Banking Law and Initial Coin Offerings Regulation in Spain

1. Introduction

An Initial Coin Offering (ICO) is a method of raising capital in which an issuer offers digital tokens or crypto-assets to investors, often using distributed-ledger or blockchain technology.

In Spain, ICO regulation has changed substantially because of the EU Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114. MiCA now provides the principal regulatory framework for many public offerings of crypto-assets that are not already regulated as financial instruments. Spain's Law 6/2023 on Securities Markets and Investment Services complements this European framework and designates the Comisión Nacional del Mercado de Valores (CNMV) as an important competent authority.

The first question in any Spanish ICO is therefore not simply:

“Is this an ICO?”

The legally important question is:

What type of token is being issued, and which regulatory regime applies to it?

2. Basic Structure of an ICO

A simplified ICO may operate as follows:

Promoter/Issuer

↓

creates blockchain-based token

↓

publishes offering information/white paper

↓

offers tokens to investors

↓

investors contribute money or other permitted assets

↓

issuer uses capital for its proposed project.

The token might provide access to a service, represent economic rights, maintain a stable value by reference to other assets, or have characteristics resembling traditional securities.

Its legal classification determines the applicable rules.

3. Current Spanish Regulatory Structure

Spain does not regulate every token through one single domestic “ICO Act.”

Instead, several overlapping regimes may apply.

The most important are:

• Regulation (EU) 2023/1114 (MiCA);
• Spanish Law 6/2023 on Securities Markets and Investment Services;
• MiFID II and related securities rules where a token constitutes a financial instrument;
• anti-money-laundering legislation;
• consumer-protection rules;
• advertising requirements;
• data-protection rules;
• general contract and commercial law.

Law 6/2023 expressly adapted Spanish securities legislation to the emerging EU crypto-assets framework and designated the CNMV to supervise relevant crypto-asset issuance, offers and admission to trading.

4. MiCA and ICOs

MiCA represents the central change in European ICO regulation.

Its relevant rules have applied since 30 December 2024, while the provisions concerning asset-referenced tokens and e-money tokens became applicable earlier.

MiCA covers, among other things:

• public offers of crypto-assets;
• admission of crypto-assets to trading;
• crypto-asset white papers;
• marketing communications;
• asset-referenced tokens;
• e-money tokens;
• crypto-asset service providers;
• market abuse.

Spain's tax administration describes the post-December 2024 phase as including public crypto-asset offerings—ICOs—as well as transparency, service-provider supervision and investor-protection requirements.

5. Three Important Token Categories

MiCA essentially requires the legal classification of the crypto-asset before the regulatory consequences can be determined.

A. Ordinary MiCA Crypto-Assets

These are crypto-assets that are neither asset-referenced tokens nor e-money tokens and are not excluded from MiCA because another EU financial-services regime applies.

Many conventional ICO-style token offerings fall within this category.

B. Asset-Referenced Tokens

An asset-referenced token (ART) seeks to maintain a stable value by referring to another value, right, or combination of them, including one or more official currencies.

They are subject to significantly more extensive requirements.

C. E-Money Tokens

An e-money token (EMT) seeks to maintain a stable value by reference to the value of one official currency.

These tokens interact particularly closely with EU banking and electronic-money regulation.

6. Security Tokens and Financial Instruments

This distinction is critical.

A crypto-asset can be issued using blockchain technology but still qualify as a financial instrument.

If the token is legally a financial instrument, the analysis moves away from the ordinary MiCA Title II regime and into the established EU securities-law framework.

Law 6/2023 expressly recognises that financial instruments can be issued using distributed-ledger technology.

Consequently:

Blockchain technology does not determine legal classification.

Instead:

rights represented by token + economic function + legal characteristics = applicable regulatory regime.

7. Why This Matters to Banks

ICOs can interact with banking law even when the issuer itself is not a bank.

Banks may become involved through:

• payment accounts;
• custody arrangements;
• fiat transfers;
• financing;
• compliance controls;
• AML monitoring;
• tokenisation services;
• settlement infrastructure.

A bank therefore cannot assume that a transaction falls outside financial regulation merely because it uses crypto-assets.

The bank must identify the actual economic and legal nature of the activity.

8. Crypto-Asset White Paper

One of MiCA's most important ICO mechanisms is the crypto-asset white paper.

Depending upon the type of offering and applicable exceptions, the relevant offeror may need to prepare, notify and publish a white paper containing prescribed information.

Its purpose resembles, although it is legally distinct from, disclosure mechanisms in traditional securities markets.

Information can include matters relating to:

• the offeror;
• issuer where different;
• crypto-asset;
• project;
• offer;
• underlying technology;
• rights and obligations;
• relevant risks.

