Spain's Bitcoin Custody Market After MiCA: Retail Banks vs. Wholesale Custodians

Every roundup of "which Spanish banks now offer crypto custody" makes the same mistake: it treats a MiCA authorization as a single, comparable credential. It isn't. Behind that one license sit two genuinely different businesses, and knowing which one you're dealing with matters more than knowing the license exists at all.

What actually ended on July 1

Until June 30, 2026, a provider could operate in Spain under a lighter pre-registration with SEPBLAC, Spain's anti-money-laundering authority. From July 1, full authorization under the MiCA Regulation became mandatory, either directly from Spain's CNMV or passported in from another EU regulator. CNMV's public registry, as of this writing, lists over 250 entities with the ability to operate in the country.

Who's authorized, and since when

BBVA moved first among Spanish credit institutions: authorized since March 2025, covering custody, execution, and transfers, the first major European bank to clear this bar. Cecabank and Openbank (the latter part of Grupo Santander) followed in July 2025, Renta 4 Banco in November, and CaixaBank and Kutxabank as recently as March 2026. On the crypto-native side, Bit2Me was authorized in October 2025, covering nearly the full range of services, custody included.

Treat these dates as a verified starting point, not a closed list. CNMV's registry updates with every new authorization — check the live registry before deciding where to custody anything, not a dated article.

The nuance almost nobody explains

Here's the actual problem with "institutional custody" as a phrase: it covers two business models with little in common. A bank like BBVA or Openbank custodies for its own retail or corporate client, a regulated, bank-wrapped version of what an exchange already does. Cecabank is something else entirely: a wholesale custodian, technical and operational infrastructure that other financial institutions contract instead of building their own custody stack. It reported over €400 billion in assets under custody at the start of 2026, serving more than 100 financial institutions across 70-plus countries, and almost none of that volume got there because an individual chose it directly.

That distinction changes the question worth asking. If your bank offers "crypto custody," the real question is whether it custodies the assets itself or subcontracts to a third party like Cecabank, and if it's the latter, who's actually accountable when something goes wrong.

What to ask before trusting an institutional custodian

With MiCA authorization now a baseline requirement (not a guarantee of anything beyond that baseline), the questions that actually matter are different: whether your crypto assets are segregated from the bank's own balance sheet (so they're excluded from the insolvency estate if the bank fails), which external audit certifies that segregation, and whether the actual custodian is the entity you signed with or an undisclosed subcontractor. None of those answers come bundled with a MiCA license. The license is the legal floor to operate, not a quality signal.

This doesn't replace self-custody, it complements it

None of this changes the underlying calculation we already covered in our practical Bitcoin management guide: an institutional custodian solves a real problem (compliance, insurance, operations at scale) but remains a third party holding your keys. For anyone who can operationally afford it, the most sensible split is still the one that predates MiCA entirely: real self-custody for most of it, and only what genuinely needs that level of institutional service handed to a custodian with clear audits and demonstrated segregation.

Want to check the sync status of our own Bitcoin node, the infrastructure behind everything we verify before publishing it? See it live in Network & Mining.

Last updated: September 15, 2026