Banking Law and Utility Tokens Regulation in Spain

1. Introduction

The regulation of utility tokens in Spain is now principally governed by the European Union's Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, together with Spanish implementing and supervisory legislation.

MiCA became fully applicable on 30 December 2024. In Spain, the Comisión Nacional del Mercado de Valores (CNMV) is the principal competent authority for crypto-assets falling within MiCA's Title II, including most utility tokens, while the Banco de España has specific responsibility for asset-referenced tokens (ARTs) and electronic-money tokens (EMTs).

A utility token is essentially a crypto-asset intended to provide digital access to a good or service supplied by its issuer. MiCA therefore treats it differently from a security token, ART or EMT.

2. Meaning of a Utility Token

Under MiCA, a utility token is a type of crypto-asset intended only to provide access to a good or service supplied by its issuer.

Examples may include a token that gives the holder:

• access to software;
• access to an online platform;
• digital membership;
• access to cloud services;
• access to games or digital content;
• future access to a service;
• use of a blockchain-based platform.

The important point is that the legal classification depends upon the economic and legal characteristics of the token, not merely the name chosen by its issuer.

Thus, calling something a "utility token" does not automatically place it outside securities or other financial-services regulation.

3. Position of Utility Tokens under Spanish Banking Law

Utility tokens occupy an unusual position because they are generally not bank deposits, electronic money or traditional securities.

The regulatory structure can be simplified as follows:

The CNMV expressly states that it supervises MiCA Title II crypto-assets, whereas the Banco de España supervises the issuance of ARTs and EMTs.

4. MiCA and Utility Tokens

MiCA creates a specific regulatory framework for crypto-assets that are neither ARTs nor EMTs.

Utility tokens generally fall within this "other crypto-assets" category.

The CNMV itself identifies utility tokens as crypto-assets providing access to goods or services and places them within the category of crypto-assets other than ARTs and EMTs.

Therefore, a Spanish company intending to issue a utility token must first determine:

1. whether the token is actually a utility token;
2. whether it constitutes a financial instrument;
3. whether it qualifies as an ART or EMT;
4. whether an exclusion under MiCA applies;
5. whether it will be offered to the public;
6. whether it will be admitted to trading;
7. whether related activities constitute regulated crypto-asset services.

5. White-Paper Requirement

One of the most important requirements for utility-token issuers is the crypto-asset white paper.

The white paper functions as the principal disclosure document for investors and users.

It generally explains matters such as:

• identity of the issuer;
• characteristics of the token;
• technology used;
• rights attached to the token;
• intended utility;
• risks;
• project description;
• conditions of the offer;
• transferability;
• technological risks;
• conflicts of interest;
• circumstances affecting the project.

MiCA requires transparency and disclosure when qualifying crypto-assets are offered to the public or admitted to trading. The CNMV confirms that Title II establishes obligations concerning issuance, public offering and admission to trading of crypto-assets other than ARTs and EMTs.

Important distinction

Notification of a white paper to the CNMV does not mean that the CNMV has approved or guaranteed the token.

The CNMV specifically warns that notification of the white paper and accompanying documents does not constitute authorisation or approval of its content.

6. Protection Against Misleading Information

Utility-token issuers must provide information that is fair, clear and not misleading.

This is particularly important because a token may be marketed as providing "utility" while actually being promoted primarily as an investment.

For example:

"Buy this token because it will increase tenfold."

Such marketing can create significant regulatory concerns where the token's actual characteristics do not correspond to the claimed utility.

The legal analysis therefore focuses upon the substance of the arrangement, rather than merely its label.

7. Utility Token versus Security Token

This is one of the most important distinctions in Spanish banking and financial law.

Utility token

Provides access to:

• goods;
• services;
• digital platforms;
• applications;
• memberships.

Security/financial-instrument token

May provide:

• ownership rights;
• dividends;
• repayment rights;
• investment returns;
• rights comparable to securities.

MiCA does not replace existing EU financial-services legislation for crypto-assets that already qualify as financial instruments. CNMV's MiCA framework therefore has to be read alongside securities legislation.

Example

Suppose a company creates:

Token A: one token gives six months of access to its software.

This is potentially a utility token.

But suppose:

Token B: holders receive a percentage of the company's profits.

The second arrangement may have investment/security characteristics and could fall outside the ordinary utility-token regime.

8. Banking Institutions and Utility Tokens

Spanish banks are not prohibited from interacting with utility tokens merely because they are crypto-assets.

However, a bank must comply with applicable:

• banking regulations;
• AML/CFT requirements;
• customer-protection rules;
• risk-management obligations;
• outsourcing requirements;
• operational-resilience requirements;
• securities legislation where applicable;
• MiCA requirements when providing regulated crypto-asset services.

