Portugal CMVM CASP Authorisation 2026 — Practitioner Guide

The CMVM steps into a regulator role for crypto

Portugal entered the MiCA era with a sizeable pre-existing crypto-asset service-provider register operated by the Banco de Portugal. The register was AML-only — it satisfied the EU’s 5AMLD obligation to capture crypto-asset business but did not impose substantive conduct or prudential requirements. The result was a relatively low compliance bar and a friendly perception among crypto-asset businesses choosing an EU home.

MiCA brought that arrangement to an end for new entrants. Law 27/2024 designated the CMVM — the securities market regulator — as the national competent authority for CASP authorisation, prudential supervision, and conduct supervision. The Banco de Portugal retained AML supervisory responsibility, recognising the register infrastructure already in place and the BdP’s role as the broader AML supervisor.

The two-supervisor model is not unique to Portugal — Spain operates the same split between CNMV (markets) and SEPBLAC (AML) — but it does require careful coordination on the application file. CASPs file the authorisation dossier with the CMVM but include a separate AML programme that the Banco de Portugal reviews.

The transitional period and what it changed

Entities on the Banco de Portugal VASP register at the MiCA application date had 12 months to file a CASP authorisation application with the CMVM. The transitional window ran from 30 December 2024 to 30 December 2025. Providers that did not file by the end of the window lost the right to keep operating without a granted CASP authorisation.

The transition was not automatic. A BdP register entry conferred no presumption of CMVM authorisation. The same governance, ICT, prudential, AML, and consumer-protection documentation expected of a fresh applicant was expected of a transitioning entity. The benefit of the transitional regime was operational continuity, not application-file relief.

By mid-2026 the transitional regime is closed and the CMVM is in steady-state mode. New entrants file fresh CASP applications.

What the CMVM looks for

The CMVM has been clear in its public communications about the application standards it applies. The recurring themes from supervisory publications and observed application outcomes through 2025:

Governance maturity. A management body sized for the scale of the planned business, with documented fit-and-proper assessments. Independent directors expected at higher file sizes (broadly above EUR 10 million projected annual revenue). Three-lines-of-defence framework with independent compliance and internal audit functions.

Substance in Portugal. Real presence — registered office in Portugal (not a postal address), at least one senior manager resident in Portugal, Portuguese-speaking compliance contact. The CMVM has been explicit that “letterbox” arrangements are not acceptable.

ICT and operational resilience. Documented ICT risk-management framework consistent with DORA expectations. Business continuity plan tested. Cybersecurity controls documented and demonstrably effective.

Consumer protection in Portuguese. Client-facing communication in Portuguese for any service marketed to Portuguese clients. Marketing-communications compliance aligned with MiCA Article 7 and the CMVM’s broader consumer-protection guidance.

AML programme. Designed for review by the Banco de Portugal but coordinated with the CMVM’s overall supervisory view. MLRO appointed, BdP register entry maintained, KYC and transaction-monitoring tooling adequate for the planned customer base.

The five-month clock in Portuguese practice

The MiCA Article 63 five-month clock starts when the CMVM confirms the application file is complete. Confirmation typically takes three to four weeks after first submission — the pre-screen pass is rigorous. Information requests during the pre-screen do not start the clock; they extend the pre-screen period.

Once the clock starts, the CMVM uses the full statutory period for medium-to-large files. Smaller files for Class 1 or limited Class 2 service sets sometimes complete in three to four months. Class 3 trading-platform files routinely use the full five months.

A realistic end-to-end timeline for a clean first-time file:

• Pre-filing preparation including Portuguese translation: 6-10 weeks
• Pre-screen and information-request cycle: 4-8 weeks
• Active clock period: 16-22 weeks
• Decision and onboarding to the supervisory regime: 2-4 weeks

Six to eight months end-to-end is a reasonable working assumption.

Tax — the headline that needs updating

Portugal’s crypto-asset tax regime was famously unconditional for individuals through 2022 — 0% capital gains tax on crypto-asset disposals. The 2023 reform brought Portugal into line with other EU member states by imposing a holding-period rule:

• Crypto-asset capital gains for individuals held more than 365 days: 0% tax
• Held less than 365 days: 28% flat rate (the standard Portuguese investment-income rate)
• Crypto-asset business income for individuals: progressive PIT scale, up to 48%
• Corporate income tax: 21% standard rate; reduced rates available under the Madeira IBC regime for qualifying activity with substance

The regime remains attractive for buy-and-hold individuals but is no longer the unconditional zero-tax jurisdiction it was. For corporate CASPs the operating tax position is standard EU.

When Portugal is the right home supervisor

Portugal is a strong fit for CASPs with a Portuguese-speaking customer base (Portugal plus Brazil and lusophone Africa via passport limitations), for businesses that value being in a smaller EU jurisdiction with direct CMVM access, and for individuals planning to relocate under the favourable holding-period tax treatment. It is well-suited to mid-sized CASPs that want supervisor responsiveness alongside professional rigour.

Portugal is a weaker fit if the goal is the absolute lightest-touch EU authorisation — the CMVM is a serious markets regulator and the substance requirements are real. CASPs prioritising minimum cost and fastest authorisation typically look to Lithuania or Estonia instead.