Since July 2025, providers of crypto-asset services (VASPs) that offer custody or cryptocurrency exchange services in Spain are fully subject to a new formal obligation: to actively and periodically inform the Tax Agency (AEAT) about balances, operations, and identifying data of their users.
This obligation derives from Royal Decree 249/2023, in force since 2024 but effectively applicable now with the full operability of the new tax models and the integration of declaration systems. The measures are channeled through the new articles 39 bis, 39 ter and 39 quater of the General Regulation of tax management and inspection actions and procedures (RGAT).
Although the Administration presents it as an advance in taxpayer protection, the reality is that it implies an increase in fiscal control, especially over users of centralized platforms (CEX).
What information must VASPs declare to the AEAT?
Providers of custody or cryptocurrency exchange services must supply the AEAT with detailed information about users, assets, and operations, including both national and foreign assets, as long as the service is linked to tax residents in Spain.
1. User Identifying Data
- Name and surnames or company name.
- Address.
- Tax identification number (NIF or equivalent).
2. Information on Balances as of December 31
- Type of virtual currency.
- Number of units.
- Valuation in euros.
3. Information on Operations Performed
- Type of operation: acquisition, transfer, exchange, or transfer.
- Date of the operation.
- Type and number of virtual currency units.
- Consideration (if any): fiat currency, another crypto-asset, goods or services, or combination.
- Commissions and expenses associated with the operation.
These obligations affect both Spanish platforms and those based abroad that provide services to taxpayers resident in Spain, reinforcing the principle of fiscal extraterritoriality in information matters.
What implications do VASPs reporting obligations have for cryptocurrency users?
A Merely Informative Obligation... For Now
Formally, it is an obligation to supply information, not a self-assessment. That is, the fact of reporting data to the AEAT does not imply by itself an additional tax obligation, but it does leave users' movements and assets completely exposed to a possible future verification or liquidation.
Forced Transparency and Loss of Privacy
This new regulatory framework breaks with the partial opacity that the sector still maintained in relation to tax authorities. From now on, the AEAT will not have to request data from taxpayers: the CEX will have provided it previously.
This places the user in a position of permanent fiscal risk, especially if they have not voluntarily regularized past operations or if they have made unintentional errors in declaring their gains or crypto-asset assets.
Are decentralized exchanges (DEX) subject to VASPs reporting obligations?
One of the most controversial points of the new regime is its current inapplicability to decentralized exchanges (DEX) and other structures without identifiable intermediaries.
The tax administration has not yet articulated an effective control mechanism over these environments, and it is foreseeable that in the coming years an attempt will be made to develop a regulatory response. However, for now, the focus is exclusively on centralized VASPs.
The big question is whether, and how, this obligation will be attempted to be extended to DeFi environments, where there is no traditional service provider that channels operations. Any attempt to impose a reporting obligation in these cases will clash with very significant technical, legal, and execution problems.
Conclusion
What in theory is born as a measure to protect the taxpayer, in practice increases taxation and preventive control over cryptocurrency users in Spain. The AEAT will now have a complete picture of the ecosystem of operations carried out on centralized platforms, reducing to a minimum the taxpayer's discretion in the information they decide to provide.
Meanwhile, DEXs remain an unregulated area, but one that will presumably become the next target of the legislator.