A bank providing custody, trading, transfer or other regulated crypto-asset services may itself fall within the crypto-asset service provider (CASP) framework.

MiCA establishes authorisation and organisational requirements for crypto-asset service providers. CNMV's Spanish framework expressly recognises the new category of regulated CASPs.

9. Crypto-Asset Service Providers

A business involved in utility tokens may be regulated even where the token itself is relatively simple.

Examples include services involving:

• custody and administration;
• operation of a trading platform;
• exchange of crypto-assets for funds;
• exchange of one crypto-asset for another;
• execution of orders;
• placement;
• transfer services;
• advice;
• portfolio management.

Therefore, Spanish law distinguishes between:

the regulation of the token itself

and

the regulation of services performed in connection with the token.

This is crucial for fintech companies and banks.

10. Limited-Purpose Tokens

Not every token necessarily falls within MiCA.

The CNMV identifies certain limited-purpose crypto-assets as exclusions, including tokens accepted only within a limited network of merchants or for limited goods/services, subject to the applicable MiCA conditions.

For example, a closed loyalty system usable only for a narrow range of services may potentially fall outside MiCA.

However, an issuer cannot simply label a widely tradable investment product as a "loyalty token" to avoid regulation.

11. Utility Tokens and Banking Payments

A utility token must also be distinguished from an electronic-money token (EMT).

An EMT is designed to maintain a stable value by referencing a single official currency.

Utility tokens, by contrast, primarily provide access to a good or service.

This distinction is particularly important for banks because EMTs can interact directly with the EU payment-services framework.

The Banco de España states that EMTs qualify as electronic money and can fall within the definition of "funds" under PSD2. Consequently, CASPs providing certain payment services involving EMTs require PSD2 authorisation in addition to their MiCA authorisation, or must work with an authorised payment-service provider.

This is a significant development for Spanish banking regulation in 2026.

12. AML and Financial-Crime Regulation

Utility-token businesses are also relevant to Spain's anti-money-laundering framework.

Risks include:

• anonymous transactions;
• money laundering;
• terrorist financing;
• fraud;
• market manipulation;
• sanctions evasion;
• misuse of crypto exchanges.

Consequently, regulated CASPs are subject to compliance obligations concerning customer identification, transaction monitoring and financial-crime controls.

The wider purpose of MiCA includes strengthening market integrity and preventing money laundering and terrorist financing.

13. Market Abuse

MiCA introduces market-abuse rules for covered crypto-assets.

Conduct such as:

• insider dealing;
• unlawful disclosure of inside information;
• market manipulation;
• misleading market activity

may attract regulatory enforcement.

CNMV has confirmed that it exercises the relevant MiCA supervisory powers concerning market abuse.

This is especially important when a utility token becomes actively traded on a secondary market.

A token can therefore begin as a service-access instrument but still create substantial regulatory obligations once secondary-market trading develops.

14. Consumer Protection

Consumer protection is a central feature of the Spanish/EU regime.

A utility-token purchaser should be able to understand:

• what the token actually provides;
• whether the service already exists;
• whether the token can be redeemed;
• whether the token is transferable;
• whether the issuer can discontinue the project;
• what technological risks exist;
• what happens if the project fails.

EU implementing legislation specifically provides for disclosure concerning the possibility that a utility token may not be exchangeable for the promised good or service if the project fails or is discontinued.

This demonstrates that utility does not mean guaranteed value.

15. Investor Compensation and Deposit Guarantee

A particularly important distinction from traditional banking is that utility-token holders do not automatically receive the protection of bank deposit insurance.

MiCA's standard white-paper disclosures include a warning that qualifying crypto-assets are not covered by the investor-compensation scheme under Directive 97/9/EC or deposit-guarantee scheme under Directive 2014/49/EU.

Therefore:

Holding a utility token is not equivalent to holding a bank deposit.

This is particularly relevant where a bank-affiliated fintech company markets crypto-assets.

16. Transitional Regime in Spain

Spain adopted a transitional approach for existing crypto-asset businesses.

The Spanish Tax Agency explains that Spain extended the transitional period for certain existing crypto-asset service providers until 30 June 2026.

Consequently, by October 2026, the transitional period is essentially over and businesses operating in Spain need to comply with the applicable MiCA authorisation framework.

The CNMV currently states that, from 1 July 2026, crypto-asset service providers operating in Spain must be authorised by the CNMV or another competent EU authority under the applicable framework.

17. Utility Tokens and the Banco de España

The Banco de España's role should not be confused with the CNMV's role.

CNMV

Generally concerned with:

• MiCA Title II crypto-assets;
• utility tokens;
• CASP supervision;
• market conduct;
• crypto-asset trading activities.

