Portugal Compliance Report

Generated 2026-09-22

Comprehensive Framework

Regulatory Overview

Regulatory Status: Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s): Bank of Portugal, Portuguese Securities Market Commission, Portuguese Tax and Customs Authority
Primary Legislation: Law No. 58/2019, Decree-Law 125/2025, Pending legislation (Bill 398/XVII/1) on children's data and age verification ma, Portugal Data Protection & Privacy Regulation Monitor | GDPRI
Travel Rule: Adopted — Threshold: Implemented
Tax Reporting: Applies to profits from selling or disposing of cryptoassets not classified as securities.. Short-term (<365 days): 28% flat rate; aggregation possible for progressive IRS brackets (14.5%-53% for 2026), mandatory if total income exceeds top bracket.. Long-term (>365 days): Exempt from tax, but transactions must still be reported.. Crypto-to-crypto swaps are non-taxable, deferring gains until fiat conversion.. Exceptions: 35% rate for blacklisted jurisdiction assets; no exemption if treated as securities.

Key Facts

aml Full compliance with Law No. 83/2017 (Anti-Money Laundering Law) and FATF standards is mandatory KYC procedures: Identify and verify client identity, understand the nature of business relationships, and document beneficial ownership information in a Central Register Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF) Internal compliance programs including risk assessments, internal policies, and staff training Compliance with restrictive measures approved by the UN or EU Banco de Portugal (BdP, Bank of Portugal): Registers virtual asset service providers (VASPs) and supervises AML/CFT compliance; handles MiCA authorization applications for crypto-asset service providers (CASPs) starting July 2026. Comissão do Mercado de Valores Mobiliários (CMVM, Portuguese Securities Market Commission): Determines if crypto-assets qualify as financial instruments; shares MiCA supervision with BdP. Autoridade Tributária e Aduaneira (AT, Portuguese Tax and Customs Authority): Enforces crypto taxation, including reporting requirements.
enforcement September 2025: Eurojust coordinated an operation halting a cryptocurrency investment fraud exceeding 100 million euros across Europe, resulting in five arrests including the alleged main perpetrator. May 2024: A coordinated operation uncovered a cryptocurrency scam using "rip deals" methods, leading to suspect arrests in France, with investigations involving Portugal, Germany, Italy, and Romania. The Portuguese Securities Commission (CMVM) website for market abuse and crypto asset service provider violations The Bank of Portugal for anti-money laundering compliance actions Individual regulator enforcement databases
general Collection and retention of required Travel Rule information for uniquely identifying each transfer Request for proof of wallet ownership or control for transactions EUR 1,000 or above involving self-hosted wallets Data verification and recordkeeping procedures At least one director with qualifications and experience in finance, compliance, or law must be based in Portugal Registered office: Local or virtual office is acceptable for legal correspondence Compliance Officer: Appointment of a local Compliance Officer with experience in Portuguese financial regulations is required Internal compliance personnel: AML and compliance duties must be covered by internal staff Integration of financial monitoring and reporting tools
licensing Exchange of cryptocurrency for fiat currency and vice versa Custodial services (storage of crypto-assets and encrypted keys) ICO/IEO and stablecoin issuance and maintenance Execution of orders on behalf of clients Crypto-asset advisory and portfolio management services Reception and transmission of orders
securities Portuguese Securities Market Commission (CMVM): Responsible for securities regulation. Banco de Portugal: Oversees banking and monetary policy. Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF): Manages insurance and pension funds. Law on the Organization of the Securities Market (Decreto-Lei n.º 89/2002, 29 de maio): Governs securities market activities. Regulation (EU) No 809/2007: Implements MiFID II provisions in Portugal concerning investment services and markets. Entities Requiring License: Companies engaging in securities trading or issuing digital asset securities must obtain authorization from CMVM. Activities Requiring Licensing: Issuance of tokens classified as securities, operation of centralized exchanges dealing in such tokens, and provision of custodial services for tokenized assets. Capital Requirements: No explicit capital thresholds are set by CMVM for crypto-related licensing; however, general banking regulations may apply if the entity is also a financial institution.
