Regulation of financial services in Portugal

Pavel Kos

04.01.2021 | 6 min read

Updated: 09.11.2026

Portugal's financial sector is regulated by three separate authorities, each with its own mandate. The Banco de Portugal (BdP) is the central bank and the prudential supervisor of banks, payment institutions and e-money institutions, and, since Law 69/2025 implemented the EU Markets in Crypto-Assets Regulation (MiCA) in Portugal, it also authorises and supervises crypto-asset service providers (CASPs) and issuers of asset-referenced and e-money tokens. The CMVM, Portugal's securities market regulator, is responsible for market-conduct rules for crypto-asset services, as well as for investment firms and fund managers. The ASF (Autoridade de Supervisão de Seguros e Fundos de Pensões) supervises insurance and reinsurance undertakings and pension funds, and plays no part in banking, payment or crypto-asset licensing. Entities already registered with the BdP as VASPs before the MiCA implementing law could keep operating under a transitional regime that closed on 1 July 2026; from that date, crypto-asset activity in Portugal requires full MiCA/CASP authorisation from the BdP. Our financial licensing team in Portugal advises on both the traditional BdP/CMVM authorisation tracks and the MiCA/CASP route.

Authorisation routes

The authorisation route for a financial business in Portugal depends on the activity. Deposit-taking and lending require a banking licence from the BdP; payment services and e-money issuance require a payment institution (PI) or electronic money institution (EMI) licence from the BdP under the rules transposing the EU Payment Services and E-Money Directives; investment services, fund management and crypto-asset market-conduct activity fall to the CMVM; insurance mediation and underwriting fall to the ASF; and crypto-asset services such as exchange, custody, operating a trading platform, advice and transfer services require CASP authorisation from the BdP, coordinated with the CMVM, under Law 69/2025.

Every application is assessed against broadly the same criteria: a sound business plan and governance structure, adequate own funds, "fit and proper" qualifying shareholders and directors, and, for most licences, an effective place of management in Portugal. For CASP applications specifically, Law 69/2025 gives the CMVM ten business days to confirm an application file is complete and a further fifteen business days from the BdP's completeness notice to issue its opinion on the matters it supervises; silence is treated as no objection. For the overall decision the EU rules themselves set the clock: under MiCA (Article 63) the BdP has 25 working days to check that a CASP application is complete and 40 working days from a complete application to decide, extendable where it asks for additional information; under the Payment Services Directive (Article 12) a payment or e-money institution licence must be decided within three months of a complete application; a banking licence follows the Capital Requirements Directive timetable of six months from a complete application, up to a maximum of twelve. In practice, preparing a complete file is what determines the real timeline, so founders should confirm current processing times with the BdP before planning a launch date. Firms preparing an EMI, PSP or CASP application often also need contractual and liability protection in place before they go live; our legal protection service for EMI, PSP and crypto-businesses covers this.

Internal control

Financial companies opening in Portugal — including crypto-asset service providers authorised under MiCA — have an obligation to set up internal control systems, and, depending on the licence held, to meet the AML/CFT, ICT-risk and reporting obligations described later in this guide. Those systems also need to fulfill the following conditions:

Applicability to all subsidiaries of a financial company;
Correlation with the company’s activities, risks associated with a company’s activities, and centralization/delegation of authority in a company.

Internal control systems aim to avoid any negative consequences connected to violations of financial legislation, customer relations, contractual obligations, rules of conduct. Moreover, when someone sets up a financial institution, they need to keep documentation about strategies, procedures, policies, and systems related to that institution.

Auditors

When opening a business in Portugal, it is crucial to learn about the main activities conducted by internal auditors:

Audit plan preparation;
Preparation and submission of annual audit reports;
Provision of recommendations and control of their implementation.

Supervised entities must also appoint a statutory external auditor. Depending on the licence held, the auditor reports to the BdP, the CMVM or the ASF on the entity's financial statements and, for AML/CFT purposes, on the effectiveness of its internal control systems under Law 83/2017, as amended.

Directors

Directors and other members of the management body go through a "fit and proper" assessment by the relevant regulator — covering their experience, reputation and the time they can commit to the role — before authorisation is granted and on an ongoing basis afterwards. Beyond that assessment, there are two key responsibilities of directors:

Cautiousness about their company’s activities;
Acting in their company’s best interests.

It is vital to remember while preparing to obtain a financial services license in Portugal that directors bear responsibility for the failure of complying with their responsibilities. In addition, directors can be held responsible if their actions or violation of legal/contractual duties result in damages. However, directors can be excluded from liability, yet only if it was found out that they acted in good faith and their actions were not influenced by their personal interests.

In case it is proven that directors were aware of a regulatory violation and did not act on precluding the infringement, they can be also held liable.

Mediators

If you are obtaining a financial mediator license in Portugal, do not forget that you would need to request permission to use financial instruments registered in the name of non-professional clients. On the opposite side, when it is professional clients who receive the services, those individuals or entities are considered to be experienced and familiar with financial instruments, financial services as well as the process of conducting financial transactions.

