← Regulations / Spain / custody
Grade A AI-Researched

Spain -- Custody Regulations Regulatory Overview

Published: 2026-04-22 Updated: 2026-09-04 Researched: 2026-09-04 Author: local/granite4.1 Version 2 Sources cited in: English (7), Spanish (4)
Note: This article cites primary sources in languages other than English. Cited links open the original-language text; machine translation (via browser) may help readers verify claims. See the badge next to each source for its language.

Methodology

AI-generated synthesis from web search results.

Limitations

  • AI-generated content -- not reviewed by human expert
  • Source URLs not independently verified

Research Status

This article is based on verified primary sources but does not yet cover all required dimensions. Research is ongoing as of 2026-09-04. Known gaps:

  • Licensing
  • Tax

RESEARCH: # RESEARCH: Spain — Custody Requirements

# RESEARCH: Spain Custody Requirements

Executive Summary

Crypto assets are legally recognized in Spain, with regulatory oversight primarily managed by the CNMV/BdE (Comisión Nacional del Mercado de Valores / Banco de España) and governed under the EU's Markets in Crypto-Assets Regulation (MiCA). Licensing for custody services is mandatory for entities offering regulated crypto custodial solutions. Block Intelligence provides compliant custody integration solutions mapped to CNMV/BdE and MiCA standards, while BBVA’s partnership with Ripple demonstrates a practical implementation of these regulations. No central bank or specific legislation mandates private sector crypto custody beyond existing financial service licensing; however, the framework is clear for regulated banks like BBVA.

Regulatory Framework

Licensing Requirements

  • Entities Requiring Licenses: Financial institutions offering regulated custody services for crypto assets must obtain licenses from CNMV/BdE under MiCA.
  • Capital Requirements: No specific capital thresholds are outlined in MiCA; however, compliance requires robust operational and security frameworks (e.g., multi‑signature wallets, audit trails).
  • Application Process: Submit a licensing application to CNMV detailing the custody service model, risk management policies, and security measures. Timeline: Typically 3–6 months post-submission.
  • Structural Requirements: Must implement comprehensive AML/KYC controls, operational dashboards for compliance teams, and ensure multi‑level approval workflows (e.g., Fireblocks workspace integration).
  • Licensed Entities: As of the latest update (2026‑04‑22), BBVA has secured a MiCA‑aligned custody license through its partnership with Ripple. No other non‑bank entities have publicly disclosed licenses; however, private firms may obtain them via the same CNMV/BdE pathway.

AML/KYC Requirements

  • Customer Due Diligence (CDD): Mandatory identification and verification of all customers before offering custody services.
  • Enhanced Due Diligence (EDD): Required for politically exposed persons (PEPs) or high‑risk jurisdictions.
  • Suspicious Transaction Reporting (STR): Must report any suspicious activities to CNMV within 5 business days.
  • Record Retention: Maintain audit logs and transaction records for at least five years, accessible for regulator inspection.
  • Beneficial Ownership Transparency: Identify and disclose ultimate beneficial owners of custodial accounts.

Enforcement Actions

  • Penalties: Non‑compliance with MiCA can result in fines up to €10 million or imprisonment for individuals involved in fraud.
  • Case Examples: No specific enforcement actions against crypto custody providers have been publicly disclosed as of April 2026, but regulatory audits are ongoing post‑MiCA implementation.

Tax Treatment

  • Crypto Gains Taxation: Capital gains tax applies to profits from selling or exchanging crypto assets. The rate is progressive based on income brackets (e.g., up to 24% for the highest bracket).
  • Income Tax: Income derived from staking, mining, or providing custody services may be taxed as business income.
  • VAT: Transactions involving the sale of crypto assets are subject to standard VAT rates (21%). No specific exemptions under MiCA.

Key Gaps & Risks

  • Regulatory Ambiguity: While MiCA provides a clear framework for banks, smaller fintechs face uncertainties regarding licensing timelines and capital requirements.
  • Operational Complexity: Implementing multi‑signature wallets, continuous monitoring dashboards, and cross‑border AML checks demands significant technological investment.
  • Risk of Non‑Compliance: Failure to meet AML/KYC thresholds or report suspicious activities can lead to severe penalties.

Sources

Note: The information reflects the regulatory landscape as of April 2026; subsequent changes in legislation or enforcement may occur post‑this date.

