Crypto & Blockchain Regulation & Licensing in Portugal

Portugal has built one of Europe';s more structured regulatory frameworks for virtual asset service providers (VASPs), combining EU-level anti-money laundering directives with domestic licensing administered by Banco de Portugal (the Bank of Portugal). For any crypto or blockchain business seeking a European base, Portugal offers a defined registration pathway - but the compliance burden is substantial and the regulator applies rigorous scrutiny. This article maps the legal framework, registration process, ongoing obligations and key risks for international operators entering the Portuguese market.

Portugal';s primary instrument for crypto regulation is Law No. 83/2017 (Lei n.º 83/2017), which transposed the EU';s Fourth Anti-Money Laundering Directive (4AMLD) into domestic law and established the first obligations for virtual currency exchange operators. This was subsequently updated by Law No. 58/2020 (Lei n.º 58/2020), which transposed the Fifth Anti-Money Laundering Directive (5AMLD) and formally brought virtual asset service providers within the scope of obligated entities under Portuguese AML law.

The definition of a VASP under Portuguese law follows the Financial Action Task Force (FATF) standard: any natural or legal person that, as a business, conducts one or more of the following activities on behalf of another person - exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets or instruments enabling control over virtual assets, and participation in and provision of financial services related to an issuer';s offer or sale of a virtual asset.

Banco de Portugal is the competent supervisory authority for VASP registration and ongoing supervision. The Comissão do Mercado de Valores Mobiliários (CMVM, the Portuguese Securities Market Commission) retains jurisdiction over activities that qualify as financial instruments under the Markets in Financial Instruments Directive (MiFID II), such as security token offerings or crypto-asset derivatives. The distinction between these two regulatory tracks is not always obvious in practice, and a non-obvious risk is that a business structured as a simple exchange may inadvertently offer instruments that fall under CMVM oversight, triggering a separate and more demanding authorisation process.

Decree-Law No. 74-A/2017 (Decreto-Lei n.º 74-A/2017) further reinforced the supervisory powers of Banco de Portugal and established the administrative sanctions framework applicable to VASPs. Penalties for operating without registration or for material AML failures can reach several million euros, and Banco de Portugal has demonstrated willingness to use these powers.

The EU Markets in Crypto-Assets Regulation (MiCA), which entered into full application across EU member states in late 2024, now sits above this domestic framework. MiCA introduces a harmonised licensing regime for crypto-asset service providers (CASPs) and issuers of asset-referenced tokens and e-money tokens. Portugal';s domestic VASP registration regime continues to apply in parallel for activities not fully harmonised under MiCA, and the transition between the two frameworks requires careful legal mapping for each business model.

Registration with Banco de Portugal is mandatory before commencing any VASP activity in Portugal. Operating without registration constitutes an administrative offence subject to significant financial penalties and potential criminal referral. The registration process is not a mere notification - it is a substantive assessment of the applicant';s fitness, governance and compliance infrastructure.

The core conditions for registration include the following:

• The applicant must be a legal entity incorporated in Portugal or, for EU-based entities, must establish a branch or representative presence in Portugal.
• Beneficial owners, directors and key function holders must pass a fit-and-proper assessment, covering criminal record, financial integrity and professional competence.
• The entity must implement a documented AML/CFT (anti-money laundering and counter-financing of terrorism) programme compliant with Law No. 83/2017 as amended by Law No. 58/2020.
• A compliance officer must be appointed, with demonstrable qualifications in AML and financial regulation.
• The entity must maintain adequate internal controls, risk assessment procedures and transaction monitoring systems.

The application is submitted electronically through Banco de Portugal';s supervisory portal. The regulator has a statutory period of 60 working days to assess the application and issue a decision, though in practice the process often extends beyond this if the regulator requests supplementary information - which it frequently does for first-time applicants without prior regulatory experience in Portugal.

A common mistake made by international applicants is submitting a generic AML policy translated from another jurisdiction without adapting it to Portuguese law and the specific risk profile of the business. Banco de Portugal expects a risk-based approach that reflects the actual products, customer base, transaction volumes and geographic exposure of the applicant. A policy that reads as a template will typically generate a request for substantial revision, adding months to the timeline.

The costs of registration are not limited to the regulatory filing fee, which is modest. The real cost lies in legal and compliance advisory fees for preparing the application package, which for a well-structured submission typically start from the low tens of thousands of euros. Ongoing compliance infrastructure - transaction monitoring software, KYC (know your customer) platforms, staff training - adds further recurring cost.

