1. The Legal Perimeter - Where DeFi Meets Banks

A. MiCA Position - DeFi is OUTSIDE but not EXEMPT:

Recital 22 MiCA: "This Regulation does not apply to crypto-asset services provided in a fully decentralised manner without any intermediary." EU Commission Q&A July 2024 confirms: Truly decentralised protocols where no natural/legal person exercises control are out of scope.

But ESMA/CNMV interpretation 2025-2026:

• If you have a front-end, multisig, admin keys, governance token that gives control, fee collection, or a company marketing the protocol - you are NOT fully decentralised and you become a CASP needing CNMV authorization.
• Pure staking, lending/borrowing smart contracts (Aave, Compound style) currently sit outside MiCA perimeter, meaning they have no passport, no consumer protection, and banks cannot treat them as regulated counterparties.

So for Spanish banks:

• BBVA, Santander, Cecabank, Renta 4 have obtained CNMV CASP registration (60+ entities registered as of 2026). They can offer custody, exchange, transfer.
• They cannot directly integrate DeFi yield protocol into balance sheet as regulated product. It would be considered unregulated activity + potential MiFID breach.

B. Banking Law Perimeter - What banks CAN do:

As CASP under MiCA Art. 60: Custody and administration of crypto-assets, exchange crypto for funds, execution of orders, transfer services. Need CNMV authorization, own funds €125k-€150k, AML, conflict management.

As Credit Institution under PSD2 / Law 16/2009 Payment Services: Manage fiat on/off ramp to DeFi. Must apply AML Law 10/2010 + SEPBLAC guidance.

As DLT Pilot / Blockchain Infrastructure: Art. 270 Law 6/2023 allows tokenization of financial instruments on DLT. Example: Iberdrola €150M syndicated loan managed fully on blockchain by BBVA + Santander + ioBuilders - disbursement, interest, repayments, transfer of participations all on shared DLT. This is permitted because underlying asset is regulated syndicated loan, blockchain is just administration layer.

What banks CANNOT do:

• Hold DeFi governance tokens as own funds without high risk weight (Basel crypto standard 1250% risk weight).
• Provide direct interface to DeFi lending pool without prospectus and without identifying borrower (KYC failure).
• Offer yield on crypto deposits as if it were a bank deposit - CNMV circular 1/2022 on crypto advertising prohibits presenting unregulated yields as guaranteed.

C. AML Perimeter - SEPBLAC:

Under RD 7/2021 transposing 5AMLD, all VASP (now CASP) must register with Banco de España for AML (until Dec 2024, then CNMV). For banks dealing with client who interacts with DeFi:

• Transaction >€1,000 from/to crypto is high-risk. Must apply Enhanced Due Diligence.
• If origin is Tornado Cash-type mixer or non-KYC DeFi, must file Suspicious Transaction Report to SEPBLAC.
• Banks have been closing accounts: Criptonoticias report 2020-2021: 30-40 LocalBitcoins users had accounts frozen/closed by BBVA, Pibank (now EVO), Bankia without notice claiming AML Law 10/2010 Art. 7. This is allowed if bank cannot trace source of funds. Spanish courts have generally upheld bank's right to terminate under contract if AML risk, provided 2-month notice under payment services law unless fraud suspicion.

2. Spanish Regulatory Architecture Since 2026

• CNMV: Competent authority for CASP authorization under MiCA Art. 94, supervised by ESMA. Since 30 Dec 2024, Banco de España stopped accepting new VASP registrations. Transitional period ended 1 July 2026. All old VASPs (70+ companies) must obtain CNMV MiCA license or cease.
• Banco de España: Competent for E-Money Tokens (EMT) and Asset-Referenced Tokens (ART) issuance.
• CNMV Circular 1/2022: Any mass advertising of crypto assets must include warning: "Investment in cryptoassets is not regulated, may not be suitable for retail investors and entire amount may be lost."
• DAC8 + AEAT: From Jan 2026, CASPs and banks must report all crypto transactions >€... to Agencia Tributaria.

3. Case Laws and Enforcement

1. Spain - Audiencia Provincial & Tribunal Supremo - Crypto is not legal tender, but is attachable asset:
STS 326/2019 (Supreme Court Criminal) - Bitcoin is not money nor financial instrument under old law, but can be subject to embargo. This defines why banks treat DeFi interaction as commodity operation, not payment.

2. CNMV vs. Spanish Crypto Platforms - Warning List:
CNMV has issued 100+ warnings for unregistered platforms offering DeFi yield (e.g., 20% APY staking). Under Law 6/2023 Art. 240, offering investment services without authorization = serious infringement up to €300k fine.

3. BBVA Account Freezes - AML Justification - Juzgado de lo Mercantil Madrid:
Clients sued BBVA for abusive closure after transferring to Binance/DeFi. Courts (e.g., J. Mercantil Madrid 2022) dismissed claims, citing Art. 7 Law 10/2010: Bank must apply risk-based approach; if cannot verify origin of funds from DeFi protocol without KYC, termination justified. Need to show proportional measure.

4. EU Case Law - Hedqvist C-264/14 - CJEU 2015 - Applied in Spain:
Exchange of Bitcoin for fiat is VAT-exempt under Payment Services. Spanish DGT binding consultation V2034-15 applied this. Therefore bank on/off ramp for DeFi is VAT exempt, but service fee taxable.

5. SEC vs. DeFi in Spain - Impact via EU:
Spanish banks watch US cases: SEC v. Ripple, SEC v. Coinbase. While not binding, CNMV follows ESMA classification: If DeFi governance token gives profit expectation from others' work, it may be security token under MiFID II, requiring prospectus. This is why Santander via Openbank and BBVA via Visa stablecoin pilot only use EMT (e-money token) model, not DeFi yield tokens.

6. EU MiCA Recital - Peer-Review Checklist 2026:
ESMA 2026 peer review warns: Building regulated CASP and simultaneously operating unregulated DeFi front-end is direct route to license refusal. Many Spanish fintechs forced to separate entities.

4. Compliance Blueprint for Bank <> DeFi Interaction in Spain

If you are a Spanish regulated bank wanting to touch DeFi:

Permitted Model (BBVA/Cecabank model):

• Step 1: Obtain CNMV CASP authorization (custody + exchange).
• Step 2: Offer client access to DeFi via non-custodial information tool - client connects wallet himself, bank only provides fiat on-ramp and tax reporting. Bank does NOT custody DeFi position, does NOT guarantee yield. Disclaimer required.
• Step 3: Stablecoin path - Issue EMT (euro-backed stablecoin) under MiCA Title IV with Banco de España approval, then EMT can be used in DeFi protocols (e.g., BBVA piloting with Visa). This keeps regulated perimeter.
• Step 4: DLT for regulated assets - Use private DLT for syndicated loans, bonds, as Santander/ BBVA did.

Prohibited Model:

• Taking retail deposits and pooling them into Aave/Compound to offer 8% yield as "crypto savings account" - This triggers (i) unauthorized deposit-taking under Law 10/2014 (ii) MiFID collective investment scheme (iii) CNMV advertising breach.

If you are DeFi project wanting bank account in Spain:

• Must have legal entity, CNMV CASP application or legal opinion stating fully decentralized.
• Provide SEPBLAC AML manual, blockchain analytics (Chainalysis), proof of no mixer exposure.
• Expect enhanced monitoring and limits.