Ultimate Guide to Obtaining the CASP License from the CNMV (MiCA 2025)

2025 marks a before and after in the European crypto ecosystem. With the entry into force of the MiCA Regulation (Markets in Crypto-Assets), the European Union establishes for the first time a homogeneous legal framework regulating crypto-asset service providers (CASPs).

In Spain, the Comisión Nacional del Mercado de Valores (CNMV) will be the authority responsible for authorizing and supervising companies wishing to operate legally in this new environment.

Obtaining the CASP license from the CNMV is the essential step for exchanges, custodians, tokenization platforms, fintechs, and family offices that wish to offer crypto-asset related services with full legal certainty and access to the European market.

Moreover, obtaining CASP registration provides significant advantages for crypto sector providers, as it strengthens the suitability of resources, structure, cybersecurity, and platform legality. This accreditation, recognized in the European Union and globally, often translates into tangible competitive advantages.

In this practical guide prepared by IN DIEM Abogados, with the technical support of Cryptoveritas 360, we explain how to obtain your CASP license step by step, what requirements the CNMV demands, and why Spain is consolidating its position as one of Europe’s leading regulatory hubs.

What is a CASP and why do you need to register?

The term CASP (Crypto-Asset Service Provider) encompasses any legal entity that, on behalf of third parties, offers services related to crypto-assets (such as Bitcoin, Ethereum, USDC, BUSD, Solana, etc.). In essence, they are regulated and supervised intermediaries in the crypto ecosystem.

According to Article 3 of the MiCA Regulation (Regulation (EU) 2023/1114), CASPs include those who provide, among others:

• Custody and Administration of Crypto-Assets: Storing clients’ private keys on their behalf (like an exchange that holds your cryptocurrencies).
• Operation of a Trading Platform: Serving as an exchange or platform where users buy and sell crypto-assets.
• Exchange of Crypto-Assets for Legal Tender: Serving as an exchange house (for example, exchanging euros for Bitcoin).
• Execution of Orders on Behalf of Third Parties: Operating on behalf of a client.
• Advice on Crypto-Assets.
• Placement of Crypto-Assets: Managing initial coin or token offerings.

The key importance of being a CASP lies in regulation. Under frameworks like MiCA, these companies obtain a license or authorization from a national supervisor in the European Union, which implies compliance with strict requirements for capital, corporate governance, IT security, and consumer protection.

In other words: if your company manages, custodies, or intermediates third-party digital assets, you need CNMV authorization to continue operating within the MiCA framework.

Having the CASP license offers clear advantages:

• European recognition (MiCA passport): a single authorization allows operation across the entire EU.
• Credibility and trust: your clients will know that you meet transparency and security standards.
• Access to institutional investors and banks.
• Reduction of legal and reputational risk.

The MiCA legal framework in Spain

The MiCA Regulation was published in the Official Journal of the European Union on June 9, 2023, and began its progressive rollout in 2024.

As of June 2025, all CASPs must be authorized.

In Spain, the CNMV will act as the competent authority for most CASP activities, while the Bank of Spain will supervise the issuance of stablecoins or asset-referenced tokens (ARTs and EMTs).

You can consult official information on the CNMV website (especially in the Crypto-Asset Service Providers section).

The CNMV has published guiding documents and forms for registration.
The process involves demonstrating economic solvency, effective governance, and adequate compliance policies (AML/CFT).

This combination of legal control and technological flexibility makes Spain a strategic point for operating across the EU: a stable legal environment, solid financial infrastructure, and a natural connection with Latin America.

Key requirements for obtaining the CASP license

Requirements vary depending on the type of service provided, but the CNMV requires all applicants to comply with the following fundamental areas:

Minimum capital

Between €50,000 and €150,000, depending on the type of activity (custody, exchange, advisory, etc.).

It must be proven that the share capital is fully paid up and unencumbered.

Organizational structure and governance

Appointment of a management body with demonstrable financial or technological experience.

