Self-custodial wallet / non-custodial software in Portugal
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Portugal without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No direct AML obligations attach to the non-custodial software publisher itself, since it never holds, controls, or has access to user funds and is not classified as a VASP/CASP under Portuguese law (licensing categories cover custodial services, exchange, execution of orders, advisory, and transmission of orders — none cover pure software publishing).
- However, if the wallet software facilitates transactions involving self-hosted wallets, counterparty CASPs interacting with users of this wallet must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5) via Law No. 70/2025).
- If the publisher also offers any ancillary services (e.g., order routing, exchange integration, staking-as-a-service), it may fall under a licensing category and become subject to full AML obligations under Law No. 83/2017, including KYC, ongoing monitoring, and reporting to UIF.
Key Restrictions
- The publisher must not offer any custodial, exchange, order-execution, or transmission services — doing so would trigger VASP/CASP licensing and full AML obligations.
- If the software includes a built-in on-ramp/off-ramp, trade aggregation, or staking feature where the publisher exercises control, the activity may be reclassified as a CASP service under MiCA (effective July 2026 via Law No. 69/2025).
- Portuguese AML Law (Law No. 83/2017) requires VASPs to register with Banco de Portugal; a purely non-custodial wallet publisher does not need to register unless additional services are provided.
- Tax disclosure obligations apply to users (annual IRS declaration of crypto assets per February 2024 bill), but these are user-side obligations, not publisher-side.
Key Risks
- Regulatory ambiguity risk: The line between 'publishing non-custodial software' and 'providing crypto-asset services' may be tested by Portuguese regulators, especially if the publisher integrates swap/trade features or charges transaction fees.
- MiCA brings broader CASP definitions (effective July 2026) — a non-custodial wallet with integrated DeFi features could be reclassified as a CASP, requiring authorization from Banco de Portugal.
- Enforcement precedent is limited — no published enforcement action specifically addresses purely non-custodial wallet publishers in Portugal, creating uncertainty.
- Tax and PR risk: Users of the software face a 28% tax on gains from crypto held <365 days; the publisher could face reputational scrutiny if perceived as facilitating tax evasion, even if not legally responsible.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Exchange of cryptocurrency for fiat currency and vice versa
Custodial services (storage of crypto-assets and encrypted keys)
Execution of orders on behalf of clients
Crypto-asset advisory and portfolio management services
Reception and transmission of orders
Reception and transmission of orders
Law No. 69/2025 (December 2025): Incorporates MiCA and Transfer of Funds Regulation (TFR) into national law; treats CASPs as financial entities under AML rules; effective July 2026.
Law No. 70/2025 (January 2026): Further implements TFR alongside MiCA.
Portuguese AML Law: Governs VASP registration; VASPs registered by December 30, 2024, can operate under transitional MiCA rules until June 30, 2026.
For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5)).
Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention by originating CASP, plus verification for ≥EUR 1,000.
Banco de Portugal (BdP) supervises compliance for CASPs and payment service providers; registered CASPs can operate under MiCA transitional rules until July 1, 2026.
February 2024 bill: Mandates annual IRS declaration of crypto assets.
Lei n.º 24-D/2022 (State Budget Law, effective January 1, 2023): Introduced 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a purely non-custodial wallet publisher is not classified as a VASP/CASP under Portuguese law and does not trigger licensing or direct AML obligations, provided it offers no custody, exchange, order-execution, or transmission services; however, if any integrated service crosses into CASP territory, full MiCA authorization and AML compliance (including TFR self-hosted wallet verification ≥EUR 1,000) will apply from July 2026.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?