The Portuguese blockchain market is in a promising phase, with blockchain and other Distributed Ledger Technology (“DLT”) solutions being increasingly used across several industries, such as finance, energy, healthcare, logistics and supply chain. Moreover, Non-Fungible Tokens (“NFTs”) continue to be very popular in the Portuguese sports, art, gaming and entertainment industries.

In the financial services sector, decentralized finance (“DeFi”) solutions are being designed to allow users to perform financial transactions – like lending, banking and investing – using DLT, allowing for faster, cheaper and more secure transactions without the intervention of an intermediary.

In the energy sector, blockchain is being used for peer-to-peer energy trading, smart grids, and renewable energy certificates, facilitating energy trading, making processes more efficient and transparent, and reducing costs.

Blockchain solutions are also being explored for healthcare applications like electronic health records, supply chain management of pharmaceuticals, and clinical trials, improving data security, interoperability, and patient privacy.

As for the logistics and supply chain sector, blockchain is being implemented through applications for the tracking of goods, verifying authenticity, and improving supply chain transparency, thus enhancing security and consumer trust and allowing for more efficiency and cost reduction.

The real estate sector has also witnessed a growing interest for the use of blockchain solutions, with some transactions involving the purchase of real estate assets with the payment of the purchase price in cryptocurrencies having already been implemented.

Projects involving asset tokenization are also under development, and the operational and legal feasibility of tokenization of real-world assets is currently under analysis by several national and international companies.

In the cryptoasset sector, Portugal has become a hub for innovation with founders and investors creating a vibrant crypto environment. The Bank of Portugal has issued 13 licences for virtual asset service providers, and cryptoassets are also being integrated by financial entities and brokers as part of their commercial offering. The full application of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (the “MiCA Regulation” – link) from 30 December 2024 onwards will substantially impact on the evolution of this sector in the upcoming years.

The key factors driving the rapid growth of the Portuguese blockchain landscape are the bustling startup ecosystem (leveraged by visa programmes and favourable tax regimes for foreigners) coupled with national and foreign investors’ interest in the country, due to its innovative companies and highly qualified talent. The Portuguese government has also been active in promoting the adoption of blockchain solutions by businesses through public initiatives and supporting new opportunities for business and individuals through the creation of regulatory sandboxes.

Finally, the development of EU initiatives and legal frameworks, such as the EU Blockchain Strategy and the Digital Finance Package, have also contributed to the rapid growth of the Portuguese blockchain market, by ensuring legal certainty and fostering innovation.

In the context of cryptoassets qualifying as financial instruments, the European pilot regime for market infrastructures based on DLT under Regulation (EC) No. 2022/858 (the DLT Pilot Regime – link) will apply. This regulation provides the legal framework for the trading and settlement of transactions in cryptoassets that qualify as financial instruments. Decree-Law 66/2023 of 8 August (link) implemented in the Portuguese jurisdiction the rules established in the DLT Pilot Regime in respect of the use of DLT to issue, trade and settle financial instruments, notably in the context of the issuance of debt instruments up to € 1 billion.

This DLT Pilot Regime provides for several legal exemptions to general legislation and for a 6-year testing period. After this period, a decision needs to be made where it will become a permanent legislation.

Other types of blockchain usage are still not subject to specific legislation or regulation.

In relation to cryptoassets that are not classified as financial instruments, entities carrying out activities relating to their issuance, trading, exchange, transfer and custody or administration with local presence in Portugal will need to comply with the anti-money laundering legislation (Law No. 83/2017 of 18 August – link) and will be subject to prior registration with the Portuguese banking authority (the Bank of Portugal) for carrying out these activities. Since 30 June 2024, the rules included in the MiCA Regulation directly apply to entities offering or admitting to trading certain types of cryptoassets (asset-referenced tokens and e-money tokens) in Portugal. The remaining rules included in the MiCA Regulation (notably, the rules applicable to the issuance of cryptoassets that are not asset-referenced tokens and e-money tokens and cryptoasset service providers) will apply from 30 December 2024, which will substantially increase the level of regulation applicable to the use of DLT. It should be noted however that the MiCA Regulation’s scope of application contains an important exclusion in what related to decentralised protocols where a controlling entity cannot be identified, since it will not apply to cryptoasset services provided ‘in a fully decentralised manner’ (Recital 22 of the MiCA Regulation).

