Cryptoasset regulation in Europe is undergoing massive change. The EU's landmark Markets in Crypto-Assets regulation (MiCA), which establishes a harmonised EU-wide framework for issuing, dealing or intermediating cryptoassets, takes effect during 2024.

In a recent article for Thompson Reuters Regulatory Intelligence our fintech specialists in Madrid provide the following Q&A update on the current approach to the regulation of cryptoassets in Spain.

1. Which body or bodies regulate cryptoassets and related activities?

The Spanish Securities Market Commission (Comisión Nacional del Mercado de Valores) (CNMV) is the competent authority in charge of the supervision of crypto-assets which qualify as financial instruments and those under the scope of MiCA other than e-money tokens (EMTs) and asset-reference tokens (ARTs).

The CNMV will be responsible for the authorisation and supervision of crypto-asset services providers once the relevant parts of MiCA start to apply. Financial promotions of all types of cryptoassets are also under its remit. The Bank of Spain, meanwhile, is the competent authority for the supervision of the issuers of EMTs and ARTs.

2. Does any existing or proposed national law regulate cryptoasset issuers or service providers?

National laws and regulations include specific local rules and the implementation of EU legislation.

They cover:

• promotions of crypto-assets [1];

• the use of DLT for the issuance, registration or transfer of crypto-assets which qualify as financial instruments [2]; and

• anti-money laundering obligations applicable to virtual asset services providers [3].

Additionally, on 29 May 2024, the CNMV published a Q&A related to DLT-based financial instruments which provides guidance on some aspects of the rules.

3. Does any existing or proposed national law impose requirements regarding stablecoin?

The subcategory of cryptoassets known as stablecoins, which purport to maintain their value by reference to another asset or assets, are a particular concern for regulators because they can carry stability risks. MiCA treats stablecoins differently from other crypto assets and divides them into “asset-referenced tokens” and “electronic money tokens”. Stablecoins that pass threshold conditions will be classed as “significant” by the European Banking Authority.

There are no existing or proposed national laws in Spain specifically targeting stablecoins, however, some stablecoins might be within the scope of the rules applicable to promotions of crypto-assets or e-money.

4. What rules apply to the promotion of cryptoassets?

The rules apply to any advertising activity aimed at Spain-domiciled investors that promotes cryptoassets as a form of investment, either implicitly or explicitly. Financial instruments, cryptoassets that do not qualify as investments, and NFTs, among others, are out of scope. White papers and corporate/brand awareness campaigns are explicitly excluded from the concept of advertising activity too.

Pursuant to the rules, advertising materials must be clear, balanced, impartial, and not misleading. They must include specific warnings about risks and provide a link or reference to where additional information about the cryptoasset and its risks can be found. The approach is principles-based but there are also very concrete rules, such as with regards to the risk-warning wording.

The CNMV conducts ex-post control of most advertising activities and has the authority to request specific information about the advertising to assess compliance. It can notify relevant parties of any deviations from the rules and demand the cancellation or correction of non-compliant activities.

Additionally, for mass advertising campaigns only (targeting more than 100,000 people), ex-ante supervision is applied, and notification must be submitted to the CNMV a minimum of ten working days prior to launch.

5. What anti-money laundering requirements apply to cryptoasset activities or custody?

Any individual or legal entity offering exchange services between virtual currencies and fiat currencies, or those providing services to safeguard private cryptographic keys for end-users to manage, store and transfer virtual currencies in Spain (regardless of having a physical presence in the territory), is required to register with the Bank of Spain as a virtual asset service provider and comply with Spanish anti-money laundering requirements, which are primarily based on the 5MLD but include specific national provisions.

Spain is preparing for the application of MiCA and has launched a consultation announcing a widening of the scope of the obliged entities subject to the anti-money laundering requirements to cover other crypto-asset service providers.

The SEPBLAC and Bank of Spain have communicated that they comply with most of the EBA guidelines on anti-money laundering matters, which among others include guidance on what particular elements subject entities need to pay attention when assessing the risk of clients involved in activities with cryptoassets.

6. Do any rules restrict banks from holding or dealing in cryptoassets or their derivatives?

There are no specific rules that explicitly restrict Spanish banks from holding or dealing in cryptoassets or their derivatives, although they will be subject to the above-mentioned rules and subject to MiFID where the crypto-assets or their derivatives qualify as financial instruments.

Additionally, banks are subject to prudential regulations and, once the Basel Committee on Banking Supervision (BCBS) standards on the prudential treatment of banks' crypto-asset exposures are implemented into EU law, they will work in conjunction with MiCA's provisions.

7. Do any current or proposed rules apply to decentralised finance (DeFi) arrangements?

None currently, assuming they are truly decentralised.

8. Have there been any significant regulatory or criminal enforcement proceedings involving rules concerning crypto-assets?

Yes. The CNMV imposed in February 2024 its first known penalties for breaching crypto-asset advertising regulations, levying a public reprimand in the Spanish Official State Gazette (BOE) and four fines for an aggregate amount of 30,000 euros. According to the information published by the CNMV, the infringing entity:

• failed to include information and warnings about the risks of crypto-assets in their mass media advertising campaigns in two Spanish newspapers; and

• did not notify the CNMV in advance of these mass media advertising campaigns.

The CNMV considered both the recent creation and the financial situation of the infringing entity to determine the amount of the fines.

The main Spanish criminal enforcement proceedings related to crypto-assets include an alleged 92 million euros fraud involving around 32,000 individuals, which is still under prosecution at the National Court; and a case where cryptocurrency ATMs were used for money laundering.

[1] Circular 1/2022, de 10 de enero, de la Comisión Nacional del Mercado de Valores, relativa a la publicidad sobre criptoactivos presentados como objeto de inversión.
[2] Ley 6/2023, de 17 de marzo, de los Mercados de Valores y de los Servicios de Inversión.
[3] Ley 10/2010, de 28 de abril, de prevención del blanqueo de capitales y de la financiación del terrorismo.

A version of this article was originally published in Thomson Reuters Regulatory Intelligence.