On 8 October 2026 Spain’s Official State Gazette (BOE) published Royal Decree 813/2026, and with it one of the last ways to buy bitcoin in Spain without giving your name came to an end. From 28 October, every transaction at a crypto-asset ATM requires the user’s identity to be established and verified. It makes no difference whether it is 20 euros or 2,000: there is no minimum amount.
At CryptoImpuestos we have read the full text published in the BOE, and it is worth separating the headline from the small print. This is not a tax rule: it is an anti-money-laundering rule. But its practical effect does reach your tax return, because it turns into named transactions purchases that until now were the last anonymous corner of the system. If you have ever used a crypto ATM and left it out of your accounts, now is the time to sort it out.
What exactly does Royal Decree 813/2026 say?
The royal decree is a broad piece of legislation that amends several financial-sector regulations. The part that matters here is its fifth article, which amends the Regulation implementing Law 10/2010 on the prevention of money laundering, approved by Royal Decree 304/2014.
The new wording of article 4.1 keeps the general threshold: identity must be established and verified for any occasional transaction equal to or above 1,000 euros. It then adds a list of transactions where identification is mandatory in all cases, with no minimum amount:
- Money remittances and the handling of transfers.
- Transactions carried out before a notary, except for the acts listed in article 163 of the Notarial Regulation.
- Those carried out at crypto-asset ATMs.
That last line is the whole story. Until now, a crypto ATM could process small transactions without asking for a document, because they fell below the general threshold. From 28 October, it cannot.
When does it apply? On 28 October, not before
The fourth final provision states that the royal decree enters into force twenty days after its publication in the BOE. Published on 8 October, that puts the date at 28 October 2026.
There is a second deadline that should not be confused with it. The third transitional provision allows eighteen months from publication —until 8 April 2028— for the amendments to articles 6.1.a) and 28 of the regulation, that is, for electronic identification methods and the retention of the information obtained that way. That long deadline does not delay the obligation to identify yourself at the ATM: that starts on 28 October.
Does this mean the tax agency will see my ATM purchases?
Not automatically, and precision matters here. Law 10/2010 is an anti-money-laundering law: the natural recipient of that information is Sepblac (Spain’s financial intelligence unit), not the AEAT (Spanish tax agency). The ATM operator becomes an obliged entity that identifies you, keeps the documentation and reports suspicious transactions.
That said, the trail exists and it lasts. The new article 28 requires all due-diligence documentation to be kept for ten years from the transaction. That means that if, in the future, there is an information request, a tax inspection or cooperation between agencies, your 80-euro ATM purchase in 2027 will still be documented under your name in 2036.
It is the same underlying shift that already brought DAC8 to European exchanges: first you are identified, then you are reported. If you are wondering how far tracking capability reaches today, we cover it in detail in how the tax agency knows you have a cold wallet.
The digital DNI now counts, and that is new too
The same fifth article amends article 6.1.a) to state that the National Identity Document (DNI) is valid in its physical or digital version, as defined in Royal Decree 255/2025 of 1 April. For foreign nationals, the Foreigner’s Identity Card (TIE), the passport and official identity documents from the EU and the European Economic Area remain valid.
It is the change that makes the obligation workable: identifying users on every ATM transaction would be a bottleneck if a physical document had to be scanned each time. Hence also the eighteen-month period for operators to set up proper electronic identification systems.
What if I only buy 50 euros to try it out?
That too. That is precisely the difference from the previous regime. The 1,000-euro threshold still applies to generic occasional transactions, but crypto-asset ATMs are taken out of that threshold and moved into the “in all cases” group, alongside money remittances and transfers.
For people who use these ATMs occasionally, the change is mostly one of habit. For those who used them precisely for the anonymity, the change is fundamental: that route is closing.
What does not change: declaring is just as mandatory as before
It is worth saying clearly, because the two get mixed up a lot. This rule creates no new tax and no new reporting obligation. Whatever you already had to declare, you still have to declare in exactly the same way:
- Buying with euros is not taxed. Selling crypto, swapping it for other crypto or paying with it generates a capital gain or loss that goes into the savings income base of IRPF (Spanish personal income tax), at rates from 19 % to 30 % depending on the bracket.
- The acquisition cost is calculated using FIFO, and an ATM purchase is a purchase like any other: it joins the queue. If you did not keep the receipt, the FIFO method guide explains why that can cost you money.
- Modelo 721 only affects crypto-assets held by a custodian not resident in Spain above 50,000 euros at 31 December. What you buy at an ATM and send to your own wallet is not included there, although it does enter IRPF when you sell it. We go through it in the complete Modelo 721 guide.
What does change is the likelihood of a forgotten purchase resurfacing with your name on it. If you have years left undeclared, regularising on your own initiative always works out cheaper than waiting: the figures are in penalties for not declaring crypto.
What to do before 28 October
| Your situation | What it means | What to do |
|---|---|---|
| You use crypto ATMs now and then | From 28 October you will always be asked for ID | Bring your document (physical or digital) and keep the receipt for every purchase |
| You bought at ATMs and never declared it | Past purchases are not identified under this rule, but sales are still taxed | Rebuild your transaction history before the next tax return |
| You do not know the acquisition cost of those coins | Without a documented cost, the tax agency may treat the full amount as a gain | Gather statements, receipts and wallet movements |
| You hold more than €50,000 in custody outside Spain | Modelo 721 obligation between 1 January and 31 March | Check your balances at 31 December in good time |
| You operate an ATM or a crypto-asset business | You are an obliged entity under Law 10/2010 | Adapt your procedures before 28 October |
Frequently asked questions
Does this affect online exchanges or only physical ATMs?
The change to article 4.1 refers to “transactions carried out at crypto-asset ATMs”. Exchanges were already required to identify their customers because of their own business relationship and, since July 2026, under the MiCA regime. The new element is the ATM.
If I buy at an ATM and send it to my wallet, do I have to declare anything?
Buying with euros does not generate a gain, so there is nothing to declare for the purchase. Sending it to your own wallet is not a disposal either. The obligation arises when you sell, swap or pay with those coins. We go over it in the guide to declaring crypto.
What about my old ATM purchases, will they be identified now?
The rule is not retroactive: it identifies future transactions. But your old purchases still have tax consequences when you sell, and there the problem is not identification but whether or not you have the acquisition cost documented.
Does the DNI on my phone count?
Yes. The amended article 6.1.a) accepts the DNI in physical or digital form. Whether each ATM already has the system to read it is another matter: operators have until 8 April 2028 to roll out electronic identification methods.
What if I lose the purchase receipt?
It is the most expensive problem of all and the most common. Without a receipt, rebuilding the acquisition cost becomes harder and you may end up paying tax on more than you actually gained. Keep the ticket and note down the destination address; if you have already lost them, the wallet transaction extraction guide explains how to rebuild it from the blockchain.
Royal Decree 813/2026 does not charge you anything new, but it closes the last small door of crypto anonymity in Spain. From 28 October, every ATM purchase carries your name and is kept for ten years. The practical consequence is not felt on that day: it comes with the next tax return, when you sell and have to show where each coin came from.
If you have ATM purchases, old undocumented transactions or simply do not know where to start rebuilding your history, our specialists analyse your case and give it the right treatment. Better to do it in good time than in March.
Sources: Royal Decree 813/2026 of 7 October (BOE no. 250, 8 October 2026) · Royal Decree 304/2014, Regulation implementing Law 10/2010 · Royal Decree 255/2025 of 1 April, regulating the DNI
Víctor Lázaro
Marketing Director, Cryptoimpuestos.es
