Centralized exchange in Portugal
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Portugal with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Full compliance with Law No. 83/2017 (Portuguese AML Law) and FATF standards is mandatory, supervised by Banco de Portugal (BdP).
- KYC procedures: identify and verify client identity, understand business relationships, document beneficial ownership in a Central Register.
- Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF).
- Internal compliance programs including risk assessments, internal policies, and staff training.
- Compliance with UN/EU restrictive measures.
- Travel Rule obligations under TFR (Law No. 70/2025): CASPs must collect, retain, and share originator/beneficiary details for unique transfer identification.
- For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more.
- Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention plus verification for ≥EUR 1,000.
- Annual IRS declaration of crypto assets required (February 2024 bill).
- 28% tax on crypto gains held <365 days; gains held >365 days tax-free (unless involving tax havens or security tokens).
Key Restrictions
- Must register as a VASP with Banco de Portugal (BdP) under Portuguese AML Law (Law No. 83/2017).
- Must obtain full MiCA authorization as a CASP by July 1, 2026 (transitional rules allow operation until then for VASPs registered by December 30, 2024).
- Crypto-assets that qualify as financial instruments fall under CMVM (Portuguese Securities Market Commission) supervision.
- Travel Rule obligations apply to all withdrawals/transfers; no general de minimis threshold below EUR 1,000 for self-hosted wallets.
- Must be incorporated as a local entity — CASPs are treated as financial entities under AML rules.
Key Risks
- Transitional regime uncertainty: VASPs registered by Dec 30, 2024 can operate until July 1, 2026, but full MiCA authorization timeline may cause gaps.
- CMVM may classify certain listed crypto-assets as financial instruments, triggering securities law compliance on top of VASP/CASP rules.
- Tax treatment (28% short-term gains tax) creates reporting complexity and potential audit exposure for exchange users.
- TFR / GDPR tension on data sharing for Travel Rule remains an unresolved operational risk.
- Enforcement precedent exists: Eurojust-coordinated operations targeting crypto fraud involving Portugal (September 2025, May 2024).
- No specific mandated protocols for Travel Rule interoperability — technology fragmentation is a challenge.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Exchange of cryptocurrency for fiat currency and vice versa
Custodial services (storage of crypto-assets and encrypted keys)
Execution of orders on behalf of clients
Reception and transmission of orders
Reception and transmission of orders
Full compliance with Law No. 83/2017 (Anti-Money Laundering Law) and FATF standards is mandatory
KYC procedures: Identify and verify client identity, understand the nature of business relationships, and document beneficial ownership information in a Central Register
Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF)
Internal compliance programs including risk assessments, internal policies, and staff training
Compliance with restrictive measures approved by the UN or EU
Banco de Portugal (BdP, Bank of Portugal): Registers virtual asset service providers (VASPs) and supervises AML/CFT compliance; handles MiCA authorization applications for crypto-asset service providers (CASPs) starting July 2026.
Comissão do Mercado de Valores Mobiliários (CMVM, Portuguese Securities Market Commission): Determines if crypto-assets qualify as financial instruments; shares MiCA supervision with BdP.
Lei n.º 24-D/2022 (State Budget Law, effective January 1, 2023): Introduced 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens.
Law No. 69/2025 (December 2025): Incorporates MiCA and Transfer of Funds Regulation (TFR) into national law; treats CASPs as financial entities under AML rules; effective July 2026.
Law No. 70/2025 (January 2026): Further implements TFR alongside MiCA.
OE2026 (2026 State Budget, finalized January 2026): Retained the 365-day tax exemption.
Portuguese AML Law: Governs VASP registration; VASPs registered by December 30, 2024, can operate under transitional MiCA rules until June 30, 2026.
February 2024 bill: Mandates annual IRS declaration of crypto assets.
The framework was adopted via Law No. 70/2025 (and companion Law No. 69/2025 for MiCA implementation) in December 2025, ensuring national execution of the TFR.
For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5)).
Applies to Crypto-Asset Service Providers (CASPs), formally integrated into Portugal's AML regime.
Banco de Portugal (BdP) supervises compliance for CASPs and payment service providers; registered CASPs can operate under MiCA transitional rules until July 1, 2026.
CASPs must collect, retain, and share Travel Rule data (e.g., originator/beneficiary details for unique transfer identification) for transparency in transfers.
Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention by originating CASP, plus verification for ≥EUR 1,000.
Requirements include data verification, recordkeeping, security measures, and alignment with TFR for AML/CFT (e.g., immediate/secure sharing).
September 2025: Eurojust coordinated an operation halting a cryptocurrency investment fraud exceeding 100 million euros across Europe, resulting in five arrests including the alleged main perpetrator.
May 2024: A coordinated operation uncovered a cryptocurrency scam using "rip deals" methods, leading to suspect arrests in France, with investigations involving Portugal, Germany, Italy, and Romania.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a centralized exchange in Portugal must register as a VASP with Banco de Portugal under transitional rules, obtain full MiCA CASP authorization by July 1, 2026, comply with comprehensive AML/KYC/Travel Rule obligations, and navigate potential CMVM securities classification of listed assets.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?