Custodial wallet / SaaS in Portugal

Custodial services (storage of crypto-assets and encrypted keys)

Full compliance with Law No. 83/2017 (Anti-Money Laundering Law) and FATF standards is mandatory

KYC procedures: Identify and verify client identity, understand the nature of business relationships, and document beneficial ownership information in a Central Register

Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF)

Internal compliance programs including risk assessments, internal policies, and staff training

Compliance with restrictive measures approved by the UN or EU

Banco de Portugal (BdP, Bank of Portugal): Registers virtual asset service providers (VASPs) and supervises AML/CFT compliance; handles MiCA authorization applications for crypto-asset service providers (CASPs) starting July 2026.

Comissão do Mercado de Valores Mobiliários (CMVM, Portuguese Securities Market Commission): Determines if crypto-assets qualify as financial instruments; shares MiCA supervision with BdP.

Law No. 69/2025 (December 2025): Incorporates MiCA and Transfer of Funds Regulation (TFR) into national law; treats CASPs as financial entities under AML rules; effective July 2026.

Law No. 70/2025 (January 2026): Further implements TFR alongside MiCA.

Portuguese AML Law: Governs VASP registration; VASPs registered by December 30, 2024, can operate under transitional MiCA rules until June 30, 2026.

Applies to Crypto-Asset Service Providers (CASPs), formally integrated into Portugal's AML regime.

Banco de Portugal (BdP) supervises compliance for CASPs and payment service providers; registered CASPs can operate under MiCA transitional rules until July 1, 2026.

CASPs must collect, retain, and share Travel Rule data (e.g., originator/beneficiary details for unique transfer identification) for transparency in transfers.

For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5)).

Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention by originating CASP, plus verification for ≥EUR 1,000.

Requirements include data verification, recordkeeping, security measures, and alignment with TFR for AML/CFT (e.g., immediate/secure sharing).

No general de minimis threshold is explicitly detailed for all transfers beyond this; it aligns with FATF's recommended EUR 1,000 limit, though countries vary implementation.

No specific protocols (e.g., interoperability solutions) mandated beyond TFR; challenges like GDPR and tech fragmentation noted globally.

Lei n.º 24-D/2022 (State Budget Law, effective January 1, 2023): Introduced 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens.

February 2024 bill: Mandates annual IRS declaration of crypto assets.

September 2025: Eurojust coordinated an operation halting a cryptocurrency investment fraud exceeding 100 million euros across Europe, resulting in five arrests including the alleged main perpetrator.