• Implementation of internal risk control, audit, and business continuity policies.
• Appointment of a Compliance Officer.

AML/CFT Policies

The applicant must demonstrate effective mechanisms for preventing money laundering and terrorist financing, in accordance with Law 10/2010 and European directives.

Here, it is essential to have specific manuals adapted to the crypto business.

Business plan and viability

Must include 3-year financial projections, risk analysis, revenue structure, and description of the technological model.

The CNMV particularly reviews the consistency between the projected volume of operations and available resources.

Technical solvency and cybersecurity

The authority requires guarantees regarding the security of infrastructures and the protection of client funds. Cryptoveritas 360, a technical partner, validates the technological architecture, smart contract audits, and cybersecurity plans.

Step-by-step processes with the CNMV

The path to the CASP license can be summarized in six phases:

Step 1: Initial assessment

Analysis of the type of activity, scope of services, and determination of the applicable regulatory model.

In this phase, IN DIEM performs a free MiCA assessment to evaluate viability.

Step 2: Document preparation

Drafting and review of:

• Articles of association and minutes.
• AML/CFT manuals and internal policies.
• Organizational chart and executive profiles.
• Business plan and projections.
• Description of the technological platform and security measures.

Step 3: Submission to the CNMV

The complete dossier is submitted digitally. The CNMV confirms receipt and may request initial clarifications.

Step 4: Review and rectification

Over the following weeks or months, the CNMV evaluates the documentation, requests amendments, and conducts technical interviews if necessary.

Step 5: Resolution and registration

Once the application is approved, the entity becomes part of the Public Register of Crypto-Asset Service Providers, available on the CNMV website.

Step 6: Ongoing compliance

Once the license is obtained, the CASP must keep its policies updated, submit periodic reports, and undergo audits.

Here, IN DIEM and Cryptoveritas 360 offer a compliance as a service, with annual legal and technological monitoring.

AML/CFT processes and technological security

Anti-money laundering (AML) and technological security are the two pillars of compliance under MiCA.

It’s not enough to have a manual: you have to demonstrate that the procedures work.

Prevention and control

• Client identification and verification (KYC).
• Transactional monitoring.
• Reporting suspicious transactions to SEPBLAC.
• Internal staff training.

Cybersecurity

The MiCA Regulation requires platforms to guarantee the security of keys, wallets, and personal data. Indeed, for the CNMV to grant CASP authorization, the applicant company must have a solid risk management framework, where cybersecurity is an essential component, with a comprehensive approach.

In this regard, the Crypto Service Provider must have robust security policies and procedures, secure technological systems, cyber risk management systems, incident response protocols, regular audits, etc.

Cryptoveritas 360 conducts periodic system and smart contract audits to detect vulnerabilities and certify compliance with the regulator.

Common mistakes and how to avoid them

1. Generic AML manual: copying banking models without adapting them to the crypto business.
2. Lack of consistency between business plan and actual resources.
3. Failure to clearly identify services provided (e.g., mixing custody and advisory without functional separation).
4. Underestimating deadlines. The process usually takes between 4 and 9 months.
5. Neglecting the technological aspect: the CNMV values the resilience of systems as much as legal compliance.

Spain as a MiCA regulatory hub

Spain is positioned as one of the most attractive jurisdictions for registering a CASP for several reasons:

• Clear regulatory environment and CNMV–Bank of Spain coordination.
• Access to the Latin American market thanks to language and trade agreements.
• Growing fintech and blockchain ecosystem (Madrid, Barcelona, Málaga Tech Park).
• Competitive tax regime for tech startups.

Indeed, Spain has stood out for its proactive and clear regulation, with strong and recognized supervisors, as well as a growing Fintech ecosystem, which has also led to initial success that has attracted major players.

According to data from the CNMV’s Public Register, Spain already has dozens of registered CASPs, both national and international.

