Legal Alert

1. Introduction

On Monday 22 December, two legal acts were published in the Portuguese official gazette (Diário da República): Law No. 69/2025 of 1 December, which ensures the implementation of Regulation (EU) 2023/1114 on markets in crypto-assets (the MiCAR implementing law), and Law No. 70/2025 of 1 December, which implements, within the domestic legal order, Article 38 of Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (the TFR implementing law).

With the publication of these two laws, the EU legal framework for crypto-assets—composed of the Regulation on markets in crypto-assets (MiCAR) and the Regulation on information accompanying transfers of funds and certain crypto-assets (TFR)—is now fully in force in Portugal. This means that crypto-asset service providers (CASPs) and entities wishing to offer crypto-assets to the public or to have crypto-assets admitted to trading on platforms may request authorisation from the local competent authorities to commence their activities. It also puts an end to uncertainty surrounding the provision of services in Portugal by entities already licensed in other Member States.

This note provides a general overview of both implementing laws, their background and approval processes, their contents and their transitional periods.

 

2. Background and approval

Although both the TFR and MiCAR were published on 31 May 2023, their provisions became applicable at different times. While the TFR entered into force just twenty days after publication, MiCAR followed a longer and phased rollout: certain provisions (notably those concerning asset-referenced tokens and e-money tokens) became applicable in June 2024, whereas the remaining provisions—most importantly, those applicable to CASPs—became applicable in January 2025.

Both instruments are EU regulations and therefore have direct applicability, not requiring transposition into national law. However, for their effective implementation, Member States were required to designate the national competent authorities responsible for supervision. In addition, the TFR amended provisions of Directive (EU) 2015/849, requiring Member States to amend their national AML/CFT legislation.

Most EU Member States approved their respective MiCAR and TFR implementing laws during 2024. Portugal did not, due to a snap parliamentary election held in March 2024, which resulted in a change of government. At the time, the government was preparing draft legislation and had already requested an opinion from the National Council of Financial Supervisors (Conselho Nacional de Supervisores Financeiros). However, the government’s failure to secure a confidence vote led to its dismissal and the scheduling of new elections in May 2025.

Following its reappointment, the government submitted two legislative proposals to Parliament in September 2025. After parliamentary debate and consultation with relevant stakeholders—such as business associations, consumer organisations, and financial supervisors—the laws were approved by a strong majority and published in December 2025.

Until the approval of the MiCAR implementing law, it was not possible to apply for MiCAR authorisation in Portugal. However, virtual asset service providers (VASPs) already registered with the Bank of Portugal were able to continue operating under the previously applicable framework.

 

3. The content of the laws

As noted above, MiCAR and the TFR are directly applicable EU regulations. Accordingly, the scope of intervention of the Portuguese legislator was limited. In the case of MiCAR, the implementing law primarily designates the national competent authorities and establishes the sanctions framework applicable to non-compliant market participants. In the case of the TFR, the legislator implemented the amendments introduced by Article 38, which modifies provisions of the Fifth AML Directive.

Overall, the Portuguese legislator did not go beyond this scope. With respect to MiCAR supervision, the implementing law assigns competence to two national authorities: the Bank of Portugal (Banco de Portugal – BdP) and the Portuguese Securities Market Commission (Comissão do Mercado de Valores Mobiliários – CMVM). Supervisory responsibilities are allocated as follows:

• The BdP is the competent authority for supervising Titles III (asset-referenced tokens) and IV (e-money tokens) of MiCAR. It is also responsible for supervising Chapters 1 (authorisation of CASPs), 4 (acquisition of CASPs), and 5 (significant CASPs) of Title V, as well as Articles 67 (prudential requirements), 68 (governance arrangements), 73 (outsourcing), and 74 (orderly wind-down of CASPs).
• The CMVM is the competent authority for supervising Title II (crypto-assets other than asset-referenced tokens and e-money tokens) and Title VI (prevention and prohibition of market abuse), as well as Chapter 3 of Title V (obligations in respect of specific CASPs) and Articles 66 (duty to act honestly, fairly, and professionally in the best interests of clients), 70 (safekeeping of clients’ crypto-assets and funds), 71 (complaints-handling procedures), and 72 (identification, prevention, management, and disclosure of conflicts of interest).

In broad terms, the BdP is responsible for supervision relating to the issuance of stablecoins (asset-referenced tokens and e-money tokens), for authorising CASPs, and for overseeing their prudential requirements and governance arrangements. It is also responsible for assessing acquisitions of CASPs and for supervising significant CASPs (i.e., CASPs with at least 15 million average users per year).

The CMVM, in turn, supervises the issuance of crypto-assets other than stablecoins (and not excluded from MiCAR’s scope under Article 2), as well as market abuse, particularly in relation to trading platforms. It is also responsible for supervising CASPs’ conduct-of-business obligations vis-à-vis their clients.

In effect, the MiCAR implementing law establishes a “twin peaks” supervisory model for the Portuguese crypto-asset market, with the BdP acting as the prudential supervisor and the CMVM as the market conduct supervisor. This represents a departure from Portugal’s traditionally sectoral model of financial supervision, under which different authorities exercise both prudential and conduct supervision within their respective sectors (banking and payments for the BdP; securities and foreign exchange for the CMVM; and insurance for the Insurance and Pension Funds Supervisory Authority). The law expressly requires the BdP and the CMVM to cooperate “closely” in all matters relating to the crypto-asset market.

The MiCAR implementing law also establishes rules concerning the knowledge and experience of CASP staff, as well as provisions on public interest class actions (ação popular), complaints handling, and alternative dispute resolution mechanisms.

As regards the TFR implementing law, the amendments provided for in Article 38 of the TFR are incorporated into the Portuguese AML/CFT framework (Law No. 83/2017 of 18 August), aligning it with the EU regulatory framework for crypto-assets.

 

4. Authorisation procedure for CASPs

Under the MiCAR implementing law, any entity wishing to provide crypto-asset services in Portugal must apply for authorisation from the BdP. The CMVM also participates in the authorisation process and must be notified by the BdP whenever an application for CASP authorisation is submitted.

Upon receipt of the application and notification, the CMVM must issue an opinion assessing whether the information submitted—particularly regarding certain internal policies, the applicant’s business plan, and compliance with Title V of MiCAR—is complete. The CMVM has between 10 and 15 business days to issue this opinion. Failure to do so is deemed to indicate that the CMVM has no objection to the granting of authorisation by the BdP.

The BdP must also inform the CMVM of any changes to the business activities of authorised CASPs, as well as of any cross-border provision of services. It may also request information from the CMVM concerning the market conduct of authorised CASPs.

 

5. Entry into force and transitional period

Both implementing laws entered into force on the day following their publication. However, MiCAR provides for a transitional period for VASPs already registered with the BdP to obtain full MiCAR authorisation. These entities have until 1 July 2026 to obtain a licence and may continue providing services until that date.

 

6. Conclusion

It took one year from the date on which MiCAR became fully applicable for Portugal to adopt the necessary implementing legislation. That process is now complete, and the Portuguese market is open to entities wishing to provide crypto-asset services or issue crypto-assets in Portugal.

At DLA Piper Portugal, we are available to assist clients in navigating this regulatory framework and in developing their activities in Portugal.