stablecoin Fines for non-compliance with AML/KYC procedures. Suspension of operations for entities failing to maintain adequate reserve assets. Revocation of licenses for persistent regulatory breaches. Bison Bank issues Portugal's first stablecoin Legal Alert – Portugal implements laws on crypto-assets ... Application for authorisation as a crypto-asset service ... Blockchain & Cryptocurrency Laws 2026 | Portugal Portugal's Income Tax Law – Article 23
status Comissão Nacional de Proteção de Dados (CNPD): Sole national supervisory authority for GDPR compliance. PORTUGAL STATUS 🇵🇹 – Telegram Autoridade Monetária Portuguesa (AMP): Oversees financial stability and monetary policy, including crypto-related financial services. Utopia in Portugal, Brazil and Lusophone African Countries (The Unstable Status of Sebastianism) Instituto da Competição Económica (ICE): Regulates antitrust and competition issues affecting digital asset markets. Runa Portugal Status — Live Health & Uptime GDPR Implementation Law (Law No. 58/2019): Full applicability with CNPD overseeing compliance. 1. Status of Religious Communities (Portugal) NIS2 Directive Transposition (Decree-Law 125/2025): Expands cybersecurity obligations for public and private entities, including those in crypto sectors. Is Tink Portugal Down? Live Status, Outages & Alerts | IsDown Regulamento (UE) n.º 2016/679 (GDPR): Directly applicable with CNPD ensuring GDPR consistency. Deutsche Rentner in Portugal: Besteuerung deutscher Rentner in Portugal – Status des „residente não habitual“ im DBA-Portugal Portugal is a member of the European Union’s Financial Action Task Force (FATF) and adheres to its recommendations on AML/CFT for virtual asset service providers (VASPs). SEF for Ukraine The CNPD issued a €1.25 million fine against the Municipality of Lisbon for unlawful processing of protesters' data and unauthorized transfer to the Russian Embassy.
tax Applies to profits from selling or disposing of cryptoassets not classified as securities. Short-term (<365 days): 28% flat rate; aggregation possible for progressive IRS brackets (14.5%-53% for 2026), mandatory if total income exceeds top bracket. Long-term (>365 days): Exempt from tax, but transactions must still be reported. Crypto-to-crypto swaps are non-taxable, deferring gains until fiat conversion. Exceptions: 35% rate for blacklisted jurisdiction assets; no exemption if treated as securities. Covers passive income like staking rewards, lending yields, airdrops, or DeFi yields: taxed at 28% flat rate regardless of holding period (aggregation option to progressive rates up to 53%). Professional trading, mining, or business-scale activities taxed as business income (Category B) at progressive rates 14.5%-53%. If remuneration received in crypto, treated as Category G (deferred until sale).
travel rule Banco de Portugal (BdP): National bank responsible for supervising stablecoin issuance and authorising CASPs. Website: https://www.bportugal.gov.pt/ Comissão do Mercado de Valores Mobiliários (CMVM): Oversees non-stablecoin crypto asset issuance and market abuse. Website: https://www.cmvm.pt/ Law No. 69/2025 & Law No. 70/2025 (December 22, 2025): Implement Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR). Source: https://www.21analytics.co/blog/portugal-travel-rule-what-casps-need-to-know/ Law No. 83/2017: Aligns with EU standards for crypto-assets and AML/CFT. Source: https://gfdl.legal/portugal-travel-rule-implementation/ FATF Recommendations: Portugal aligns with FATF Travel Rule requirements, including data sharing and verification obligations for VASPs. Source: https://sumsub.com/blog/what-is-the-fatf-travel-rule/ EU Status: Portugal is a member of the European Union, thus compliant with MiCA and FATF standards. Source: https://eur-lex.europa.eu/ Entities Requiring License: All CASPs providing crypto-asset services must obtain prior authorisation from BdP; CMVM provides opinion on completeness, focusing on internal policies and MiCA compliance. Source: https://www.21analytics.co/blog/portugal-travel-rule-what-casps-need-to-know/ Capital Requirements: Specific monetary thresholds not explicitly stated; however, for self-hosted wallets over EUR 1,000, proof of ownership is required. Source: https://www.21analytics.co/blog/portugal-travel-rule-what-casps-need-to-know/

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-09-21. View full profile