Spain CNMV CASP Authorisation 2026 — Practitioner Guide

Why Spain CNMV is one of the more active EU CASP supervisors

Spain ran one of the largest pre-MiCA crypto-asset service-provider registers in the EU through the Banco de España — driven by retail demand, a thriving fintech sector in Madrid and Barcelona, and a regulator that engaged with the industry rather than pushed it offshore. When MiCA took effect on 30 December 2024 and the CASP regime turned on, supervision shifted to the CNMV. Spain’s transitional regime — set by Royal Decree-Law 7/2025 — gave pre-existing providers a year to convert their registrations into a granted CASP authorisation.

The conversion pipeline kept the CNMV busy through 2025 and into 2026. The agency stood up a dedicated MiCA team within its Markets directorate and published its Spanish-language application guide in early 2025. By mid-2026 the steady-state regime is the live pathway — new entrants file fresh CASP applications against the standard five-month statutory clock.

The CNMV’s substance overlay

MiCA Article 68 sets the floor for substance — actual presence in the EU, an effective management body, fit-and-proper assessment. The CNMV layers Spanish supervisory practice on top of that floor. From observed application outcomes through 2025 the working expectations are:

• At least one senior manager — typically the CEO or the head of compliance — resident in Spain and reachable for unannounced supervisory contact
• The registered office in Spain (not merely a postal address; the CNMV asks for the lease and floor plan)
• A Spanish-speaking compliance contact, fluent enough to engage in supervisory dialogue without an interpreter
• Local AML/CFT documentation in Spanish, signed by an MLRO whose appointment SEPBLAC has acknowledged

These are not bright-line statutory rules; they are the working expectations of the CNMV’s authorisation team based on its application of MiCA Article 68 and Spanish administrative practice. Files that lack them tend to receive an information request asking for them.

The five-month MiCA clock starts when the file is complete

MiCA Article 63 gives the CNMV three working days to acknowledge a filing as complete, then five months from that confirmation to grant or refuse. In Spanish practice the clock does not start ticking until the CNMV’s pre-screen confirms the dossier is in order — and the pre-screen often produces an information request that resets the timeline. The dossier components the CNMV’s checklist asks for include:

• Programme of operations covering the next three years
• Description of governance arrangements, business continuity plan, ICT risk-management procedures
• AML/CFT manual, sanctions screening procedures, MLRO appointment
• Description of the prudential capital position with auditor confirmation
• Description of safeguarding arrangements for client funds and client crypto-assets
• Internal controls, including conflicts of interest policy and complaints-handling procedure

The complete-file pre-screen typically takes two to four weeks. Add Spanish translation on the front end and supervisor dialogue on the back, and a realistic end-to-end timeline is six to nine months for a clean first-time application.

What changes after authorisation

A granted CNMV authorisation grants the EU passport. The CASP can notify the CNMV of cross-border services into any other EU member state and begin operating in the host market 15 working days after the CNMV forwards the notification — the standard MiCA Article 65 mechanism. The CNMV is the home supervisor for the CASP’s prudential, governance, and conduct supervision; host AML supervisors continue to engage with the CASP for activity in their territory.

For Spanish-headquartered CASPs the CNMV joins ESMA’s supervisory college for any cross-border service operations that grow large enough — the criteria for “significant CASP” designation under MiCA Article 85 trigger ESMA co-supervision rather than CNMV-only supervision. That threshold is around 15 million active users — territory only the largest cross-border platforms approach.

When the CNMV is the right home supervisor

Spain is a strong fit for CASPs whose customer base is Spanish or Latin American, who want a credit-institution-grade regulator close to a major fintech ecosystem, and who have the budget for Spanish-language operational presence. It is a poor fit if the goal is to file the lightest-touch authorisation possible — the CNMV is not the most permissive supervisor in the EU and Spanish substance is not free.

For a buyer thinking about EU CASP choice in 2026: Spain is in the second tier of MiCA jurisdictions by application volume and processing speed, comparable with France (AMF) and the Netherlands (AFM), behind Lithuania, Estonia, and Cyprus in raw throughput but ahead in supervisory reputation and bank-access ease for Spanish-resident customers.