CASP License in Portugal (2026): Cost, Timeline & Requirements

Portugal has quietly become one of the most watched destinations for crypto firms seeking an EU foothold. A single CASP authorisation obtained in Lisbon passports across all 30 EEA countries, the regulator has now approved its first MiCA licences, and the Madeira tax regime offers a corporate income tax rate as low as 5% for qualifying activity. But the window for an easy transition is closing fast: Portugal's MiCA transitional period ends on 1 July 2026.

This guide walks through exactly how to obtain a CASP license in Portugal in 2026 — who actually grants it (a point most online guides get wrong), what the application requires, the capital you must hold, how long it takes, what it costs, and where the Madeira angle helps. It is written for crypto-asset firms, founders, and compliance teams planning an EU entry or a transition from a national VASP registration.

Who actually authorises a CASP in Portugal?

Here is the single most common error in online guides: CASP authorisation in Portugal is not granted by the CMVM alone. Portugal operates a *twin-peaks* supervisory model.

• **Banco de Portugal (the central bank) is the authority that grants the CASP authorisation** and supervises prudential requirements, governance, qualifying holdings, outsourcing, and orderly wind-down.
• **The CMVM (Comissão do Mercado de Valores Mobiliários) is the conduct co-supervisor** — responsible for conduct-of-business rules, safeguarding of client assets, conflicts of interest, complaints handling, and market abuse. The CMVM issues a binding **reasoned opinion** during the authorisation process, but it does not issue the licence.

This division was set by Portugal's MiCA implementing law, Lei n.º 69/2025 of 22 December 2025 (in force 27 December 2025). A companion law, Lei n.º 70/2025, implements the Transfer of Funds Regulation (the crypto "Travel Rule").

Before MiCA, crypto firms operated under a registration regime: they registered as Virtual Asset Service Providers (VASPs) with Banco de Portugal under Law 83/2017 and Bank of Portugal Notice 3/2021. That regime is now superseded by the MiCA CASP framework — and, in June 2026, Bison Bank became the first firm to obtain a full MiCA CASP authorisation in Portugal, granted by Banco de Portugal with a favourable CMVM opinion.

The 1 July 2026 transitional deadline

Portugal adopted the full MiCA transitional ("grandfathering") period permitted under Article 143(3) — the EU-wide maximum. In practice:

• Firms that were **registered as VASPs with Banco de Portugal as of 30 December 2024** (and had begun operating) may continue providing crypto-asset services until the **earlier of** (a) a Banco de Portugal decision on their CASP application, or (b) **1 July 2026**.
• **New entrants** — firms that were not already registered — do not benefit from any transition and need a CASP authorisation before they can serve clients.

After 1 July 2026, operating without a CASP licence (or a valid passport from another Member State) is the unauthorised provision of crypto-asset services across the EU. If you are relying on the transition, your application needs to be with the regulator well before the deadline — not on it. See our guide to the [MiCA 1 July 2026 deadline](/blog/mica-1-july-2026-deadline-casp-wind-down-final-countdown) for the wind-down mechanics.

What you need to apply (MiCA Article 62)

A CASP application is a substantial dossier. Under Article 62 of MiCA, an applicant must submit, among other items:

• the applicant's name, legal form, **LEI**, registered and head-office address (which must be in the EU), and website;
• a **programme of operations** setting out the crypto-asset services to be provided and how they will be marketed (typically a three-year outlook);
• a description of **governance arrangements** and internal organisation;
• proof of the **good repute and suitability ("fit and proper")** of the management body — at least **two persons** must effectively direct the business;
• the identity of **shareholders or members with qualifying holdings (≥10%)** and proof of their good repute;
• **internal control mechanisms, risk-management procedures, and business-continuity** arrangements;
• **AML/CFT** policies, controls, and procedures;
• a description of **ICT systems and security arrangements** (aligned with DORA);
• where the firm will hold client assets, the **custody and segregation** arrangements for client crypto-assets and funds;
• **complaints-handling** procedures and a **conflicts-of-interest** policy;
• service-specific information (for example, operating rules for a trading platform, or a safekeeping policy for custody).

