CNMV MiCA supervision has become the new regulatory axis for any company wishing to operate as a crypto-asset service provider in Spain. And, although many companies focus solely on CASP registration, the truth is that supervision goes much further. It affects solvency, custody, corporate governance, technology, and operational conduct.
In this article, we clearly and practically review how this continuous supervision works, what the CNMV truly expects, and what CASPs must prepare to operate with legal certainty. We also explain how the technical work of Cryptoveritas 360 facilitates successful supervision through crypto architecture auditing, traceability, and custody.
The CNMV as the Central Supervisor under MiCA
With MiCA, the CNMV has transitioned from a peripheral observer to a regulator with full authority to authorize, review, and oversee CASPs. This change is significant: it represents a leap from a model based on voluntary registrations (such as for advertising) to a real and demanding supervision regime.
MiCA, approved by the European Parliament, stipulates that each Member State must designate a primary supervisor. In Spain, this responsibility falls to the CNMV, which also applies the technical guidelines issued by ESMA and the EBA.
In summary: the CNMV no longer observes; it supervises. And this supervision is dynamic: it adapts to the CASP’s size, operational risks, business model, and the robustness of its internal governance.
To better understand it, it is useful to divide the process into phases.
The Supervision Process for CASPs under MiCA: Step by Step
Phase 1: The CASP Registration Application to the CNMV
CASP registration marks the starting point. Far from being a simple formality, it consists of a complex, structured, and deeply technical application. The CNMV evaluates, among other aspects:
- Program of activities: clear description of crypto services, target markets, and operational structure.
- Minimum capital: between €50,000 and €150,000, depending on the type of service.
- Corporate governance: administrators, directors, significant shareholders, and their professional suitability.
- Operational risks: cybersecurity, market, external providers, technology.
- Custody: security, segregation, and internal processes.
- Anti-money laundering: AML/CFT policies, KYC, and transaction monitoring.
In practice, preparing a solid dossier usually requires months of coordination. Experience shows that dossiers integrating specialized legal advice with technical support — such as that from Cryptoveritas 360 — are more coherent, complete, and aligned with what the CNMV expects.
Phase 2: CNMV Evaluation and Resolution
Once the application is submitted, the CNMV has a maximum period of three months to issue a resolution, although this may be extended if the dossier is complex. During this period, the supervisor reviews each element in detail.
It is common to receive requests for additional information: clarifications, policy modifications, expanded documentation, or technical justifications. The suitability of administrators and shareholders is also analyzed, which includes reputation, experience, and financial capacity.
In cross-border cases, the CNMV coordinates its review with other European authorities, following the procedures defined by ESMA and the official technical documentation of MiCA available in the ESMA MiCA section.
Phase 3: Continuous Supervision and Regulatory Reporting
Authorization does not mark the end of the process, but the beginning of constant supervision. The CASP comes under permanent surveillance, which includes:
Periodic Reporting
- Financial reports: solvency, liquidity, audits.
- Operational reports: transaction volume, incidents, client activity.
- Compliance: AML/CFT controls, alerts, corrective measures.
The frequency varies according to the entity’s risk: it can be quarterly, annually, or even monthly.
On-site Inspections
The CNMV may conduct scheduled or unannounced on-site inspections. During these inspections, it reviews documentation, interviews employees, and analyzes the effectiveness of internal controls.
Remote Supervision
The CNMV also monitors the CASP’s operational data to detect risk patterns. For example, a sudden increase in transaction volume can trigger an alert.
Phase 4: External Audits and Certifications
MiCA requires CASPs to undergo periodic external audits. These audits are key to validating internal controls and the robustness of the technological architecture.
This is where Cryptoveritas 360 provides differential value: portfolio analysis, technical review of blockchain architecture, traceability, and verification of custody models.
How to Prepare for Efficient Supervision?
In our experience at IN DIEM Abogados, the best-prepared CASPs share common elements:
- Updated and realistic documentation: no generic templates.
- Aligned teams: legal, compliance, and technology speak the same language.
- Robust custody: segregation, fragmented keys, and documented recovery.
- Complete logs: accessible and traceable technical evidence.
- Live risk map: frequently reviewed and updated.
- External technical support: partners like Cryptoveritas 360 ensure that systems meet CNMV expectations.
The goal is not to pass supervision, but to turn it into a competitive advantage.
Ongoing Obligations under CNMV MiCA Supervision
Maintenance of Minimum Capital
CASPs must permanently maintain the capital required by MiCA. If it falls, the CNMV may demand a capital increase or even limit activities.