Once registered, the entity appears on the public register of VASPs maintained by Banco de Portugal. This registration is a prerequisite for opening business bank accounts in Portugal, as Portuguese banks are themselves obligated entities and will not onboard unregistered VASPs.

To receive a checklist for VASP registration with Banco de Portugal, send a request to info@vlolawfirm.com

The Markets in Crypto-Assets Regulation (MiCA) represents the most significant structural change to crypto regulation in Portugal and across the EU. MiCA creates a single licensing framework for crypto-asset service providers, replacing the patchwork of national regimes for activities within its scope. A CASP licence granted by a competent authority in one EU member state - including Portugal - can be passported across all EU member states, making the choice of home jurisdiction strategically important.

Under MiCA, the competent authority in Portugal for CASP authorisation is Banco de Portugal for most service categories, with CMVM retaining jurisdiction over services more closely linked to financial instruments. The authorisation process under MiCA is more demanding than the previous VASP registration: it requires a detailed business plan, governance documentation, capital adequacy evidence, cybersecurity policies, client asset safeguarding arrangements and a recovery plan.

The minimum capital requirements under MiCA vary by service category. Operators providing custody and administration of crypto-assets must hold a minimum of EUR 150,000 in own funds. Operators of a trading platform for crypto-assets must hold EUR 150,000 or a quarter of fixed overheads of the preceding year, whichever is higher. Issuers of asset-referenced tokens face more complex capital and reserve requirements tied to the outstanding value of tokens in circulation.

Portugal';s existing VASP registrants benefit from a transitional period under MiCA, during which they may continue operating under the national regime while preparing a full MiCA authorisation application. This transitional period is time-limited, and businesses that delay the transition risk finding themselves operating without valid authorisation once the transitional window closes. The risk of inaction here is concrete: a business that misses the transition deadline must cease regulated activity until a full MiCA authorisation is granted, which can take six months or more.

In practice, it is important to consider that MiCA authorisation and VASP registration are not interchangeable. A business registered as a VASP under the national regime that begins offering services within MiCA';s scope - such as operating a crypto-asset trading platform or providing portfolio management in crypto-assets - must obtain MiCA authorisation separately. Continuing to rely solely on VASP registration for MiCA-covered activities constitutes a regulatory breach.

The business economics of MiCA authorisation in Portugal are significant. Legal and compliance preparation costs for a full MiCA application typically start from the mid tens of thousands of euros for a straightforward service model, rising substantially for complex multi-service operators. The benefit is a passport that eliminates the need for separate national registrations across 27 EU member states, which for a business with genuine pan-European ambitions represents a material commercial advantage.

AML/CFT compliance is not a one-time exercise for registration purposes - it is a continuous operational obligation enforced by Banco de Portugal through regular supervisory reviews, thematic inspections and on-site examinations. The legal basis is Law No. 83/2017 as amended, which imposes obligations that mirror those applicable to banks and other financial institutions.

The core ongoing obligations include:

• Customer due diligence (CDD) at onboarding and on a risk-sensitive ongoing basis, including enhanced due diligence for higher-risk customers and politically exposed persons.
• Transaction monitoring using automated systems capable of detecting unusual patterns, with documented escalation and investigation procedures.
• Suspicious transaction reporting to the Unidade de Informação Financeira (UIF, the Financial Intelligence Unit of Portugal), which operates within the Polícia Judiciária (the Portuguese Criminal Investigation Police).
• Record-keeping for a minimum of seven years, covering customer identification documents, transaction records and internal investigation files.
• Annual AML/CFT risk assessment updated to reflect changes in the business model, customer base and regulatory environment.

The FATF Travel Rule, implemented in Portugal through Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, requires VASPs and CASPs to collect and transmit originator and beneficiary information for crypto-asset transfers above EUR 1,000. This is a technically demanding requirement, as it necessitates integration with counterparty VASPs and CASPs to exchange Travel Rule data. Many smaller operators underappreciate the infrastructure investment required to comply with the Travel Rule, and non-compliance is an area of active supervisory focus.

A common mistake among international operators is treating Portuguese AML compliance as equivalent to compliance in their home jurisdiction. Portuguese law imposes specific requirements on the format and content of AML policies, the qualifications of the compliance officer and the frequency of internal audits. A compliance officer who is qualified in another jurisdiction but lacks knowledge of Portuguese law and the Banco de Portugal supervisory approach will frequently produce documentation that fails the regulator';s standards.

The sanctions for AML failures are graduated under Law No. 83/2017. Minor procedural breaches attract fines starting from several thousand euros. Systemic failures - such as inadequate transaction monitoring, failure to file suspicious transaction reports or absence of a functioning compliance programme - can attract fines reaching several million euros and, in serious cases, suspension or cancellation of registration.

