Criminal Defence for MiCA Regulation, CASPs and Traceability Risks

The MiCA Regulation (Markets in Crypto-Assets), fully applicable since 30 December 2024, has created in the EU a harmonized authorization and supervision regime for Crypto-Asset Service Providers (CASP). Spanish transposition has integrated MiCA into the CNMV supervisory framework and has established relevant criminal obligations for directors of companies operating with crypto without authorization or without complying with KYC and traceability.

TFR Traceability Obligations

EU Regulation 2023/1113 (crypto Travel Rule) requires CASPs to transmit, with each transfer, the identification data of the originator (name, address, account number or equivalent) and the beneficiary. The transmission must be simultaneous or immediate to the operation, and must be retained for 5 years. Non-compliance generates serious administrative liability and, when systematic, may trigger criminal imputation for cooperation with money laundering (Art. 301.3 CP, negligent modality).

Criminal Risks of Unauthorized CASP

Operating as a CASP in Spain without CNMV authorization may give rise to: (1) Professional intrusion (Art. 403 CP) in relation to the reserved activity; (2) Misappropriation if the company holds client funds without license and without adequate segregation; (3) Fraud if advertising services it cannot legally provide; (4) Negligent money laundering due to systematic omission of KYC and traceability; and (5) Corporate offense of the directors who approved the operation.

CASP Compliance Program

A defensible MiCA compliance program rests on five pillars: (1) Enhanced KYC/KYB with identity verification and source of funds; (2) transaction monitoring and suspicious-activity reporting to SEPBLAC; (3) technical implementation of the Travel Rule (TFR) with interoperable messaging protocols; (4) segregation and custody of client assets; and (5) documented governance with a responsible body, training and periodic audit. Its prior and effective existence is the best defense against the imputation of the director (Arts. 31 and 31 bis CP).

Transitional Regime and European Passport

MiCA provides a transitional regime for entities already operating before its full application, with adaptation deadlines that each Member State sets. CASP authorization also enables the European passport, allowing services to be provided across the EU by notifying the host supervisor. Operating by invoking a non-existent passport or outside the authorized scope reintroduces the risk of professional intrusion (Art. 403 CP) and misleading advertising.

Exact Criminal Classification and Penalties for CASP Conduct

A crypto-asset service provider's conduct can fall under different criminal offences depending on its role. Providing reserved services without the required authorisation may be examined as an intrusion into activities subject to administrative reservation and, where there is sufficient deceit and a transfer of assets, as ordinary fraud under Articles 248 and 249.1.a of the Criminal Code, punishable by six months to three years' imprisonment. Where the crypto operation is the channel used to obtain victims' funds, the provider may answer as a principal, a necessary cooperator or an accessory, and that distinction shapes the sentence.

Fraud is aggravated under Article 250.1 (among other cases, substantial amounts, abuse of personal relationships, or numerous victims), carrying one to six years' imprisonment plus a fine, and is raised further under Article 250.2 where qualified circumstances concur, with four to eight years' imprisonment. If crypto-assets are used to conceal the unlawful origin of funds, money laundering under Article 301 applies, punishable by six months to six years' imprisonment plus a fine; the negligent form under Article 301.3 carries six months to two years.

Money laundering must be separated from tax fraud: concealing gains or failing to declare income from crypto-assets may amount to an offence under Article 305, carrying one to five years' imprisonment, or the aggravated type under Article 305 bis, two to six years, where the defrauded amount exceeds the qualified threshold or interposed structures or persons are used. The correct classification is not a technicality: it determines the penalty, the limitation period and the procedural strategy. The defence's first task is therefore to challenge the applicable offence before challenging the proof of the facts.

Limitation Periods Applicable to CASP Conduct

Limitation of the offence is governed by Article 131 of the Criminal Code and is calculated by reference to the maximum penalty the offence carries, not the penalty ultimately imposed. The relevant rule here is clear: where the maximum penalty does not exceed five years, the offence is a less serious one and is time-barred after five years; where the maximum penalty exceeds five years, the limitation period is ten years. Minor offences punishable only by a fine are time-barred after one year. There is no intermediate three-year period for these offences, so approximate calculations should be avoided.