The DLT Pilot Regime mentioned above is the main reaction of the government and regulators to the potential use of blockchain technology, in particular in financial markets for the legal recognition of rights over financial instruments (shares, bonds and units).

In any case, Portuguese authorities are regulators are interested in creating innovation hubs in Portugal leveraging the use of blockchain, thus keeping Portugal as a crypto-friendly jurisdiction. In this context, there are other initiatives regarding blockchain usage in Portugal. We would highlight the following initiatives:

• Blockchain agenda: he agenda “BLOCKCHAIN.PT – Decentralizing Portugal with Blockchain” creates a national blockchain consortium (with more than 20 companies, 4 public entities and 10 associated partners) with the vision of leveraging blockchain technology as an engine of innovation and with the goal of seizing national and international business opportunities promoted by this technology. This agenda will enable Portugal to ensure a leadership position in Europe in this technology, helping the country become more digital, green, and resilient.

“Decentralizing Portugal” program has two main purposes:

1. decentralizing Portugal through blockchain technology;
2. decentralizing Portugal geographically (most of the proposed projects, as well as organizations and allocated investment, are outside the Lisbon region).

With an investment exceeding € 59 million, it will allow the launch of 26 products with high export potential and scalability and will result in 84 technical-scientific co-authored publications.

• Use of crypto assets in real estate transactions: the Portuguese Notary Association (transfer of ownership in Portugal is subject to a public deed and commonly executed in front of a notary) established internal rules to regulate real estate transaction using crypto-assets as a means of payment, notably for the purposes of ensuring compliance with anti-money laundering regulations.
• Technological Free Zones: Decree-Law No. 67/2021 published in July 30 of 2021 (link), established and defined the regime and governance model for the promotion of tech-based innovation through the creation of Technological Free Zone. These are defined as “test sites, geographically located, intended for testing of innovative technology, products, services and processes, by their promoters, in a safe manner, with the support and monitoring of the respective competent authorities, namely in terms of testing, provision of information, guidelines and recommendations”, corresponding to the concept of regulatory sandbox.

There has been no announcement by the Bank of Portugal in relation to a project for the issuance of a central bank digital currency (“CBDC”) exclusively created for the Portuguese jurisdiction. The Bank of Portugal is, however, working closely with the European Central Bank and with the other national central banks of the euro area for the development of the Digital Euro, EU’s CBD to be issued by the Eurosystem as a complement to cash.

In addition to the AML rules applicable to virtual asset service providers and the Portuguese DLT Pilot Regime, as mentioned above, regulation entering into force in Portugal in the context of financial regulation emerge from European regulation, such as in the context of the MiCA Regulation.

In particular, the rules established in the MiCA Regulation will apply to certain DeFi products and services, notably in the context of the issuance of e-money tokens and asset-reference tokens where the MiCA Regulation follows a more stringent approach.

DeFI is matter of concern for the European and Portuguese regulators. The Bank of Portugal has already published reports addressing DeFi risks to financial stability, identifying related vulnerabilities, but also exploring potential opportunities brought by DeFi.

However, regulatory approach concerning DeFi is still undergoing and the final approach is uncertain, with current focus emphasis on establishing a more defined structure for crypto-assets regulation and addressing concerns regarding AML/CTF. In this regard, we note the MiCA Regulation does not apply to DeFi services when these are provided in a fully decentralised manner without any intermediary (in any case the concept of “fully decentralised” if often not easy to apply).

General laws including, for instance civil law or banking laws, will in any case apply and some smart contracts will be recognised as valid contracts under Portuguese civil laws, in the absence of any specific legal or regulatory framework for smart contracts in Portugal.

Current national AML/CTF rules – notably further implementation in Portugal of the several AML European Directives – are based and solely focused on activities that are undertaken by an intermediary, i.e., the virtual assets service provider, subject to registration requirements with the Bank of Portugal and to general and specific AML regulations.

