Picture the platform holding your crypto collapsing overnight. Before the EU’s MiCA regulation, whether you’d ever see your coins again hinged on national rules and buried fine print. Now, if your exchange holds a licence in the bloc, the law requires it to keep your cryptoassets separate from the company’s own holdings, so creditors cannot seize them. That segregation is the regulation’s most consequential safeguard — and the one most often misunderstood. MiCA shields your assets from the provider, not from a falling market. This guide is aimed at anyone buying, or planning to buy, through an exchange in Spain. It is not financial advice or an investment recommendation.
What MiCA is and when it started applying
Formally Regulation (EU) 2023/1114 of 31 May 2023, MiCA is the first common EU rulebook for cryptoasset markets. It has applied broadly since 30 December 2024, while the section covering stablecoins — asset-referenced and e-money tokens — kicked in earlier, on 30 June 2024.
Platforms already operating were granted a transition window of up to 18 months, running to 1 July 2026, with each member state free to shorten it. Spain initially set 12 months, according to a December 2024 CNMV statement, but ultimately applied the full 18: per the CNMV’s MiCA page, the Spanish transitional period ended on 1 July 2026. Since that date, only providers authorised by the CNMV or another European authority may operate in Spain. As the CNMV stressed in a 15 June 2026 statement, what counts is having secured authorisation — merely filing an application is not enough to keep trading.
What you are protected against with a licensed exchange
MiCA labels exchanges, custodians and brokers cryptoasset service providers (CASPs). If yours is licensed, the regulation imposes a set of duties, including:
- Acting honestly and in your best interest, with clear, non-misleading information — advertising included — and warning you of the risks of trading cryptoassets (Article 66).
- Publishing its pricing and fee policy on its website, along with information on the climate and environmental impact of each cryptoasset it handles.
- Giving you access to the white paper for each cryptoasset — the disclosure document the issuer must publish.
- Maintaining a free complaints procedure, with a template for submissions and a log of every complaint received (Article 71).
- If it custodies your cryptoassets: signing an agreement with you covering its custody policy, keeping your assets segregated from its own and legally outside its estate, “in particular in the event of insolvency” (Article 75).
- Being liable to you if you lose cryptoassets or access to them through an incident attributable to the provider — capped at the market value of the asset at the time of loss.
My read: asset segregation is what genuinely changes the game for a saver. The rest — fee transparency, complaints handling — is the bare minimum demanded of any financial institution, and in crypto it simply didn’t exist uniformly before.
What MiCA does not cover
Here lies the misunderstanding. Providers offering advice or portfolio management must warn you that cryptoassets may lose all or part of their value, may be illiquid, and are not covered by deposit guarantee schemes or, where applicable, investor compensation schemes. In plain terms: there is nothing resembling the protection that covers money in a bank account.
Other gaps worth knowing:
- The 14-day right of withdrawal exists, but only when you buy in an initial offering directly from the issuer or the person placing it. It does not apply if the cryptoasset was already trading on a platform before your purchase (Article 13). Buying bitcoin on an exchange gives you no 14-day cooling-off period.
- Unique, non-fungible NFTs, such as digital art collections, fall outside the regulation.
- Services provided in a fully decentralised manner, without an intermediary, are also excluded, per the recitals.
- If you move your cryptoassets to a self-hosted wallet, you leave regulated custody behind. Key security becomes your responsibility.
How to check whether your platform is licensed
The regulation requires ESMA to maintain a public register of authorised providers and white papers (Article 109), plus a non-exhaustive register of entities offering services without authorisation (Article 110). In Spain, Law 6/2023 on Securities Markets designates the CNMV as the competent authority for applying MiCA on issuance and offering of cryptoassets, and the CNMV itself explains that service providers must be authorised by it or by another competent EU authority. Before MiCA, registration with the Bank of Spain sufficed; according to the CNMV, that register is now informational only and has accepted no new entries since 30 December 2024.
Three quick checks:
- Search the exact corporate name shown in the app’s terms — not the brand — in ESMA’s register and in the CNMV’s cryptoasset service provider register. The CNMV warns that MiCA protections apply only to the legal entity authorised in the EU, not to other companies in the same group.
- Confirm the licence covers the service you use: custody, exchange, trading platform.
- Be wary of any platform that reaches you through an ad featuring celebrities. That is the pattern described in guidance on celebrity investment ads and how to verify with the CNMV whether a firm is authorised.
What to do if your exchange is unlicensed
The CNMV’s advice in its June 2026 statement is blunt: do not deal with unauthorised entities. Firms that will not obtain a licence must have a migration plan letting you move your cryptoassets to another address and your funds to an account, or accept a transfer to another authorised provider. If your provider is unlicensed, the CNMV recommends requesting that plan and the options on offer. Ask in writing, and don’t wait.
And even on a licensed platform, account security remains your job. MiCA won’t protect you if someone logs in with your password: enable a second factor other than SMS, which is no longer a secure second factor, and watch for your email appearing in data breaches that expose you to targeted attacks.
MiCA is a genuine step forward, and I think it is being sold badly. It is presented as “regulated crypto,” and many people hear “safe crypto.” It isn’t: it regulates intermediaries, not the asset. It protects you from an exchange using your money, mixing your coins with its own, or hiding fees. It does not protect you from buying high, selling in a panic, or holding a token that goes to zero. That distinction — which the regulation itself obliges providers to spell out — is the one that saves the most money.