From 1 July 2026, Regulation (EU) 2023/1114 (MiCA) is fully applicable. Any entity providing crypto-asset services to EU clients without CNMV authorization, or without a valid European passport, is exposed to administrative sanctions under Article 111 of MiCA. It affects those who provide services, not those who issue security tokens under LMVSI.
MiCA (Regulation (EU) 2023/1114) applies in Spain without a transitional period since July 1, 2026: only authorized providers or those with a European passport can provide services on crypto-assets. As of October 2, 2026, the CNMV registers 15 Spanish entities: 9 authorized CASPs and 6 notified banks. Security tokens remain outside MiCA (art. 2.4).
Here is the complete MiCA timeline, what happened with the transitional period, how the Spanish market stands after July 1 and the dates that remain pending. Data verified on October 2, 2026 in official sources: the MiCA text on EUR-Lex, the CNMV register and the ESMA register.
The MiCA timeline, date by date
MiCA did not come into play all at once. It was published in 2023, applied in two phases and left each State some room for providers already operating. This is the applied timeline, with what has already happened and what is still missing.
| Date | What happens | Who it affects | Status |
|---|---|---|---|
| 9 Jun 2023 | Publication of MiCA in the Official Journal of the EU | General framework | Done |
| 29 Jun 2023 | Entry into force (art. 149.1), still without obligations | General framework | Done |
| 30 Jun 2024 | Titles III and IV apply: asset-referenced tokens (ART) and electronic money tokens (EMT) (art. 149.3) | Stablecoin issuers | Applicable |
| 30 Dec 2024 | The rest applies: other crypto-assets (Title II), service providers or CASPs (Title V) and market abuse (Title VI) (art. 149.2) | Crypto-asset offerors and CASPs | Applicable |
| 18 May 2025 | ESMA guidelines on when a crypto-asset is a financial instrument apply (art. 2.5) | Anyone classifying a token | Applicable |
| 1 Jul 2026 | End of the transitional regime in Spain, which applied the maximum of 18 months (art. 143.3) | Providers operating before 30 Dec 2024 | Closed |
| 30 Jun 2027 | Commission report on the application of MiCA, with a legislative proposal if appropriate (art. 140) | The entire market | Pending |
| 31 Dec 2027 | Trading platforms must have published the white paper of the crypto-assets admitted before 30 Dec 2024 (art. 143.2.b) | Crypto-asset trading platforms | Pending |
| No MiCA date | Issuance of security tokens: excluded from MiCA (art. 2.4) | Issuers of tokenized securities | Ley 6/2023 and MiFID II apply |
How the transitional regime worked in Spain
To avoid expelling from the market those already operating, art. 143.3 of MiCA allowed providers that were providing services under national law before 30 December 2024 to continue doing so until 1 July 2026, or until they were granted or denied authorization if that occurred earlier. Each Member State could shorten that period. Spain applied the maximum of 18 months, according to the list of transitional periods published by ESMA.
In Spain, entities registered in the Bank of Spain's registry of virtual currency exchange and electronic wallet custody providers were covered by the transitional regime. That registry is for anti-money laundering prevention and never authorized them to provide services with MiCA guarantees. That's why those entities had to request authorization from the CNMV before the deadline.
ESMA recalled in its statement of 17 April 2026 that the transitional regime expired throughout the EU on 1 July 2026 and that, since then, providing crypto-asset services to EU clients without MiCA authorization infringes European law. The CNMV specified this in a statement of 15 June 2026: since the end of the transitional regime, only authorized providers can operate in Spain, and those that were not going to obtain authorization had to have a client migration plan. That plan had to allow withdrawing the crypto-assets and funds, or transferring them to an authorized provider with each client's acceptance.
What has happened since 1 July 2026
Data from the CNMV register of crypto-asset service providers (list updated on 2 October 2026) and from the ESMA interim MiCA register (update of 30 September 2026).
| Entities in the CNMV register | Number | Who |
|---|---|---|
| Spanish CASPs authorized by the CNMV (art. 63) | 9 | Bit2Me, Due Network, Crossmint Europe, Criptan, Minos Global, Prosegur Crypto, Iqana Technologies, Fazil Crypto (Basque Pay) and CryptoPocket (Fintech Payments PSC) |
| Notified Spanish credit institutions (art. 60) | 6 | BBVA, Openbank, Cecabank, Renta 4 Banco, CaixaBank and Kutxabank |
| CASPs from another State with a branch in Spain | 1 | IG Europe (Germany) |
| CASPs from other States under freedom to provide services | More than 160 | Providers authorized in another EU or EEA country that operate in Spain with the art. 65 passport |
What these figures show:
- The Spanish list was completed at the end of the deadline. Bit2Me was the first, dated 31 October 2025. Five of the nine CASPs are dated between 12 and 30 June 2026, and three arrived after 1 July: Iqana Technologies (10 July), Fazil Crypto and CryptoPocket (31 July).
- Spain is the sixth State by number of originating CASPs in the ESMA register, with 15 of the 362 that hold a valid authorization in the EU and the EEA, behind Germany, France, the Netherlands, Cyprus and Malta.
- Stablecoins: the ESMA register does not include any ART issuer authorized in the EU and includes 50 EMT white papers, none from an issuer based in Spain.
- Supervision: on 4 December 2025 the European Commission proposed transferring direct supervision of crypto-asset service providers to ESMA. It is under negotiation and currently changes nothing: in Spain the competent authority remains the CNMV, and the Banco de España for ART and EMT issuers (art. 251.h of Ley 6/2023).