This addresses one of the central problems of ICO markets:

information asymmetry between promoters and purchasers.

9. White-Paper Notification in Spain

The CNMV has established procedures for MiCA white-paper notifications.

Since 23 December 2025, relevant Title II white-paper notifications use the applicable standardised format and template, including iXBRL requirements and the relevant ESMA taxonomy.

The CNMV performs technical and legal checks associated with the notification process.

This represents a significant movement away from the early ICO environment, where white papers were frequently little more than promotional documents.

Under MiCA, the white paper forms part of a formal regulatory disclosure framework.

10. White Paper Is Not the Same as Regulatory Approval

An important distinction must be maintained between:

notification/publication

and

regulatory approval.

For ordinary Title II crypto-assets, investors should not automatically interpret the existence of a MiCA white paper as meaning that the CNMV has certified that the token is commercially sound.

This is important from a banking-law perspective because disclosure regulation generally aims to ensure that material information is available; it does not guarantee investment performance.

11. Marketing Communications

ICO advertising is also regulated.

Marketing material must be consistent with applicable regulatory requirements and with the information supplied through required disclosures.

The policy objective is obvious.

An issuer should not be able to provide a legally cautious white paper while simultaneously using promotional material that gives potential purchasers a materially different impression.

Spain already had CNMV rules dealing with advertising of crypto-assets presented as investments before the full MiCA framework became applicable.

MiCA now provides a much more harmonised European framework.

12. Asset-Referenced Tokens

ARTs are more heavily regulated because of their potential financial-system significance.

MiCA contains requirements relating to matters such as:

• authorisation;
• governance;
• reserve assets;
• custody;
• communications;
• conflicts;
• recovery;
• redemption arrangements.

Spanish Law 6/2023 provides a domestic enforcement structure for breaches of MiCA requirements, including those concerning ART issuers.

13. E-Money Tokens

E-money tokens create an even stronger connection with traditional banking and payments regulation.

Because an EMT references one official currency, MiCA imposes specific issuer requirements and redemption-related rules.

Competence is also divided between Spanish authorities in certain areas. The CNMV has noted that it is the principal Spanish authority for MiCA supervision without prejudice to Banco de España's competences regarding issuers of e-money tokens and asset-referenced tokens.

14. ICOs That Are Financial Instruments

Suppose a company issues blockchain tokens representing rights economically equivalent to transferable securities.

Calling the instrument a “utility token” does not necessarily determine the legal result.

If legally classified as a financial instrument, securities-market requirements may become relevant, including potentially:

• MiFID II;
• prospectus regulation;
• market-abuse legislation;
• investment-services requirements;
• trading rules;
• Spanish Law 6/2023.

This produces a fundamental rule:

Substance is more important than the marketing label attached to the token.

15. Anti-Money-Laundering Regulation

Crypto-asset activities also create AML concerns because digital assets can move rapidly across borders and between technological platforms.

Spain historically required certain virtual-currency exchange and wallet-custody providers to register with Banco de España under the AML framework.

MiCA subsequently moved the European system toward comprehensive authorisation of crypto-asset service providers.

The CNMV explains that Spain's transitional arrangements allowed qualifying providers already operating under the previous national framework to continue temporarily while the MiCA authorisation system was implemented.

Thus the regulatory evolution can be simplified as:

AML-focused registration

↓

MiCA authorisation

↓

broader prudential, organisational and conduct supervision.

16. Crypto-Asset Service Providers

An ICO frequently depends on third parties providing services such as:

• custody;
• trading;
• exchange;
• placement;
• execution;
• transfer;
• advice;
• portfolio management.

MiCA establishes the Crypto-Asset Service Provider (CASP) framework.

The regulatory focus therefore extends beyond the token issuer.

It can encompass the surrounding ecosystem through which tokens are distributed, traded and held.

17. Market Abuse

MiCA also introduces a market-abuse framework for crypto-assets admitted to trading or for which admission has been requested.

It addresses matters including:

• inside information;
• insider dealing;
• unlawful disclosure;
• market manipulation.

Spanish Law 6/2023 gives the Spanish enforcement framework teeth by classifying violations of relevant MiCA obligations as administrative infringements.

This represents another important convergence between traditional securities regulation and crypto markets.

18. Banking Risk

A Spanish bank interacting with an ICO or crypto business may face several categories of risk:

Legal risk — Is the token properly classified?

AML risk — Are transactions appropriately monitored?

Operational risk — Is the technological infrastructure reliable?

Counterparty risk — Is the issuer financially reliable?

Conduct risk — Are purchasers receiving appropriate information?

Reputational risk — Is the project misleading or poorly governed?