Banco de Portugal publishes supervisory decisions and sanctions on its website, creating reputational consequences that extend beyond the financial penalty. For a VASP or CASP seeking banking relationships, investor funding or business partnerships, a published sanction can be commercially damaging in ways that far exceed the fine itself.

To receive a checklist for AML/CFT compliance for VASPs and CASPs in Portugal, send a request to info@vlolawfirm.com

Beyond the VASP and CASP licensing frameworks, blockchain technology raises distinct legal questions in Portugal that do not map neatly onto existing regulatory categories. Three areas deserve particular attention for international business operators: smart contracts, asset tokenisation and decentralised finance (DeFi).

Smart contracts are not expressly regulated under Portuguese law as a distinct legal instrument. However, the Portuguese Civil Code (Código Civil Português) and the general principles of contract law apply to obligations created or performed through smart contracts. A smart contract that meets the requirements of offer, acceptance and consideration under Portuguese law will be treated as a binding contract, regardless of its technical form. The practical challenge arises when a smart contract executes in a manner inconsistent with the parties'; intentions - Portuguese courts will apply general principles of contractual interpretation, which may produce outcomes that differ from what the code was designed to achieve.

Asset tokenisation - the representation of real-world assets such as real estate, receivables or equity on a blockchain - is an area of growing commercial interest in Portugal. The legal treatment of tokenised assets depends on the nature of the underlying asset and the rights conferred by the token. Tokens representing equity interests in a Portuguese company must comply with the Portuguese Companies Code (Código das Sociedades Comerciais), which governs share transfers, shareholder rights and corporate governance. Tokens representing debt instruments may fall under the Portuguese Securities Code (Código dos Valores Mobiliários) and CMVM oversight. Tokens representing real estate rights must comply with the Portuguese Land Registry Code (Código do Registo Predial), which requires notarial deeds and formal registration for property transfers - a requirement that blockchain-based transfers cannot currently circumvent.

DeFi protocols present the most complex regulatory challenge. A protocol that operates without a central operator and provides services equivalent to those of a VASP or CASP may technically fall within the scope of MiCA or the national AML framework, but enforcement against a decentralised protocol is practically difficult. Portuguese law does not yet have specific DeFi legislation. However, individuals or entities that develop, deploy or control DeFi protocols - even if they describe themselves as decentralised - may be treated as VASPs or CASPs if they exercise sufficient control over the protocol';s operation. This is an area where regulatory guidance is evolving rapidly, and the risk of retroactive reclassification is real.

Three practical scenarios illustrate the range of situations operators encounter:

A European fintech company launches a crypto exchange targeting Portuguese retail customers from a Malta-based entity. It does not register with Banco de Portugal on the basis that it operates from another EU member state. Under MiCA';s passporting rules, this may be permissible once the company holds a valid MiCA authorisation from the Malta Financial Services Authority. However, if the company is operating under a transitional national regime in Malta rather than a full MiCA authorisation, it cannot rely on passporting and must register with Banco de Portugal separately.

A Portuguese real estate developer seeks to tokenise a commercial property portfolio and sell tokens to international investors. The tokens confer fractional economic rights over rental income and sale proceeds. CMVM takes the position that such tokens constitute transferable securities under the Portuguese Securities Code, requiring a prospectus or an applicable exemption, and that the offering must comply with MiFID II distribution rules. The developer must engage CMVM before launch, not after.

A blockchain startup incorporated in Portugal develops a DeFi lending protocol and deploys it on a public blockchain. The founders hold administrative keys that allow them to pause the protocol or upgrade its smart contracts. Banco de Portugal';s supervisory approach would likely treat the founders as VASPs providing virtual asset transfer and custody services, requiring registration and AML compliance. Failure to register exposes the founders to personal liability under Law No. 83/2017.

Portugal';s tax treatment of crypto assets has evolved significantly and is now codified in the Portuguese Personal Income Tax Code (Código do IRS) and the Portuguese Corporate Income Tax Code (Código do IRC), following amendments introduced by the State Budget Law for 2023 (Lei do Orçamento do Estado para 2023).

For individuals, gains from the disposal of crypto assets held for less than 365 days are subject to personal income tax at a flat rate applicable to capital gains. Gains from crypto assets held for 365 days or more are exempt from personal income tax, which remains one of Portugal';s most commercially attractive features for long-term crypto holders. This exemption applies to straightforward buy-and-hold strategies but does not extend to income from crypto-asset staking, lending or mining, which is taxed as ordinary income.