Banco de España

Particularly responsible for:

• EMTs;
• ARTs;
• certain payment-related activities;
• banking/payment-service regulation.

The Banco de España expressly confirms that ART and EMT issuance falls within its MiCA supervisory competence.

18. Important Case Laws

A major difficulty with this topic is that MiCA is relatively new, and there is not yet a large body of Spanish Supreme Court jurisprudence specifically deciding the legality of a "utility token" under MiCA.

Therefore, the most useful case law consists of Spanish/EU cases establishing broader principles concerning financial products, investor protection, financial classification and crypto-assets.

Case 1 — Skatteverket v David Hedqvist, C-264/14

Court: Court of Justice of the European Union
Year: 2015

The CJEU considered the VAT treatment of Bitcoin exchange transactions.

The Court treated Bitcoin as a means of payment for the purposes of the relevant VAT exemption, despite Bitcoin not being legal tender.

Importance for utility tokens

The case demonstrates that EU law looks at the economic function of a digital asset, rather than simply whether it constitutes official currency.

This principle is useful when analysing whether a particular token is functioning as:

• a means of payment;
• a service-access instrument;
• an investment product;
• another financial asset.

It is not a MiCA case, but it remains important background jurisprudence for EU crypto-asset classification.

Case 2 — Spanish Supreme Court, STS 117/2020

Tribunal Supremo, Civil Chamber
22 January 2020

This case concerned compensation for breach of legal information/advisory obligations in the marketing of subordinated debt.

The Supreme Court emphasised the legal consequences of inadequate information provided to customers concerning complex financial products.

Relevance to utility tokens

Although it did not concern a utility token, its principle is highly relevant:

A financial product's complexity increases the importance of proper customer information.

The same reasoning is useful when analysing misleading or inadequate disclosures concerning complicated crypto-assets.

Case 3 — Spanish Supreme Court, STS 3944/2019

16 December 2019

The Court dealt with a complex financial product and emphasised the importance of transparent pre-contractual information and compliance with investor-protection duties.

The case illustrates that information provided to an inexperienced customer must be sufficiently understandable, rather than merely technically available.

Relevance

For utility tokens, this supports a broader legal principle:

technical disclosure is not necessarily meaningful disclosure.

A white paper and marketing material must allow users to understand the relevant risks.

Case 4 — Spanish Supreme Court, STS 40/2020

16 January 2020

The Supreme Court considered liability arising from inadequate information concerning subordinated/preference financial products.

The Court's reasoning demonstrates the importance of assessing the actual economic consequences of defective information and the resulting customer loss.

Relevance

This can be applied by analogy where a crypto-asset provider gives materially misleading information concerning the rights attached to a token.

Case 5 — Spanish Supreme Court, STS 86/2020

16 January 2020

The Supreme Court again dealt with claims arising from the marketing of complex financial products and customer-information duties.

Relevance

The decision reinforces the broader Spanish judicial approach that financial-product providers cannot treat disclosure as a mere formality.

This is particularly significant for crypto-assets because inexperienced consumers may misunderstand:

• token price;
• utility;
• liquidity;
• redemption;
• project risk;
• secondary-market value.

Case 6 — Spanish Supreme Court / Audiencia Nacional financial-crime jurisprudence

Spanish courts have also dealt with criminal cases involving digital currencies.

For example, the Audiencia Nacional convicted a hacker involved in large-scale financial fraud and found that proceeds were converted through virtual-currency services, including substantial Bitcoin transactions.

Relevance

This demonstrates that cryptocurrency transactions do not operate outside ordinary criminal and financial law.

Crypto-assets can become relevant to:

• fraud;
• money laundering;
• criminal proceeds;
• asset tracing;
• confiscation.

A utility-token structure therefore cannot be used to immunise unlawful transactions from Spanish criminal law.

19. Case-Law Principle: Substance over Label

The combined jurisprudential approach leads to an important principle:

Calling a digital asset a "utility token" does not determine its legal status.

Authorities must examine:

• contractual rights;
• economic purpose;
• transferability;
• investment expectations;
• relationship with the issuer;
• promised returns;
• redemption arrangements;
• governance rights;
• payment function;
• connection with goods/services.

If the token actually possesses characteristics of a financial instrument, the issuer cannot avoid financial regulation merely by using the term "utility."

20. Utility Tokens and Financial Instruments

This is arguably the most important legal boundary.

MiCA does not regulate crypto-assets that are already financial instruments under EU financial-services legislation.

Therefore, a Spanish issuer must perform a classification analysis before issuing the token.

Possible outcomes

A. Genuine utility token

→ MiCA Title II.

