Tokenizing real assets in Spain (2026): the legal and practical map.

The reason this matters is that a lot of the fear around tokenizing an asset in Europe comes from a sense that you are operating in a legal grey zone, and that a regulator will one day decide your token was never really a security or was secretly one and you got it wrong. In Spain that fear is smaller than it looks, because the classification is not exotic. A token that carries a claim on a real asset's cash flow is a security, and the security is regulated the way any other security is, under EU and Spanish securities law, with the CNMV as the supervisor. You are not improvising a category and hoping it holds.

The honest caveat is that Spain reaches this result through the general framework rather than through a dedicated on-chain-securities statute. Germany wrote a specific law, the eWpG, that says a security can live on a blockchain, and France did something comparable with its DEEP regime. As of 2026, verify current, Spain has not written that kind of bespoke statute, so the legal recognition leans on MiFID II and Ley 6/2023 and on a supervised sandbox rather than on a purpose-built DLT-securities law. That is a difference worth understanding, and it is the spine of this guide. None of it makes the activity unworkable; it makes the framing matter.

None of that makes it trivial either. The structuring, the vehicle, the offer route, and the way you market the raise all have to be set up correctly, and the useful thing to know from the start is which parts are the settled framework and which parts are the genuine work. This guide walks each Spanish piece, then ends on the part that is hard in Spain exactly as it is hard everywhere: the raise itself.

The foundation in Spain is not a special blockchain statute, it is the mainstream securities framework. The relevant law is Ley 6/2023 de los Mercados de Valores y de los Servicios de Inversion, the securities markets law in force since 2023, which replaced the old LMV. Together with MiFID II at the EU level, it defines what a security, a valor negociable, is and how it is regulated. A tokenized interest in a real asset that gives its holder a claim on cash flow, a return, or a participation falls inside that definition. So it is regulated as a security, not as a MiCA crypto-asset.

The practical consequence is that the form of the instrument, a token on a blockchain, does not change the substance of what it is. If the thing you are offering is economically a security, Spanish and EU securities law treats it as a security regardless of whether it is recorded on-chain or in a traditional book-entry system. Spain has not, as of 2026, verify current, passed a Germany-style law that says the on-chain record is itself the security in a bespoke sense, but it does not need to in order for the token to be a recognized valor negociable. The claim it carries is what puts it under Ley 6/2023 and MiFID II.

For a CFO the takeaway is that you are working inside a mature, well-mapped body of law rather than on a frontier. That is reassuring, because securities law is the oldest and best-understood part of financial regulation. The trade-off, relative to Germany, is that you do not get a purpose-built statute confirming the on-chain record as the security, so the on-chain mechanics have to be fitted to the existing securities framework with care. What actually happens end to end, from asset to instrument to raise, is walked through in the how-businesses-tokenize guide, and the way Germany handled the same question with a dedicated statute is in the Germany guide.

The supervisor is the CNMV, the Comision Nacional del Mercado de Valores, Spain's securities regulator, with the Banco de Espana sitting alongside it on prudential matters. A tokenized real-asset security is regulated activity, so the CNMV supervises the offering and the surrounding roles the way it supervises any securities activity. That is a feature, not a burden: because the token is a recognized security, there is a known, licensed way to do each part rather than a legal vacuum.

Here is the piece that saves most issuers a lot of worry. The regulated roles around a tokenized issuance, such as custody, the placement of the tokens, and running a platform or a trading venue, are activities that require authorization. That sounds heavy until you see what it means for you: you do not have to hold those licences yourself. In practice, issuers use already-authorized providers for the regulated infrastructure and rely on those licences rather than building their own. You provide the asset and the offering; licensed partners handle the regulated pieces.

Spain adds something genuinely useful on top: a regulatory sandbox. Under Ley 7/2020 de transformacion digital del sistema financiero, the CNMV and the Banco de Espana run a supervised space where firms can test financial innovations, and they have supervised real tokenized-securities pilots inside it. For an operator that wants to test a structure under the eye of the regulator before a full launch, that is a real advantage and a route that many EU jurisdictions do not offer in the same form. As of 2026, verify current, the sandbox is an active programme, and whether your structure fits it is worth raising early with Spanish counsel.

What you should not do is assume none of this applies because it is on a blockchain. The opposite is true in Spain. Because the token is a recognized security, the surrounding activities are recognized regulated activities, which is a good thing, because it means there is a known, licensed way to do each of them. Which roles your specific structure triggers, and which need authorization versus a licensed partner, is exactly the kind of thing to confirm with Spanish counsel and current CNMV guidance before you commit to a design.

A common source of confusion in 2026 is where MiCA fits. The short version: for a tokenized real asset, MiCA usually does not fit at all. MiCA governs crypto-assets that are not financial instruments. A token that gives its holder a claim on a real asset's cash flow, a bond-like return, a participation, a share of profits, is a financial instrument, which puts it under MiFID II and Spain's Ley 6/2023 as a valor negociable, supervised by the CNMV, not under the MiCA crypto-asset regime.