Applied to crypto operations, the periods are as follows: basic fraud under Articles 248 and 249.1.a, with a maximum penalty of three years, is time-barred after five years; aggravated fraud under Article 250.1, with a maximum of six years, and the fraud under Article 250.2 are time-barred after ten years. Intentional money laundering under Article 301, with a maximum of six years, is time-barred after ten years, while negligent money laundering under Article 301.3, with a maximum of two years, is time-barred after five years.

On the tax side, Article 305, with a maximum penalty of five years, is time-barred after five years, and the aggravated type under Article 305 bis, with a maximum of six years, after ten years. The period runs from completion of the offence or, in continuing or permanent offences, from the last act or the cessation of the unlawful situation. Filing a complaint or private prosecution directed against a specific person interrupts limitation on the statutory terms. Correctly identifying the start date of the period and the acts capable of interrupting it can be decisive in arguing that criminal liability has been extinguished.

Blockchain Forensic Expert Evidence and How a Court Weighs It

In crypto-related proceedings, the central evidence is usually forensic analysis of the blockchain: tracing addresses, clustering wallets, identifying mixing services and reconstructing the path of funds up to their conversion into fiat currency. Although the distributed ledger is immutable and allows the flow of value to be followed, attributing an address to a specific individual requires additional links (platform registration data, IP, devices, time correlation). The defence must scrutinise precisely that leap from address to holder, which is where reasonable doubt tends to concentrate.

The court weighs this evidence under the rules of sound judicial reasoning. The defence may challenge the chain of custody of the digital evidence, the reliability and traceability of the analytical tools used, the documentation of the method and its reproducibility by a third party, and the expert's qualifications. Challenging the integrity of the data image, the verification hashes or the methodology may strip an apparently conclusive report of its force. It is also legitimate to submit a party-appointed expert offering alternative readings of the same flow of funds.

Case-law doctrine, without the need to cite specific rulings, requires circumstantial evidence to rest on fully proven, plural and consistent indicators, from which the inference of authorship is logical and not open to reasonable alternative hypotheses. In the crypto context, this means that the mere passage of funds through an address does not equate to participation in the underlying offence. A sound technical defence combines legal analysis of the inference with an expert counterpoint that exposes the blind spots of on-chain tracing.

Corporate Criminal Liability, Plea Agreements and the Boundary with the Administrative Route

Where the provider operates as a company, the legal entity itself may be investigated under Article 31 bis of the Criminal Code for offences committed in its name or for its benefit by directors and employees. The company's defence is built by evidencing a suitable organisation and management model, in place before the events, with risk assessment, anti-money-laundering controls, a compliance body with autonomous powers and operational whistleblowing channels. An effective and genuinely implemented compliance programme may ground exemption or, in the alternative, mitigation of the entity's liability.

Procedurally, the ordinary route is investigation before the competent court, with the participation of the Public Prosecutor; where elements of organisation, multiple victims or a cross-border connection concur, the National High Court may have jurisdiction. The plea-agreement strategy allows, in suitable cases, the penalty to be negotiated with the prosecution in exchange for acknowledging the facts, which may open the door to suspending custodial sentences not exceeding two years for first-time offenders. Repairing the harm and restoring funds to victims operate as mitigating factors and weigh on sentencing.

Finally, it is essential to distinguish the criminal response from the administrative and civil ones. A lack of authorisation or breach of the obligations under the MiCA framework and the anti-money-laundering regime may give rise, in the first place, to sanctioning proceedings and supervisory measures, without every regulatory irregularity being automatically a crime. Criminal law requires intent or gross negligence and material relevance to a criminal type. A well-framed defence works to channel back to the administrative route what does not reach the criminal threshold, while structuring, in parallel, the victims' civil claim together with asset recovery.