The use of DeFi, when completely decentralised thus not involving the intermediation of a virtual assets service provider, is not covered by AML/CTF rules or other type of registration or licensing requirements related to AML. Proposals at the European level regarding the inclusion of Decentralised Autonomous Organisations (“DAO”) and other “DeFi arrangements” to comply with EU AML/CFT rules were not accepted and thus DAOs and DeFI remain outside the scope of the last AML package, notably the AMLR (Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing – link).

The tax treatment of cryptoassets and DeFi is evolving in Portugal, reflecting distinct regulatory approaches for both individuals and companies. Individuals may find their income from cryptoassets classified as professional income, investment income, or capital gains, depending on the nature of the activities generating such income. In contrast, companies engaged in crypto-asset-related activities are subject to the general corporate tax regime, ensuring a comprehensive regulatory framework for this dynamic sector.

(A) PERSONAL INCOME TAX (“PIT”)

I. Professional or entrepreneurial income

• If an individual engages in (i) the issuance of cryptoassets, including mining or validating cryptoasset transactions, or (ii) any other profit-orientated regular and continuous activities involving crypto-assets (e.g., mining or trading as a business), the income arising from such activities will be classified as professional income and subject to taxation under the progressive PIT rates.
• Non taxation of crypto-to-crypto transactions – if the consideration for the sale of cryptoassets is in the form of other cryptoassets, no tax is triggered at that point. Taxation is deferred until the assets are ultimately disposed of for cash or non-crypto consideration.

II. Investment Income

• Often referred as passive income, this is an open-ended category that encompasses severable taxable events, including any form of remuneration arising from operations with cryptoassets, such as staking. This income is exempt from withholding tax and taxable, as a rule, at a flat rate of 28% upon year end self-assessment.
• When the consideration takes the form of cryptoassets, it is taxed under the category mentioned below (Capital Gains), but only upon its disposal, conversion, or exchange.

III. Capital Gains

• Income obtained with the disposal of cryptoassets for consideration outside the scope of Professional and Investment Income are, as a rule, taxable as capital gains at a 28% flat rate.
• However, gains and losses arising from the sale of cryptoassets which do not constitute securities and are held for at least 365 days will be excluded from PIT.
• If the consideration for the sale of cryptoassets is in the form of other crypto-assets, no tax is triggered at that point. Taxation is deferred until the assets are ultimately disposed of for cash or non-crypto consideration.

(B) CORPORATE TAX

• Companies engaged in cryptoasset-related activities must report and pay tax on their cryptoasset income under the general corporate tax regime.
• The tax rate for corporate income derived from cryptoassets is aligned with the general corporate tax rate, which is 21% on taxable profits, plus any applicable municipal or state surtaxes.

Key takeaways

• Income from cryptoassets earned by individuals who are tax residents in Portugal can be taxed as professional income, investment income, or capital gains, while income earned by companies is subject to the general corporate tax regime.
• Crypto-to-crypto transactions are not taxable at the point of exchange; taxation is deferred until the cryptoassets are converted into cash or non-crypto consideration.
• Anti Abuse – the transfer of residence abroad or the termination of a professional activity involving cryptoassets triggers an exit tax, treating these events as a deemed disposal of the cryptoassets and subjecting them to a 28% capital gains tax.
• Stamp Tax on transfer of cryptoassets does not trigger PIT but is subject to Stamp Tax at a rate of 10%, typically borne by the beneficiary.
• Commissions and remuneration charged by or through cryptoasset service providers are subject to Stamp Tax at a rate of 4%.
• Reporting – Both tax resident individuals and companies dealing with cryptoassets must report all relevant transactions and gains/losses in their annual tax returns.

There are no specific no specific restrictions or licensing requirements related to purchasing, holding or selling crypto assets by investors. These investment activities are also not subject to licensing or registration requirements not to any specific reporting obligation (apart from tax obligations). Mining activities are also not restricted or regulated in Portugal.

Cryptoasset trading is common in the Portuguese jurisdiction. There were recent studies mentioned that almost 30% of Portuguese in financial markets is also investing in crypto assets.

Initial Coin Offerings (“ICOs”) have been used as funding mechanisms for blockchain-based businesses in Portugal since 2018.

