1. Regulatory Timeline Spain - From Warning to MiCA Licensing

Phase 1 - Warning 2018-2021:
Banco de España and CNMV joint communiqués: crypto not legal tender, no supervision. Bank of Spain notice Feb 10: "Spain has not yet passed any legislation in regard to cryptocurrency, and crypto exchange platforms are neither supervised nor authorized." Banks closing accounts of LocalBitcoins traders - BBVA, Pibank, Bankia named.

Phase 2 - AML Registry 2021-2024:
Royal Decree-law 5/2021 transposes Directive 2018/843. Banco de España runs registry for virtual-asset exchange/custody providers for AML purposes. Requirement: register if exchange fiat-to-crypto or custodian. No prudential supervision.

Phase 3 - MiCA Implementation:

• EU Regulation 2023/1114 MiCA entry into force 29 June 2023. Directly applicable, no transposition needed.
• National Law 6/2023, 17 March, Securities Markets and Investment Services - LMVSI: Art.251.h assigns supervision of CASPs to CNMV and prudential oversight of ARTs/EMTs to Banco de España.
• Phases: 30 June 2024 - ARTs and EMTs stablecoins rules apply. 30 Dec 2024 - full authorization for CASPs. Spain used maximum transitional period until 1 July 2026 - only authorized CASPs or passported firms can serve Spanish clients.

Institutional split:

• CNMV: Lead supervisor for CASPs, investment advertising.
• Banco de España: Supervises issuers of e-money tokens and asset-referenced tokens, and banks' exposure to crypto.
• SEPBLAC: AML/CTF.

As of mid-2026: CNMV received 77 applications, 20 authorizations. First exchange authorized July 2025 - Bit2Me. First banks authorized:

• BBVA - July 2025 - retail crypto desk 7 assets - first Spanish bank MiCA CASP
• Openbank - 11 Nov 2025 - MiCA licence July 2025
• Cecabank, Renta 4 Banco, Kutxabank, CaixaBank - March 2026 - CaixaBank sixth bank cleared.

Royal Decree 253/2025 adds reporting of cash withdrawals >€3,000 to detect crypto off-ramping.

2. Exchange Collapse Exposure Model - What Risk Do Spanish Banks Have?

a) No Direct Proprietary Trading - But Indirect via Clients:

Circular Banco de España - crypto does not meet criteria of electronic money per Law 21/2011. Therefore not balance sheet eligible. Spanish banks did not hold FTX tokens on balance sheet. Exposure was:

1. Client funds on exchange: Spanish retail clients had €8bn losses globally per FTX bankruptcy filing. Spanish banks as off-ramps - SEPA transfers to FTX - faced claims for failing to prevent scam.
2. Custody Model Post-FTX: New model to prevent FTX 2.0 - Binance + BBVA August 2025: Binance collaborates with BBVA to store customer assets in form of US Treasury bonds at BBVA, not on exchange. "Initiative aimed at consolidating trust after record fines and FTX bankruptcy... bankruptcy in 2022 and $4.3bn fine from US in 2023." BBVA becomes qualified custodian, bankruptcy remote.

This is MiCA Art.75 custody requirement: segregation, no reuse, bankruptcy remote.

b) Liability for Facilitating Fraud:

STS 571/2025, 9 April 2025 - PSD2 Liability Shift - Supreme Court:

"Banks are liable for unauthorised transactions resulting from digital fraud, such as phishing or SIM swapping, unless they can demonstrate gross negligence on part of customer."

Lower court application:

Juzgado Murcia 2024 - BBVA 5,977 euros: BBVA ordered to compensate customer for failing to fulfil responsibilities and take all possible steps to prevent client from being scammed. Court cites STS 571/2025 doctrine for fraud by usurpation of passwords.

