The new cryptocurrency registry that Hacienda and the Police will be able to consult

The “new regulation on the registration of crypto-asset accounts” you refer to does not appear as a law with that exact title, but it is mainly being structured through the Bill 121/000060, which transposes the European directive DAC8 and reforms the General Tax Law and other regulations to strengthen the information and registration obligations related to crypto-assets and financial accounts. This is currently the central piece of the registration and information framework on crypto-assets in the parliamentary setting.

With the available information, the situation is as follows:

1. What the regulation is and its relation to the “registration of crypto-asset accounts”

The Congress is processing the Bill modifying Law 58/2003, of December 17, General Tax Law, regarding prescription, collection, mutual assistance, and information obligations; Law 35/2006 on Personal Income Tax and Law 29/1987 on Inheritance and Gift Tax (file 121/000060, Government author).

Its explanatory statement makes clear that this law:

• Transposes Directive (EU) 2023/2226 (DAC8), which strengthens the automatic exchange of tax information on crypto-assets, electronic money, and other alternative payment means.
• Introduces a new additional provision in the General Tax Law that will establish, with subsequent regulatory development, information supply obligations, due diligence, and, where applicable, registration for certain crypto-asset service providers, as well as a specific sanctioning regime.
• Updates the terminology from “virtual currencies” to “crypto-assets” in information obligations on balances and operations, including those located abroad, and adapts the infringement and sanction regime.

In other words, it does not create a “single registry of crypto-asset accounts” by that name, but it does establish the legal framework so that the Tax Agency has a strengthened framework for registration and information on crypto-asset accounts and operations, aligned with DAC8 and the European crypto-asset Regulation (MiCA).

2. Phases already completed in the Congress of Deputies

According to the initiative’s file in the Congress of Deputies:

• It is a government bill, submitted to the Cortes after approval by the Council of Ministers (the Treasury had already announced this content in its notes on DAC8 for 2024 and 2025, detailing the new information and due diligence obligations on crypto-assets).
• It was admitted for processing and published in the Official Bulletin of the General Courts on June 13, 2025, opening the corresponding amendment period.
• The deadline for submitting amendments closed on October 29, 2025.
• On December 3, 2025, the referral to Plenary was published, meaning it was agreed that the final approval in Congress would not be solely in the hands of the Commission, but that the Commission’s report must be submitted to the Plenary of Congress before being sent to the Senate.

Additionally, parliamentary press (for example, several pieces from Demócrata in October 2025) confirms that the Plenary already rejected Vox’s total amendment that sought to return the bill to the Government. This means that the processing of the law continued, opening the period for amendments to the articles and work in the Commission.

3. Current status of the processing

With the latest official milestones available, the bill is:

• Under processing in the Congress of Deputies, once:
  • the total debate was overcome (attempt to return rejected),
  • the deadline for amendments to the articles closed, and
  • the referral to Plenary was agreed.
• There is no record yet, in the consulted information, of its submission to the Senate nor its final approval and publication in the Official State Gazette (BOE), so as of the available data, the regulation continues its parliamentary course in the Commission of Treasury and Public Function and is pending:
  • preparation and approval of the Committee report,
  • debate and voting of the Commission’s opinion, and subsequently
  • debate and voting in the Plenary of Congress, before moving to the Senate.

4. How it fits into the general crypto-asset framework

This bill adds to the direct application of the MiCA Regulation and to national developments such as the circulars of the CNMV and communications from the Bank of Spain, which have already been defining registries and obligations for crypto-asset service providers. But, regarding specifically the registration and information on crypto-asset accounts and balances, the core of the parliamentary reform is the Bill 121/000060, still under processing in the General Courts.

If you have another specific initiative in mind (for example, linked to the future Law on digitalization and modernization of the financial sector), it would be advisable to indicate its official title to distinguish it from this DAC8 transposition.

In recent Spanish legislation, the National Securities Market Commission (CNMV) is established as the competent authority to apply Regulation (EU) 2023/1114 (MiCA) concerning certain crypto-assets and their service providers, completing and adapting the domestic framework to that European regulation.

