DeFi regulation in Portugal

Map the Portuguese supervisory responsibilities

Article 2 of Law 69/2025 of 22 December 2025 allocates MiCA responsibilities between Banco de Portugal and the Comissão do Mercado de Valores Mobiliários (CMVM). Banco de Portugal handles the issuer regimes for ART and EMT and specified provider authorization, prudential and organizational matters. CMVM handles other-token offers, market abuse and specified conduct and service duties.

This split does not turn one CASP application into two independent authorizations. Article 6 sets a coordination procedure: Banco de Portugal communicates the Article 60 notifications and Article 62 applications it receives to CMVM within two working days. That period concerns communication between authorities, not approval of the applicant.

Prepare one consistent description of the service

Choose the relevant Article 63 authorization or eligible Article 60 notification route before preparing the file. The latter depends on the existing financial institution and the crypto service proposed. The law's coordination process does not remove the EU eligibility conditions.

Describe the same contracting entity, service and customer assets in the prudential file, conduct policies and customer terms. Resolve inconsistent custody, execution or complaints descriptions before submission. Obtain the current filing-channel instructions from the receiving authority. The statute does not specify an upload portal or establish a complete filing checklist.

For an interface using DeFi protocols, document who controls the interface, executes orders and can alter deployed contracts. The EU scope analysis depends on those activities and actors. Token issuance and a financial-instrument classification need separate assessment.

Reconcile application and conduct evidence

This DeFiSec worksheet helps a team prepare consistent evidence across the two authorities' areas of responsibility. It is not an official application form.

Pharos Production's engineering guide to the DORA information register supports the practical reconciliation of suppliers, contracts and services. Keep this technical register aligned with the application and update it when the provider's arrangements change. It does not determine which authority accepts a filing.

Keep service scope and staff competence current

Article 7 requires publication of the entities authorized or entitled to provide services in Portugal with their service scope. Verify that scope before presenting a provider as authorized for a particular feature.

Article 8 addresses staff giving crypto advice, including responsibilities, competence evidence and at least annual assessment. A one-time training certificate is not the entire ongoing process. Record the review outcome and any remedial action.

The earlier VASP transition in Article 30 ended by July 2026. Use a current permission or other valid MiCA basis rather than treating the old registration as continuing authorization. The DORA evidence guide expands the technical work after the provider's regulatory scope is established.