Licensing of virtual currency service providers in Spain

Spain is actively working to attract entrepreneurs, and corporate and venture investors by creating an effective legal framework that facilitates the seamless integration of blockchain technology.

This goal is supported by several recent events, including the entry into force in December 2022 of Law 28/2022 of December 21 “On the Promotion of the Development of the Startup Ecosystem”, the entry into force in April 2023 of Law 6/2023 of March 17 “On Securities Markets and Investment Services » and making changes to other regulatory acts aimed at regulating the crypto-assets market.

Also in October 2023, the Government of Spain announced that it intends to shorten the period of implementation of the European Regulation on the market of crypto-assets (MiCA) on the territory of Spain and introduce the relevant regime by the end of 2025.

On April 28, 2021, Royal Decree 7/2021 of April 27 on the transposition of EU directives in the field of competition, prevention of money laundering, and credit institutions was published in the Spanish National Gazette.

This Royal Decree amended Law 10/2010 of April 28 “On Prevention of Money Laundering and Terrorist Financing”. The most important innovations of this Decree were the official definition of virtual assets and new subjects of regulation, which included service providers for exchanging virtual currencies for fiat, as well as service providers for managing virtual wallets (hereinafter – virtual currency service providers).

According to the provisions of the Decree, all virtual currency service providers must register in a specially designed register of the Central Bank of Spain (SCB), which became effective in January 2022.

Legal entities or natural persons who intend to obtain the relevant virtual currency service provider license must submit the following information and documents through the SCB special register:

• filled and signed forms depending on the type of activity;
• completed and signed suitability assessment forms for both the company and its directors;
• company registration documents, company tax identification number (NIF), passports of the applicant and directors;
• certificates of no criminal record (not older than three months), both for the company and for the directors;
• anti-money laundering procedures policy, which should include due diligence measures, KYC policy, customer identification, notification to the local anti-money laundering authority (SEPBLAC), internal control measures, etc.;
• a risk analysis assessment document that must identify and assess: risks by type of client, country or geographic region, products, services, operations, taking into account the purpose of the business relationship, the level of the client’s assets, the volume of transactions, as well as the regularity or duration of the business relationship; money laundering and terrorist financing risks; systems or channels used to receive, pay, distribute, move or transfer fiat and virtual currencies, with reference to the risks associated with them and including the pattern of expected flows (e.g. use of cash, credit or prepaid cards, registered checks or bearer checks, national or international transfers, peering transactions, etc.); a typology of clients indicating those who may pose a greater risk from a prevention perspective (e.g. new clients, non-resident clients, clients with large cash businesses, publicly accountable persons, clients with complex ownership or control structures, clients engaged in certain risky activities activities, etc.); the geographic regions in which the regulated entity will provide its services and where its customer base will come from, indicating the high-risk areas with which or in which it operates (for example, tax havens; countries, territories or jurisdictions subject to international financial sanctions , with a high level of corruption, etc.);

Applicants must also meet the requirements of commercial and professional integrity, which consist of demonstrating personal, business, and professional conduct that does not call into question the ability to exercise sound and prudent management of the organization.

Supervision of compliance with the above-mentioned requirements is entrusted to the State Banking Supervision Committee.

After receiving the relevant information and documents from the applicant, the CBS must decide within three months to register the virtual currency service provider or refuse the registration.

If necessary, CBS may request additional information and/or documents from the applicant, in which case the three-month review period will be suspended.

It should be noted that by EU Regulation 2023/1113 of May 31, 2023 “On information accompanying transfers of funds and certain crypto-assets” and amendments to EU Directive 2015/849 of June 9, 2023, crypto-asset service providers (CASP) must, among other things, implement general measures to track the transfer of crypto-assets and specific measures to track the transfer of crypto-assets to and from non-custodial wallets.

The general measures require CASP that transfers of cryptoassets be accompanied by certain information about the sender (name, wallet address, country of cryptoasset account address, official personal document number and customer identification number, date and place of birth or LEI code) and recipient (name, wallet address, crypto-asset account or LEI code) (required information).

In addition, the recipient’s CASP must implement effective procedures to detect whether mandatory information is included in the cryptoasset transfer to ensure that the sender or recipient is not subject to special restrictive measures.

Special measures to track the transfer of crypto-assets to or from non-custodial wallets require CASP to collect and store the necessary information from its client, verify the accuracy of such information, provide it to the competent authorities at their request, and ensure individual identification of the transfer of crypto-assets.

In the event of a crypto asset transfer from a non-custodial wallet, the recipient’s CASP must keep records of all crypto asset transfers and notify the competent authority of any customer who has received an amount equal to or greater than €1,000.

In addition, in April 2023, Law 6/2023 of March 17 “On Securities Markets and Investment Services” entered into force. This law establishes that all financial instruments that are issued, registered, transferred, or stored using distributed ledger technology or other similar technologies will be subject to it. The law also appoints the National Stock Market Commission (CNMV) as the competent authority to supervise compliance with the provisions of the MiCA Regulation.

So, when you have questions about starting a cryptocurrency business in sunny Spain, you know where to go.

The lawyers of the company “Prikhodko and Partners” will help with the registration of the company in Spain and prepare a package of documents necessary for obtaining a license for a virtual currency service provider without unnecessary costs and in the optimal time frame.