Segregation and Protection of Assets
The CNMV verifies that client assets are segregated, audited, and held with robust procedures. This point is especially critical for companies managing third-party funds or cryptocurrencies.
Client Transparency
Information must be clear, understandable, and not misleading. Contracts, fees, and risks must be explained without ambiguity.
Complaint Management
The CNMV reviews the quality of the internal complaint system. It’s not enough to have one; it must function effectively.
Regulatory Updates
MiCA evolves through RTS and ITS issued by ESMA and EBA. CASPs must update policies, processes, and systems as these technical standards advance.
Supervisión CNMV bajo MiCA
La CNMV actúa como autoridad competente en España para supervisar a los proveedores de servicios sobre criptoactivos bajo el Reglamento MiCA.
Solicitud de registro CASP
Presentación del expediente completo ante la CNMV.
- Programa de actividades.
- Capital mínimo desembolsado.
- Gobierno corporativo y compliance AML/CFT.
Evaluación y resolución
Análisis de la solicitud por parte del supervisor.
- Revisión documental.
- Requerimientos adicionales.
- Evaluación de idoneidad y resolución motivada.
Supervisión continua
Control permanente del cumplimiento normativo.
- Reporting periódico.
- Inspecciones y supervisión remota.
- Monitorización de riesgos y gobierno corporativo.
Auditorías externas
Verificaciones independientes y controles periódicos.
- Auditoría financiera y de controles internos.
- Revisión de cumplimiento normativo.
- Informes periódicos a la CNMV.
¿Necesitas obtener tu licencia CASP?
IN DIEM Abogados y Cryptoveritas 360 pueden ayudarte a preparar el expediente jurídico, técnico y regulatorio.
Consulta con expertosPreguntas frecuentes sobre supervisión CNMV, MiCA y CASP
¿Qué es la supervisión CNMV MiCA?
La supervisión CNMV MiCA es el control continuo que ejerce la Comisión Nacional del Mercado de Valores sobre los proveedores de servicios de criptoactivos autorizados bajo el Reglamento MiCA. No se limita a la autorización inicial, sino que alcanza al funcionamiento permanente del CASP, su gobierno corporativo, controles internos, custodia, reporting, tecnología y cumplimiento normativo.
¿Es obligatorio el registro CASP para operar en España?
Sí. Para prestar servicios de criptoactivos en España bajo el marco MiCA es necesario contar con la correspondiente autorización como CASP cuando la actividad encaje dentro de los servicios regulados. Operar sin autorización puede implicar riesgos regulatorios, sancionadores y reputacionales.
¿Qué revisa la CNMV antes de autorizar a un CASP?
La CNMV puede revisar el programa de actividades, el capital mínimo, la idoneidad de administradores y accionistas significativos, los controles internos, la política de custodia, la prevención de blanqueo de capitales, la gestión de riesgos, la tecnología utilizada y la capacidad operativa real de la entidad solicitante.
¿La autorización CASP termina con la resolución favorable?
No. La autorización es solo el inicio de una relación supervisora continua. Una vez autorizado, el CASP debe mantener sus requisitos, actualizar documentación, cumplir obligaciones de reporting, comunicar incidencias relevantes y permitir la revisión de sus sistemas, procesos y controles internos.
¿Qué sucede si un CASP incumple?
Si un CASP incumple sus obligaciones, la CNMV puede adoptar medidas supervisoras o sancionadoras, incluyendo requerimientos de corrección, limitación o suspensión de actividades, revocación de la autorización, medidas cautelares o sanciones, según la gravedad del incumplimiento y el caso concreto.
¿Puede un CASP operar en toda la Unión Europea tras ser autorizado en España?
Sí. El Reglamento MiCA prevé un sistema de pasaporte europeo que permite a un CASP autorizado en un Estado miembro prestar servicios en otros Estados de la Unión Europea, siempre que se cumplan los requisitos de notificación y las condiciones regulatorias aplicables.
¿Qué obligaciones de reporting tiene un CASP bajo MiCA?
Las obligaciones de reporting pueden incluir información financiera, operativa, de riesgos, incidencias, controles AML/CFT, actividad de clientes, custodia y cumplimiento. Su alcance concreto depende del tipo de servicio prestado, el tamaño de la entidad, su perfil de riesgo y los criterios técnicos aplicables.
¿Por qué es importante auditar la custodia de criptoactivos?