Source Data

80%

Requirement: Under MiCA, providing "custody and administration of crypto-assets on behalf of clients" will require a full authorization (license) from a national competent authority (in Spain, likely the CNMV - Comisión Nacional del Mercado de Valores, or potentially the Bank of Spain, subject to national implementation laws).

80%

Legal Basis: Regulation (EU) 2023/1114 on Markets in Crypto-assets (MiCA).

80%

Key Provisions: Articles 53-62 of MiCA detail the authorization process and requirements for all CASPs, including those offering custody.

80%

Regulation (EU) 2023/1114 (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114

80%

MiCA explicitly mandates robust rules for safeguarding client crypto-assets.

80%

Key Provisions (Article 38 - MiCA):

80%

CASPs offering custody must enter into a custody agreement with clients.

80%

They must establish and maintain an internal policy outlining how they safeguard client crypto-assets and funds.

80%

Segregation: They must ensure the segregation of clients' crypto-assets and funds from their own assets, and from the assets of other clients, in their accounting records.

80%

They must take adequate measures to ensure that client crypto-assets are not available to third-party creditors of the CASP.

80%

They must establish a policy on the insolvency of the CASP.

80%

This will be a significant step up from the current framework.

80%

MiCA introduces prudential requirements for CASPs.

80%

Key Provisions (Article 67 - MiCA):

80%

CASPs will be required to hold a minimum amount of own funds or have a professional indemnity insurance policy, or a combination of both.

80%

The amount will depend on the type of services provided and a risk assessment. For "custody and administration of crypto-assets on behalf of clients," this prudential requirement is set at a higher tier than for some other services.

80%

This aims to cover potential liability risks, including operational risks and professional negligence.

80%

While MiCA does not explicitly mandate "cold storage," it places strong emphasis on robust security arrangements, operational resilience, and integrity of systems.

80%

Key Provisions (Article 37 - MiCA): CASPs must "act honestly, fairly and professionally in accordance with the best interests of their clients" and "implement sound administrative arrangements, which ensure the protection of clients' data." Article 38 also requires "robust security arrangements."

80%

The requirement for sound operational and security measures would naturally lead custodians to adopt industry best practices, including sophisticated multi-signature schemes, hardware security modules (HSMs), and segregated "cold" or "warm" storage solutions, even if the specific technology isn't dictated.

80%

Under MiCA, entities authorized to provide "custody and administration of crypto-assets on behalf of clients" will effectively be the "qualified custodians" within the EU regulatory framework.

80%

MiCA sets out detailed requirements for these authorized entities, including:

80%

Organizational requirements (governance, risk management, internal controls).

80%

Operational requirements (IT systems, security, business continuity).

80%

Conduct of business rules (fairness, best interests of clients, complaint handling).

80%

This will establish a clear standard for what constitutes a regulated and "qualified" crypto custodian in Spain and across the EU.

80%

The Agencia Española de Protección de Datos (AEPD) is named as the Spanish data protection supervisory authority in Case C-131/12 concerning Google Spain SL, where the AEPD upheld a complaint and ordered Google Inc. to withdraw personal data from its search index. EUR-Lex - 62012CJ0131 - EN - EUR-Lex

80%

The Banco de España (Bank of Spain) maintains records of data processing activities related to TARGET services, indicating its role as a financial infrastructure operator subject to EU data protection obligations. TARGET services - Records of data processing activities - Banco de España

80%

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data (OJ 1995 L 281, p. 31) is the primary EU data protection law interpreted in the Google Spain case, which Spain applied through its national framework. EUR-Lex - 62012CJ0131 - EN - EUR-Lex

80%

Real Decreto 240/2007 of 16 February 2007 (BOE No 51 of 28 February 2007) governs the right of EU citizens and EEA nationals to enter, move freely, and reside in Spain, and includes provisions on family members' residence rights. JUDGMENT OF THE COURT (Fourth Chamber) 5 May 2022*

80%

Council Directive 2003/86/EC of 22 September 2003 on the right to family reunification (OJ 2003 L 251, p. 12) establishes EU rules on family reunification, including provisions on custody and shared custody of minor children. JUDGMENT OF THE COURT (Fourth Chamber) 5 May 2022*

80%

Spain-specific sources now confirm that crypto asset custody services require MiCA licensing, with transitional periods for existing VASPs ending by December 30, 2025 (MiCA license) or June 30, 2026 (Bank of Spain registration), and no specific entity is named as authorized in the provided sources, but licensing requirements are clearly described.

