What is a CASP and why should you register?

IMPORTANT: This article was drafted in accordance with the regulatory framework in effect at the time of its publication, specifically Regulation (EU) 2023/1114 (MiCA), the applicable Spanish regulations on cryptoassets, and the CNMV’s supervisory criteria. Given that the authorization and supervision regime for cryptoasset service providers, transitional periods, technical requirements, AML/CFT obligations, and administrative criteria are subject to change, each specific case must be reviewed in accordance with current regulations and the actual activities carried out by the company or platform.

The regulation of crypto-assets in Spain is no longer unclear territory. Since the entry into force of Law 7/2021 and the application of the European MiCA Regulation, the CNMV has the authority to sanction—and is doing so—those who operate without proper authorization.

In this new scenario, if you are engaged—or plan to engage—in activities related to crypto-assets, this concept affects you directly. It is not an administrative formality. Operating without CASP registration entails administrative, criminal, and reputational risks that can sink any crypto project, no matter how promising. Thus, understanding the process is essential.

In this article, we explain what a CASP is, who is required to register, what the process with the CNMV entails, and what real benefits you gain by complying with the regulations. Our experience at IN DIEM working with dozens of companies in the sector—and with the technical support of Cryptoveritas 360—allows us to offer you a practical perspective.

What is a CASP?

CASP stands for Crypto-Asset Service Provider. According to the CNMV, a CASP is any natural or legal person who professionally provides one or more services related to crypto-assets to third parties in Spanish territory.

In other words, the concept encompasses any company—large or small—that provides any service linked to digital assets. And it includes more activities than many imagine.

What activities make a company a CASP?

Among the most common:

• Exchange of crypto-assets for fiat money or for other crypto-assets
• Custody of keys or wallets on behalf of third parties
• Management of platforms for buying, selling, or trading
• Transfer of crypto-assets on behalf of clients
• Advisory or execution of orders related to crypto-assets
• ICOs, IEOs, or other token issuances
• Staking services or financial services linked to digital assets
• Placement of crypto-assets or proprietary operations when directed to third parties

If you perform any of these activities—even partially—you are a CASP under MiCA. And if you are, the CNMV requires you to register and comply with specific legal, financial, and technical requirements.

What is NOT a CASP

These activities are outside the registration obligation:

• Individual or professional mining (if you do not provide services to third parties)
• Personal holding of crypto-assets without commercial activity
• Open-source software development without associated service directed to third parties
• Proprietary trading without external clients
• R&D activities without commercialization of services

Many companies believe they are off the radar, but by offering additional services—such as custody—they automatically fall into the CASP category. Here, coordination between specialized lawyers like IN DIEM and technical auditors like Cryptoveritas 360 is key.

Why the CASP concept is key today: MiCA and the CNMV

MiCA (Markets in Crypto-Assets Regulation), the new European Regulation on crypto-asset markets, unifies for the first time the legal framework across all Member States. Its progressive application between 2024 and 2025 marks a turning point.

Its two major contributions are:

1. Exhaustively defines what a CASP is and what requirements it must meet
2. Requires companies to register and submit to continuous supervision

The CNMV as supervisor in Spain

In Spain, the CNMV is the authority responsible for authorizing and supervising CASPs.

It evaluates whether:

• You meet the legal, organizational, and technical requirements
• You have effective anti-money laundering policies
• You have adequate internal controls for your business model
• You can provide additional information when requested
• Your management team has the necessary integrity and experience
• Your technological systems are robust and secure

If you are not sure whether you meet the requirements, this article is for you.

Why should you register as a CASP?

Even if you think it does not apply to you or you can postpone it, registering is crucial for reasons that go beyond regulatory compliance.

Because it’s required

The CNMV requires registration if you provide crypto services included in MiCA. Failing to do so entails:

• Significant financial penalties: From tens of thousands to millions of euros, depending on business volume
• Immediate suspension of activity through administrative orders
• Irreversible loss of reputation once the sanction is made public
• Critical difficulties in opening or maintaining bank accounts
• Problems with serious providers who require regulatory compliance

Because it protects your business and your customers

Registration ensures that:

• You have solid internal policies that prevent future problems
• You proactively manage operational and technological risks
• You have secure systems that protect your clients’ assets
• You comply with AML/CFT, avoiding more serious sanctions
• You offer complaint mechanisms that generate trust

In a sector where reputation is everything, this is essential.

Because it boosts your credibility with partners, customers, and investors

Registration is not just a formality: it is a protective shield that ensures:

• Institutional investors who previously avoided you now consider you
• Traditional financial institutions open their doors
• Top-tier technology providers prioritize your access
• B2B clients require the CNMV seal to collaborate
• Public administrations include you in their tenders

In a sector where reputation is everything, this is not an expense: it is the best marketing investment you can make.

Risks of not registering as a CASP

Operating without registration when you should have it is not just an administrative infraction: it is an existential threat to your business.