Regulatory risk — Does the activity require authorisation?

Accordingly, ICO regulation is increasingly connected with ordinary bank governance and risk-management systems.

19. Relevant Case Law

A qualification is necessary.

Because MiCA's ICO regime is relatively new, there are not yet six mature Spanish Supreme Court judgments interpreting MiCA ICO provisions themselves.

It would therefore be inaccurate to invent six “Spanish MiCA ICO cases.”

Instead, the most relevant jurisprudence comes from EU crypto cases and established Spanish Supreme Court authorities concerning investment-product disclosure, financial-instrument information duties and investor protection. Those principles provide useful context for understanding how Spanish courts approach technologically new financial products.

Case 1 — Skatteverket v David Hedqvist, C-264/14

The CJEU delivered this important cryptocurrency judgment on 22 October 2015.

Hedqvist intended to operate a service exchanging traditional currencies for bitcoin and vice versa.

The Court held, in the context of the EU VAT Directive, that transactions exchanging traditional currencies for bitcoin constituted supplies of services for consideration and fell within the relevant VAT exemption for currency transactions.

Importance

This was one of the earliest major CJEU decisions acknowledging that cryptocurrency transactions could have identifiable legal consequences within existing EU financial and tax legislation.

For ICO regulation, the broader lesson is:

The use of blockchain does not place an economic transaction outside existing law.

20. Case 2 — Spanish Supreme Court, Judgment 451/2018 of 17 July 2018

This case concerned subordinated obligations rather than cryptocurrency, but it establishes an important investor-information principle.

The Supreme Court found that merely having purchase orders was insufficient to satisfy the applicable legal information obligations where the customer had not been properly informed about the product's nature, characteristics and risks.

ICO Relevance

MiCA's white-paper and marketing requirements pursue a comparable regulatory objective:

investor decision

should follow

meaningful risk information

rather than merely formal acceptance of a transaction.

The case does not itself interpret MiCA, but its disclosure logic is highly relevant when comparing traditional and tokenised investment markets.

21. Case 3 — Spanish Supreme Court, Judgment 373/2018 of 20 June 2018

This judgment concerned subordinated obligations and the calculation of investor losses.

The Supreme Court held, in substance, that where the amounts ultimately obtained by the investor—including returns—exceeded the initial investment, there was no compensable net financial loss on the relevant liability theory.

ICO Relevance

The case illustrates an important distinction between:

regulatory breach

and

recoverable financial damage.

If future ICO litigation alleges inadequate disclosure, proving a regulatory violation does not necessarily answer every question concerning causation and damages.

22. Case 4 — Spanish Supreme Court, Judgment 3919/2019

This Supreme Court decision concerned a complex derivative associated with mortgage financing.

The Court recognised that inadequate information concerning matters such as early-cancellation consequences and costs could be legally significant when determining whether the customer's consent was affected by error.

ICO Relevance

Crypto-assets can also have technically complex economic characteristics.

The underlying investor-protection principle is important:

Disclosure must address economically material risks, not merely identify the product.

An ICO white paper containing extensive technical language may therefore still fail its regulatory purpose if legally required material information is omitted or misleading.

23. Case 5 — Spanish Supreme Court, Judgment 3944/2019

This case also involved complex swap products.

The Supreme Court emphasised the special information duties applicable when financial institutions market complex investments and considered the absence of transparent pre-contractual information significant.

ICO Relevance

The decision predates MiCA and does not regulate tokens.

Nevertheless, it illustrates Spain's established judicial approach to financial complexity:

greater complexity increases the practical importance of understandable information.

That principle provides useful background for MiCA's extensive crypto-asset disclosure system.

24. Case 6 — Spanish Supreme Court, STS 2461/2022, 22 June 2022

This case concerned the acquisition of Bankia shares and inaccurate information contained in the public offering documentation.

The Supreme Court considered that the investor did not possess privileged alternative information capable of correcting inaccuracies or omissions in the published material. The inaccurate public information therefore affected the investor's understanding of the shares' value.

ICO Relevance

The analogy with ICO white papers is particularly useful.

Investors in public offerings commonly depend upon information supplied by issuers.

The regulatory objective is therefore:

accurate disclosure

↓

informed investment decision

↓

better market integrity.

Again, the case concerns securities rather than MiCA tokens, so it should not be represented as directly interpreting MiCA.

25. Case 7 — Spanish Supreme Court, Judgment 1274/2024 of 10 October 2024

The Supreme Court considered damages arising from the marketing of complex structured financial products where information obligations had allegedly been breached.

The judgment addressed how financial loss should be determined after the investment had matured and the investor retained underlying reference securities.

