Crypto-funded debit card in Portugal
A card program where customer fiat balances are funded from crypto holdings, typically through an off-ramp at point of sale or top-up.
Crypto debit card is conditionally permitted in Portugal with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Full KYC under Law No. 83/2017: identify and verify client identity, understand business relationships, document beneficial ownership in a Central Register
- Ongoing transaction monitoring and regular suspicious transaction reporting to Unidade de Informação Financeira (UIF)
- Internal compliance programs including risk assessments, internal policies, and staff training per Portuguese AML Law
- Travel Rule compliance under TFR incorporated by Law No. 69/2025 and Law No. 70/2025: CASPs must collect, retain, and share originator/beneficiary data for transfers
- Enhanced measures for self-hosted wallets: for transactions ≥ EUR 1,000, CASPs must request proof of ownership/control
- Annual IRS declaration of crypto assets (mandatory since February 2024 bill)
- Compliance with UN/EU restrictive measures
- BdP supervises AML/CFT compliance for CASPs and payment service providers; MiCA authorization regime effective July 2026
Key Restrictions
- Crypto-to-fiat conversion at point of sale or top-up requires a VASP registration (currently under BdP transitional rules) and likely a payment institution or e-money institution license for the fiat side
- Crypto-funded debit card must be structured as a partnership with a regulated payment institution / e-money institution and a BIN sponsor (e.g., Mastercard or Visa issuer) — standalone operation is not possible
- Cardholders must be subject to full AML/KYC under Portuguese AML Law (Law No. 83/2017) before any fiat top-up or crypto conversion
- CASPs need full MiCA authorization as Crypto-Asset Service Providers by July 1, 2026; transitional registration (by Dec 30, 2024) is currently valid
- Crypto-to-crypto swaps are non-taxable (deferring gain); only fiat conversion triggers taxable event under short-term (<365 days) 28% regime
Key Risks
- Regulatory ambiguity during MiCA transition period (until July 2026): unclear whether a single entity can hold both VASP and payment/e-money licenses or if a partnership structure is mandatory
- Tax complexity: short-term crypto gains (<365 days) at 28% flat (or up to 53% via aggregation) — card top-ups that auto-convert crypto to fiat may trigger taxable events on each transaction, creating reporting burden
- Travel Rule compliance for self-hosted wallets at EUR 1,000 threshold is operationally difficult for a card product where top-ups are frequent and small-value
- Enforcement risk: BdP and CMVM actively monitor VASP/CASP compliance; Eurojust-coordinated operations in 2024-2025 show Portuguese law enforcement is engaged on crypto fraud
- If the card program's fiat leg is not licensed as a payment institution/e-money institution, the operator risks unlicensed payment services exposure
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Exchange of cryptocurrency for fiat currency and vice versa
Custodial services (storage of crypto-assets and encrypted keys)
Full compliance with Law No. 83/2017 (Anti-Money Laundering Law) and FATF standards is mandatory
KYC procedures: Identify and verify client identity, understand the nature of business relationships, and document beneficial ownership information in a Central Register
Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF)
Internal compliance programs including risk assessments, internal policies, and staff training
Compliance with restrictive measures approved by the UN or EU
Banco de Portugal (BdP, Bank of Portugal): Registers virtual asset service providers (VASPs) and supervises AML/CFT compliance; handles MiCA authorization applications for crypto-asset service providers (CASPs) starting July 2026.
Comissão do Mercado de Valores Mobiliários (CMVM, Portuguese Securities Market Commission): Determines if crypto-assets qualify as financial instruments; shares MiCA supervision with BdP.
Lei n.º 24-D/2022 (State Budget Law, effective January 1, 2023): Introduced 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens.
Law No. 69/2025 (December 2025): Incorporates MiCA and Transfer of Funds Regulation (TFR) into national law; treats CASPs as financial entities under AML rules; effective July 2026.
Law No. 70/2025 (January 2026): Further implements TFR alongside MiCA.
Portuguese AML Law: Governs VASP registration; VASPs registered by December 30, 2024, can operate under transitional MiCA rules until June 30, 2026.
February 2024 bill: Mandates annual IRS declaration of crypto assets.
CASPs must collect, retain, and share Travel Rule data (e.g., originator/beneficiary details for unique transfer identification) for transparency in transfers.
Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention by originating CASP, plus verification for ≥EUR 1,000.
For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5)).
Banco de Portugal (BdP) supervises compliance for CASPs and payment service providers; registered CASPs can operate under MiCA transitional rules until July 1, 2026.
Short-term (<365 days): 28% flat rate; aggregation possible for progressive IRS brackets (14.5%-53% for 2026), mandatory if total income exceeds top bracket.
Long-term (>365 days): Exempt from tax, but transactions must still be reported.
Crypto-to-crypto swaps are non-taxable, deferring gains until fiat conversion.
Crypto holdings and gains must be declared annually in the IRS tax return (Modelo 3), mandatory since February 2024 law.
February 2024 Bill: Mandates crypto declaration in IRS (https://imin-portugal.com/blog/portugal-crypto-taxes/).
September 2025: Eurojust coordinated an operation halting a cryptocurrency investment fraud exceeding 100 million euros across Europe, resulting in five arrests including the alleged main perpetrator.
May 2024: A coordinated operation uncovered a cryptocurrency scam using "rip deals" methods, leading to suspect arrests in France, with investigations involving Portugal, Germany, Italy, and Romania.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a crypto-funded debit card can operate in Portugal, but requires both a BdP-registered VASP/CASP license (for crypto-to-fiat conversion and custody) and a payment institution or e-money institution license (for the fiat card program), with full AML/KYC on cardholders, compliance with TFR Travel Rule for transfers ≥EUR 1,000, and careful handling of taxable events on each crypto-to-fiat conversion.
Questions this verdict aims to answer
- What e-money / payment-institution license is required?
- How is the crypto-to-fiat conversion regulated?
- What KYC and AML obligations apply to cardholders?
- What partner-bank or BIN-sponsor arrangements are required?