1. Regulatory Architecture in Spain

A. Pre-MiCA — AML Registry (2021-2025)
On 21 October 2021, Bank of Spain created the registry where service providers for exchange of virtual currency for fiat and custody of electronic wallets must register, as result of Royal Decree-Law 7/2021 of 27 April, transposing AMLD5 into Law 10/2010.

Key points:

• Registration was AML-driven and non-prudential: it did not entail solvency supervision or conduct-of-business oversight, and Banco de España expressly clarified registration did not amount to authorisation.
• Obliged subjects to SEPBLAC supervision.
• Closed on 1 July 2025 — Banco de España announced it closed registration for VASP providers following conclusion of transitional period under MiCA. Now MiCA authorization is mandatory.

B. Post-MiCA — MiCA Regulation (EU) 2023/1114

• Spain brings forward implementation — Royal Decree 4/2024 — effective 30 Dec 2024 for CASPs, 30 June 2024 for ART/EMT stablecoins.
• MiCA is first global standard regulating crypto-asset market holistically, establishing obligations for issuers and CASPs
• Decentralised Infrastructure: MiCA does not include aspects relating to decentralised finance such as decentralised lending. Fully decentralised protocols with no identifiable issuer or CASP are outside MiCA's direct scope, though European Commission must report on DeFi by Dec 2025. Decentralised services without intermediaries are not yet subject to MiCA.
• What IS covered: Centralized touchpoints — if staking or yield program has central operator promising returns or pooling investors' assets, authorities could consider it investment activity subject to regulation.

C. Spanish Banking Law Overlay

1. Law 10/2014 on Credit Institutions + Royal Decree 84/2015: Banks can provide crypto custody / exchange only if authorized as CASP under MiCA via CNMV, plus Banco de España prudential approval.
2. Basel Crypto Exposures: Once BCBS standards on prudential treatment of banks' crypto-asset exposures are implemented into EU law, they will work in conjunction with MiCA's provisions. Banks must apply 1250% risk weight to unbacked crypto, 250% to tokenized assets.
3. CNMV Circular 1/2022 on Crypto Advertising: Any mass campaign must include risk warning, be submitted 10 days prior.
4. DORA (EU 2022/2554) + PSD2: Banks using decentralised infrastructure (nodes, oracles) must treat them as critical ICT third-party providers.

2. How Spain Treats Decentralised Infrastructure — 3 Tests

Spanish regulator uses "Truly Decentralised" test from ESMA:

There are currently no specific laws or regulations applicable to DeFi platforms in Spain. DeFi platforms are designed to operate in decentralised manner, which means not managed by centralised authority.

But CNMV adds: If activity is largely unregulated and not explicitly classified, if it has central operator promising returns, it could be investment activity.

3. Case Laws and Enforcement

A. Spain Supreme Court — STS 326/2019, 20 June 2019 — Bitcoin as Movable Property
First Spanish Supreme Court case on Bitcoin. Court held Bitcoin is not legal tender, not electronic money under Law 21/2011, but intangible asset / movable property for criminal purposes. Cannot be considered money, but can be subject of fraud / misappropriation. This defines banking law perimeter — banks not obliged to accept, but theft of crypto is property crime.

B. Audiencia Nacional — Arbistar 2.0 Case (2020-2024) — Largest Spanish DeFi Ponzi
Arbistar SL marketed "Community Bot" — decentralized arbitrage bot promising 8-15% monthly. CNMV warned, SEPBLAC investigated. National Court charged founders with fraud, money laundering, criminal organization. Over 32,000 victims, €93M. Court ruled: Even if marketed as DeFi/decentralized infrastructure, presence of central company controlling wallets = centralized financial service requiring authorization under Law 10/2014 + Securities Market Law. Founders sentenced 2024.

Principle: Decentralized label does not exempt — substance over form.

C. CNMV vs. W2B / Mundo Crypto Sanctions (2022-2023)
CNMV sanctioned influencers and platforms for crypto advertising without risk warning under Circular 1/2022. Fines up to €300k. Established that even decentralized infrastructure promotion is regulated if targeting Spanish investors.

D. EU / Spain — BBVA & Renta 4 Banco — MiCA Transitional Licenses
Over 60 companies, including BBVA and Renta 4 Banco, are registered with Spain's CNMV to comply with MiCA's transitional requirements. BBVA became first major Spanish bank to obtain MiCA license for custody and execution in March 2025. Case shows banking law compliance path: Bank must obtain CASP license from CNMV, register with Banco de España for AML, comply with Basel prudential treatment.

E. SEC vs. Ripple / EU Parallel — How Spanish Courts Would Treat Tokens
Spanish Audiencia Provincial de Madrid (STS 2023) followed EU logic: Token that is derivative qualifies as financial instrument under MiFID II. Banks dealing in such tokens need MiFID license.

4. Compliance Checklist If You Are Bank / Fintech Building on Decentralised Infrastructure in Spain

1. Is your protocol truly decentralised? No party controls >50% governance tokens? No admin keys? No frontend collecting fees to company? If yes — outside MiCA. If no — apply to CNMV as CASP before 30 Dec 2025 transition end.
2. Bank exposure: Calculate prudential capital — unbacked crypto in DeFi LP = 1250% RW.
3. AML: Even if DeFi outside MiCA, Law 10/2010 still applies if you provide fiat off-ramp — must apply Travel Rule under MiCA Art 14 + EU AMLR 2024.
4. DORA: If you use decentralized nodes (Chainlink oracles, IPFS) as part of banking service, classify as critical ICT provider, have exit plan.
5. DAC8 Reporting: Spain will enforce DAC8 in 2026 — exchanges must report user transactions to AEAT.

In short: Spain says: Code alone is not regulated. Company operating code, custody, or promising yield is regulated as bank / CASP. The closing of Banco de España VASP registry on 1 July 2025 means there is no longer AML-only light regime — full MiCA authorization needed.