Portugal VASP registration now means MiCA authorisation. A virtual asset service provider (VASP) is a business that exchanges, custodies, transfers or advises on crypto-assets for clients. In Portugal, the national registration route that existed before the EU's Markets in Crypto-Assets Regulation (MiCA) has been replaced: to serve Portuguese clients lawfully, a firm needs authorisation as a crypto-asset service provider (CASP) from Banco de Portugal, the country's central bank and market supervisor.
That is the short answer. The longer answer matters if you run payments inside a crypto business, because authorisation changes who you can bank with, what you must document, and how carefully you have to check the accounts you send money to.
Check the current rules before you file
MiCA applies across the EU, but application dates, transitional arrangements and the exact documents Banco de Portugal asks for are set at national level and can change. Confirm the current requirements with Banco de Portugal or your legal adviser before you build a plan around them.
What changed: from national register to MiCA authorisation
Before MiCA, crypto businesses in Portugal registered under national anti-money-laundering rules and appeared on a national list. MiCA replaced that patchwork with a single EU authorisation. The practical consequences are:
- One authorisation, EU-wide reach. A CASP authorised in Portugal can passport its services into other Member States rather than applying country by country.
- A single supervisor for the licence. Banco de Portugal assesses the application, the governance and the controls.
- A defined list of services. MiCA names the crypto-asset services that need authorisation - among them custody, operation of a trading platform, exchange of crypto-assets for funds or other crypto-assets, and transfer services on behalf of clients.
- Higher expectations. Prudential requirements, governance and fit-and-proper tests for management, client-asset segregation, and detailed AML and complaint-handling obligations.
Firms that were already operating under national rules were given a transitional window to move across. If you are still deciding where to base a crypto business, the honest answer is that the choice is now less about which national register is easiest and more about which supervisor, banking relationships and payment rails you can actually operate with.
Why a crypto licence does not make your payouts safe
Authorisation is about whether you may provide the service. It says nothing about whether a specific payment leaves for the right account. Those are different questions, and the second one is where money is actually lost.
A crypto business moves money in two directions. On the crypto side, transfers are checked against wallet addresses and screening tools. On the fiat side, you send euro credit transfers to client bank accounts, to liquidity providers, to exchanges and to suppliers - and those are ordinary SEPA payments, with ordinary SEPA risks. A client who asks for a withdrawal to 'their' IBAN, an email that changes a counterparty's bank details, a payout file built from a spreadsheet: each of these can send real money to the wrong place, and no crypto licence prevents it.
Where Verification of Payee fits
Verification of Payee (VoP) is the EU/SEPA name check. Before a euro credit transfer is sent, your payment service provider (PSP) - your bank or payment institution - sends the payee name and the IBAN to the PSP that holds the destination account. That bank compares the name with the account holder's registered name and returns one of four standardised outcomes:
- Match - the name agrees with the account holder. Proceed with normal confidence.
- Close match - the names are similar but not identical, for example a missing middle name or a trading name against a registered name. The verified name comes back so you can confirm or correct it.
- No match - the name does not belong to that account. Stop and re-check through a channel you trust.
- Not available - the payee's bank could not answer at that moment. Neither good nor bad news; treat a new, unverifiable payee with extra care.
The check is advisory: it warns you, it does not block the payment. That is deliberate, because the decision to send stays with you. For a crypto business, the useful pattern is to run the check on every fiat payout before release, and to re-run it whenever a client or counterparty changes bank details - which is exactly the moment invoice-redirection fraud exploits.
Two different controls, both needed
Wallet screening answers 'is this address risky?'. VoP answers 'does this IBAN belong to the party I named?'. A payout process needs both, because a clean wallet address and a mismatched bank account can appear in the same withdrawal request.
A practical checklist for a Portuguese CASP
- 1 Confirm the current authorisation route and documents with Banco de Portugal before you plan anything else.
- 2 Map every fiat flow: client withdrawals, liquidity and exchange settlements, supplier and payroll payments.
- 3 Check whether your bank already offers VoP on your euro credit transfers - Portuguese PSPs have had to since 9 October 2025.
- 4 If you send payouts through several banks or a payment provider, standardise on one VoP integration so every flow returns the same four outcomes.
- 5 Verify the whole payout file before release rather than checking payees by hand, and re-verify on any change of bank details.
- 6 Keep the VoP result with the payment record, so an auditor or supervisor can see what you checked and when.
The same question in other markets
Portugal is not the only country where 'VASP registration' is being redefined. Firms comparing jurisdictions - Portugal, Czech Republic, Lithuania, Malta - are really comparing supervisors, timelines and banking access. The EU-wide direction is the same: a single authorisation under MiCA, with national supervisors applying it. If you are weighing options, read the requirements as they stand today rather than as they were described a year ago.
RoxPay delivers Verification of Payee on the SEPA scheme through one REST API and a dashboard, returning the standardised outcomes - match, close match, no match and not available - in well under a second, with the verified name on a close match, for a single payment or a whole payout file.