Basic regulatory framework

The central piece is Law 6/2023, of March 17, on Securities Markets and Investment Services (text in BOE). This law:

• Introduces the necessary adaptations for the application of the Regulation on crypto-asset markets, expressly designating the CNMV as the competent authority for supervising the issuance, offering, and admission to trading of certain crypto-assets that are not financial instruments.
• Establishes a infringement and sanction regime so that the CNMV can exercise the powers granted by MiCA.

This framework is further developed by regulations, including:

• Royal Decree 815/2023, of November 8, on official CNMV registries, cooperation with other authorities, and supervision of investment service companies (link), relevant for how registries and cooperation are structured.
• CNMV circulars, such as Circular 1/2024, on advertising of crypto-assets as investment objects (link), issued under article 247 of Law 6/2023.

Powers regarding crypto-asset service providers

Under MiCA and Law 6/2023, the CNMV’s functions regarding crypto-asset service providers (CASPs) operating in Spain can be grouped as:

• Authorization and registration: the CNMV is the authority that receives and evaluates authorization requests from providers offering services on crypto-assets that are not financial instruments (custody, management of trading platforms, crypto-to-crypto exchange, advisory, etc.). Authorization implies inclusion in the CNMV’s official registries, regulated by Royal Decree 815/2023.
• Ongoing supervision: it must monitor compliance with requirements on solvency, internal organization, corporate governance, risk management, safeguarding of crypto-assets and client funds, conduct rules, and conflict of interest management imposed by MiCA and Law 6/2023 on these providers.
• Control of informational documents and advertising: within MiCA’s scope, the CNMV supervises white papers and other informational documents related to crypto-asset issuances and public offerings under its competence, and internally controls advertising of crypto-assets presented as investment objects, with the power to require modifications, suspend campaigns, and sanction breaches.
• Intervention and sanction powers: Law 6/2023 incorporates the sanctioning regime necessary to enforce the supervisory powers foreseen in MiCA, including the ability to impose fines, order cessation of activities, or limit certain services.
• Revocation and corrective measures: the CNMV can revoke authorization or cancel registration of a provider when requirements are not met, serious infringements occur, or conditions under which it was authorized are lost, as well as impose corrective or early intervention measures.

Subject scope and coordination with the Bank of Spain

The CNMV’s scope focuses on:

• Issuance, offering, and admission to trading of crypto-assets that are not financial instruments, as defined by Law 6/2023.
• Providers offering investment services or “investor-type” crypto-asset services (platforms, custody, crypto-to-crypto exchange, etc.).

In parallel, Spanish anti-money laundering regulations continue to require registration of certain providers (e.g., virtual currency to fiat currency exchange) with the Bank of Spain. This necessitates CNMV–Bank of Spain coordination:

• Through cooperation and information exchange mechanisms provided in Law 6/2023 and Royal Decree 815/2023.
• Via functional distribution of powers: the CNMV focuses on investor protection and market integrity in crypto-assets; the Bank of Spain on payment system stability and prudential compliance of credit and payment institutions.

Differences compared to other financial intermediaries

In terms of supervisory tools (authorization, registration, inspection, information requirements, sanctioning), the CNMV’s powers over crypto-asset providers resemble those exercised over traditional investment service companies, developed in Law 6/2023 and Royal Decree 813/2023 (link).

However, there are relevant differences:

• The specific regime derives from MiCA, not from the MiFID Directive, and adapts to the technological and operational nature of crypto-assets and distributed ledger infrastructures.
• The boundary between “crypto-asset–financial instrument” and “non-financial crypto-asset” determines whether the classic MiFID regime or MiCA applies, although in both cases the CNMV is the reference authority in Spain.

In summary, the CNMV assumes a central role in the authorization, supervision, and possible revocation of crypto-asset service providers in Spain, integrating the new European MiCA framework into the traditional financial supervision scheme and coordinating with the Bank of Spain and anti-money laundering authorities.