ICO Relevance

The case illustrates that investor-protection litigation involves several separate questions:

1. Was there an information obligation?
2. Was it breached?
3. Did the breach cause the investor's loss?
4. What is the actual economic loss?
5. What value remains with the investor?

Those questions could likewise become important in future Spanish crypto-asset disputes.

26. Classification Before Offering

The most important compliance exercise for an ICO is therefore classification.

A simplified decision tree is:

Proposed Token

↓

Is it a financial instrument?

YES → Securities/MiFID framework

NO → Continue MiCA analysis

↓

Is it an asset-referenced token?

YES → ART regime

↓

Is it an e-money token?

YES → EMT regime

↓

Otherwise → MiCA Title II may apply, subject to scope and exemptions.

This classification should occur before public marketing begins.

27. Role of the CNMV

The CNMV is central to Spanish crypto regulation.

Its responsibilities under the Spanish/MiCA framework include relevant supervision concerning:

• crypto-asset offerings;
• admission to trading;
• white-paper notifications;
• CASPs;
• market conduct;
• market abuse;
• enforcement.

Law 6/2023 provides the Spanish statutory basis for these supervisory and sanctioning functions.

28. Role of Banco de España

Banco de España remains relevant particularly where crypto activity intersects with:

• banking;
• payments;
• electronic money;
• certain stablecoin issuers;
• AML legacy registration arrangements.

The regulatory structure is therefore not:

Crypto = CNMV only.

Instead, responsibilities depend on the activity and type of crypto-asset.

29. Liability for Misleading Information

ICO disclosure regulation would be ineffective if issuers could knowingly provide inaccurate information without consequences.

MiCA therefore establishes responsibility associated with required white-paper information.

Spanish Law 6/2023 additionally establishes an enforcement and sanctions framework for breaches of MiCA obligations, including serious violations involving omissions, inaccuracies or misleading information in crypto-asset placements.

Consequently, promoters should treat a white paper as a regulatory document rather than merely promotional copy.

30. Banks Participating in Token Offerings

Banks themselves may increasingly participate in tokenised financial markets.

Law 6/2023 expressly accommodates financial instruments represented through distributed-ledger systems and supports Spain's participation in the EU DLT Pilot Regime established by Regulation (EU) 2022/858.

Therefore:

traditional banking

and

blockchain finance

are no longer necessarily separate legal categories.

The decisive question is the regulated financial activity being performed.

31. Spain's Current MiCA Position

As of September 2026, MiCA is fully applicable, and Spain's transitional period for qualifying pre-existing crypto service providers ended on 1 July 2026. The CNMV states that from that date only providers authorised by the CNMV or another competent EU authority may provide MiCA-regulated crypto-asset services in Spain.

This is important because Spain has now moved beyond the principal transitional phase.

The regulatory model has effectively changed from:

limited national registration

to

EU-wide authorisation and supervision.

32. Practical ICO Regulatory Model

A Spanish ICO can therefore be analysed through the following sequence:

1. Design token

↓

2. Determine legal classification

↓

3. Determine whether MiCA or securities law applies

↓

4. Identify issuer/offeror requirements

↓

5. Check applicable exemptions

↓

6. Prepare required disclosure/white paper

↓

7. Notify competent authority where required

↓

8. Ensure compliant marketing

↓

9. Use appropriately authorised service providers

↓

10. Apply AML controls

↓

11. Observe market-abuse requirements

↓

12. Maintain continuing compliance.

33. Case-Law Summary

These Spanish Supreme Court authorities should be treated as analogical investor-protection jurisprudence, not falsely described as MiCA ICO decisions.

34. Conclusion

Banking Law and Initial Coin Offerings Regulation in Spain has evolved from a relatively fragmented framework into a substantially harmonised EU regulatory system.

The central framework is now MiCA, complemented by Spanish Law 6/2023, securities legislation where tokens qualify as financial instruments, AML requirements, consumer rules and banking/payment regulation.

The most important legal principle is:

Do not regulate the name “ICO”; regulate the legal and economic substance of the token and activity.

Accordingly:

ordinary crypto-asset → MiCA

asset-referenced token → enhanced MiCA ART requirements

e-money token → MiCA + strong electronic-money/banking connection

financial-instrument token → securities/MiFID framework

crypto service → CASP authorisation framework

The case law also shows why disclosure remains central. Although mature Spanish MiCA-specific ICO jurisprudence is still limited because the regime is new, established Spanish Supreme Court decisions concerning complex financial products and public offerings demonstrate the importance of accurate information, understandable risk disclosure, informed consent, causation and properly calculated investor losses. MiCA effectively brings those traditional investor-protection concerns into the European crypto-asset market.