Remote VASP serving residents in Portugal
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Portugal with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with Banco de Portugal (BdP) as a VASP — mandatory under Law No. 83/2017 (AML Law) and FATF standards
- Full KYC procedures: identify and verify client identity, understand business relationships, document beneficial ownership in a Central Register
- Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF)
- Internal compliance programs including risk assessments, internal policies, and staff training
- Compliance with restrictive measures approved by the UN or EU
- Travel Rule compliance: CASPs must collect, retain, and share originator/beneficiary data for transfers (per TFR via Law No. 69/2025 and Law No. 70/2025)
- Enhanced measures for self-hosted wallets: must request proof of ownership/control for transactions of EUR 1,000 or more
- Annual IRS (tax) declaration of crypto assets required (February 2024 bill)
- 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens (Lei n.º 24-D/2022, confirmed by OE2026)
Key Restrictions
- Must be registered with Banco de Portugal as a VASP before offering services to residents; cannot operate purely remotely without registration
- Transitional regime: VASPs registered by December 30, 2024 may operate under transitional MiCA rules only until June 30, 2026 — full MiCA authorization (as a CASP) is required by July 1, 2026
- Effective July 2026, CASPs are treated as financial entities under AML rules — local entity status effectively required
- No general de minimis threshold for Travel Rule; EUR 1,000 threshold applies for self-hosted wallet verification
Key Risks
- Enforcement risk for unlicensed remote operators is significant — BdP actively supervises VASPs and can take AML compliance actions; CMVM enforces securities/crypto-asset violations
- Eurojust-coordinated enforcement operations in 2024-2025 demonstrate cross-border enforcement cooperation against crypto fraud in Portugal and EU
- Tax authority (AT) enforces crypto taxation and reporting — non-compliance carries audit and penalty risk
- Transition period ending July 1, 2026 means unregistered operators face immediate enforcement; even registered VASPs must upgrade to full MiCA CASP authorization
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Exchange of cryptocurrency for fiat currency and vice versa
Custodial services (storage of crypto-assets and encrypted keys)
Full compliance with Law No. 83/2017 (Anti-Money Laundering Law) and FATF standards is mandatory
KYC procedures: Identify and verify client identity, understand the nature of business relationships, and document beneficial ownership information in a Central Register
Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF)
Internal compliance programs including risk assessments, internal policies, and staff training
Compliance with restrictive measures approved by the UN or EU
Banco de Portugal (BdP, Bank of Portugal): Registers virtual asset service providers (VASPs) and supervises AML/CFT compliance; handles MiCA authorization applications for crypto-asset service providers (CASPs) starting July 2026.
Lei n.º 24-D/2022 (State Budget Law, effective January 1, 2023): Introduced 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens.
Law No. 69/2025 (December 2025): Incorporates MiCA and Transfer of Funds Regulation (TFR) into national law; treats CASPs as financial entities under AML rules; effective July 2026.
Law No. 70/2025 (January 2026): Further implements TFR alongside MiCA.
OE2026 (2026 State Budget, finalized January 2026): Retained the 365-day tax exemption.
Portuguese AML Law: Governs VASP registration; VASPs registered by December 30, 2024, can operate under transitional MiCA rules until June 30, 2026.
February 2024 bill: Mandates annual IRS declaration of crypto assets.
The framework was adopted via Law No. 70/2025 (and companion Law No. 69/2025 for MiCA implementation) in December 2025, ensuring national execution of the TFR.
For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5)).
No general de minimis threshold is explicitly detailed for all transfers beyond this; it aligns with FATF's recommended EUR 1,000 limit, though countries vary implementation.
Applies to Crypto-Asset Service Providers (CASPs), formally integrated into Portugal's AML regime.
Banco de Portugal (BdP) supervises compliance for CASPs and payment service providers; registered CASPs can operate under MiCA transitional rules until July 1, 2026.
CASPs must collect, retain, and share Travel Rule data (e.g., originator/beneficiary details for unique transfer identification) for transparency in transfers.
Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention by originating CASP, plus verification for ≥EUR 1,000.
Requirements include data verification, recordkeeping, security measures, and alignment with TFR for AML/CFT (e.g., immediate/secure sharing).
September 2025: Eurojust coordinated an operation halting a cryptocurrency investment fraud exceeding 100 million euros across Europe, resulting in five arrests including the alleged main perpetrator.
May 2024: A coordinated operation uncovered a cryptocurrency scam using "rip deals" methods, leading to suspect arrests in France, with investigations involving Portugal, Germany, Italy, and Romania.
The Portuguese Securities Commission (CMVM) website for market abuse and crypto asset service provider violations
The Bank of Portugal for anti-money laundering compliance actions
Individual regulator enforcement databases
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP may serve Portuguese residents only if registered with Banco de Portugal as a VASP (under Law 83/2017), complies with full AML/KYC/Travel Rule obligations, and obtains full MiCA CASP authorization by July 1, 2026; purely unregistered cross-border service is not permitted and carries enforcement risk.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?