ESMA's technical standards provide templates for the programme of operations, the prudential plan, and the fit-and-proper files. Our free [CASP authorization checklist](/tools/casp-authorization-checklist) tracks each of these items.

How much capital you must hold (Annex IV + Article 67)

MiCA sets a minimum capital floor by service class, under Annex IV. The classes are cumulative:

| Class | Minimum capital | Services covered |

|---|---|---|

| Class 1 | €50,000 | Reception & transmission of orders, execution of orders, placing, advice, portfolio management, transfer services |

| Class 2 | €125,000 | All Class 1 services plus custody & administration and exchange of crypto-assets |

| Class 3 | €150,000 | All of the above plus operating a trading platform |

But the floor is not the whole story. Under Article 67, a CASP must hold own funds equal to the higher of (a) the Annex IV minimum for its class, or (b) one quarter (25%) of the previous year's fixed overheads. A firm with high running costs will be driven by the overheads test, not the floor. Use our free [MiCA capital calculator](/tools/mica-capital-calculator) to work out which figure applies to your firm.

How long it takes (Article 63 timeline)

MiCA sets a statutory clock in Article 63:

• **Within 5 working days** of receiving the application, the authority acknowledges receipt.
• **Within 25 working days**, it checks the application is **complete**. If anything is missing, it sets a deadline for the applicant to provide it — the clock effectively pauses until the file is complete.
• **Within 40 working days** of receiving a **complete** application, the authority must take a **reasoned decision** to grant or refuse authorisation, and notify it within 5 working days.
• The 40-day assessment can be **suspended** while the authority requests further information, with **each suspension capped at 20 working days**.

In Portugal there is an additional internal step: Banco de Portugal consults the CMVM, which issues its opinion (reported at roughly 10–15 business days, with silence treated as favourable).

The realistic total is longer than the statutory clock suggests. Because the 40-day decision window only starts once the file is deemed complete — and most applications go through one or more rounds of questions — practitioners typically budget around six to eight months end-to-end for Portugal, including pre-filing preparation. Treat that as a planning estimate, not a guarantee.

How much it costs

There is no single headline price for a CASP licence. The real cost has three parts:

• **Regulatory capital.** You must hold the own-funds figure above (at least €50,000, €125,000, or €150,000 depending on your class, or 25% of fixed overheads if higher). This is capital you hold, not a fee you pay.

• **Professional and advisory fees.** Legal counsel, the programme of operations and prudential plan, AML and ICT policy drafting, and fit-and-proper files. For a full CASP application these market fees commonly run into the **tens of thousands of euros** and vary widely with the firm's complexity and service mix — confirm scope with your advisers.

• **Supervisory fees and ongoing compliance.** Banco de Portugal sets the applicable application and ongoing supervision fees; confirm the current schedule directly with the regulator. Then budget for ongoing compliance staff, audits, ICT resilience (DORA), and AML monitoring.

We deliberately do not quote a fixed "licence fee" figure — anyone who does is usually quoting an advisory package, not an official tariff.

The Madeira (MIBC) tax angle

Madeira's International Business Centre (MIBC / Free Trade Zone) offers a reduced corporate income tax (IRC) rate of 5% on qualifying income — well below mainland Portugal's standard rate. Because Madeira is part of Portugal, a CASP authorised by Banco de Portugal can be established there.

Two important caveats:

• **The benefit is conditional on substance.** A company must meet MIBC requirements — broadly, creating **one to five jobs in the first six months and investing at least €75,000 in fixed assets within two years**, or creating **six or more jobs** with no minimum investment. Benefits are also capped relative to headcount and gross value added.
• **The regime has deadlines.** New entities can be licensed into the MIBC regime only **until 31 December 2026**, and the 5% rate for already-licensed companies is guaranteed **until 31 December 2033** under the current EU state-aid approval.

Whether your specific CASP model qualifies for the MIBC rate is an activity- and substance-specific question. Treat the 5% rate as *potentially* available, conditional on MIBC licensing and genuine substance — and take qualified Portuguese tax advice before relying on it.