The Portuguese Securities Market Commission (“Comissão do Mercado de Valores Mobiliários”) has adopted a cautionary approach in relation to Initial Coin Offerings (“ICOs”) and has warned issuing entities about the possibility of the rules applicable to public security offerings applying to ICOs, to the extent the cryptoassets issued fall within the definition of securities under Portuguese law (link). The Portuguese Securities Market Commission has also warned investors about the risks associated with investing in an ICO (link). This approach is aligned with the approach adopted at EU level by the European Securities and Markets Authority.

According to the Portuguese Securities Market Commission, a cryptoasset will be deemed a security under Portuguese law if (i) if it constitutes a document (including a document in a digital format) representative of one or more legal situations of private and patrimonial nature (i.e. rights and obligations), and (ii) if, according to the legal situations it represents, it is comparable with typified securities. For assessing the fulfilment of this second requirement, the information made available by the issuer to the investors (namely, in the white paper published by the issuer), specifically if the elements included in this information allow for a link to be established between the actions to be carried out by the issuer and an expectation of return of the investor. Two of the examples mentioned by the regulator are the cases where a right to income has been assigned (e.g. if the cryptoasset grants its holder a right to a profit or interest) and the cases where certain acts to be carried out by the issuer or by a related entity are suitable for increasing the value of the cryptoasset.

If an ICO comprises the issuance of cryptoassets that fall within the concept of securities under Portuguese law, the ICO will have to comply with the rules established for public security offerings, such as the obligation to prepare a prospectus and submit it to the review of the Portuguese Securities Market Commission (to the extent the offering is directed, in whole or in part, to undetermined recipients and the threshold of € 100,000 is exceeded), the issuer’s liability for the information included in the prospectus, the rules applicable to placing, dealing or advising in financial instruments and information and reporting obligations to avoid market abuse.

If the cryptoassets issued in the ICO cannot be classified as securities, the issuer will be subject to a prior registration as virtual asset service provider with the Bank of Portugal, to the extent it has local presence in Portugal (either through a subsidiary, a branch or an establishment). Under the current legal framework applicable in Portugal, the issuance and trading of cryptoassets by a service provider established in Portugal would require a prior registration as virtual asset service provider with the Bank of Portugal, for the sole purpose of complying with AML regulations.

The framework applicable to the issuing of cryptoassets that are not classified as securities will change with the application of the MiCA Regulation to the Portuguese legal system: stricter requirements will apply to the issuing of cryptoassets, which may include the obtention of a prior authorization, depending on the type of cryptoassets to be issued. The MiCA Regulation provides for a transitional period applicable to entities already registered as virtual asset service providers prior to 30 December 2024, under which such entities may continue rendering their services under the previous local legal framework during a certain period (to be defined by each Member State) or until they have obtained an authorization as cryptoasset service providers under the MiCA Regulation.

As for the compliance by ICOs with tax requirements, please refer to the answer to question 7 above.

Cryptoassets are not recognised in Portugal as legal tender or as mean of payment but are regular assets capable of being legally owned by holders and relevant title might be transferred by way of contract (including smart contracts) with such contract being recognised as valid under Portuguese law.

This also means that security might be created over these assets under general Portugues law, in particular pledges over cryptoassets (which might be programmed in the blockchain in order to transfer control over the pledge cryptoassets).

Though there is no specific legislation addressing smart contracts, smart contracts are defined within the Portuguese jurisdiction as self-executing computer programs or protocols that use a conditional logic to perform the actions required in a blockchain transaction in an automated and autonomised way when the predetermined conditions are met. Once executed, the results of a smart contract are recorded on the blockchain / DLT and cannot be altered. The advantage associated to smart contracts’ immutability is that it ensures the integrity and trustworthiness of the contract’s execution, as all participants can independently verify its outcome

Not all smart contracts will be deemed as contracts under Portuguese law. In the national legislation, the existence of a contract will require that certain requirements are met, such as the legal capacity of the parties, the lawfulness of the contract’s object and the main elements for the contract’s formation (i.e. the existence of an offer and of an acceptance, and the agreement of the parties on the main aspects necessary for the deal) are present. Hence, a smart contract will only be deemed as a contract under Portuguese law insofar as it fulfils these requirements. In any case, even if they lack one or more of these elements, smart contracts can still be relevant from a legal point of view, as they may implement actions that fulfil a contractual obligation (e.g. transferring an amount needed to fulfil a payment obligation) or that allow for the exercise of a right that is legally or contractually provided for (e.g. sending a notification to a counterparty in an agreement for the exercise of a right established under such agreement).