Not to forget

The CASP Registration with the CNMV is not just a legal obligation: it is a strategic opportunity to position yourself in the European crypto market under a regulated and secure framework.

With the support of IN DIEM Abogados, experts in commercial and regulatory law, and the technical assistance of Cryptoveritas 360, specializing in blockchain auditing and cybersecurity, the process becomes a structured, predictable, and efficient experience.

How can we help you?

At IN DIEM Abogados, we understand that the process of registering as a crypto-asset service provider (CASP) with the CNMV can seem complex, especially if your company combines legal, financial, and technological components.

That’s why we have designed comprehensive support that unites legal strategy, regulatory compliance, and specialized technical support through our collaboration with Cryptoveritas 360.

Here’s how we can help you at each stage of the journey:

1. Initial assessment and MiCA diagnosis.
   We analyze your business model, the type of services you provide, and regulatory viability according to the MiCA Regulation. We identify the exact type of license you need and the associated legal or technical risks.
2. Preparation of the dossier for the CNMV.
   We draft and adapt all required documents: articles of association, business plan, AML/CFT manuals, organizational structure, security policies, and governance. We ensure everything complies with CNMV standards.
3. Interlocution with the regulator.
   We act as the point of contact with the CNMV during the review and rectification process, reducing timelines and avoiding errors that could delay approval.
4. Technical advice and auditing.
   Through Cryptoveritas 360, we verify your technological systems, blockchain security, wallet custody, traceability, and compliance audits. Legal and technical aspects are integrated into a single workflow.
5. Continuous compliance and training.
   Once the license is obtained, we help you maintain it with periodic audits, employee training, and constant updates to your MiCA and AML policies.

In summary, we transform compliance into a growth tool: a solid and well-managed CASP license not only allows you to operate legally but also to attract investors, partners, and clients with the confidence offered by a registered and supervised firm.

👉 If you are considering starting your application or want to review your current documentation, contact us for guidance without obligation.

Publications on Companies in our blog

Expert Cryptocurrency Lawyers: Málaga, Seville, Madrid, Las Palmas de Gran Canaria, Almería, Huelva, Marbella, Estepona,…

At IN DIEM Abogados and Cryptoveritas 360 we provide our services at all our offices and locations in Spain, offering direct and personalized coverage in Madrid, Seville, Málaga, Marbella, Las Palmas de Gran Canaria, as well as continuous service through our digital channels for clients throughout the country.

Our multidisciplinary team also advises international companies—including Europe, Latin America and Asia—that wish to establish or expand in Spain under the MiCA regulatory framework, whether through obtaining the CASP license from the CNMV or the incorporation of companies and compliance structures adapted to the European market.

Thanks to a hybrid working methodology (in-person and online), we guarantee the same level of quality, confidentiality and efficiency for both local and foreign clients, supporting each project from initial planning to effective regulatory authorization.

We are at your disposal for anything you need. You can reach us via IN DIEM Lawyers Phone (+34) 916 353 892. For urgent cases, you can contact us on IN DIEM 24-Hour Emergency Lawyers Phone: (+34) 610 667 452.

Did you know that IN DIEM Abogados offers an online service and an urgent service?

We offer our clients the option of being assisted via video call or videoconference, as well as by telephone, according to our clients’ preference, so that the assistance is as personal as possible, with absolute immediacy, without the need to travel. This service is complemented by communication via email, which facilitates the analysis and delivery of documentation.

Likewise, we offer urgent and 24-hour services for our companies, handling national and international contracting operations.

For more information on the Online Legal Advisory Service HERE, the 24-hour and Urgent Service, HERE, and some recognitions, we leave you this link.

Anything else about IN DIEM Lawyers? Here’s a short presentation video…

You will find us in Seville, Madrid, Las Palmas de Gran Canaria, Málaga, Huelva, Punta Umbría, Tomares, Coria del Río, Dos Hermanas, Mairena del Alcor, Estepona, Marbella, Mairena del Aljarafe… it will be a pleasure to serve you…!!