B. EMT

→ MiCA Title IV + relevant payment/e-money framework.

C. ART

→ MiCA Title III.

D. Financial instrument

→ MiFID II/Spanish securities legislation rather than the ordinary MiCA utility-token regime.

E. Excluded token

→ potentially outside MiCA, although another legal regime may still apply.

21. Relationship with Traditional Banking Regulation

Utility tokens increasingly intersect with banking law through:

1. Custody

Banks or CASPs may hold crypto-assets for customers.

2. Payments

Tokens can be used in payment ecosystems.

3. AML

Banks must assess crypto-related money-laundering risks.

4. Customer due diligence

Crypto transactions may require enhanced monitoring depending upon risk.

5. Outsourcing

Banks using blockchain or external crypto providers must manage operational and outsourcing risks.

6. Cybersecurity

Token infrastructure creates additional technology and cyber risks.

7. Liquidity and market risk

Banks dealing with crypto-assets must manage volatility and counterparty exposure.

8. Governance

Boards and senior management must understand the risks associated with crypto-related business.

22. Regulatory Risks for Spanish Utility-Token Issuers

A Spanish issuer faces several major risks.

23. Recent Regulatory Development: EMT and PSD2

Although EMTs are different from utility tokens, the development is important for understanding Spain's regulatory approach.

In March 2026, the Banco de España reiterated that crypto-asset service providers providing payment services involving EMTs must obtain the necessary PSD2 authorisation or operate with an authorised payment-service provider.

The transitional deadline for affected providers was 2 March 2026.

This illustrates an important principle:

MiCA does not automatically eliminate other financial-services regulation.

Where a crypto business performs an activity regulated by another EU financial-services framework, both regimes may need to be considered.

24. Enforcement in Spain

The CNMV possesses supervisory powers over MiCA-related activities falling within its competence.

These include powers concerning:

• supervision;
• inspections;
• crypto-asset service providers;
• banks engaging in relevant crypto-asset activities;
• electronic-money institutions;
• market-abuse enforcement.

Spanish legislation and CNMV's organisational framework have been updated to accommodate these responsibilities.

25. Practical Example

Suppose a Spanish technology company creates "TravelToken."

One token provides the holder with €100 worth of travel services on the company's platform.

Stage 1 — Classification

The company examines whether TravelToken is genuinely a utility token.

Stage 2 — White paper

If MiCA applies, the issuer prepares the required crypto-asset white paper.

Stage 3 — Public offering

The company complies with applicable MiCA requirements concerning the offer.

Stage 4 — Marketing

The company cannot falsely advertise the token as a guaranteed investment.

Stage 5 — Trading

If the token is admitted to a trading platform, additional regulatory considerations arise.

Stage 6 — CASP

If another company provides custody, exchange or trading services, that service provider may need MiCA authorisation.

Stage 7 — Payment function

If the arrangement actually becomes an electronic-money/payment instrument, the classification must be reconsidered.

Thus, the legal character of the token must be continuously monitored as the business model evolves.

26. Key Legal Principles

The Spanish utility-token regime can be reduced to the following principles:

1. MiCA is the principal regulatory framework.
2. Utility tokens generally fall under the "other crypto-assets" category.
3. The CNMV is the principal Spanish supervisor for these assets.
4. The Banco de España has important competence concerning ARTs and EMTs.
5. A token's name does not determine its legal classification.
6. Financial instruments remain subject to financial-services legislation.
7. Public offerings can trigger white-paper and disclosure requirements.
8. CASPs require regulatory authorisation.
9. AML and market-abuse rules remain important.
10. Utility-token holders do not receive ordinary bank-deposit protection.
11. Payment functionality may trigger PSD2 requirements.
12. Consumer/investor information must be accurate and understandable.

27. Conclusion

Spain's regulation of utility tokens has moved from a relatively fragmented crypto environment to a harmonised EU framework under MiCA. The central legal question is no longer simply whether a product is called a cryptocurrency or utility token; it is what rights and economic functions the token actually possesses.

For a genuine utility token, MiCA provides a framework centred on transparency, white-paper disclosure, fair marketing, market integrity and regulation of associated crypto-asset services. The CNMV is the principal Spanish authority for this category.

At the same time, the boundaries with MiFID II, PSD2, electronic money, AML law and traditional banking regulation are extremely important. A token designed as a service-access instrument may enter another regulatory category if its economic characteristics change.

Finally, because MiCA is comparatively recent, there is not yet a substantial body of Spanish Supreme Court case law specifically interpreting "utility tokens" under MiCA. Existing Spanish and EU jurisprudence on financial-product classification, customer information, financial crime and crypto-assets therefore remains important for understanding how courts are likely to approach disputes.