Are crypto exchanges operating in Spain regulated?

Yes, and the framework changed recently. Until July 1, 2026, providers had to register with the Bank of Spain. Since that date, the competent authority is the CNMV, and any provider needs a CASP (Crypto-Asset Service Provider) authorization under the EU's MiCA regulation. Neither regime is a guarantee of solvency, but MiCA's mandate is broader -- it also covers client fund protection, not just anti-money-laundering checks.

Does Spain's MiCA rule apply to me if I'm not a Spanish citizen but I live there?

Yes. MiCA authorization requirements are tied to where the customer is located when using the service, not their nationality -- if you're resident in Spain, the same rules apply to any provider serving you, whether you're Spanish, American, British, or anything else.

What's the safest way to hold Bitcoin?

It depends what 'safe' means to you. Self-custody removes the risk of a third party failing, but shifts all the technical responsibility onto you. A regulated exchange or custodian reduces that responsibility, but adds counterparty risk. There's no universal answer.

What does 'not your keys, not your coins' mean?

That if you don't control the private key, your Bitcoin is, in practice, a claim against whoever does control it -- it works as long as that entity keeps working and lets you withdraw.

Is institutional custody only for companies?

Not exclusively, but it's built for large holdings that prioritize a formal contractual and audit framework over the simplicity of a retail exchange or the full control of self-custody.

Three translucent structures floating side by side -- a hardware wallet, a columned building, and a shield -- each orbited by a golden Bitcoin coin, against a dark background with Japanese candlesticks — Original illustration generated with AI (Adobe Firefly) -- does not represent real data.

Bitcoin Custody in Spain: The Rules That Apply If You Live There or Hold Funds There

This isn't a generic "how to store your Bitcoin" guide. It's about what changes when Spain is the jurisdiction involved -- who's now allowed to custody your Bitcoin under Spanish and EU law, and how that interacts with the three ways of holding it yourself: self-custody, exchange, or institutional custody.

If you're a resident, an expat, or you're weighing a move to Spain with Bitcoin already in hand, the custody question comes with a layer most general guides skip entirely: what Spanish and EU regulation actually requires from whoever holds your keys for you. That framework changed substantially this year, and it's the real gap this piece fills -- the structural comparison of self-custody, exchange, and institutional custody matters everywhere, but the regulatory half is specific to Spain and changes what "regulated" even means here. Company names are deliberately left out: fees, coverage, and solvency shift over time, and a claim that's accurate today can stop being accurate tomorrow. What stays stable is the structure of each option -- and, since this year, the rulebook that sits on top of it.

Three ways to hold Bitcoin, one underlying question

Self-custody: nobody can stop you, and nobody can save you

A hardware or software wallet where you hold the seed phrase means no outside party -- not a company going under, not a government, not a hacker without your physical device -- can authorize a transaction without you. The flip side is symmetrical: there's no support line to call if you lose that phrase. Nothing recovers it for you. It's the option with the most control and, at the exact same time, the least room for error.

Exchange custody: you get convenience, they get the keys

Handing custody to an exchange trades control for ease of use. While the coins sit on the platform, they aren't yours in the sense that actually matters -- they're a ledger entry in someone else's database, and what you hold is a claim against that company, not the asset itself. That's fine for fast trading and zero key management, right up until the company can't honor withdrawals -- through insolvency, a breach, or a freeze -- and the claim turns out to be worth exactly as much as the company behind it.

Institutional custody: the same trust relationship, with a paper trail

An institutional custodian doesn't eliminate the trust problem an exchange has -- it's still not self-custody -- but it wraps it in a formal contract, periodic audits, and usually segregation of client assets from the custodian's own balance sheet. It exists for the holders (large individual portfolios, companies, funds) who'd rather pay for that verifiability than accept either a retail exchange's terms of service or the full operational burden of holding keys themselves.

Diagram with three columns -- Self-custody (you, directly, no middleman), Exchange (the company, you hold a claim against it), and Institutional (a regulated custodian, under contract and audit) -- answering the question 'who holds the key?' — Original diagram: the same question, three structurally different answers.

From the Bank of Spain registry to MiCA: what changed on July 1, 2026

Until this year, the rule in Spain was simple: any provider of virtual currency exchange or electronic wallet custody services operating in the country had to register with the Bank of Spain (Banco de España). That registry existed from 2021 and was built for anti-money-laundering compliance -- it never certified solvency and never protected customer funds.

That registry stopped being the legal basis to operate on July 1, 2026, when Spain's transitional period under the EU's Markets in Crypto-Assets Regulation (MiCA) ended. From that date, providers without a formal Crypto-Asset Service Provider (CASP) authorization from Spain's securities regulator, the CNMV (Comisión Nacional del Mercado de Valores), must stop offering exchange and custody services to customers in Spain. The Bank of Spain hasn't left the picture entirely -- it still supervises the issuance of stablecoins and other asset-referenced tokens -- but it's no longer the body that decides who's allowed to custody your Bitcoin.

If you're checking whether a provider is legitimate to use from Spain today, the list that matters is the CNMV's authorized-CASP registry, not a Bank of Spain registration that may already be stale.

What a CASP authorization under MiCA actually covers

The move from Banco de España to CNMV wasn't a change of letterhead. A CASP authorization under MiCA is built to cover the same ground securities regulators already cover for traditional brokers: minimum capital requirements, safeguarding and segregation of client assets, complaint-handling procedures, and ongoing solvency supervision -- not a one-time anti-money-laundering check and nothing else.

One detail worth knowing if you're comparing providers across borders: a CASP license issued by any single EU or EEA member state can be passported across the entire bloc, so a provider authorized in, say, France or Malta can legally serve customers in Spain without a separate Spanish license. What matters is that the authorization exists somewhere in the EU, not that the CNMV specifically issued it.

None of this changes the structural comparison above -- a CASP license is still a claim against a company, never self-custody. It just means that claim now rests on a meaningfully firmer regulatory floor than it did before this year.

What happens with each option if something goes wrong

With self-custody, "something goes wrong" is entirely on you: you lose the key, expose it, or die without a succession plan in place (see the inheritance guide for that last scenario). With an exchange or custodian, it can be entirely on them -- insolvency, a breach, withdrawal limits -- with no mistake of yours involved at all. Neither failure mode is objectively worse; they're different in kind, and picking a custody model is really picking which kind of failure you're willing to own.

How each option plays out for your heirs

Self-custody only survives you if you've already built an access path for your heirs -- redundancy, multisig, a digital-inheritance service -- because no will, Spanish or otherwise, can hand over a key nobody else can find (the dedicated guide covers this in full). An exchange or institutional custodian runs a recognizable succession process instead, closer to a bank account: a death certificate, the right paperwork, a claim the company processes. The tradeoff is the same one that shows up everywhere else in this comparison -- you're trading your own responsibility for dependence on that company still existing and cooperating when your heirs need it to.

Which one actually fits your situation

There's no single right answer here, and any comparison claiming otherwise is oversimplifying. A workable rule of thumb: the more you hold and the more comfortable you are with the technical side, the more self-custody pays off; the less technical you are, or the more you need fast liquidity, the more an exchange makes sense; and past a certain size, institutional custody's paper trail starts to matter more than either option's convenience. Plenty of people end up splitting their holdings across more than one of the three, matched to what each portion of their Bitcoin is actually for.

Whichever custody model you use, it's worth knowing exactly what's sitting in the addresses you do control yourself. You can check any of them with the address analyzer.

Last updated: 2026-07-29