A golden Bitcoin coin crossing the threshold of an open door with light pouring through it, against a dark background with blurred candlestick charts in orange and blue.
AI-generated illustration (FLUX.1-schnell, generated locally) — does not represent real data.

Buying Bitcoin in Spain as a Resident or Expat: The Register Check, the Tax-Residence Trap and the Withdrawal

NodeWitness Team 8 min read

For people who have already decided to buy and live in Spain, whatever their passport. It skips the platform rankings and covers what they leave out: how to verify a licence, why your tax residence decides where your data goes, and why the withdrawal to your own wallet is the step everything else depends on.

Since 9 October 2025, every bank in the euro area has been required to send instant SEPA transfers, and under the same regulation, as the European Central Bank summarises it, it may not charge more for them than for an ordinary transfer. English-language guides to buying bitcoin here lead with exchange rankings; we read several, and none explained how to confirm a MiCA licence, what DAC8 does with your data, or that the address you withdraw to should be used once. Those three gaps are this guide.

Before you pick a platform: two registers and one passport

This piece is the front door to our practical guide to managing Bitcoin in Spain, which assumes you already hold some. Self-custody, exchange and institutional custody are compared in the Spain custody guide, and what a bank's MiCA licence certifies is in the institutional custody piece.

Spain's MiCA transitional period ended on 30 June 2026. From 1 July, according to the CNMV's notice of 15 June, only a crypto-asset service provider authorised under MiCA may serve customers in Spain. The authorisation does not have to be Spanish: a licence from any EU regulator can be passported, so a platform authorised anywhere in the Union serves Spain legally once it has notified the CNMV.

The check needs no account. The CNMV's public list of crypto-asset service providers covers nationally authorised and passported firms alike, and points to ESMA's MiCA register for the EU-wide detail. We are not naming platforms: fees and solvency change; the register does not. If a firm is on neither list, stop there.

Whichever route you take, a licensed exchange, a bank or broker with a MiCA licence, a peer-to-peer platform or a bitcoin ATM, the first two always need the authorisation. For P2P and ATMs it depends on whether a company is providing the service, and a direct trade between two individuals sits outside the register and its protections.

KYC in Spain: your NIE, your residence, and where the data goes

Before you can deposit a euro, an authorised platform will identify you: passport or Spanish ID, your NIE if you have one, a liveness check, and often proof of a Spanish address, as anti-money-laundering rules require of every licensed firm.

What most expats miss is the second layer. Since 1 January 2026, under the EU's DAC8 directive, crypto-asset service providers operating in the Union collect their users' tax data and report it to the tax authority of the user's country of residence. Deadlines and what gets reported are in the Spain tax guide; what matters at signup is which country that is. The Agencia Tributaria's own criteria make you tax resident in Spain if you spend more than 183 days of the calendar year here, sporadic absences included, or if the main base of your economic activity is in Spain. If Spain is where you live for more than half the year, Spain is where the platform's report on you goes, whichever nationality is on the document you uploaded. How that interacts with your home country is a question for an adviser who knows both systems, not for this guide.

One more consequence shapes the last two sections: once you have passed KYC, the platform knows who you are, and every address you withdraw to from it inherits that link.

Funding and the first purchase: small, by transfer, with the real cost written down

Bitcoin divides into 100 million satoshis and every platform sells fractions, so there is no minimum. Size the first purchase so a mistake would not hurt: the point is to complete the whole cycle once, withdrawal included, before repeating it with money that matters.

Fund by SEPA transfer. Since October 2025 the bank leg is instant and, by law, no dearer than a standard transfer; a card payment routes through a network that takes its percentage, and the platform passes it on.

Then write down the real cost. A platform can advertise zero commission and earn its margin in the spread between the price it buys at and the price it sells to you. What you actually paid is the difference between the euros that left your bank and the market value of the satoshis you received at that moment.

The withdrawal is the point of the exercise

On the platform, what you hold is a claim against a company, not bitcoin on the chain. The custody guide explains what that claim is worth; for a first purchase the conclusion is short. If you have not withdrawn, you have not finished.

