager resident in Portugal, and a Portuguese-speaking compliance contact, and it has been explicit that letterbox arrangements are not acceptable. That is the trade-off: Portugal offers a responsive, professional markets regulator and direct CMVM access, but it is not the lightest-touch EU route — CASPs chasing minimum cost and fastest authorisation tend to look elsewhere.
Reading the five-month clock correctly
The MiCA Article 63 five-month clock does not start when you submit — it starts when the CMVM confirms the file is complete, and confirmation typically takes three to four weeks after first submission because the pre-screen is rigorous. Information requests during the pre-screen do not start the clock; they extend the pre-screen. Smaller Class 1 or limited Class 2 files sometimes finish in three to four months, while Class 3 trading-platform files routinely use the full five. Add Portuguese translation time up front, and six to eight months end-to-end is a reasonable working assumption for a clean first-time file.
Portugal's CASP authorisation is the licence granted by the Comissão do Mercado de Valores Mobiliários (CMVM) under MiCA Regulation (EU) 2023/1114 (Articles 59 and 63), transposed into Portuguese law by Law 27/2024, to crypto-asset service providers established in Portugal or serving Portuguese clients.
Fast facts
| Parameter | Value |
|---|---|
| Competent authority | Comissão do Mercado de Valores Mobiliários (CMVM), Lisbon |
| AML supervisor | Banco de Portugal — AML supervision retained on the existing register infrastructure |
| Legal basis | MiCA Regulation (EU) 2023/1114 + Law 27/2024 + Decree-Law 486/99 amendments |
| Initial capital | €50,000 / €125,000 / €150,000 by Class 1 / 2 / 3 service set, MiCA Annex IV |
| Statutory clock | Five months from a complete file to decision under MiCA Article 63 |
| VASP-to-CASP transition | Pre-MiCA Banco de Portugal register entities had 12 months to file with the CMVM — window closed end-2025 |
| Application language | Portuguese required for the formal file; English working translations accepted for supporting documents |
Top counsel for Portugal CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented Portugal engagement, regardless of where they are headquartered.
Frequently asked questions about Portugal CASP authorisation
Who supervises CASPs in Portugal under MiCA?
The CMVM is the national competent authority for CASP authorisation and for prudential and conduct supervision. The Banco de Portugal continues to supervise AML/CFT for crypto-asset service providers under the existing register-based framework.
Did Banco de Portugal's VASP register stay in force after MiCA?
It stayed in force for AML purposes but stopped being the authorisation regime. Register entities had a 12-month transitional window from MiCA application to file a CASP authorisation dossier with the CMVM; that window closed at the end of 2025.
How long does CMVM CASP authorisation take in practice?
Six to eight months end-to-end for a clean first-time file. The MiCA Article 63 five-month clock starts only when the dossier is complete; the pre-screen typically takes three to four weeks before the clock begins, plus supervisory dialogue.
What is the minimum capital for a Portuguese CASP?
The MiCA Annex IV floors apply: roughly €50,000 for Class 1, €125,000 for Class 2, and €150,000 for Class 3, depending on the service set.
Pitfalls and nuances in Portugal
1 Confusing the AML register with regulatory authorisation
Portugal's pre-MiCA Banco de Portugal register was an AML registration only. It did not authorise an entity to provide regulated crypto-asset services the way MiCA conceives them. The CASP authorisation under MiCA is a substantive licence with conduct, prudential, and consumer-protection obligations — a different category of permission.
2 Underestimating the CMVM's investment-firm-style expectations
The CMVM has supervised the Portuguese securities market for decades, and it brings that MiFID supervisory experience to CASP files — formal governance structures, independent directors expected for larger files, internal-audit charters, three-lines-of-defence frameworks. The bar is higher than the pre-MiCA register asked for.
3 Filing in English with the CMVM
The CMVM reads English at a working level, but the formal application file must be filed in Portuguese. Articles of association, internal policies, the AML manual, and the ICT risk-management framework all need certified Portuguese translations — a workflow that typically takes four to six weeks for a substantial file.
Practitioners in Portugal
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Portugal. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in Portugal is Comissão do Mercado de Valores Mobiliários (CMVM). The legal basis is MiCA Regulation (EU) 2023/1114, transposed in Portugal via Law 27/2024 amending Decree-Law 486/99 and the Banking Companies General Regime. Visit www.cmvm.pt/pt/AreadoInvestidor/Pages/MiCA.aspx for the regulator's official guidance, application forms, and supervisory expectations.