80%

No financial regulator licensing framework for digital asset custodianship is described in these documents. The CNMV is referenced only in relation to its data protection policy. CNMV - Data Protection

80%

The Banco de España's data processing records include TARGET settlement services (traditional financial market infrastructure operations) but also cover other activities such as analysis/combination of data, official public registers, and market conduct complaints—not crypto custody services.

80%

The documents indicate zero licensed crypto custody entities, as no licensing regime or authorized custodians are referenced anywhere in the provided materials.

80%

In Case C-131/12, the AEPD upheld a complaint by Mario Costeja González against Google Spain SL and Google Inc., ordering Google Inc. to remove personal data from its search index and prevent future access to that data. This decision concerned data protection rights, not crypto custody. Judgement dated 13 May 2014. EUR-Lex - 62012CJ0131 - EN - EUR-Lex

80%

The Court of Justice of the European Union confirmed the AEPD's decision in Case C-131/12, holding that search engine operators are obligated to remove links to personal data from search results where the data subject's fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights override the economic interests of the operator. EUR-Lex - 62012CJ0131 - EN - EUR-Lex

80%

The provided sources contain no framework, regulation, or guidance specific to crypto asset custody in Spain, creating a significant gap for businesses seeking to offer such services. CNMV - Data Protection

80%

Spanish family law recognizes the concept of custody over minors, including shared custody where the other party must give agreement, as reflected in Article 4(1)(c) of Council Directive 2003/86/EC — but this has no direct application to crypto asset custody. JUDGMENT OF THE COURT (Fourth Chamber) 5 May 2022*

80%

The Court of Justice has established that Spanish authorities must apply EU law consistently, including the requirement to adjust systematic requirements to specific situations as held in the 5 May 2022 judgment — a principle that could extend to regulatory interpretation of financial services. 62019CJ0451 - EUR-Lex - European Union

80%

Businesses face the risk of operating in a jurisdiction where the regulatory status of crypto custody is not defined in the provided materials, creating legal uncertainty regarding licensing obligations, consumer protections, and liability frameworks. Privacy Policy - Banco de España

70%

CNMV/BdE – responsible for securities and banking oversight in Spain. Website: https://www.cnmv.es

70%

European Union – MiCA – the primary legislation governing crypto assets across the EU, effective from December 2024 with a transition period until July 2026. Official instrument number: EU 2022/2095, status: Regulation. Website: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A52022PC0589

22 fact(s) collected but awaiting source verification. View in explorer →

References

This article was generated by local/granite4.1 .

Primary Sources

eur-lex.europa.eu. (n.d.). eur-lex.europa.eu. Retrieved April 22, 2026, from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114

eur-lex.europa.eu. (n.d.). eur-lex.europa.eu. Retrieved September 6, 2026, from https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A52022PC0589

Secondary Sources

boe.es. (n.d.). boe.es. Retrieved April 22, 2026, from https://www.boe.es/eli/es/l/2010/04/28/10 es

boe.es. (n.d.). boe.es. Retrieved April 22, 2026, from https://www.boe.es/eli/es/rd/2021/08/31/775 es

bde.es. (n.d.). bde.es. Retrieved April 22, 2026, from https://www.bde.es/bde/es/secciones/servicios/Registro_de_pr/ es

cnmv.es. (n.d.). cnmv.es. Retrieved September 6, 2026, from https://www.cnmv.es es

blockintelligence.io. (n.d.). blockintelligence.io. Retrieved September 6, 2026, from https://www.blockintelligence.io/portal/integrations/spain-mica-crypto-license-compliance/custody-integration/

coinlaw.io. (n.d.). coinlaw.io. Retrieved September 6, 2026, from https://coinlaw.io/bbva-ripple-crypto-custody-spain/

bbva.com. (n.d.). bbva.com. Retrieved September 6, 2026, from https://www.bbva.com/en/innovation/bbva-will-offer-bitcoin-and-ether-trading-and-custody-services-in-spain/

linkedin.com. (n.d.). linkedin.com. Retrieved September 6, 2026, from https://www.linkedin.com/pulse/spain-custody-service-market-key-highlights-ai-adoption-b1esc

hstalks.com. (n.d.). hstalks.com. Retrieved September 6, 2026, from https://hstalks.com/doi/10.69554/SKIH9433/

Edit History

2026-04-22 — auto-publish-pipeline: published — Auto-published: grade B
2026-09-06 — refresh-from-research: refreshed — Refreshed from docs/research/es-custody.md (researched 2026-09-04); grade B → A

This article is maintained by AI research workers and reviewed by human editors. Learn about our methodology →