From July 1, 2026, the authorization of crypto-asset service providers (CASP) before the CNMV is governed by Regulation (EU) 2023/1114 (MiCA), which is directly applicable, and by the Spanish securities market framework, particularly Law 6/2023 on Securities Markets and Investment Services, and its regulatory development (including Royal Decree 815/2023 on CNMV registries and supervision). Rather than a single procedure, it involves meeting a coherent set of prudential, organizational, and client protection requirements.

1. Authorization and scope of activity

Any entity wishing to provide in Spain services included in MiCA (custody and administration of crypto-assets, management of trading platforms, crypto-fiat or crypto-crypto exchange, order execution, order reception and transmission, crypto-asset advisory, etc.) must:

• Request authorization as a crypto-asset service provider before the CNMV, precisely indicating the services it intends to provide.
• Establish itself as a legal entity with registered office and central administration in the EU (in practice, if the CNMV grants authorization, in Spain).
• Register in the CNMV’s official registries once authorized, according to Law 6/2023 and Royal Decree 815/2023, which regulate such registries and supervision.

2. Capital, solvency, and insurance requirements

MiCA requires CASPs to have:

• Minimum initial capital, the level of which depends on the type of service provided (higher, for example, for operating trading platforms or custody services). This capital must be fully paid up and maintained continuously.
• Ongoing own funds sufficient to cover activity risks, similarly to the prudential regime of other financial entities, complemented by the CNMV’s general supervisory tools provided in Law 6/2023 and Royal Decree 815/2023.
• Where applicable, professional civil liability insurance or equivalent guarantees, when required by technical regulation, to cover damages from operational or custody failures.

3. Corporate governance and internal organization

The applicant must demonstrate a solid and proportionate organization:

• Clear governance structure, with administrative bodies responsible for risk policy, internal control, and regulatory compliance.
• Independent control functions (risk, compliance, and, where appropriate, internal audit) equipped with resources and direct access to the administrative body.
• Written procedures for all key areas: client onboarding, order execution and settlement, safeguarding of crypto-assets and client funds, conflict of interest management, business continuity, and technological incident management.
• Robust IT systems and controls, appropriate to the digital nature of the business, including cybersecurity management, backups, environment segregation, and operation traceability.

4. Integrity and competence of administrators and significant shareholders

In line with Law 6/2023 on investment services, the following are required:

• Integrity and good governance of members of the administrative body and senior management, implying absence of relevant records, adequate professional history, and responsible financial behavior.
• Sufficient knowledge and experience in financial services, technology, and risk management related to crypto-assets.
• Evaluation of significant shareholders: any acquirer with a relevant participation must be assessed by the CNMV, following criteria similar to those for other financial entities (suitability, source of funds, impact on prudent management of the CASP).

5. Client protection and asset safeguarding

CASPs must demonstrate compliance with strict conduct and investor protection requirements:

• Asset segregation between client assets and those of the CASP itself, both for crypto-assets and fiat funds, and updated records allowing identification of ownership at all times.
• Clear, understandable, and non-misleading information and transparency policies about risks, fees, platform operation, and the nature of offered products.
• Best execution and order management procedures, including rules for priority and matching of operations on platforms.
• Claims management and extrajudicial mechanisms to resolve conflicts with clients.

6. Regulatory compliance, anti-money laundering, and supervision

Finally, it is essential to:

• Fully integrate anti-money laundering and counter-terrorism financing obligations, with KYC policies, transaction monitoring, and suspicious activity reporting.
• Establish a reporting framework to the CNMV, with periodic submission of financial, risk, and activity information, in line with Law 6/2023 and Royal Decree 815/2023.
• Accept and facilitate the exercise of the CNMV’s supervisory and inspection powers (information requests, on-site inspections, corrective measures, and, if necessary, sanctions).

In practice, preparing the application requires compiling a complete file (business plan, internal manuals, organizational chart, suitability certificates, financial statements, and projections) that allows the CNMV to verify that the CASP is capable of operating prudently and adequately protecting its clients from July 1, 2026, onwards.