Crypto License in Portugal

Is Portugal the Right Fit?

Fits
Holding, exchanging or transferring clients’ crypto-assets, operating a platform, handling orders or providing crypto investment advice.

Requires Separate Analysis
Token issuance, asset-referenced and e-money tokens, and payment services.

Outside MiCA Scope
Financial instruments follow securities rules. Supplying blockchain software alone does not establish a CASP requirement.

Choose the Applicable Route

Route	Eligible Applicant	Authority	Output	Limitation
Article 59	Ordinary CASP applicant	Banco de Portugal with CMVM involvement	Service-specific permission	Establishment and application requirements apply
Article 60	Eligible already-authorized financial entity	Banco de Portugal with CMVM involvement	Services after required prior notification	Equivalent services only; no shortcut for startups or legacy VASPs
Historical VASP registration	Qualifying legacy provider	Banco de Portugal	Former transitional status	No current permission

Covered Service Scope

Each activity needs permission and controls:

• Custody and administration: control clients’ assets or keys, safeguard and segregate assets.
• Trading platform: match multiple trading interests, establish operating rules.
• Exchange for funds: trade against money using own capital, document pricing.
• Exchange for crypto-assets: trade crypto pairs using own capital, document pricing.
• Execution: conclude client orders, establish execution arrangements.
• Placing: market assets for offerors, document placing arrangements.
• Reception and transmission: forward client orders, document order handling.
• Advice: give personal recommendations, demonstrate expertise.
• Portfolio management: invest under discretionary mandates, demonstrate expertise.
• Transfers: move assets between addresses for clients, document transfer arrangements.

Scope and Fees

Package	Included	Excluded	Official Fees	Professional Fees	Dependencies
Core support	Assessment, application, AML and governance documents, correspondence	Regulatory outcome, third-party and ongoing costs. Extras unless agreed	Separate. Confirm current charges before filing	Quoted by task	Services, entity, governance, existing documents

Prudential safeguards cover business risks, they are not fees.

What We Need from You

For assessment and application preparation, provide:

• Ownership and ultimate beneficial owner details, management records and operating locations
• Business plan and proposed services
• Existing AML, governance and technology-security policies, and outsourcing arrangements
• Financial forecasts

Article 59 requires a registered office in a Member State where some services occur. Effective management must be in the EU, and at least one director must reside there; Portuguese citizenship is not required.

Article 67 safeguards for ordinary Article 59 applicants equal the higher of the service-class minimum and one-quarter of preceding-year fixed overheads. First-year calculations use projected 12-month overheads. Class 1 starts at €50,000, custody or exchange raises this to €125,000, platforms to €150,000. Safeguards may comprise eligible own funds, qualifying insurance or comparable guarantees, or a combination. Eligible Article 60 entities follow sector prudential rules instead.

Timeline and Dependencies

Preparation depends on your services and available documents.

Under Article 63, acknowledgment takes up to five working days, and completeness assessment up to 25 working days from receipt. The authority must decide within 40 working days of a complete application, decision notification follows within five working days. A qualifying first information request by assessment day 20 can pause assessment for up to 20 working days.

Missing information and third-party arrangements add time; these periods do not establish a launch deadline. Article 60 notification rules differ.

Regulatory Framework

MiCA, Regulation (EU) 2023/1114, and Portugal’s Lei n.º 69/2025 govern access to crypto-asset services and their supervision. Banco de Portugal handles access and prudential matters; CMVM handles allocated conduct and market responsibilities. Permission is service-specific, with requirements protecting clients and supporting orderly markets.

Anti-money-laundering and counter-terrorist-financing duties (AML/CFT) arise under Lei 83/2017, amended by Lei 70/2025. The Transfer of Funds Regulation, Regulation (EU) 2023/1113, requires information accompanying crypto transfers and controls for missing information. The Digital Operational Resilience Act (DORA) governs technology risk, incidents, testing and technology suppliers for authorized CASPs. Authorization does not replace these obligations or permissions needed for other regulated activities, including payment services.

Current Regulatory Status

Current Route	Legacy Route	Authority	Action
Article 59 or eligible Article 60	Qualifying VASP transition ended by July 1, 2026, or earlier authorization or refusal	Banco de Portugal with CMVM participation	Check current status and scope; no automatic conversion or permission from pending applications

Ongoing Compliance

The CASP remains responsible, including for outsourced tasks:

• MiCA Articles 68–73: maintain competent management, safeguards, complaints handling, conflicts controls, outsourcing oversight and applicable regulatory reporting.
• Records: retain service, order and transaction records five years, up to seven if the authority requests it before five years expire
• Conflicts: review the policy at least annually.
• AML/CFT and transfer rules: maintain transfer-information controls, missing-information procedures and risk-based self-hosted-address checks; escalate suspicious transactions separately.
• DORA: maintain technology risk, incident, testing and supplier controls; advanced testing is not universal.

Penalties and Operating Risk

Unauthorized or out-of-scope services are very serious infringements under Lei 69/2025. Misleading permission claims, governance, AML, client-asset and conduct failures also create regulatory exposure.

Banking and Payment Arrangements

Authorization does not guarantee a bank, electronic money institution (EMI) or payment service provider account. Institutions check ownership, sources of funds and wealth, counterparties, volumes, flows and compliance.

MiCA does not grant payment-services permission. When you hold clients’ money other than e-money tokens, Article 70 generally requires placement at a credit institution or central bank. An ordinary EMI account does not automatically meet that requirement.

Tax Considerations

Corporate taxable profit follows the accounts, with tax adjustments. The standard mainland rate for periods beginning in 2026 is 19%, subject to applicable reduced rates and surcharges.

VAT depends on the service. Assess payroll, withholding, permanent establishment and applicable Madeira rules for your structure.

Portugal and EU Alternatives

Choose the home state around establishment, management and operations.

Jurisdiction	Regulator	Operational Fit	Transition Status	Key Limitation
Portugal	Banco de Portugal and CMVM	Portuguese operations	Ended July 2026	Legacy status insufficient
Spain	CNMV	Spanish operations	Ended July 2026	Token-issuer roles differ
Germany	BaFin with Bundesbank	German operations	Ended December 2025	Legacy custody needs classification
Estonia	Finantsinspektsioon	Estonian operations	Ended July 2026	Issuer procedures differ
Lithuania	Bank of Lithuania	Lithuanian operations	Ended December 2025	No unlicensed continuation
Netherlands	AFM	Dutch operations	Ended June 2025	DNB registration insufficient