Spain ES

For a jurisdiction whose crypto-asset regulatory perimeter has been under construction since MiCA's phased entry into force, Spain's 1 July 2026 CASP-transition closure is the defining event of this cycle. CNMV confirmed that only CNMV- or other-EU-authorised crypto-asset service providers may now operate in Spain; the pre-MiCA legacy VASP registration regime run through Banco de España since 2021, which had functioned as an AML-driven registration route independent of full MiCA licensing, is now transitional and legacy rather than a standalone path to market. This is a structural narrowing of the unsupervised or partially-supervised population of crypto-asset firms in Spain: entities that previously operated on AML registration alone must now hold full CASP authorisation to continue.

The practical effect is a consolidation of AML/CFT supervisory responsibility for crypto firms under the MiCA authorisation architecture, rather than the legacy Banco de España AML-registration track running in parallel to it. Firms operating without CASP authorisation after the deadline are, on the CNMV's own communication, outside the lawful perimeter entirely — this is a jurisdiction-wide market-access event with direct AML consequence, since firms outside the authorised perimeter are also outside its AML supervisory net.

Layered onto this closure is Spain's DAC8 implementation, which entered force on 1 January 2026 and requires crypto-asset service providers to automatically report user transaction, balance and asset-movement data to Agencia Tributaria with no minimum-value threshold. This obligation is tax-transparency in character rather than AML/CFT in character, but the two regimes now sit side by side for the same population of newly-consolidated CASPs: one supervisory and AML-oriented (CNMV authorisation), one tax-transparency oriented (Agencia Tributaria reporting), with the first DAC8 transmission cycle expected in 2027. This DAC8 finding is sourced this cycle to a single Tier-1 document and corroborated only by lower-tier press, so it is carried at probable rather than confirmed confidence pending fuller corroboration.

Underneath both developments sits Spain's standing FATF assessment: 28 Compliant and 10 Largely Compliant of the FATF's 40 Recommendations, with Spain not appearing on the FATF strategic-deficiencies list. This is unchanged this cycle and functions as descriptive baseline context for the broader AML/CTF regime within which the crypto-specific narrowing occurs, rather than a crypto-specific finding in its own right.

Outlook

The principal unresolved question is what happens to Spanish entities that relied solely on the legacy Banco de España AML registration and did not secure CNMV CASP authorisation ahead of the 1 July 2026 deadline. Wind-down mechanics, any grace period, and CNMV's enforcement posture toward residual unauthorised activity are not established this cycle and represent a genuine coverage gap rather than a confirmed absence of activity. The first DAC8 transmission cycle in 2027 will be the first practical test of the threshold-free reporting mechanism's operation, and will merit close tracking given the overlapping-but-distinct nature of the AML and tax-transparency obligations now applying to the same population of authorised CASPs.