Ongoing obligations

Once authorised, a financial entity's obligations do not stop at internal control and audit. Anti-money-laundering and counter-terrorist-financing (AML/CFT) duties — customer due diligence, beneficial-ownership checks, transaction monitoring and suspicious-activity reporting — apply under Law 83/2017, as amended, which partially transposed the EU's anti-money-laundering directives into Portuguese law; BdP Notice No. 1/2023 sets out sector-specific AML/CFT rules that continue to apply to CASPs during the MiCA transition. At EU level, the AML Regulation (AMLR) becomes directly applicable from 10 July 2027 and will be enforced alongside a new EU Anti-Money Laundering Authority (AMLA), which has been operational since 1 July 2025; firms should treat the next two years as a transition period rather than a fixed, far-off deadline. Many PI, EMI and CASP applicants outsource parts of their AML/CFT function rather than build it from scratch; our AML support and outsourcing service covers this.

Since 17 January 2025, the EU's Digital Operational Resilience Act (DORA) has applied directly to banks, payment and e-money institutions, investment firms, fund managers, CASPs and other EU financial entities, requiring an ICT risk-management framework, incident classification and reporting, regular digital operational resilience testing, and oversight of critical ICT third-party providers. A Portuguese financial entity bringing in outside developers, cloud hosting or custody technology should expect its DORA obligations to extend to those contracts.

What changed in Portugal's financial regulation

The single largest change to this area since the early 2020s is the entry into force of Law 69/2025 of 22 December 2025, which implements MiCA in Portugal and creates the BdP/CMVM authorisation and supervision split for crypto-asset services described above.

Law 69/2025 (in force from 27 December 2025) gives the BdP authorisation and prudential-supervision powers over CASPs and ART/e-money token issuers, with the CMVM responsible for market conduct and market abuse;
the transitional regime that let firms already registered with the BdP as VASPs keep operating lapsed on 1 July 2026, or earlier if their MiCA application was decided first; crypto-asset activity in Portugal now requires full CASP authorisation;
DORA has applied to in-scope financial entities, including CASPs, since 17 January 2025;
at EU level, the AMLR/AMLA package and, for payment services, the proposed PSD3/PSR reform continue to move through implementation; as of November 2026 PSD3/PSR had not yet been formally adopted and published, so Portugal has not yet transposed it — founders should check the Official Journal and the BdP's website for the current status before relying on any specific application date.

Common mistakes

Assuming a BdP VASP registration from before the MiCA implementing law still allows crypto-asset activity after 1 July 2026 — it does not, once the transitional regime has lapsed or the CASP application has been decided;
treating internal control and AML/CFT as a one-off document produced for the licence application, rather than a live system that the BdP, CMVM or ASF expects to see operating and evidenced on an ongoing basis;
under-estimating the fit-and-proper review of directors and qualifying shareholders, which looks at experience and reputation, not only at the formal paperwork;
overlooking DORA's reach into contracts with outside ICT providers, including cloud and crypto-custody technology vendors, rather than treating it as an internal IT policy exercise;
leaving AML/CFT monitoring and reporting entirely in-house without the specialist resourcing it needs; our outsourced MLRO service is one way to cover this gap.

Frequently asked questions

Does Portugal still allow crypto-asset businesses to operate under their old VASP registration?

No. The transitional regime for entities registered with the BdP before the MiCA implementing law ended on 1 July 2026, or earlier if the entity's MiCA application had already been decided. From that date, crypto-asset services in Portugal require full CASP authorisation from the BdP.

Which regulator should a payments or e-money business deal with?

The Banco de Portugal authorises and supervises payment institutions and e-money institutions. The CMVM only becomes relevant if the business also carries out investment or crypto-asset market-conduct activity, and the ASF only if it also carries out insurance mediation.

Does DORA apply to a small Portuguese fintech?

DORA applies broadly across the categories of EU financial entities listed in the regulation, including payment institutions, e-money institutions, investment firms and CASPs, with simplifications available for some smaller entities. A firm should check its own classification against the regulation rather than assume size alone exempts it.

How long does CASP authorisation take in Portugal?

Law 69/2025 sets fixed opinion periods for the CMVM once an application reaches the BdP — ten business days to confirm the file is complete and a further fifteen business days to opine on the matters it supervises — while MiCA itself (Article 63) gives the BdP 25 working days to check completeness and 40 working days from a complete application to decide, extendable where additional information is requested. Realistically, applicants should budget several months including preparation, and confirm the BdP's current expected timeline directly.

Do you want to register a financial company in Portugal and need professional help? Do not hesitate to contact us in COREDO: we are prepared to assist on every stage of setting up your business there.

How COREDO can help: we support clients through both the traditional BdP/CMVM authorisation tracks and MiCA/CASP licensing introduced by Law 69/2025, including company formation in Portugal and ongoing internal-control and governance compliance.