Legal Alert | Implementation of the Markets in Crypto-Assets Regulation in Portugal

Background

On 9 December, Decree of the Assembly of the Republic No. 22/XVII was published, having been approved by the Assembly of the Republic on 5 December, which ensures the implementation in the Portuguese legal order of Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), and amends the the Portuguese Securities Code¹ and the Complaints Book Regime², (Implementation Act).

MiCA constitutes the first harmonised framework for the crypto-asset market and pursues key EU legislative policy objectives, namely:(i) financial stability; (ii)integrity and transparency of crypto-asset markets; and (iii) enhanced protection of investors and consumers.

The Implementation Act aims to:

• Designate the national competent authorities;
• Allocate supervisory competences;
• Detail investigatory and enforcement powers;
• Configure the administrative offence regime; and
• Establish the transitional regime for conversion from the previous virtual asset service providers’ model to the new crypto-asset service providers’ regime.

Supervisory model and allocation of competences

Designation of national competent authorities (NCAs)

The Implementation Act designates the Bank of Portugal and the Portuguese Securities Market Commission (Comissão do Mercado de Valores Mobiliários, CMVM) as National Competent Authorities (NCAs), establishing a functionally split supervisory model between both entities, based on the material distinction between prudential supervision and market supervision, under a mandatory cooperation and procedural coordination regime.

Authorisation applications for the provision of crypto-asset services must be submitted to the Bank of Portugal, which acts in coordination with CMVM.

Bank of Portugal’s competences

Under Article 2 of the Implementation Act, the Bank of Portugal is the “competent authority responsible” for: (i) supervision of Titles III and IV, of MiCA; and (ii) supervision of Chapters 1, 4 and 5, of Title V and Articles 67 to 69, 73 and 74, of MiCA.

This allocation covers:

       i. Titles III and IV, of MiCA:

• Title III: which refers to Asset-Referenced Tokens (ARTs);
• Title IV: which refers to E-Money Tokens (EMTs).

     ii. Title V, regarding Crypto-Asset Service Providers (CASPs), supervision of Chapters 1, 4 and 5, of Title V and specific articles:

• Chapter 1 of Title V: Authorisation and withdrawal of authorisation of CASPs;
• Chapter 2 of Title V: Obligations for all CASPs:

1. Articles 67 to 69: Prudential requirements, governance mechanisms and information to competent authorities;
2. Articles 73 and 74:Outsourcing and orderly wind-down of CASPs.

• Chapter 4 of Title V: Acquisition of CASPs;
• Chapter 5 of Title V: Significant crypto-asset service providers.

CMVM’s competences

Under Article 2 of the Implementation Act, CMVM is the “competent authority responsible” for: (i) supervision of Titles II and VI, of MiCA; and (ii) supervision of Chapter 3 of Title V and Articles 66 and 70 to 72, of MiCA.

This allocation of competences covers:

i) Titles II and VI, of MiCA:

• Title II: which refers to offers to the public and admission to trading of crypto-assets other than ARTs or EMTs;
• Title VI: which refers to prevention and market abuse related to crypto-assets.

ii) Title V, regarding CASPs, supervision of Chapter 3 of Title V and specific articles:

• Chapter 2 of Title V: Obligations for all CASPs:

1. Article 66: Duty to act with honesty, fairness and professionalism in the best interest of clients;
2. Articles 70 to 72: Safekeeping of clients’ crypto-assets and funds, complaints-handling procedure and identification, prevention, management and disclosure of conflicts of interest.

• Chapter 3 of Title V: Obligations relating to specific crypto-asset services, namely:

1. Custody and administration of crypto-assets on behalf of clients;
2. Operation of a trading platform for crypto-assets;
3. Exchange of crypto-assets for funds or for other crypto-assets;
4. Execution of orders for crypto-assets on behalf of clients;
5. Placing of crypto-assets;
6. Reception and transmission of orders for crypto-assets on behalf of clients;
7. Advice on crypto-assets and portfolio management of crypto-assets; and
8. Transfer services for crypto-assets on behalf of clients.

CMVM also ensures the application of the provisions of Title VI of MiCA to all acts concerning crypto-assets admitted to trading on a trading platform for crypto-assets having Portugal as home Member State.

Mandatory cooperation regime

Article 5 of the Implementation Act imposes on the Bank of Portugal and CMVM a close cooperation regime, with exchange of information on their own initiative or whenever requested, concerning all essential or relevant information for the exercise of supervisory functions. Both authorities shall establish mechanisms for cooperation and exchange of information regarding the oversight of compliance with obligations arising from MiCA.

Regime for access to activity and authorisation of CASPs

As mentioned above, authorisation applications for the provision of crypto-asset services must be submitted to the Bank of Portugal, which acts in coordination with CMVM.

