# Spain

> Spain (CNMV · Banco de España · AEPD): First in the EU to regulate how crypto is advertised. Region: Europe. Confidential with disclosure: Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Jurisdiction
- Region: Europe
- Subject: First in the EU to regulate how crypto is advertised
- Authority: CNMV · Banco de España · AEPD
- Stance on on-chain confidentiality: Confidential with disclosure. Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.
- Tags: advertising rules, 100,000 threshold, prior notification, no privacy coin rule
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/jur-spain

## What it actually says

Spain's national contribution sits on the marketing side rather than the confidentiality side, and it got there first. Its advertising circular, in force since February 2022, was the earliest crypto advertising regulation published in any EU member state: it compels a specific risk warning and requires campaigns aimed at more than a hundred thousand people to be notified to the regulator ten business days in advance. That is a rule about how crypto is sold, not how privately it can be held. On the questions this section is actually about, Spain adds nothing to the European baseline, and we found no Spanish instrument restricting anonymity-enhancing assets or transfers to self-hosted wallets.

## The instruments that matter

- **CNMV Circular 1/2022 of 10 January 2022**: published 17 January and in force 17 February 2022, the first crypto advertising regulation published in an EU country
- **A compulsory warning**: advertising must state explicitly that investment in crypto-assets is unregulated, may not be suitable for retail investors, and can result in the loss of the entire amount invested
- **Prior notification for mass campaigns**: campaigns directed at more than 100,000 people must be notified to the regulator at least ten business days before they run
- **No divergence on confidentiality**: the national additions concern how crypto is marketed rather than how confidentially it is held; we found no Spanish restriction on anonymity-enhancing assets

## Sources

- [Circular 1/2022, BOE-A-2022-666](https://www.boe.es/diario_boe/txt.php?id=BOE-A-2022-666)

## Related entries

- [Italy](https://www.sodalabs.xyz/privacy-hub/regulation/jur-italy): Customer-level reporting to a public registrar
- [Ireland](https://www.sodalabs.xyz/privacy-hub/regulation/jur-ireland): A central bank piloting zero-knowledge KYC
- [Austria](https://www.sodalabs.xyz/privacy-hub/regulation/jur-austria): EU baseline, with an early transition close
- [Belgium](https://www.sodalabs.xyz/privacy-hub/regulation/jur-belgium): EU baseline, with no national layer on confidentiality
- [Czechia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-czechia): EU baseline, supervised by the central bank
- [Denmark](https://www.sodalabs.xyz/privacy-hub/regulation/jur-denmark): EU baseline, with tax as the historic pressure point