Crypto license in Portugal: MiCA CASP requirements (2026)

Published in the Diário da República on 22 December 2025, Law No. 69/2025 formally transposes EU Regulation 2023/1114 (MiCA) into Portuguese law, establishing a 'twin-peaks' supervisory model: Banco de Portugal (BdP) supervises prudential matters (stablecoins, CASP authorisation, governance) while CMVM oversees market conduct and non-stablecoin issuances. Existing VASPs registered before 30 December 2024 may continue operating under a transitional regime until 1 July 2026 or until their MiCA authorisation decision.

Following back-to-back parliamentary elections in March 2024 and May 2025 that delayed Portugal relative to most EU peers, the newly formed government submitted the MiCA implementing proposal in autumn 2025; it was approved by a strong parliamentary majority and sent to publication in December 2025.

From 30 December 2024, Regulation (EU) 2023/1114 became fully applicable across all EU member states, including Portugal. VASPs already registered with Banco de Portugal and active on that date automatically entered a transitional regime allowing continued operation until 1 July 2026 or until a final decision on their CASP authorisation, whichever comes first.

Portugal passed legislation requiring all crypto holders to declare their digital assets in the annual IRS (personal income tax) return, effective for the 2024 tax year, regardless of whether any tax is owed. This closed the prior reporting gap where the 2023 tax rules created liability without a formal disclosure mechanism.

Banco de Portugal published Notice No. 1/2023 establishing detailed AML/CFT compliance obligations for registered VASPs, covering KYC/KYB procedures, transaction monitoring, appointment of a Money Laundering Reporting Officer, and governance duties of a responsible board member. It supplemented the 2021 registration framework with operational requirements.

Law No. 24-D/2022 (State Budget for 2023) inserted crypto-asset provisions into the Personal Income Tax Code (Código do IRS): capital gains from crypto disposed of within 365 days are taxed at 28%; gains on assets held ≥365 days are exempt. Staking and other passive income falls under Category E at 28%; mining income under Category B. This ended Portugal's informal status as a crypto tax haven.

Bison Bank became the first credit institution in Portugal, and among the first in Europe, to receive a VASP licence from Banco de Portugal, authorising it to offer a full suite of virtual asset services. This demonstrated that the 2021 registration framework applied equally to traditional financial institutions seeking to enter the crypto space.

Law No. 99-A/2021 of 31 December 2021 (State Budget amendment) amended Law 83/2017, inserting a statutory definition of 'virtual assets' and explicitly designating VASPs as 'obligated entities' subject to the full AML/CFT regime, including transaction monitoring, KYC, and mandatory Banco de Portugal registration.

Banco de Portugal issued the first wave of VASP registrations: Utrust received a full all-categories licence in March 2021, followed by Criptoloja and Mind The Coin in mid-2021. These were the first exchanges legally authorised to offer crypto-to-fiat, custody, and transfer services to Portuguese residents.

The Portuguese securities regulator CMVM issued a formal communication to entities conducting initial coin offerings (ICOs) on how tokens are legally classified; it assessed that tokens not bearing features of tradable securities fall outside the public-offering and prospectus regime, while security-like tokens require full compliance. This was Portugal's first substantive securities-law engagement with crypto.

Law No. 83/2017 of 18 August 2017 transposed the EU's Fourth Anti-Money Laundering Directive into Portuguese law and established the core AML/CFT obligations. Although it did not yet cover VASPs explicitly, it provided the legal scaffold onto which virtual-asset provisions were later grafted by Law 99-A/2021, making it the cornerstone of Portugal's crypto regulatory architecture.

Banco de Portugal published a clarification ('Esclarecimento sobre Bitcoin') warning consumers that Bitcoin is issued by unregulated, unsupervised entities, carries no payment finality guarantee, and does not constitute legal tender. Aligned with ECB and EBA alerts of the same period, this was Portugal's earliest formal regulatory statement on crypto assets.