Under Article 6 of the Implementation Act:

• The Bank of Portugal must forward to CMVM, within 2 business days, (i) the notifications submitted under Article 60 of MiCA (e.g., initial phase of communication of intention to provide services); and (ii) the formal authorisation applications submitted under Article 62 of MiCA;
• Following such communication, CMVM has the following statutory deadlines to issue a reasoned opinion:

                           i. 10 business days to opine on the completeness of the notifications submitted under Article 60 of MiCA, as well as to opine on the completeness of the authorisation applications submitted under Article 62 of MiCA;

                         ii. 15 business days, counted from receipt of the Bank of Portugal’s communication regarding the completeness of the application, to opine on compliance with the requirements set out in Title V of MiCA, for the purposes of granting or refusing authorisation.

CMVM’s silence: In the absence of an opinion by CMVM within the aforementioned deadlines, it shall be deemed that CMVM raises no objections as to: (i)the completeness of the notification; (ii) the completeness of the authorisation application; and (iii) the applicant’s compliance with the conduct and market obligations relevant for authorisation purposes.

The Bank of Portugal shall communicate to CMVM the final decision on authorisation, extension, reduction or withdrawal of authorisation for the provision of crypto-asset services, as well as subsequent material changes, namely regarding the composition of corporate bodies and qualifying holdings.

Transitional regime

The MiCA Implementation Act establishes a transitional regime for entities which, at the date of entry into force of the new framework, were registered with the Bank of Portugal under the previous regime applicable to entities carrying out activities with virtual assets (Virtual Asset Service Providers, VASPs).

VASP entities which, as at 30 December 2024, were (i) registered with the Bank of Portugal and (ii) had commenced activity duly notified, may continue to carry out the virtual asset activities for which they were qualified until 1 July 2026 or until the final decision on granting or refusing authorisation under MiCA, whichever occurs first, being treated, during that period, as CASPs for the purposes of application of MiCA and of the legislation and regulations applicable in matters of Prevention of Money Laundering and Financing of Terrorism.

During the transitional period, certain still-applicable provisions of Law No. 83/2017 of 18 August and of other legal and regulatory provisions in matters of Prevention of Money Laundering and Financing of Terrorism continue to apply to VASP entities with commenced and notified activity, as well as Bank of Portugal Notice No. 1/2023 of 24 January. Furthermore, such entities must notify the Bank of Portugal of any changes occurring regarding corporate name and denomination, registered office and place of management, jurisdictions where they operate and identification of members of management and supervisory bodies.

However, registration lapses automatically for entities which, as of 30 December 2024, were registered but had neither effectively commenced activity nor notified it in the legally required terms. Such entities are thereby barred from pursuing any activity related to virtual assets or crypto-assets, unless they obtain authorisation under the new MiCA regime.

Additionally, during the transitional period, previously granted authorisation lapses automatically should any change occur relating to:

1. Corporate object;
2. Type(s) of virtual asset activity to be carried out;
3. Holders of direct or indirect participations; and
4. Beneficial owners.

In such cases, the entity is immediately prohibited from continuing the activity, without prejudice to the possibility of obtaining authorisation under MiCA.

Under the Implementation Act, the following were also terminated:

• Initial registration application procedures pending as of 30 December 2024; and
• Registration amendment applications not yet decided on that date.

As regards registration cancellation procedures in progress on the same date, they shall continue until final decision.

Next steps

In particular, it should be noted that:

1. The new authorisation, supervision and sanctioning regime is applicable to crypto-asset service providers commencing activity after entry into force of the national framework;
2. Entities previously registered with the Bank of Portugal under the “virtual assets” regime benefit from a transitional regime until 1 July 2026, or until the final decision on their respective authorisation application under MiCA, whichever occurs first;
3. During the transitional period, certain obligations under the previous regime remain applicable on a complementary basis, namely in matters of prevention of money laundering.

In anticipation of full subjection to the MiCA regime, it is advisable that entities:

1. Determine their regulatory perimeter by identifying whether they qualify as CASPs, as issuers of crypto-assets and which concrete services they intend to provide under the new regime;
2. Commence preparation of the authorisation process with the Bank of Portugal, including definition of business model, governance structure, internal policies and compliance with regulatory requirements;
3. Adapt their internal compliance mechanisms to the new reporting duties to the authorities, complaints-handling, Alternative Dispute Resolution and prevention and detection of market abuse;
4. Review contracts with critical third parties, including, namely, ICT service providers, in order to ensure compliance with outsourcing, security and supervisory access to information requirements;
5. Ensure review of contractual documentation with clients, including terms and conditions, order execution policies, pre-contractual information, amongst others.

The new framework introduced by MiCA and the respective Implementation Act represents a structural change in the manner in which the crypto-asset sector operates in Portugal, requiring a preventive, planned and legally structured approach by operators.

Early preparation of the authorisation process and adaptation of operational models constitutes, in this context, a critical factor for business continuity and mitigation of regulatory and sanctioning risk.

_______________________