Competent Authorities in MICA: Functions, Sanctions, and Supervision in Spain

The MICA Regulation has brought about a structural change in the regulation of crypto-asset service providers, also known as VASPs (Virtual Asset Service Providers). As in the securities markets, compliance with their obligations is subject to supervision by competent authorities, which have powers of authorization, control, and even sanction.

Who are the competent authorities in Spain?

To date, the supervision functions of the crypto ecosystem in Spain have been in the hands of two key institutions:

• The National Securities Market Commission (CNMV): responsible for controlling crypto-assets considered financial instruments and supervising advertising directed at the investing public.
• The Bank of Spain: in charge of registering and controlling exchange houses and other functions attributed by Law 10/2010 on the prevention of money laundering.

Both institutions will continue to play a central role in the application of the MICA Regulation in Spain, in coordination with European authorities.

The European structure: ESMA and EBA

Chapter I of Title VII of MICA details the role of competent authorities and their cooperation with two key European Union institutions:

• EBA (European Banking Authority): ensures financial stability, competition, and the orderly functioning of the banking sector.
• ESMA (European Securities and Markets Authority): promotes investor protection, the proper functioning of markets, and establishes common standards of conduct and supervision.

National authorities, such as the CNMV or the Bank of Spain, will act as contact points and executors of decisions and guidelines emanating from these institutions.

Powers granted by MICA to competent authorities

Article 82 of the Regulation does not automatically attribute powers to these authorities, but rather requires each Member State to endow them with such powers through its national legislation.

Supervisory powers

Competent authorities may:

• Request information from VASPs and token issuers.
• Require data from natural or legal persons with effective control.
• Conduct inspections at facilities and confiscate relevant documents.
• Demand information that may affect the provision of crypto services.
• Conduct investigations into market abuse.

Powers over VASP activity

Among their most important competences are:

• Temporarily suspend activities for up to 10 business days.
• Prohibit service provision if the Regulation is violated.
• Transfer contracts from a sanctioned VASP to another provider.
• Order immediate cessations, suspensions, or other urgent measures.
• Prohibit public offerings of cryptocurrencies or suspend their trading.

Communicative and transparency powers

Additionally, these authorities may:

• Require VASPs to inform the public about risks or non-compliance.
• Make public the existence of violations.
• Exchange information with other supervisors, always under the duty of professional secrecy and in accordance with the General Data Protection Regulation (GDPR).

Sanctions provided for by MICA

The MICA Regulation also grants sanctioning power to national authorities. Fines may amount to:

• Up to 15% of annual turnover of a legal entity.
• Between €500,000 and €5,000,000 in the case of natural persons.

The most severe violations relate to market abuse conduct, which may also have criminal consequences.

Cooperation between national and European authorities

Competent authorities in each country must:

• Actively collaborate with each other.
• Inform ESMA and EBA about adopted measures.
• Coordinate investigations and exchange information, except in cases of justified conflict.
• Notify within 12 months from the Regulation entry into force the internal rules adopted.

The cooperation model designed by MICA seeks to harmonize sector supervision throughout the EU, strengthening confidence and reducing risks derived from uncoordinated approaches.

More supervision, more legal security

Although the MICA Regulation imposes a significant regulatory burden on VASPs, it also represents an advance in legal security, fundamental for attracting investment and developing innovative projects in Europe and Spain.

Fiscalization is not synonymous with brake, but with market maturity. Recent experience shows that, compared to jurisdictions without clear rules, solid regulatory environments like the European one are more attractive to companies, investors, and users.