Portugal's Crypto Rulebook Takes Effect on 1 July, Splitting Supervision Between the Bank of Portugal and the CMVM

Portugal's crypto sector loses its regulatory grey zone on 1 July, when the country's long-delayed framework for crypto-assets finally takes effect. The rules transpose the European Union's Markets in Crypto-Assets Regulation (MiCA) into Portuguese law, end years in which Lisbon had legislation on the books in Brussels but no designated authority to enforce it at home, and hand day-to-day oversight to the country's two main financial watchdogs.

For a jurisdiction that spent the last decade marketing itself as one of Europe's friendliest addresses for crypto investors, it is a notable shift in tone — from light-touch tolerance to a supervised, licence-based regime backed by fines reaching into the millions.

Who supervises what

The new architecture splits responsibility between two regulators. The Bank of Portugal (Banco de Portugal) takes on prudential supervision — policing the financial soundness of crypto-asset service providers — and the job of authorising firms that want to operate in the country. The Securities Market Commission (Comissão do Mercado de Valores Mobiliários, or CMVM) handles conduct supervision and market-abuse oversight, the behavioural side of how providers treat clients and trade.

Both regulators are required to publish and keep updated public lists of the providers they have authorised, giving consumers a way to check whether a platform is operating legally before handing over money. Firms that offer crypto services without that authorisation face the toughest end of the new penalty scale.

The penalties

The sanctions are substantial. Very serious breaches can draw fines of up to €5 million for companies and up to €2.5 million for individuals, while contraventions tied to market abuse can be punished with penalties of up to 15 percent of a firm's annual turnover. Operating without a licence, manipulating the market, and giving false or incomplete information to regulators or clients sit at the top of the severity scale. Authorities can also confiscate illicit profits and bar offenders from holding certain functions.

The rules import a familiar piece of banking compliance into the crypto world: a "travel rule" obliging providers to identify both the originator and the beneficiary of every transfer, exactly as banks already do for conventional wire transfers. The aim is to make it harder to move bitcoin and other digital assets anonymously for money laundering or other illicit ends.

A reluctant green light

The legislation reached the statute book only after the President promulgated it in December with open reservations, arguing in effect that imperfect control of the sector was preferable to none at all. Portugal had been exposed to EU infringement proceedings for failing to name the competent authorities MiCA requires, and the law was as much about closing that gap as about designing an ideal regime. The framework arrives as Portugal's regulators are already wrestling with how the financial system is policed — the finance minister recently rejected a proposal to merge the country's three financial supervisors.

What this means for expats

• Check the authorisation list. From July, the safest first step before using any platform is to confirm it appears on the Bank of Portugal's or the CMVM's register of authorised providers. An unlicensed operator is now operating illegally, not merely informally.
• Tax is a separate question. These rules govern how the market is supervised, not how gains are taxed. Portugal already taxes short-term crypto gains at 28 percent while leaving assets held for more than a year untaxed — that regime is unchanged by the new supervisory framework.
• More paperwork, more protection. Identity checks on transfers mean crypto transactions will increasingly feel like bank transactions, with the compliance friction that implies but also stronger recourse if something goes wrong.
• Reputation reset. Portugal's image as a crypto haven was always more about tax than oversight. With supervision now formalised, the country looks less like an outlier and more like the rest of regulated Europe.

The practical impact will depend on how aggressively the Bank of Portugal and the CMVM build out their registers and use their new enforcement powers. But as of 1 July, operating in Portugal's crypto market without a licence stops being a grey area and becomes a fineable offence.