For companies incorporated in Portugal, crypto-asset gains and losses are treated as ordinary business income and losses under the IRC, subject to the standard corporate tax rate. Companies must mark crypto assets to market at year-end and recognise unrealised gains and losses for tax purposes, which creates cash flow complexity for businesses holding volatile assets.

A non-obvious risk for international operators is the concept of Portuguese tax residency for individuals. A person who spends more than 183 days in Portugal in a calendar year, or who maintains a habitual residence in Portugal, becomes a Portuguese tax resident and is subject to Portuguese income tax on worldwide income, including crypto gains. The Non-Habitual Resident (NHR) regime, which historically offered favourable tax treatment for new residents, has been reformed and its benefits for crypto income are now more limited than they were before the 2023 amendments.

Value Added Tax (VAT) treatment of crypto transactions in Portugal follows the Court of Justice of the European Union';s established position: exchange of traditional currency for crypto-currency and vice versa is exempt from VAT under Article 135(1)(e) of the EU VAT Directive, as transposed into the Portuguese VAT Code (Código do IVA). However, services provided in exchange for crypto-currency - such as consulting, software development or goods sold for crypto - are subject to VAT in the normal way, with the crypto-currency valued at its market rate at the time of the transaction.

Transfer pricing rules under the IRC apply to transactions between related parties involving crypto assets, requiring that such transactions be conducted at arm';s length and documented in accordance with Portuguese transfer pricing regulations. This is frequently overlooked by international groups that treat intra-group crypto transfers as administratively simple.

We can help build a strategy for crypto tax structuring and compliance in Portugal. Contact info@vlolawfirm.com to discuss your specific situation.

What is the practical difference between VASP registration and MiCA authorisation in Portugal, and does a business need both?

VASP registration under the national AML framework and MiCA authorisation are distinct regulatory statuses with different legal bases, requirements and effects. VASP registration is an AML compliance measure that permits a business to operate in Portugal but does not grant passporting rights across the EU. MiCA authorisation is a full prudential and conduct licence that, once granted by Banco de Portugal or CMVM, allows the business to passport its services across all EU member states without separate national registrations. A business offering services within MiCA';s scope must obtain MiCA authorisation - VASP registration alone is not sufficient. During the transitional period, both statuses may coexist, but the transition to MiCA authorisation must be completed within the statutory deadline to avoid a regulatory gap.

How long does the VASP registration process take in Portugal, and what are the main causes of delay?

The statutory assessment period is 60 working days from receipt of a complete application. In practice, the process frequently takes four to eight months for first-time applicants. The most common causes of delay are incomplete or inadequate AML documentation, insufficient evidence of the compliance officer';s qualifications, and failure to demonstrate that the entity';s internal controls are proportionate to its risk profile. Banco de Portugal issues requests for supplementary information that pause the statutory clock, and each round of supplementary information can add six to ten weeks to the timeline. Applicants who engage experienced legal and compliance advisers before submitting the application consistently achieve shorter timelines than those who submit without specialist support.

When should a crypto business in Portugal consider engaging CMVM rather than Banco de Portugal as its primary regulator?

A business should engage CMVM as its primary regulator when its crypto-asset activities involve instruments that qualify as financial instruments under MiFID II or transferable securities under the Portuguese Securities Code. This includes security token offerings, crypto-asset derivatives, tokenised equity or debt instruments and portfolio management services involving crypto-assets that meet the definition of financial instruments. The boundary between Banco de Portugal';s jurisdiction and CMVM';s jurisdiction is not always clear from the business model alone - it requires a legal analysis of the rights conferred by the tokens or instruments involved. A business that misidentifies its primary regulator and registers with the wrong authority may find that its registration does not cover its actual activities, exposing it to enforcement action from the authority whose jurisdiction it failed to engage.

Portugal offers a defined and increasingly sophisticated regulatory framework for crypto and blockchain businesses, combining domestic VASP registration, MiCA authorisation and a tax environment that retains meaningful advantages for long-term holders. The framework is demanding: Banco de Portugal applies substantive scrutiny, AML compliance obligations are continuous and the transition to MiCA requires careful planning. Businesses that approach the Portuguese market with a well-prepared legal and compliance strategy can establish a durable European base. Those that underestimate the regulatory burden or delay the MiCA transition face material enforcement risk.

To receive a checklist for crypto and blockchain regulatory compliance in Portugal, send a request to info@vlolawfirm.com

Our law firm VLO Law Firms has experience supporting clients in Portugal on crypto and blockchain regulatory matters. We can assist with VASP registration, MiCA authorisation preparation, AML programme development, tax structuring and engagement with Banco de Portugal and CMVM. To receive a consultation, contact: info@vlolawfirm.com