La custodia es uno de los puntos más sensibles en la supervisión de un CASP. Debe acreditarse la segregación de activos de clientes, la seguridad de las claves, los procedimientos de acceso, la trazabilidad, los planes de recuperación y la existencia de controles técnicos adecuados para proteger los criptoactivos gestionados.
¿Qué papel tienen ESMA y EBA en la supervisión MiCA?
ESMA y EBA desarrollan criterios, guías y estándares técnicos que ayudan a concretar la aplicación práctica de MiCA. Estos documentos son relevantes para preparar expedientes, adaptar políticas internas y anticipar las expectativas de supervisión que pueden aplicar las autoridades nacionales, incluida la CNMV.
¿Cómo ayudan IN DIEM Abogados y Cryptoveritas 360?
IN DIEM Abogados y Cryptoveritas 360 ofrecen acompañamiento integral en materia jurídica, técnica, de custodia y arquitectura blockchain. Esto incluye análisis regulatorio, preparación documental, revisión de modelos CASP, auditoría de trazabilidad, evaluación de riesgos, soporte técnico y adaptación del proyecto a las exigencias de MiCA y de la CNMV.
Keep in mind…
CNMV MiCA supervision is not a mere formality: it is a thorough oversight system that demands documentary coherence, robust technology, and updated policies. Those who prepare well can operate with legal certainty and competitiveness.
If your company needs to obtain a CASP license, prepare a technical audit, or strengthen its compliance, contact IN DIEM Abogados. We work together with Cryptoveritas 360 to cover all the requirements demanded by the CNMV.
How can we help you?
At IN DIEM Abogados, we understand that the process of registering as a crypto-asset service provider (CASP) with the CNMV can seem complex, especially if your company combines legal, financial, and technological components.
That’s why we have designed comprehensive support that unites legal strategy, regulatory compliance, and specialized technical support through our collaboration with Cryptoveritas 360.
Here’s how we can help you at each stage of the journey:
- Initial assessment and MiCA diagnosis.
We analyze your business model, the type of services you provide, and regulatory viability according to the MiCA Regulation. We identify the exact type of license you need and the associated legal or technical risks. - Preparation of the dossier for the CNMV.
We draft and adapt all required documents: articles of association, business plan, AML/CFT manuals, organizational structure, security policies, and governance. We ensure everything complies with CNMV standards. - Interlocution with the regulator.
We act as the point of contact with the CNMV during the review and rectification process, reducing timelines and avoiding errors that could delay approval. - Technical advice and auditing.
Through Cryptoveritas 360, we verify your technological systems, blockchain security, wallet custody, traceability, and compliance audits. Legal and technical aspects are integrated into a single workflow. - Continuous compliance and training.
Once the license is obtained, we help you maintain it with periodic audits, employee training, and constant updates to your MiCA and AML policies.
Lawyers Specializing in Cryptocurrencies: Málaga, Seville, Madrid, Las Palmas de Gran Canaria, Almería, Huelva, Marbella, Estepona…
At IN DIEM Abogados and Cryptoveritas 360 we provide our services at all our offices and locations in Spain, offering direct and personalized coverage in Madrid, Seville, Málaga, Marbella, Las Palmas de Gran Canaria, as well as continuous service through our digital channels for clients throughout the country.
Our multidisciplinary team also advises international companies—including Europe, Latin America and Asia—that wish to establish or expand in Spain under the MiCA regulatory framework, whether through obtaining the CASP license from the CNMV or the incorporation of companies and compliance structures adapted to the European market.
Thanks to a hybrid working methodology (in-person and online), we guarantee the same level of quality, confidentiality and efficiency for both local and foreign clients, supporting each project from initial planning to effective regulatory authorization.
Did you know that Abogados IN DIEM offers online and expedited services?
We offer our clients the option of receiving assistance via video call or videoconference, as well as by phone, depending on their preference, so that the assistance is as personalized as possible, provided immediately, and without the need to travel. This service is complemented by communication via email, which facilitates the review and delivery of documentation.
In addition, for businesses and individuals, IN DIEM Abogados offers urgent services and 24-hour support for matters that require a quick response.
Anything else about IN DIEM Lawyers? Here’s a short presentation video…
To acknowledge some of you, here’s this link.
You can find us in Seville, Madrid, Las Palmas de Gran Canaria, Málaga, Tomares, Coria del Río, Dos Hermanas, Mairena del Alcor, Estepona, Marbella, and Mairena del Aljarafe. We look forward to serving you.
