Fintech & digital payments rules in Portugal (2026)

Portugal published Law No. 69/2025 implementing the EU Markets in Crypto-Assets Regulation (MiCAR) and Law No. 70/2025 implementing the EU Transfer of Funds Regulation, establishing a 'twin peaks' supervisory model (CMVM for conduct and market integrity; Banco de Portugal for prudential oversight of e-money tokens) and a 12-month transitional period allowing VASPs already registered under Law 83/2017 to continue operating until 1 July 2026 while seeking MiCA authorisation.

Under Regulation (EU) 2024/886, all Eurozone payment service providers including those in Portugal were required to offer the sending of instant euro credit transfers by 9 October 2025, completing mandatory real-time outbound payments capability for Portuguese banks and payment institutions.

The first compliance deadline under Regulation (EU) 2024/886 required all Eurozone payment service providers, including Portuguese banks and payment institutions, to be able to receive instant euro credit transfers at no extra charge on a 24/7 basis, embedding real-time settlement capability into Portugal's retail payment infrastructure.

Notice No. 1/2023 updated and strengthened AML/CFT compliance requirements for Virtual Asset Service Providers registered in Portugal, specifying KYC, transaction monitoring, and suspicious-transaction reporting standards aligned with FATF Recommendations and pre-positioning the sector ahead of full MiCA authorisation requirements.

Decreto-Lei n.º 67/2021 enacted the legal regime for Technological Free Zones (Zonas Livres Tecnológicas), Portugal's cross-sector regulatory sandbox, allowing fintech, AI, blockchain, and 5G innovators to test products and services in real or near-real environments under regulatory supervision; it did not create specific ZLTs but set the conditions for their creation.

Portugal transposed Directive (EU) 2015/2366 (PSD2) through Decreto-Lei n.º 91/2018, replacing Decreto-Lei 317/2009 and establishing the comprehensive Payment Services and Electronic Money Legal Framework (PSEMLF); the law created regulatory categories for Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs), mandated Strong Customer Authentication (SCA), and opened the market to third-party open-banking players under Banco de Portugal oversight.

Banco de Portugal, the Insurance and Pension Funds Supervisory Authority (ASF), and the Securities Market Commission (CMVM) jointly launched Portugal FinLab with Portugal Fintech, creating a structured communication channel through which fintech, insurtech, and regtech innovators can obtain regulatory guidance from all three supervisors without the standard compliance burden; the first edition received 40 applications for 10 places.

Law No. 83/2017 transposed the EU Fourth Anti-Money Laundering Directive (2015/849/EU) into Portuguese law and, critically, introduced the first mandatory registration regime for Virtual Asset Service Providers (VASPs) with Banco de Portugal, subjecting crypto businesses to AML/KYC obligations years before EU-wide MiCA licensing existed.

Portugal transposed the EU's first Payment Services Directive (2007/64/EC) through Decreto-Lei n.º 317/2009, establishing the legal framework for payment institutions as a new class of non-bank payment service provider licensed and supervised by Banco de Portugal, defining permissible payment services, and setting the consumer-protection and transparency obligations that underpinned all subsequent digital payments regulation.