A decision every country made in 2024 is still deciding who holds the licences.
MiCA let each member state give its existing crypto firms up to eighteen months of cover while they applied for authorisation. Six states gave six months. Spain gave eighteen. The firms that faced the earliest deadline were authorised first, and they have spent the intervening period passporting into everyone else’s market — including this one. The CNMV register still carries the imprint of that choice.
Months. Chosen by the Netherlands, Latvia, Hungary, Poland, Slovenia and Finland.
Six-month states, median licence
Dec 2025
Their firms in the Spanish register were authorised around this date.
Eighteen-month states, median
Jun 2026
Six months later. Spain took eighteen.
A MiCA authorisation is the same instrument wherever it is issued. It passports across the European Economic Area, and a firm authorised in Vilnius has exactly the same access to Spanish clients as one authorised in Madrid. That is the design, and it means the choice of home state is not a choice of market. It is a choice of regulator, timetable and cost base.
So why did so few firms choose Spain? Part of the answer is simply that Spain had a smaller pre-MiCA crypto sector than France, Malta or the Netherlands. But part of it is a decision made in 2024 that nobody presented as a competitive one.
What each state chose, and how many of its firms now serve Spain
Article 143(3) allowed a transitional period of up to eighteen months for firms already operating under national law. Member states notified their choice to the Commission and ESMA by mid-2024. The third column counts entries in the Spanish CNMV register whose home state is that country.
State
Months
In register
Note
Finland
6
2
Hungary
6
—
Latvia
6
7
Netherlands
6
21
Poland
6
—
Slovenia
6
1
Sweden
9
—
Austria
12
8
Germany
12
13
Ireland
12
11
Lithuania
12
5
Norway
12
1
Slovakia
12
6
Belgium
18
—
Bulgaria
18
—
VASPs registered between 30 December 2024 and 8 July 2025 had to apply by 8 October 2025.
Croatia
18
2
Cyprus
18
15
Czechia
18
2
Applicants had to file by 31 July 2025 to keep the benefit.
Denmark
18
5
Applicants had to file by 30 December 2024 to keep the benefit.
Estonia
18
1
France
18
23
Greece
18
—
Iceland
18
—
Italy
18
2
Italian AML-register VASPs and their groups had to file by 30 December 2025.
Liechtenstein
18
8
Luxembourg
18
12
Malta
18
17
Portugal
18
—
Romania
18
—
Spain
18
9
Spain took the maximum. Nine of its own firms are authorised.
Grandfathering periods as notified by member states under article 143(3) and published by ESMA. Register counts are entries whose home state is that country; for Spain the figure is CASPs authorised by the CNMV and excludes the six Spanish credit institutions. Iceland, Liechtenstein and Norway appear as EEA states.
The timing is not a coincidence
Group the register by what the firm’s home state chose, and take the median date from which each firm became entitled to provide services in Spain.
The state chose
States in the register
Firms serving Spain
Median start date
Six months
4
31
18 December 2025
Nine to twelve months
6
44
16 December 2025
Eighteen months
10
87
24 June 2026
A firm in Amsterdam had until the middle of 2025 and no longer. A firm in Madrid had until July 2026. Both ended up with the same passport, but one of them had it a year earlier, into a market where nobody else was yet authorised. That is the whole of the first-mover effect, and it was handed out by a notification letter in 2024.
What genuinely varies between home states
Worth weighing
Regulator throughput and predictability. Some authorities had a national crypto regime and the staff to run it. Others started from nothing.
The language of the file. A full application in Spanish is a different project from one in English, and it shapes who you can hire to write it.
Where your people actually are. Authorisation requires real management in the home state. This is the constraint that decides most cases honestly.
Cost base. Own funds are the higher of the Annex IV floor and a quarter of fixed overheads, so the overheads you run in the home state feed directly into your capital requirement.
What does not vary, whatever you are told
Not a reason to choose
Market access. The passport is identical. No home state gives you better access to Spanish clients than any other.
The capital floors. 50,000, 125,000 and 150,000 euro are set in MiCA, not nationally.
The substance of the obligations. Conduct, custody segregation, complaints, disclosure and prudential rules come from the Regulation directly.
Escaping supervision. The host authority supervises your conduct in its market regardless of who issued the licence.
The honest version of this advice is uncomfortable for a Spanish firm to give. If your management, staff and operations are in Spain, you licence in Spain, and the fact that Lithuanian firms got a head start is history rather than a reason to relocate. Shopping for a home state where you have no real presence produces an application that fails on substance, and a regulator that has already returned thin files will return that one too.
Frequently asked
Can I licence in a small member state and operate entirely from Spain?
No, and this is the most common structure people ask about. Authorisation requires the firm to be established and effectively managed in the home state, with management there and real decision-making. A shell in one state operated from another fails the test at application and, if it somehow got through, exposes the licence afterwards.
Is a Spanish licence worth less than a Maltese or French one?
No. The passport and the obligations are identical. What differs is the process of getting it and the language it is conducted in. The register shows Spain has issued few licences, which tells you about the size of the pipeline rather than the value of the output.
Does the CNMV supervise a firm that passported in?
It supervises conduct in the Spanish market and can act on it, but the licence itself, and the prudential supervision behind it, stay with the home authority. That split is why a passport is not an escape from Spanish rules of conduct, and why the home state still matters for everything prudential.
What if I already trade in Spain with no licence anywhere?
Then the jurisdiction question is the second question. The Spanish transitional period ended on 1 July 2026 and there is no residual basis to operate, so the position needs addressing before a licensing strategy is chosen.
Position as at September 2026. Grandfathering periods are those notified by member states under article 143(3) of Regulation (EU) 2023/1114 and published by ESMA in its list of member-state transitional periods; ESMA notes some were communicated as expectations and may not all have been carried into national law identically. Register counts and median dates are computed from our transcription of the CNMV list of crypto-asset service providers and reflect the date from which each entity may provide services in Spain, not the date its home authority granted the licence. Own-funds classes are those in Annex IV of the Regulation. General information, not legal advice.
The passport is the same everywhere. Where your people sit is not.
Founder, Voixa Consultors · International corporate structuring since 2008
Seventeen years designing and delivering cross-border corporate structures — incorporation, tax, holding, banking and market entry — for founders and companies expanding into Spain and the EU. Author of professional books on entering the Spanish market.