The eIDAS Regulation (Regulation (EU) n. 910/2014 of the European Parliament and of the Council of the 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market – link) plays a significant role in the legal validity of smart contracts under the Portuguese legal system, by recognizing electronic signatures and other electronic actions as alternatives to real life actions.

As for the enforceability of smart contracts, the main challenges faced within in the Portuguese jurisdiction arise from their autonomy and irreversibility, since this implies that they cannot be easily modified or reversed if the circumstances underlying their execution have changed or in case of flaws in their execution. Their immutability also makes it difficult for smart contracts to adjust to unforeseen events.

Legal certainty issues also arise, both as regards to the interpretation of the terms of the smart contract as in terms of the determination of the applicable law. Given the decentralized nature of the technology used for smart contracts, it may be challenging to determine which jurisdiction will apply to them and which law did the parties intend to apply to their contractual relationship.

Furthermore, smart contracts are exposed to technical vulnerabilities, such as hacking or errors in the underlying code, leading to financial losses or other negative consequences for the parties involved.

Decentralised Autonomous Organisations (or “DAOs”) currently lack legal recognition as such under Portuguese law.

DAOs can be described as a smart contract (or nexus of smart contracts) deployed on a blockchain underlying an organisation that is jointly owned by its members (the “tokenholders”), where the decisions on how to use or allocate the common resources are taken in an automated and decentralized manner, with technology supporting economic transactions and social interactions. Membership in a DAO is linked to the ownership of tokens or coins (which are either purchased or allocated as a reward) and there is little to no separation between ownership and control.

DAOs visibly operate under different assumptions than traditional legal entities and other business associations existing under the Portuguese legal system:

1.     DAOs are not run by boards or managers, but rather their governance relies on the consensus of all (or at least, of a group of) tokenholders, using smart contracts to aggregate their consensus.

2.     DAO members primarily agree to abide by and govern their relationship using smart contracts and the “rule of code”, contrarily to members of other legal entities, who will be bound by contractual agreements (such as the articles of associations or the incorporation act) and statutory laws.

3.     DAOs pool funds through the sale or attribution of tokens, rather than through traditional mechanisms used in corporate finance (equity or debt instruments).

4.     DAOs are structured to operate globally and tend not to focus on just one or few jurisdictions, rendering the task of determining which national law would apply to them difficult.

Portuguese scholars tend to consider that the rules established for civil law partnerships, which are also applicable to unincorporated companies prior to the execution of the incorporation document, could apply to DAOs, at least until a final position is adopted by the legislator on whether a bespoke regime should be created for DAOs or if the rules on existing legal entities are sufficiently flexible to accommodate DAOs.

If the civil law partnership rules were to apply to DAOs, the main consequences would be that the DAO would not be granted legal personality and the tokenholders would face joint and several liability for the DAO’s debts and liability, on a subsidiary basis.

To date, there haven’t been any major governmental or regulatory enforcement actions specifically targeting blockchain technology in Portugal, though this may change over the next years as the regulatory framework applicable to blockchain at the EU and national level continues to evolve.

While there haven’t been direct enforcement actions, Portuguese authorities have been actively involved in fostering digitalisation and incentivising the use of blockchain technology by companies and within public administration.

