Crypto Country GuideCrypto rules and tax, country by country

Portugal: regulation

Last reviewed: October 2026

On this page
  1. Legal status and supervision
    1. The end of the old registration
  2. Exchanges and KYC
  3. Stablecoins
  4. Crypto ATMs
  5. Scams and where to report them
  6. Self-custody
  7. Sources
  • Banco de Portugal authorizes crypto-asset service providers and supervises stablecoin issuers; the CMVM supervises offers of other crypto-assets, market abuse and part of the conduct rules.
  • The transitional regime for firms registered with Banco de Portugal ended on 1 July 2026. Since then, only MiCA-authorized providers, from Portugal or another EU country, may serve you.
  • Expect identity checks. For transfers above €1,000 to your own wallet, the provider checks whether the wallet is yours.
  • Report crypto fraud to the police: the Polícia Judiciária, or the PSP or GNR through the online complaint system.

This page covers who supervises crypto in Portugal, what that means when you use an exchange, and the rules for your own wallet. Which exchanges are authorized is on exchanges, and the EU-wide rules on EU rules. It is general information, not legal advice.

Law 69/2025, published on 22 December 2025, executes the EU Markets in Crypto-Assets Regulation (MiCA) in Portugal. It splits the supervision between two authorities.

AuthorityResponsible for
Banco de PortugalAsset-referenced tokens and e-money tokens (stablecoins, MiCA titles III and IV); the authorization of crypto-asset service providers, their prudential and governance requirements, outsourcing and wind-down plans.
CMVM (securities regulator)Offers and admission to trading of other crypto-assets (title II), market abuse (title VI), and the rules for specific services, information to clients, safekeeping of clients’ assets, complaints handling and conflicts of interest (MiCA title V, chapter 3, and Articles 66 and 70 to 72).

An application for authorization goes to Banco de Portugal, which forwards it to the CMVM within two business days; the CMVM has 15 business days to give a reasoned opinion. Both authorities must publish the up-to-date list of authorized providers and the services they may provide (article 7).

The end of the old registration

Before MiCA, providers of virtual-asset services registered with Banco de Portugal under the anti-money-laundering law. Under article 30 of Law 69/2025, firms registered on 30 December 2024 whose activity had started could continue until 1 July 2026, or until they were granted or refused a MiCA authorization, whichever came first. Since then a firm may not provide crypto-asset services without MiCA authorization. Doing so is a very serious offense: the fine for a company is €25,000 to €5,000,000, and the maximum can be raised to 5% of turnover (article 13).

Exchanges and KYC

An exchange or custodian that serves customers in Portugal needs a MiCA authorization from Banco de Portugal or from the regulator of another EU country that has passported it to Portugal. On 7 October 2026 the ESMA register listed one provider authorized in Portugal and 184 from other EU countries that may serve Portugal; the main exchanges are compared on exchanges.

  • Identity checks. Law 70/2025 amended the anti-money-laundering law (Law 83/2017): providers apply customer due diligence when they start a business relationship, and for occasional transactions above €1,000.
  • Travel rule. Under the EU Transfer of Funds Regulation (2023/1113), providers send and receive information on the sender and the recipient with every crypto transfer.
  • Tax data. Providers also collect your tax residence and tax number and report your transactions to the AT (DAC8); see filing and deadlines.

Stablecoins

MiCA sets two kinds of stablecoin. An e-money token (EMT) refers to one official currency, such as the euro or the dollar, and may only be offered to the public or admitted to trading by a credit institution or an e-money institution (Article 48). An asset-referenced token (ART) refers to other values or a basket, and its issuer needs an authorization (Article 16). In Portugal, Banco de Portugal is the competent authority for both. A stablecoin that does not meet these rules should not be offered to you by an authorized provider in the EU. For tax, a stablecoin is a crypto-asset like any other: swapping into it is not taxed, converting it to euros is (see swaps).

Crypto ATMs

We found no Portuguese law or regulator statement that deals specifically with crypto ATMs. Exchanging crypto-assets for funds is a crypto-asset service under MiCA, so a machine that sells or buys crypto for cash must be run by an authorized provider, and the anti-money-laundering checks above apply to it. Check the operator in the register before you use one.

Scams and where to report them

The simplest check is the register: a firm that is not in the ESMA register, or on the lists that Banco de Portugal and the CMVM must publish, may not offer crypto-asset services in Portugal, whatever it says about itself. Remember too that MiCA requires every crypto-asset white paper to state that the crypto-asset may lose its value in part or in full and is not covered by deposit guarantee or investor compensation schemes (Article 6(5)). If something has gone wrong:

  1. Stop paying and keep all evidence: messages, wallet addresses, transaction IDs and bank statements. If you paid by bank transfer or card, contact your bank at once.
  2. Report it to the police. Fraud (burla) is one of the crimes you can report online to the PSP or GNR through the Queixa Eletrónica system of the Ministry of Internal Administration. The Polícia Judiciária has a national cybercrime unit (UNC3T) and its own online complaint page.
  3. Tell the regulators. Under article 10 of Law 69/2025, Banco de Portugal and the CMVM must have procedures for complaints about infringements of MiCA. They supervise firms; they do not recover money for you or decide your individual case.

Self-custody

The legal texts we read contain no prohibition and no license or registration requirement for holding your own wallet. The rules fall on providers when you move crypto between them and your wallet:

  • For a transfer of more than €1,000 to a self-hosted address, the provider must take adequate measures to assess whether that address is owned or controlled by you (Article 14(5) of Regulation 2023/1113).
  • Under the new article 71-A of the anti-money-laundering law, providers take enhanced measures in proportion to the risk for transfers to or from self-hosted addresses, such as verifying the identity of the sender or recipient, asking where the crypto comes from or goes to, and closer monitoring.
  • DAC8 reports include transfers to wallets not linked to a provider.

Moving crypto between your own wallets is not a sale, so it is not a taxable event in itself, but the AT leaflet does not say this expressly. We found no AT or Banco de Portugal guidance on lost or stolen keys. Holding crypto yourself means the keys are your responsibility; if you keep larger amounts of bitcoin, this comparison of multisig versus a single hardware wallet sets out what each protects against. What heirs need to do to reach crypto in a wallet or on an exchange is covered in this guide to crypto inheritance in the European Union.

Sources

This page is general information, not legal advice. Rules change, so check the official sources above before you act.