Implication for exchange collapse: If client transferred to fraudulent exchange and bank did not trigger fraud alerts, bank may be liable under quasi-objective liability of Directive 2015/2366. Burden reversal Art.44.1 RD 19/2018: bank must provide verifiable records of each step in authentication.

3. Criminal Case Law - Exchange Collapse as Fraud

Spanish Audiencia Nacional has become EU hub for crypto fraud.

a) Arbistar - Largest Spanish Crypto Pyramid:

Alleged "Community Bot" automated arbitrage system that never existed. >1000 victims Spain.

• First investigation Juzgado Instrucción 3 Arona
• Then Audiencia Nacional accepts competence due to number of victims
• Appeals Chamber doubles sentences: Santiago Fuentes 16 years, Diego Fernández 11 years. Guardia Civil report traced Bitcoin wallets.

Doctrine: Crypto investment without real underlying activity = fraud Art.248 Código Penal.

b) STS 2109/2019, 20 June 2019 - Criminal Chamber - Bitcoin Not Legal Tender - Leading Case:

Supreme Court: "Bitcoin is not something capable of being returned since it is not material object, nor is it legal tender." For civil liability derived from crime, Bitcoin not legal tender, therefore restitution should take place in Bitcoin or equivalent amount of monetary contribution made. Fraud can arise in bilateral transactions where deceit lies in false tricks leading counterparty to believe certain qualities.

Cited in INSOL Europe database. Establishes that crypto fraud = traditional estafa, but restitution problematic.

c) Eurojust Operation 2023-2024 - €100m+ Fraud Network:

At request of Spanish and Portuguese authorities, Eurojust coordinated operation halting elaborate crypto investment fraud. Online platform defrauded over 100 victims Germany, France, Italy, Spain of at least €100m. Investigative Court 1 Audiencia Nacional + Anti-Corruption Prosecutor.

d) €460 Million Crypto Laundering Bust 2024:

Authorities dismantled sprawling laundering network. Statement: "Banks and payment providers who unknowingly facilitated group's transactions are now under microscope. Regulators made clear financial institutions have duty to detect and disrupt suspicious flows, particularly those involving virtual..." Shows banks' exposure not just civil but AML administrative - SEPBLAC sanctions.

e) Madeira Invest Club - Nov 2025 - 3000 victims:

Spanish crypto influencer arrested $300m pyramid scheme. CNMV had issued warnings. Shows failure of pre-MiCA warnings regime.

4. New MiCA Liability Regime for Banks as CASPs

From 1 July 2026, banks that are CASPs under MiCA have:

Art.75 MiCA - Custody: Must segregate client crypto, keep in bankruptcy-remote account, not reuse without consent, maintain insurance. BBVA- Binance Treasury bond model complies.

Art.70 MiCA - Conflicts: Must disclose if bank has exposure to exchange whose assets it custodies.

Art.79 MiCA - Best Execution: For banks offering crypto trading - BBVA, CaixaBank - must execute at best price, unlike pre-MiCA exchange.

Law 6/2023 Art. - Sanctions: CNMV can fine up to €5m or 3% turnover for operating without MiCA licence. Banco de España can fine for ART/EMT breaches.

Civil Liability: MiCA White Paper liability - issuer liable for false white paper. For banks as custodians, liability for loss of crypto unless proves loss due to external event beyond control - similar to CSDR.

5. Practical Exposure Management for Spanish Banks Now

Pre-MiCA model - Freeze account: BBVA, Pibank closing accounts suspected of crypto trading. Legally risky after RD 19/2017 basic payment account right.

Post-MiCA model - Onboard as CASP client:

1. Provide MiCA licence and passport
2. Use segregated custody at bank - BBVA model
3. Bank keeps verifiable SCA records per STS 571/2025 to defend against phishing claims when client loses funds on exchange
4. Report suspicious off-ramp >€3k per RD 253/2025

If exchange collapses, bank's exposure is limited to custody loss if bank reused assets or failed segregation - then bank liable under MiCA Art.75.