Crypto Country GuideCrypto rules and tax, country by country

Spain: regulation

Last reviewed: October 2026

On this page
  1. Legal status and supervision
  2. Exchanges and KYC
  3. Stablecoins
  4. Crypto ATMs
  5. Scams and fraud
    1. Where to report, and what happens
  6. Self-custody
    1. If you lose access to your wallet
  7. Sources
  • Spain applies the EU Markets in Crypto-Assets Regulation (MiCA). The Comisión Nacional del Mercado de Valores (CNMV) authorizes and supervises crypto-asset service providers; the Banco de España supervises issuers of stablecoins.
  • The transitional period for providers in the old Banco de España register ended on 1 July 2026. Since then only providers authorized by the CNMV or by another EU regulator may serve customers in Spain.
  • Check a provider in the CNMV and ESMA registers and in the CNMV warning list before you use it. Expect identity checks, and for transfers above €1,000 to or from your own wallet, a check that the wallet is yours.
  • Watch for unsolicited offers, promised returns and “recovery” services. Tell the CNMV and file a report with the Policía Nacional, the Guardia Civil or a court.
  • There is no rule to register a self-custody wallet. Crypto you control yourself is not reported on the modelo 721 but does count for the wealth tax.

This page covers who supervises crypto in Spain, what that means when you use an exchange, and the rules for your own wallet. Authorized exchanges and their fees are on exchanges. It is general information, not legal advice.

Spain applies the EU Markets in Crypto-Assets Regulation (MiCA), in full since 30 December 2024. The CNMV is the competent authority for MiCA and authorizes and supervises crypto-asset service providers. The Banco de España supervises the issuers of e-money tokens and asset-referenced tokens (stablecoins). The EU-wide rules are explained on EU rules.

Before MiCA, firms that exchanged crypto for money or held crypto wallets had to register with the Banco de España under the anti-money-laundering law (Act 10/2010); that register existed from May 2021. Spain used the longest transitional period MiCA allows: firms in the register on 30 December 2024 could keep providing the same services until 1 July 2026, unless their MiCA application was refused earlier. In a statement of 15 June 2026 the CNMV said that providers that would not be authorized had to have a migration plan that lets customers move their crypto and money elsewhere, and that investors using an unauthorized provider after 1 July 2026 do not have MiCA’s protection.

A MiCA authorization means the provider is supervised. It does not make the coins safe: the EU supervisors (EBA, EIOPA and ESMA) warn that most crypto-assets are volatile and high-risk and that consumers can lose all the money they invest.

Exchanges and KYC

An exchange or custodian that serves customers in Spain needs a MiCA authorization from the CNMV or from the regulator of another EU country that has notified Spain (passporting). Look the provider up in the CNMV register of crypto-asset service providers, which lists both, and in the ESMA register. The CNMV advises checking which legal entity you actually contract with, because a brand can operate through several companies and MiCA’s protection applies only to the authorized EU entity. A comparison of the exchanges, with their fees, is on exchanges.

Expect to be identified with your name, address and tax number. Spanish providers report your balances and transactions to the AEAT every January (see filing and deadlines). Providers must also send information about the sender and the recipient with crypto transfers under the EU Transfer of Funds Regulation (the travel rule), which has applied since 30 December 2024.

Stablecoins

MiCA has two kinds of stablecoins. An e-money token (EMT) references one official currency, such as the euro or the dollar; only banks and e-money institutions may offer one to the public in the EU, holders can redeem it at face value, and it pays no interest. An asset-referenced token (ART) references other values or a mix; only banks or issuers authorized under MiCA may offer one. In Spain the Banco de España supervises their issuers.

To check a stablecoin, look up its issuer in ESMA’s interim MiCA register. On 7 October 2026 the register of e-money token issuers listed no issuer from Spain, the register of authorized ART issuers was empty, and we did not find the issuer of USDT (Tether) in it. Which exchanges you can use is on exchanges.

Crypto ATMs

We found no statement by the CNMV or the Banco de España specifically about crypto ATMs since MiCA applies (October 2026). Exchanging crypto for money is a crypto-asset service under MiCA, and since 1 July 2026 every such provider in Spain needs an authorization. If you want to use a crypto ATM, look up its operator in the CNMV register like any other provider, and expect the same identity checks.

Scams and fraud

The CNMV calls unauthorized firms “chiringuitos financieros”. It published 458 warnings of its own in 2025, more than any other EU authority, and alerts about fraud through WhatsApp groups and romance scams. Signs it names:

  • Fake crypto investments that promise incredible gains in a short time and without risk, and pressure you to decide quickly so you “don’t miss the opportunity”, advertised aggressively on social media, by text message or by email.
  • Unsolicited investment offers on social media, fake profiles, and recommendations by celebrities.
  • Firms that copy the name and details of an authorized firm to look legitimate.
  • Phishing, fake websites and “technicians” who ask for remote access to your device.
  • After a loss, a firm offers to recover your money for a fee in advance (recovery room). The CNMV says it never contacts victims directly to recover losses and never lets anyone use its name for that.

Before you invest, check the provider in the CNMV register and the CNMV warning list, or call the CNMV on 900 535 015.

Where to report, and what happens

  • CNMV. Tell the CNMV what happened. It publishes warnings about unauthorized firms so that others can avoid them.
  • Police. Fraud is a crime: the CNMV advises filing a report (denuncia) with the Policía Nacional, the Guardia Civil or the competent court. Keep messages, screenshots, wallet addresses and transaction IDs.
  • Your bank, if you paid by bank transfer or card.

Neither the CNMV nor the police promise to get your money back. A dispute with an authorized exchange is a different matter: see where to complain.

Self-custody

In the sources listed below we found no Spanish rule that requires you to register a self-custody wallet. For tax purposes:

  • Crypto in a wallet where you control the private keys is not reported on the modelo 721, which covers only crypto held by custodians outside Spain.
  • It does count for the wealth tax at its value on 31 December, and gains are taxed when you sell or swap, as on an exchange (see personal tax).

The rules do reach you when you move crypto between a provider and your own wallet: for transfers above €1,000 to or from a self-hosted wallet, the provider must take measures to check whether the wallet is owned or controlled by its customer (EU Transfer of Funds Regulation).

Holding crypto yourself means the keys are your responsibility; the EU supervisors warn that if you lose the private keys, you lose access to and ownership of the crypto permanently. If you keep larger amounts of bitcoin in your own wallet, it is worth comparing a single hardware wallet with a multisig setup; this explanation of multisig versus single-sig sets out what each protects against.

If you lose access to your wallet

We found no AEAT or DGT guidance on crypto you can no longer access, for example after losing a seed phrase (October 2026). The AEAT does publish what happens when a platform does not return your crypto or goes bankrupt: that is an unpaid claim, which becomes a loss only in specific situations (see losses). If you lose access, keep evidence of the facts and ask a tax adviser before your next wealth tax or income tax return.

Heirs who accept an inheritance must report the end of ownership on the modelo 721 if the deceased had filed one. For the rest of your digital life, such as email, password managers and online accounts, see this introduction to planning a digital estate.

Sources

This page is general information, not legal advice. Rules change, so check the official sources above before you act.