On the other hand, regulatory bodies have been closely monitoring the blockchain projects and providing guidance to businesses and individuals operating in this sector through the following initiatives:

(i) The Technological Free Zones (Zonas Livres Tecnológicas– ZLTs), are regulatory sandboxes established by Decree-Law no. 67/2021 of July 30, 2021, which are real-life geographical areas for the demonstration and testing activities of innovative technologies or solutions, including blockchain applications, across all industries, in a real environment; and

(ii) Portugal Finlab, an innovation hub set up by the Portuguese Banking Authority (“Banco de Portugal”),the Portuguese Securities Market Commission (“Comissão do Mercado de Valores Mobiliários”) and the Insurance and Pension Funds Supervisory Authority (“Autoridade de Supervisão de Seguros e Fundos de Pensões”) to support the development of innovative tech-based financial projects or products, which can naturally also include the use of blockchain technology or of any other distributed ledger technology. The aim of the Portuguese regulatory authorities was to create a communication channel between them and innovators – new players in the market or incumbent institutions having innovative tech-based financial projects or products – through which they could provide guidelines to innovators on how to navigate and operate the Portuguese regulatory framework within the implementation of their projects.

The use of blockchain technology and of other distributed ledger technologies present several challenges from the perspective of the application of existing laws, since such laws were not originally designed to consider the features of this type of technology.

One of the main fields where such challenges arise is in data protection.

European data protection laws applicable in the Portuguese legal system, such as the General Data Protection Regulation (“GDPR” – link) were designed for environments where data management is centralized under a specific entity. In contrast, blockchain technology operates through a decentralized model, with multiple actors involved in data processing, which complicates the allocation of responsibilities under the law. Regulatory guidance has been instrumental in interpreting how blockchain technology can comply with the GDPR. Additionally, reports like the one from the European Parliamentary Research Service further explore how distributed ledger technologies (DLTs) can align with EU data protection requirements.

Key challenges include the restriction on transfers of personal data outside the European Economic Area (EEA), particularly in the context of public blockchains. Under the GDPR, transfers of personal data to third countries or international organizations are subject to strict conditions, designed to ensure that the level of protection for the data is not undermined. Public blockchains, with nodes potentially located around the world, present a significant obstacle to this requirement. Furthermore, the application of data subjects’ rights, such as the right to rectification, erasure, and objection, becomes particularly complex given the immutable nature of blockchain.

One of the most debated issues involves the tension between the right to erasure (commonly known as the “right to be forgotten”) – established under Article 17 of the GDPR – and the immutable characteristics of blockchain. A proposed solution involves deleting the private key associated with encrypted data, which would render the data inaccessible. While this may meet the technical requirements of data erasure, further guidance is needed to determine whether such approaches sufficiently fulfil the GDPR’s legal standard. Additional techniques, including redactable blockchains, pruning, and chameleon hashes, also require regulatory clarification on whether they can meet data protection standards, particularly in terms of data minimization and erasure obligations. Beyond these solutions, various technical methods related to anonymization should be evaluated for their potential to achieve compliance with the right to erasure. Regulatory authorities should provide further guidance on whether these techniques may be deemed sufficient for achieving the “right to erasure” within the scope of the law.

Despite the challenges in reconciling blockchain technology with the GDPR, a European Parliament report has emphasized the significant potential of blockchain to support the “data protection by design” principles mandated by the regulation. Due to blockchain’s inherent focus on secure and decentralized data governance, there are promising opportunities for this technology to be utilized as a tool that can fulfill key GDPR objectives. With the right design and adherence to regulatory guidance, blockchain systems can be purposefully tailored to meet the stringent requirements of GDPR, offering a robust framework for ensuring data security and compliance.

Another area where the application of existing laws to blockchain applications raises several legal questions is within insolvency legal proceedings.

The decentralized and immutable nature of blockchain systems renders it difficult to seize assets registered within the blockchain and to transfer such assets from the debtor’s estate to the insolvency estate, which complicates distributions to the debtor’s creditors. Another rule which is difficult to implement is the rule established under Portuguese law that deems as void all transactions entered into by the debtor shortly before the insolvency situation is declared. The cross-border nature of many blockchain transactions may also complicate insolvency proceedings as it can raise questions about the jurisdiction of courts, the recognition of foreign insolvency proceedings, and the enforcement of foreign judgments.

Aside the issues mentioned above, legal practitioners should be aware of consumer protection laws and to the regime applicable to distance contracts when advising on the relationship between users of blockchain applications and the entity providing such services or products, namely as regards to the transparency of the products and services offered, the protection of consumer rights, and the prevention of unfair contractual terms.