1. Legal Risk

• Significant fines based on your turnover
• Possible criminal offense if you raise funds without authorization
• Personal liability of directors

2. Reputational Risk

• CNMV sanctions are public and immediately visible
• Loss of trust from existing clients
• Inability to attract new informed clients

3. Operational Risk

• Greater likelihood of technological failures due to lack of controls
• Security incidents not detected in time
• Operational losses due to inadequate processes

4. Commercial Risk

• Banks and providers block or limit services
• Loss of the European passport for expansion
• Exclusion from marketplaces and associated platforms

5. Strategic Risk

• Your competitors who do comply gain competitive advantage
• You are left out of major market opportunities
• Inability to scale in an orderly and secure manner

Real benefits of registering as a CASP

1. Operational legal certainty

You know exactly what you can do and under what conditions. You make business decisions with legal certainty, not with fear.

2. Stability to grow with confidence

You can scale and open new business lines with regulatory backing. Investors fund growth, not uncertainty.

3. Market trust that translates into revenue

The CNMV seal increases your credibility and allows you to compete on equal terms with established players.

4. Immediate European expansion with MiCA

Spanish registration allows you to operate in all 27 EU countries through the “European passport.” Your potential market multiplies by 27.

5. Sustainable competitive advantage

It protects you from unregulated competitors who will disappear from the market. You are part of the solution, not the problem.

6. Better internal processes that save costs

The CNMV requires you to professionalize your organization, eliminating inefficiencies and reducing costly errors.

7. Access to multiplying strategic alliances

Financial and technological partners prioritize registered companies, offering you preferential terms.

The registration process: What to expect and how to prepare

CASP registration is not a simple form: it is a rigorous process that typically takes 3 to 6 months and requires:

Critical documentation:

• Descriptive report of the business model
• Operational and compliance procedure manuals
• Corporate governance and risk management policies
• Detailed technical description of systems and security
• Business plan and financial projections
• Due diligence of directors and shareholders

Key requirements:

• Minimum capital appropriate to the volume and risk of activities
• Professional liability insurance or equivalent own resources
• Robust technological systems with independent audits
• AML/CFT procedures specific to crypto-assets

Checklist: Are you a CASP and do you need registration?

Answer yes or no to these critical questions:

• Do you offer crypto-asset custody services to third parties?
• Do you manage a crypto-asset exchange platform?
• Do you execute buy/sell orders for clients?
• Do you offer professional advisory services on crypto-assets?
• Do you manage crypto-asset portfolios for investors?
• Do you organize or promote token issuances?
• Do you offer staking or lending services to third parties?

If you answered YES to any: You are very likely a CASP under MiCA and need to begin your registration process.

How does IN DIEM accompany you throughout the CASP registration process?

At IN DIEM Abogados, we understand that the process of registering as a crypto-asset service provider (CASP) with the CNMV can seem complex, especially if your company combines legal, financial, and technological components.

That’s why we have designed comprehensive support that unites legal strategy, regulatory compliance, and specialized technical support through our collaboration with Cryptoveritas 360.

Here’s how we can help you at each stage of the journey:

1. Initial assessment and MiCA diagnosis.
   We analyze your business model, the type of services you provide, and regulatory viability according to the MiCA Regulation. We identify the exact type of license you need and the associated legal or technical risks.
2. Preparation of the dossier for the CNMV.
   We draft and adapt all required documents: articles of association, business plan, AML/CFT manuals, organizational structure, security policies, and governance. We ensure everything complies with CNMV standards.
3. Interlocution with the regulator.
   We act as the point of contact with the CNMV during the review and rectification process, reducing timelines and avoiding errors that could delay approval.
4. Technical advice and auditing.
   Through Cryptoveritas 360, we verify your technological systems, blockchain security, wallet custody, traceability, and compliance audits. Legal and technical aspects are integrated into a single workflow.
5. Continuous compliance and training.
   Once the license is obtained, we help you maintain it with periodic audits, employee training, and constant updates to your MiCA and AML policies.

You will not be alone before the CNMV. You will have an expert team at every step.

Expert Cryptocurrency Lawyers: Málaga, Seville, Madrid, Las Palmas de Gran Canaria, Almería, Huelva, Marbella, Estepona,…

At IN DIEM Abogados and Cryptoveritas 360 we provide our services at all our offices and locations in Spain, offering direct and personalized coverage in Madrid, Seville, Málaga, Marbella, Las Palmas de Gran Canaria, as well as continuous service through our digital channels for clients throughout the country.

Our multidisciplinary team also advises international companies—including Europe, Latin America and Asia—that wish to establish or expand in Spain under the MiCA regulatory framework, whether through obtaining the CASP license from the CNMV or the incorporation of companies and compliance structures adapted to the European market.

Thanks to a hybrid working methodology (in-person and online), we guarantee the same level of quality, confidentiality and efficiency for both local and foreign clients, supporting each project from initial planning to effective regulatory authorization.

Anything else about IN DIEM Lawyers? Here’s a short presentation video…

To acknowledge some of you, here’s this link.

You can find us in Seville, Madrid, Las Palmas de Gran Canaria, Málaga, Tomares, Coria del Río, Dos Hermanas, Mairena del Alcor, Estepona, Marbella, and Mairena del Aljarafe. We look forward to serving you.