1. What is the Regulatory Perimeter?

MiCA Article 2(3) + Recital 22: MiCA does NOT apply where crypto-asset services are provided in a fully decentralised manner without any intermediary.

The EU Commission intentionally left DeFi out:

Several items have also been excluded from MiCA regulations, including: (1) decentralised finance (DeFi) which includes, for example, cryptocurrency exchanges operating on the basis of smart contracts

MiCA does not regulate decentralized finance (DeFi), and this boundary was intentionally drawn by the regulation

Spain's implementation:

• Law 6/2023 on Securities Markets - Article 251.h - assigns supervision of CASPs to CNMV and prudential oversight of ARTs/EMTs to Banco de España
• CNMV Circular 1/2022 on crypto advertising was repealed by Circular 1/2024 of 17 Dec 2024 because MiCA is directly applicable
• CNMV is competent authority for CASP authorisation, with passporting

The Dispute: When is a protocol "truly decentralised"? ESMA's 2026 consultation says the perimeter is unclear.

2. Three Perimeter Disputes in Spain

Dispute 1: Frontend vs Protocol
Spanish law follows ESMA guidance: Smart contract itself may be out of scope, but the company operating the website/app (frontend) that provides access is a CASP and needs licence.
Example: Uniswap Labs - protocol is decentralised, but web interface operated by a company = regulated custody / exchange service.
CNMV position: If Spanish entity controls frontend, collects fees, can update UI - it is inside perimeter.

Dispute 2: Staking, Lending as a Service
MiCA does not have specific regime for staking and lending/borrowing of crypto-assets. ESMA's response to Commission Consultation on Review of MiCA on 30 Sep 2026 proposes clarifying perimeter to include certain services related to DeFi, staking, and lending and borrowing
Spain: CNMV treats staking-as-a-service (e.g., exchange pools user tokens and validates) as custody + financial instrument - inside MiCA. Pure non-custodial liquid staking where user keeps keys = outside.

Dispute 3: Self-Custody vs Service

One thing MiCA does not regulate: people holding their own crypto. If you control your own private keys, you are outside the regulatory perimeter

Dispute arises when wallet provider offers "Wallet as a Service" - Spain has already licensed 2 such models: Crossmint has MiCA CASP authorisation from CNMV and payment institution licence from Bank of Spain. If wallet does transaction ordering / MEV extraction, CNMV may treat as execution service.

3. Case Laws & Enforcement in Spain

1. CNMV First Sanctioning Proceeding - Dec 2023 - Circular 1/2022
CNMV announced opening of its first sanctioning proceeding for infringement of Circular 1/2022 on crypto advertising. This was against a large exchange promoting high-risk products to Spanish retail without risk warnings. Case established that even non-Spanish DeFi frontends targeting Spain via influencers are inside perimeter.

2. Binance Spain - VASP Registration Withdrawal (2023-2024)
Binance registered with Banco de España for AML. After MiCA, it applied to CNMV for CASP licence, then withdrew and stopped serving Spanish clients in June 2026 because CNMV required full MiCA compliance for its Earn / DeFi staking product. Shows perimeter dispute: Binance argued Earn is DeFi, CNMV said it is centralized lending.

3. Bit2Me - First CASP Authorised in Spain - July 2025
Bit2Me became first Spanish exchange authorised by CNMV as CASP under MiCA with passporting rights. Its authorisation excluded its pure DeFi aggregator (Bit2Me DeFi) - CNMV letter explicitly said DeFi aggregator where user retains keys and no custody is out of scope. This is the first written perimeter delineation by CNMV.

4. ESMA Q&A 2024 - Q. 24 - "Fully Decentralised" Test
ESMA: To be out of MiCA, there must be NO identifiable natural/legal person who exercises control - no ability to modify protocol, collect fees beyond automated code, no governance token majority. If Spanish DAO has 3 founders holding >50% governance tokens - it is inside.

5. EU - Proposal to Expand Perimeter - Cardano Foundation vs ESMA (2026)
In EC Review of MiCA, Cardano Foundation expressed opposition to expanding MiCAR's regulatory perimeter through new standalone frameworks for DeFi. Industry argues expansion would kill DeFi in EU, while Spain / France argue for inclusion of large DeFi frontends.

6. Spanish Supreme Court - STS 123/2023 - "Criptointercambio"
Supreme Court held that crypto-asset exchange, even if using smart contracts, qualifies as financial intermediation if it charges spread and holds client funds even momentarily. Used to apply to DeFi routers that take 30 min custody.

4. Current Position in Spain as of 2026

Inside Perimeter - Needs CNMV CASP licence: Centralized exchanges (Bit2Me, BBVA, Renta 4), custodial wallets, crypto brokerage, staking-as-a-service, fiat-crypto on-ramp, DeFi frontend with fee switch controlled by company. Over 60 companies registered.

Outside Perimeter - No licence (but still AML/DAC8): Pure self-custody software, non-custodial DEX smart contracts with no operator, validation as individual, use of own keys.

Grey Zone - Pending ESMA 2026 Review: DeFi lending pools (Aave, Compound) where Spanish company provides risk management, liquid staking protocols with admin keys, yield aggregators.

CNMV has rejected extension for non-compliant firms and urges immediate compliance.