Diagram of five chained steps: choose a route, verify identity, buy, withdraw to self-custody, and store the seed; the fourth step, withdraw to self-custody, is highlighted in orange because the two steps after it depend on it.
Original diagram: five steps, and only one of them turns a balance at a company into bitcoin you control.

The withdrawal is your first on-chain transaction, where the two fees people confuse show up together. The platform charges a withdrawal fee it sets itself. The network charges a separate fee, the one miners collect for including your transaction in a block, and nobody sets that one: it depends on demand at that moment and is quoted in satoshis per virtual byte, not as a percentage. On 8 October 2026, NodeWitness's public API, which mirrors fee recommendations from public sources, returned 2 sat/vB for next-block confirmation and 1 sat/vB for the economy tier, unchanged from 11 September, when we wrote this. A simple withdrawal, one input and two outputs, is roughly 140 virtual bytes: at 2 sat/vB the network's share is about 280 satoshis, roughly 20 euro cents at today's price. In a demand spike that can rise a hundredfold, but it stays a public number you can check before pressing send; the platform fee is a price someone put in front of you.

You need a wallet of your own to withdraw to. The difference between a mobile app and a dedicated hardware device is where the private key lives: on a phone that is online or on a device that never is. For a small first purchase a well-chosen mobile wallet is enough to learn the cycle; when the amount starts to matter, the offline device stops being optional.

One address, one deposit

Your wallet will show a receiving address, which in a modern wallet begins with bc1. Copy it from the wallet itself, never from a message, and compare at least the first and last characters on the platform's screen before confirming.

Then the rule no first-time guide states: that address receives once, and is then left alone. Every payment received at the same address is publicly linked to every other, and because the first one came from a platform that knows your name, the rest inherit the link. Modern wallets generate a fresh address for each receipt for exactly this reason; our piece on address reuse explains what reuse exposes and how to check that your wallet already handles it. For your second purchase, ask for a new address. Every time.

And one habit that costs cents: make the first withdrawal for a token amount, wait until it lands, then withdraw the rest. A miscopied address has no undo.

What to keep, and what never to photograph

When you created the wallet it showed you 12 or 24 words. That seed phrase is the wallet. Anyone holding it can rebuild your keys on any device, and if you lose it, nobody can restore it for you: the same property that stops anyone freezing the funds stops anyone recovering them.

Write it by hand on paper or metal, and store it somewhere other than the device. No photo, no note in the phone, no entry in a password manager that syncs to the cloud. A screenshot ends up in your gallery, and in the automatic backup. If you are new to Spain and your belongings are still in two countries, decide now which one the paper lives in. The inheritance guide covers giving someone else access without exposing the phrase; for now, one physical copy whose location you know is enough.

First-purchase checklist, in order:

  1. Look the platform up in the CNMV list or ESMA's register. Absent from both: walk away.
  2. Complete KYC knowing the data reaches the platform and the tax authority where you are resident.
  3. Fund by SEPA transfer, an amount you can afford to lose while learning.
  4. Buy, and record the real cost: euros out versus value received.
  5. Install your own wallet and write the seed on paper before withdrawing anything.
  6. Copy the address from the wallet, compare characters, withdraw a token amount first.
  7. Withdraw the rest to a fresh address, not the same one.
  8. Confirm the physical seed copy exists and the phrase is on no screen.

Eight steps; the three that take longest (register, seed, test withdrawal) prevent the mistakes with no fix. The rest is form-filling.

Correction (October 8, 2026): an earlier version called 280 satoshis "a fraction of a euro cent". At this year's bitcoin price it is roughly 20 euro cents.

That first address is already public on the chain, and with KYC behind it, whatever it shows can be read with a name attached. Before your second purchase lands, run it through the NodeWitness privacy audit: it tells you whether the address is already linked to an identifiable platform and what reusing it would reveal, and it never asks for your key.

More in Privacy and self-custody

See all 14 articles in Privacy and self-custody →

Last updated: October 8, 2026