One licence, the whole EU/EEA (passporting)

The reason a Portuguese licence is attractive is passporting. Under Article 65, a CASP authorised in one Member State can provide its authorised services across the entire EU/EEA. The firm notifies its home authority (Banco de Portugal) of the services and host states; Banco de Portugal forwards the notification to the host regulators and ESMA; and the firm can begin cross-border services after a 15-working-day notification period. Host states cannot block the passport. One authorisation in Portugal therefore reaches all 30 EEA countries.

AML obligations

Every MiCA-authorised CASP is an obliged entity under the EU anti-money-laundering framework. The new AML Regulation (AMLR) and AMLD6 apply from 10 July 2027, harmonising customer due diligence, beneficial-ownership, and reporting rules across the EU; the Travel Rule already applies to crypto transfers. In Portugal, Banco de Portugal has been the AML/CFT supervisor for crypto firms and continues in that role within its perimeter. The new EU Anti-Money Laundering Authority (AMLA) — operational in Frankfurt since July 2025 — will directly supervise only a small group of selected high-risk cross-border entities from around 2028; the large majority of CASPs remain under national AML supervision applying the harmonised rules. Our [EU AML package guide](/blog/eu-aml-package-2024-explained-amlr-amld6-amla) covers this in depth.

Frequently Asked Questions

Who issues a CASP license in Portugal?

Banco de Portugal grants the CASP authorisation and supervises prudential requirements, while the CMVM acts as conduct co-supervisor and issues a reasoned opinion during the process. Portugal uses a twin-peaks model set by Lei 69/2025; the CMVM does not issue the licence on its own.

What is the deadline to get a CASP license in Portugal?

Portugal adopted the full MiCA transitional period, which ends on 1 July 2026. VASPs registered with Banco de Portugal as of 30 December 2024 may continue until a decision on their application or 1 July 2026, whichever is earlier. New entrants need authorisation before serving clients.

How much capital do I need for a CASP license in Portugal?

The MiCA minimum is €50,000 (Class 1), €125,000 (Class 2, which adds custody and exchange), or €150,000 (Class 3, which adds operating a trading platform). Under Article 67 you must hold the higher of that floor or one quarter of your previous year's fixed overheads.

How long does CASP authorisation take in Portugal?

The statutory clock under Article 63 is up to 40 working days from a complete application, after a 25-working-day completeness check, with suspensions of up to 20 working days for additional questions. In practice, firms typically budget around six to eight months end-to-end including preparation.

Can a CASP licensed in Portugal operate across the EU?

Yes. Under MiCA's passporting regime (Article 65), a CASP authorised in Portugal can provide its services across all 30 EEA countries after notifying Banco de Portugal, which forwards the notification to host regulators. Host states cannot block the passport.

Does the Madeira 5% tax rate apply to crypto firms?

Madeira's International Business Centre offers a 5% corporate income tax rate for qualifying activity, and a Portugal-authorised CASP can establish there. But the rate is conditional on substance (job creation and investment) and MIBC licensing, new entities can join only until 31 December 2026, and crypto eligibility is activity-specific — take qualified tax advice before relying on it.

Plan your CASP application with FinlexPro

A CASP application touches MiCA, DORA, and the EU AML package at once — across primary regulation, ESMA technical standards, and Portuguese implementing law. FinlexPro lets compliance and legal teams search 2,700+ EU regulatory documents in context and work through free tools like our [CASP authorization checklist](/tools/casp-authorization-checklist) and [MiCA capital calculator](/tools/mica-capital-calculator). If you are planning a Portugal entry or transitioning from a VASP registration before 1 July 2026, start with the primary sources — and let FinlexPro help you read them in context.

*This article is for general information and does not constitute legal or tax advice. Verify all dates, fees, and obligations against official sources — EUR-Lex, ESMA, Banco de Portugal, the CMVM, and the IBC of Madeira — and seek qualified Portuguese legal and tax counsel for your specific situation.*