That distinction decides your obligations. If your token is a security, you live in the world of securities rules: the prospectus regime and its exemptions, securities-law conduct rules, and CNMV supervision as securities activity. If a token were a pure crypto-asset with no such claim, it would fall to MiCA and its CASP licensing world instead. For a real-asset raise you almost always want, and land in, the securities side, because the entire point of the instrument is that it carries a real claim. The boundary between the two, and what pulls a token onto the MiFID II side rather than the MiCA side, is set out in the MiCA and CASP licensing guide.

The reason this is reassuring rather than alarming is that securities law is mature and well-understood, and Spain plugs a tokenized security straight into it through Ley 6/2023 and MiFID II. You are not asking a regulator to invent a category for you. You are using the oldest and best-mapped part of financial regulation. That is a far more comfortable place to raise capital than the frontier tokenization is sometimes made out to be, and it holds in Spain even without a bespoke DLT-securities statute, because the classification does the work.

Once your token is a security, the next question is whether you need a full approved prospectus to offer it. For most tokenized real-asset raises the answer is no, because the offer is structured to fit an exemption under the EU Prospectus Regulation. The common routes are an offer only to qualified investors, an offer to fewer than 150 non-qualified persons per member state, or a high enough minimum ticket per investor, such as around EUR 100,000. Any of these can take you out of the full-prospectus requirement while still letting you raise real money. As of 2026, verify current thresholds and conditions with Spanish counsel, because these figures and rules change.

For smaller public offers, Spain can also use the ECSP European crowdfunding regime, the EU-wide framework for raising through an authorized crowdfunding platform. That gives a capped public route that reaches a broader set of investors than a pure private placement, run through a platform that holds the authorization, rather than a full prospectus. It is a genuinely useful option for the lower end of the range, and it is one of the EU-wide rails that apply in Spain the same way they apply across the union. As of 2026, verify current, the exact ceilings and platform requirements should come from counsel, not from a guide.

The exemption or regime you rely on is not just paperwork, it shapes the raise. Choosing the qualified-investor route, the sub-150 route, the minimum-ticket route, or the ECSP crowdfunding route changes who you are allowed to market to, how you can market to them, and how large a raise you can run without a full prospectus. That is a strategic decision, not a formality, and it is worth getting right before you start talking to investors. The exemption routes and how each one constrains the raise are covered in the prospectus exemptions guide.

Somewhere in the structure a legal entity has to hold the real asset and be the thing your token is a claim against. In Spain the familiar candidates are an SL, a sociedad limitada, the standard limited-liability company, or an SA, a sociedad anonima, the public-limited form. Either can sit under a tokenized issuance as the entity that owns the asset and services the token. For real estate at larger scale, a vehicle like a SOCIMI, the Spanish REIT regime, can be the right wrapper because of its property-holding and tax characteristics.

You are not forced to keep the holding vehicle in Spain, though. Many tokenized deals put the asset in an EU SPV domiciled elsewhere, for example in Luxembourg, chosen for its SPV, tax, or fund-wrapper characteristics, while the raise still reaches Spanish and European investors under the same EU securities framework. Which is better depends on the asset, the investor base, the tax position, and whether a fund wrapper is involved, and it is a genuine trade-off rather than an obvious call.

Two companion guides do the work here. What an SPV is for and how it ring-fences a single asset so your token is a claim on that asset and nothing else is in the how-businesses-tokenize guide and the SPV structuring guides on the site. Where to domicile that SPV within the EU, and how Spain compares with the usual alternatives for a tokenized raise, is the whole subject of the best-EU-jurisdiction guide. It is also worth reading Spain against its neighbours: the France guide and the Switzerland guide lay out how each of those markets handles the same choice. The right answer for you is a structuring decision to take with counsel, not a default.

Read the table top to bottom and a pattern shows up. The first four rows, the securities classification, the regulator, the sandbox, and the licensed roles, are settled ground in Spain. You are not inventing them; you are using them, and the sandbox even gives you a supervised way to test. The last two rows, the offer route you choose and the vehicle you hold the asset in, are where the real decisions sit, and they are decisions about your specific asset and raise rather than about Spanish law being unclear.

Here is the thing worth saying plainly, because it is the opposite of how tokenization is usually sold. In Spain the legal classification and the token are the easier, more predictable part of the job. The securities framework is mature, the CNMV supervises it, licensed providers exist, and the sandbox gives you a supervised way to test. What is hard, in Spain exactly as everywhere else, is the raise: actually placing the tokens with investors who will fund your asset.

Distribution is the part that people underestimate every time. A perfectly structured, fully compliant, correctly classified token that no one buys has raised nothing. The token being real does not make the money appear. Reaching the right investors, meeting them within whatever exemption or regime you chose, and getting them to commit is the work, and it is a service, not a legal step. It is also why matching your vehicle and offer route to the investors you can actually reach matters so much: the structure and the raise are one problem, not two. The desk structures the raise and then runs the placement, because the token being valid is not the same thing as the money arriving.

On the numbers, the costs and the timeline are the usual EU ranges rather than anything Spain makes worse. You are paying for structuring, the vehicle, the platform or providers, issuance, and offering documentation, and then for running the distribution. A realistic budget is in the cost guide, and a realistic sense of how long it takes from decision to funded is in the timeline guide. Spain's active regulator and real sandbox tend to reduce uncertainty rather than add cost, but they do not shorten the part that is genuinely long, which is the raise.