1. Old Regime - VASP Registration - Bank of Spain - No Insurance

From 2021 to 2024, providers of exchange between fiat-crypto and custodian wallet providers only had to register with Bank of Spain Registry D738 for AML purposes under Law 10/2010.

• No prudential capital
• No mandatory insurance
• No fund segregation
• No liability for loss

Bitstamp, Binance Spain etc were only VASP-registered. That's why multiple frauds happened.

2. New Regime - CASP Authorization - CNMV - Insurance Mandatory

Since MiCA, Spain means CNMV as National Competent Authority. All 97-106 existing VASP entities must obtain full CASP authorization by 1 July 2026.

Under MiCA Article 67 and Annex IV, every authorized CASP must maintain at all times Prudential Safeguards.

Form can be:

a) Own funds consisting of CET1 items under CRR Articles 26-30, OR
b) An insurance policy covering territories of Union where services provided, OR
c) Comparable guarantee, OR combination

Conditions for insurance policy under Article 67(4)(b):

Policy must cover specifically:

• Acts, errors or omissions
• Breach of legal and regulatory obligations
• Breach of duty to act honestly, fairly, professionally in clients' best interest
• Breach of confidentiality
• Business disruption and system failures
• Gross negligence in safeguarding clients' crypto-assets and funds
• Liability under Article 75 for custody loss

Territorial scope must cover all EU states where CASP passports services.

Capital / Insurance Amounts - Three Classes:

• Class 1 - €50,000: Reception/transmission of orders, advice, portfolio management
• Class 2 - €125,000: Execution, placing, exchange fiat-crypto, exchange crypto-crypto
• Class 3 - €150,000: Custody and administration, operation of trading platform

Minimum is higher of class floor OR one quarter of fixed overheads of preceding year.

MiCA explicitly allows CASPs to utilize insurance policies as alternative or supplement to holding own funds.

Practical Market Practice in Spain:

• Most CNMV applicants use own funds - insurance-based capital is rare in practice but legally available
• For custody, CNMV additionally requires Professional Indemnity Insurance + Custody Insurance. Example: Bit2Me - first CNMV-authorized CASP - discloses $150M insurance on custody with segregated cold storage and multisig + HSM FIPS 140-2
• For custodial providers, Article 75 MiCA imposes strict liability: CASP liable to client for loss of crypto-assets up to market value of loss, unless loss due to event outside reasonable control. This liability is insurable but must be maintained.
• Spanish implementation also applies DORA - Regulation (EU) 2022/2554 - CASPs are in DORA scope, requiring ICT risk insurance and business continuity.

3. What Insurance Must Cover - Spanish CNMV Checklist

When CNMV reviews application, it asks for:

1. Insurance certificate with ESMA-recognized insurer rated min A-
2. Coverage for all services in authorization request
3. Deductible not higher than 10% of own funds
4. Duration min 12 months with auto-renewal clause
5. No exclusion for cyber events, internal fraud, or employee dishonesty
6. Spain jurisdiction clause

4. Case Laws

Case 1: STS 2109/2019 - Supreme Court of Spain - Judgment 20 June 2019 - ECLI:ES:TS:2019:2109 - Bitcoin is NOT Money

First Supreme Court ruling on crypto.

Facts: Ponzi scheme involving bitcoin. Victims claimed restitution of bitcoins.

Supreme Court held: "Neither the so-called bitcoin is something susceptible to return, since it is not a material object, nor does it have legal consideration... Bitcoin is nothing more than an intangible asset, in form of account unit defined by computer and cryptographic technology"

Ratio for Insurance:

• Bitcoin = intangible asset of exchange, not legal tender, not electronic money under Law 21/2011
• Therefore for civil liability, damage must be compensated in fiat at market value at time of damage, not in kind. This directly determines insurance payout valuation method - insurer pays fiat equivalent, not restitution of coins. All Spanish custody insurance policies now drafted on this basis.

Case 2: Spanish Supreme Court - Digital Fraud Liability - Phishing / SIM Swapping - 2024

Supreme Court determined banks are liable for unauthorized transactions resulting from digital fraud, such as phishing or SIM swapping, unless they can demonstrate gross negligence on part of customer

Ratio for CASP: Although case about banks, CNMV applies same doctrine to CASPs under MiCA Art 75 - burden of proof on CASP to prove client gross negligence. Therefore insurance must cover unauthorized access, not just gross negligence of CASP. Most Spanish PI policies now include cyber fraud extension.

Case 3: Spanish Guardia Civil Dismantles €460M Crypto Fraud Network - 2024-2025

Spanish authorities with US HSI, Estonia, France dismantled network that defrauded 5,000 victims across 30 countries, laundering €460 million via shell companies and offshore platforms. Five arrests, $26M digital assets frozen.

Ratio: This is why Spain enforced early MiCA deadline and insurance. Court noted victims had no recourse because VASPs had no insurance or segregation. Under MiCA, if CASP insolvent due to fraud, client assets segregated and not part of bankruptcy estate + insurance covers shortfall.

Case 4: Eurojust €100M Crypto Scam - Spain, Portugal, Italy, Romania - Sept 2025

Law enforcement agencies coordinated by Eurojust and Europol dismantled €100M cross-border crypto investment scam defrauding 100 victims across 23 countries since 2018

Ratio: Cross-border enforcement difficulty. MiCA insurance must cover territories where services passported - Spanish CASP offering services in Romania must have Romanian coverage too.

5. What You Must Do if You Are CASP in Spain Today

If you are still VASP-only: You cannot operate after 1 July 2026. Apply to CNMV now - review period from 6 months. Need to file:

• Business plan + 3-year fixed overheads forecast
• Proof of own funds OR insurance binder meeting Art 67(4)
• Safeguarding policy, custody policy, conflict of interest
• DORA ICT risk management framework

Insurance Structuring:

• For Class 3 custody CASP, best practice: €150k own funds + €5-150M crime/specie insurance + €2M PI
• Insurers active in Spain: Lloyd's, Arch, Munich Re - crypto custody consortium
• Premium: 0.8% - 2% of limit depending on cold vs hot wallet ratio

Client Disclosure: Under CNMV rules, must disclose on website whether client crypto-assets are covered by insurance and limit per client.

Failure to maintain insurance = ground for withdrawal of authorization under Art 72 MiCA.