MiCA in Portugal: Highlights of the New Implementing Law

On December 22, Law No. 69/2025 (the “Law”) was published in the Official Gazette (Diário da República). The statute was approved by Parliament on December 5 and implements, within the domestic legal order, Regulation (EU) 2023/1114 on markets in crypto-assets (the “MiCA Regulation“), while also introducing amendments to the Securities Code and the Complaints Book Regime. The MiCA Regulation, fully in force since 31 December 2024, established new rules on the classification, issuance and admission to trading of crypto-assets, as well as on the provision of crypto-asset-related services.

The Law remains virtually unchanged from the Bill submitted by the Government on 16 September 2025, whose detailed analysis can be found in the newsletter “Proposal to implement the European Regulation on the Crypto-assets Market (MiCA) in Portugal”.  Only a few material changes are noted: (i) under Article 19 of the Law, failure to comply with lawful orders or mandates of the competent authority constitutes a very serious administrative offence; (ii) the regime set out in Article 24, concerning the disclosure of decisions imposing sanctions for one or more infringements provided for in the statute, is expanded and detailed; and (iii) the transitional period applicable to entities carrying out activities with virtual assets that, as of 30 December 2024, were registered with the Bank of Portugal with activity commenced and duly notified, is extended.

Objectives of the Statute

The implementation of the MiCA Regulation in Portugal has the following objectives (i) the protection of crypto-asset holders; (ii) the safeguarding market stability, as well as financial stability and the smooth functioning of associated payment systems; and (iii) the mitigation of risks, particularly to monetary policy, related to crypto-assets that aim to stabilize their price in relation to a specific asset or basket of assets.

Competent National Authorities

The Law designates the Bank of Portugal (the “BoP”) and the Portuguese Securities Market Commission (the “CMVM”) as National Competent Authorities, dividing supervisory powers between them.

Under the terms of the law, the BoP is responsible for:

• the authorization of Crypto-asset Service Providers;
• the acquisition of Crypto-asset Service Providers;
• Significant Crypto-asset Service Providers;
• matters relating to Asset-Referenced Tokens and E-Money Tokens;
• prudential requirements and governance mechanisms of Crypto-asset Service Providers; and
• outsourcing and the orderly wind-down of Crypto-asset Service Providers.

In turn, the CMVM is responsible for:

• supervising public offerings and the admission to trading of crypto-assets other than Asset-Referenced Tokens and E-Money Tokens;
• preventing and tackling market abuse related to crypto-assets;
• supervising compliance with the obligations applicable to all Crypto-asset Service Providers, namely duties of conduct and the safeguarding of crypto-assets and client funds; and
• supervising compliance with obligations relating to specific crypto-asset services, such as the custody and administration of assets on behalf of clients, the operation of a crypto-asset trading platform, the exchange of crypto-assets for funds or other crypto-assets, the receipt and transmission of orders relating to crypto-assets on behalf of clients, or the provision of crypto-assets advisory services.

The Authorization Regime for Crypto-asset Service Providers

The authorization regime for Crypto-asset Service Providers is based on a model of shared powers between the BoP and the CMVM, in line with the MiCA Regulation.

Under the Law, the authorization process begins with the submission of a notification or an application to the BoP, which communicates it to the CMVM. The CMVM must issue a reasoned opinion identifying any grounds that could prevent a favourable decision. It has a period of 10 days to do so when the opinion concerns the completeness of the notifications or authorisation applications submitted. The opinion for the purposes of granting or refusing authorisation must be issued within 15 days of receipt of the BoP’s communication confirming the completeness of the application.

If the CMVM does not respond within these deadlines, it is considered that no objections have been raised.

The BoP must inform the CMVM of its authorization decision, as well as of any revocation or amendment in relation to Crypto-asset Service Providers and must also notify the same entity of any relevant changes in the composition of the governing bodies and in the qualifying shareholdings of such providers.

Although Article 29 of the Law provides for the adoption of regulatory standards by the BoP and the CMVM regarding the authorization regime for Crypto-asset Service Providers, it is not expected that the guidelines of those authorities will materially diverge from the terms defined in the MiCA Regulation and other European legislation governing authorisation applications (Delegated Regulation (EU) 2025/304, Delegated Regulation (EU) 2025/305, and Delegated Regulation (EU) 2025/306).

The Transitional Regime

Applications for initial registration and amendment that were pending before the BoP on 30 December 2024, submitted under Law No. 83/2017, automatically expired when the Law came into force.

Registration cancellation procedures pending on the same date shall continue until a final decision is made.

Entities that were already registered but had not commenced their activity and duly notified the BoP of it by 30 December 2024, have had their registration expire and are now barred from carrying out activities with virtual assets until they obtain authorization under the terms of the regime.

Entities that, on 3 December 2024, were registered with Banco de Portugal under Law No. 83/2017, with their activities commenced and duly reported, may, under the terms of the Law, continue the activities for which they were authorized until 1 July 1 or until they are granted or denied authorization under the MiCA Regulation, whichever occurs first. The transition period established in the enacted Law is longer than that provided for in the Government’s initial proposal, under which the transition period would have ended on 30 December 2025.

During the transitional period, these entities are classified as Crypto-Asset Service Providers for the purposes of applying the MiCA Regulation and legislation on the Prevention of Money Laundering and Terrorist Financing.

During this period, these entities must also notify the Bank of Portugal of any changes relating to their name, brand, registered office, jurisdictions of activity, members of the management and supervisory bodies, as well as direct or indirect shareholders and their beneficial owners.

The occurrence of changes of another nature, namely regarding the corporate purpose, the type of activities carried out, or the shareholder structure, will result in the expiry of the registration and the consequent loss of the benefit associated with the transitional period.

Next Steps

With the publication and entry into force of the Law implementing MiCA in Portugal, it is advisable that the entities concerned adopt the necessary measures to adapt their organizational structure, internal processes, and respective documentation to the new regulatory framework.

Abreu Advogados’ Financial Law team is monitoring the implementation of the Law and is available to support entities covered by this regime, particularly in the authorization process and in adapting to the new legal and regulatory requirements.