DeFi protocol frontend in Portugal
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Portugal with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- If the frontend engages in "reception and transmission of orders" or "execution of orders on behalf of clients," it must register as a VASP/CASP with Banco de Portugal (BdP) and comply with Law No. 83/2017 AML law.
- KYC procedures required: identify and verify client identity, understand nature of business relationships, document beneficial ownership in a Central Register.
- Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF).
- Travel Rule compliance: CASPs must collect, retain, and share originator/beneficiary details for transfers (Law No. 70/2025 implementing TFR).
- For self-hosted wallet transactions ≥ EUR 1,000, CASPs must request proof of ownership/control (per TFR Chapter III, Section 1, Article 1(5)).
- Internal compliance programs including risk assessments, internal policies, and staff training.
- Compliance with restrictive measures approved by the UN or EU.
- Annual IRS declaration of crypto assets required (February 2024 bill).
- If the frontend only provides a non-custodial interface to permissionless contracts and does not take orders, execute orders, or charge fees (i.e., is truly passive), AML obligations may not attach — but this is legally ambiguous.
Key Restrictions
- If the frontend charges fees (e.g., swap fees, routing fees), it likely constitutes a regulated CASP activity (reception/transmission or execution of orders), requiring registration.
- Local entity required — must register as a VASP/CASP with Banco de Portugal and comply with Portuguese corporate presence rules.
- Geofencing of US persons may be necessary to avoid US securities law exposure, but is not a Portuguese-specific requirement.
- By July 1, 2026, full MiCA authorization as a CASP is required; transitional rules for existing VASPs end June 30, 2026.
- Exchanges of crypto for fiat currency require specific licensing under Portuguese law.
Key Risks
- Regulatory ambiguity: It is unclear whether a non-custodial, non-fee-taking frontend to permissionless DeFi protocols constitutes a regulated CASP activity under Portuguese law.
- Fee-taking is a key trigger — if the frontend charges any fees (frontend fees, routing premiums), the regulatory classification shifts toward requiring full CASP registration.
- Enforcement risk: BdP and CMVM can take action against unlicensed CASPs; CMVM determines whether crypto-assets qualify as financial instruments, which could trigger securities law.
- Tax risk: Crypto gains held <365 days are taxed at 28%; frontend operators facilitating trading may have reporting obligations.
- Transitional regime uncertainty: VASPs registered by Dec 30, 2024 can operate under transitional rules until July 1, 2026 — new entrants after that date need full MiCA authorization.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Reception and transmission of orders
Reception and transmission of orders
Execution of orders on behalf of clients
Exchange of cryptocurrency for fiat currency and vice versa
Full compliance with Law No. 83/2017 (Anti-Money Laundering Law) and FATF standards is mandatory
KYC procedures: Identify and verify client identity, understand the nature of business relationships, and document beneficial ownership information in a Central Register
Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF)
Internal compliance programs including risk assessments, internal policies, and staff training
Banco de Portugal (BdP, Bank of Portugal): Registers virtual asset service providers (VASPs) and supervises AML/CFT compliance; handles MiCA authorization applications for crypto-asset service providers (CASPs) starting July 2026.
Comissão do Mercado de Valores Mobiliários (CMVM, Portuguese Securities Market Commission): Determines if crypto-assets qualify as financial instruments; shares MiCA supervision with BdP.
Lei n.º 24-D/2022 (State Budget Law, effective January 1, 2023): Introduced 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens.
Law No. 69/2025 (December 2025): Incorporates MiCA and Transfer of Funds Regulation (TFR) into national law; treats CASPs as financial entities under AML rules; effective July 2026.
Law No. 70/2025 (January 2026): Further implements TFR alongside MiCA.
Portuguese AML Law: Governs VASP registration; VASPs registered by December 30, 2024, can operate under transitional MiCA rules until June 30, 2026.
February 2024 bill: Mandates annual IRS declaration of crypto assets.
For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5)).
CASPs must collect, retain, and share Travel Rule data (e.g., originator/beneficiary details for unique transfer identification) for transparency in transfers.
Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention by originating CASP, plus verification for ≥EUR 1,000.
Requirements include data verification, recordkeeping, security measures, and alignment with TFR for AML/CFT (e.g., immediate/secure sharing).
Banco de Portugal (BdP) supervises compliance for CASPs and payment service providers; registered CASPs can operate under MiCA transitional rules until July 1, 2026.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a DeFi protocol frontend operating in Portugal is likely regulated as a CASP if it takes custody, transmits orders, executes orders on behalf of clients, or charges fees; a purely passive non-custodial interface may fall outside regulation, but the line is ambiguous and fee-taking significantly increases the risk of needing full VASP/CASP registration with Banco de Portugal and AML compliance by mid-2026.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?