Spain: Crypto, Digital Assets, and Financial Innovation

Spain's digital-asset regulatory environment moved on three distinct fronts this cycle. First, Spain's transitional period for legacy crypto-asset service providers under MiCA, Regulation (EU) 2023/1114, ended 1 July 2026, the same date across every EU Member State, meaning Spanish CASPs operating under grandfathered national authorisation must now hold full MiCA authorisation. Second, the CNMV's post-transition register stood at fifteen Spanish entities as of 2 October 2026: nine authorised crypto-asset service providers and six notified banks, giving a concrete snapshot of the newly authorised population. Third, and directly relevant to the integrity-architecture lens of this domain, Real Decreto 813/2026, published 8 October 2026 and effective 28 October 2026, removes the EUR 1,000 identification threshold for crypto-asset ATM operators, requiring identification of users regardless of transaction amount. This closes a previously exploitable low-value gap in a cash-to-crypto channel that integrity analysis treats as a structurally significant layering point, independent of any single enforcement incident.

Separately, the CNMV opened a consultation on 15 October 2026, closing 16 November 2026, on a draft circular extending its formal consumer-complaints procedure to clients of crypto-asset and crowdfunding service providers. This is a conduct and consumer-protection development rather than an AML measure, but it signals the regulator's broader intent to normalise crypto-asset activity within its existing institutional infrastructure rather than treating it as a standalone, lightly supervised category.

Outlook

The most consequential near-term date is 28 October 2026, when the RD 813/2026 crypto-ATM identification requirement takes effect; whether operators have built compliant identification flows by then will determine whether the threshold removal functions as intended or produces a compliance gap during a transition window. The CNMV's complaints-circular consultation, if adopted, is expected to take effect 20 days after BOE publication, extending investor-protection infrastructure to crypto clients on a timeline likely to fall in early 2027.