The detail by entity, with dates and services, is in the list of banks with a MiCA license in Spain.
What it means for each profile
The end of the transitional period did not affect everyone equally. This table summarizes the situation of each profile since 1 July 2026.
| Profile | Situation | Basis |
|---|---|---|
| Provider registered in the Banco de España register that did not obtain authorization | It cannot provide services in Spain. It had to execute its client migration plan. | Art. 143.3 MiCA; CNMV announcement of 15 Jun 2026 |
| Bank, ESI or other already authorized financial institution | It may provide crypto-asset services if it notifies the CNMV at least 40 business days in advance. An ESI, only services equivalent to its MiFID authorization. | Art. 60 |
| Platform from outside the EU with clients in Spain | It may only serve clients who come on their own exclusive initiative, an exception that ESMA interprets restrictively, including between companies. Soliciting clients requires authorization in the EU. | Art. 61 |
| Issuer of a utility token or other crypto-asset | White paper notified to the CNMV, without prior approval, except for exemptions: fewer than 150 persons per Member State, less than 1 M€ over 12 months or qualified investors only. | Arts. 4 and 8 |
| Issuer of ART or EMT | ART: authorization. EMT: only credit or electronic money institutions. In Spain, the Banco de España supervises. | Arts. 16 and 48; art. 251.h Ley 6/2023 |
| Issuer of security tokens | Outside MiCA. Ley 6/2023 and MiFID II, prospectus or exemption, and registration in an ERIR. | Art. 2.4 MiCA |
Why your security token is not on this calendar
MiCA does not apply to crypto-assets that are financial instruments (art. 2.4). A share, a bond or a tokenized participation remain securities: they are governed by Ley 6/2023 and MiFID II, with CNMV supervision. Tokenizing does not change the legal nature of the asset. We explain it in why security tokens are not covered by MiCA.
Other rules set your calendar. The offering requires a prospectus or an exemption: since 5 June 2026, the Listing Act allows offerings of up to 12 M€ over 12 months without a prospectus, with a Member State option of 5 M€, and the Spanish implementation is pending according to the CNMV. Securities are registered in an ERIR, the figure under art. 8 of Ley 6/2023 developed in RD 814/2023. URSUS-3 Capital was the first ERIR authorized, in November 2024. If it is not clear to you which side your token falls on, start with what a security token is.
HokenFi is a technology platform for issuing tokenized securities. It is not a CASP or an entity authorized by the CNMV: regulated steps are carried out by authorized partners.
What is still to come
- Tax reporting. Directive (EU) 2023/2226 (DAC8) requires providers to collect data from their clients from 1 January 2026; the first information on 2026 is reported in 2027. Details in DAC8 and crypto-assets.
- 30 June 2027: the Commission must submit its report on the application of MiCA, which may be accompanied by a reform proposal (art. 140).
- 31 December 2027: deadline for platforms to publish the white paper for crypto-assets admitted before 30 December 2024 (art. 143.2.b).
- Supervision by ESMA: the 4 December 2025 proposal is still in the legislative process; it has no application date.
- DLT Pilot Regime: the same package proposes extending the pilot regime used by tokenized securities infrastructures. It is not applicable yet either.
Is your token a security or a MiCA crypto-asset? Take the issuance assessment (2 min) or request a proposal.
This content is informative and educational. It does not constitute legal, tax, or investment advice. Check the current version of each regulation in the BOE and on EUR-Lex.
HokenFi is a software and infrastructure provider; it does not provide regulated services (CASP, ESI, EAF, or ERIR). This article is informative and does not constitute financial or legal advice.
Frequently asked questions
When did the MiCA transitional period end in Spain?
Spain applied the maximum of 18 months allowed by Article 143.3 of MiCA, so the transitional period ended at the end of June 2026. From 1 July 2026, only providers authorized by the CNMV, financial institutions that have notified them and CASPs from other Member States with a European passport may provide crypto-asset services in Spain.
How many crypto-asset providers has the CNMV authorized?
As of 2 October 2026, the CNMV register includes 9 authorized Spanish CASPs (including Bit2Me, Criptan, Minos Global and Prosegur Crypto) and 6 Spanish credit institutions that have notified crypto-asset services: BBVA, Openbank, Cecabank, Renta 4 Banco, CaixaBank and Kutxabank. There are also more than 160 providers from other Member States operating under a passport.
When did MiCA enter into force?
MiCA entered into force on 29 June 2023, but it applied in phases. The rules on stablecoins (ART and EMT, Titles III and IV) have applied since 30 June 2024, and the rest of the regulation, including the crypto-asset service provider regime, since 30 December 2024, according to Article 149.
Does the MiCA calendar affect the issuance of security tokens?
No. Security tokens are financial instruments and Article 2.4 excludes them from MiCA. Their issuance is governed by Ley 6/2023 and MiFID II, with a prospectus or exemption and registration in an ERIR under RD 814/2023. No date in the MiCA calendar is a deadline for issuing a tokenized security.
Which MiCA dates are still pending?
Two dates set in the regulation itself: 30 June 2027, when the Commission must submit its report on the application of MiCA (Article 140), and 31 December 2027, the deadline for platforms to publish the white paper for crypto-assets admitted before 2025. The proposal for ESMA supervision is still in process.
