Portuguese law defines virtual assets as a digital representation of value that is not necessarily linked to a legally established currency, and does not have the legal status of a fiat currency, security or other financial instrument, but which is accepted by natural or legal persons as a means of exchange or investment and which can be transferred, stored and traded electronically.

In respect to specific normative definitions, this is the only one that can be found in Portuguese jurisdiction under Law No. 83/2017, of 18 August, as amended, on anti-money laundering and combating the financing of terrorism (Portuguese AML/CFT Law), which transposed the Directive (EU) 2018/843 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLD5).

Further to the above, despite not being specifically addressed by Portuguese laws and regulations, it is worth highlighting the following definitions set forth under Regulation (EU) 2023/1114 on markets in cryptoassets (MiCA) which will be adopted by European Union (EU) member states until December 2024:

• Cryptoasset: a digital representation of value or of a right that is able to be transferred and stored electronically using distributed ledger technology (DLT) or similar technology.
• Asset-referenced token: a type of cryptoasset that is not an e-money token and that purports to maintain a stable value by referencing another value or right or a combination thereof, including one or more official currencies.
• E-money token: a type of cryptoasset that purports to maintain a stable value by referencing the value of one official currency.
• Utility token: a type of cryptoasset that is only intended to provide access to a good or a service supplied by its issuer.

At present, there are no specific laws or regulations that govern the issues related to cryptocurrency (except the rules established in the Portuguese AML/CFT Law). 

The AML legal framework foresees both the prior registration and subsequent supervision of such entities, only for anti-money laundering and combating the financing of terrorism (AML/CFT) purposes. Moreover, it’s noteworthy that following the amendment of the Portuguese AML/CFT Law, setting forth the legal framework applicable to Virtual Asset Service Providers (VASPs), the Bank of Portugal published two notices completing and further developing such regime:

1. Bank of Portugal’s Notice No. 3/2021, of 13 April 2021, regulates the registration procedure applicable to entities that intend to pursue activities with virtual assets, in Portuguese territory.
2. Bank of Portugal’s Notice No. 1/2023, of 24 January 2023, establishes the necessary aspects to ensure compliance with duties in order to prevent money laundering and terrorist financing, within the scope of the activity of entities that carry out activities with virtual assets.

However, this will change in Portugal with the enactment of MiCA and its direct applicability. Nonetheless, even without considering MiCA, one cannot say that there is a regulatory vacuum in this context, since existing laws will need to be assessed on a case-by-case basis to determine whether they apply to a particular cryptoasset or related activity. Hence, the laws and regulations applicable to cryptoassets will vary greatly depending on the specific characteristics of each token.

In general, cryptoassets (or cryptoasset service providers) are only specifically addressed in regard to the rules established under the Portuguese AML/CFT Law (see the answers to Questions 1 and 2 above and Question 4 below).

In respect of security tokens, there is no specific law or regulation designed to address them. As is common in other countries, the approach taken is to consider that tokens that may be qualified as a security and, considering its characteristics, shall be treated as such and subject to Portuguese securities laws and supervised by the Portuguese Securities and Markets Commission (CMVM). This qualification is to be conducted on a case-by-case basis and, in general, the token will fall under that scope if it represents one or more rights and obligations and in relation to which the token holders are entitled to an income (e.g., return on investment).

Regarding non-fungible tokens (NFT), these usually do not fall under the qualification of virtual assets, as established under the Portuguese AML/CFT Law, nor are some of them covered by the provisions of MiCA. There are no specific national regulations addressing NFTs. However, existing legal regimes apply to the issuance, marketing, and sale of those tokens, such as intellectual property, consumer protection, e-commerce, advertising laws and regulations, among other sectorial provisions depending on the characteristics of the NFT. In addition, note that the issuance and sale/purchase of NFTs is usually regulated contractually by acceptance of terms and conditions published by the issuer. Currently, the same shall apply, in principle, to utility tokens (until the entry into force of MiCA provisions).

The Portuguese AML/CFT Law sets forth the general regime applicable to the authorisation and registration, for purposes of AML/CFT, of VASPs together with the Notices issued by the Portuguese Central Bank (Bank of Portugal) in line with the EU regulatory framework. In this regard, any entity intending to act as a VASP shall apply for the authorisation and registration procedure before the Bank of Portugal. 

Specifically, according to said law, the following persons will have to be authorised and registered with the Bank of Portugal prior to commencing their activity in Portugal, when the following activities are carried out for and on behalf of their customers:

• providers engaged in exchange services between virtual assets and fiat currencies;
• providers engaged in exchange services between one or more forms of virtual assets; 
• providers of services that allow the transfer of virtual assets from one address or wallet to another; and
• providers of custodian wallet services (which allow the safeguarding of private cryptographic keys on behalf of its customers, to hold, store and transfer virtual assets).

This authorisation and registration procedure is mandatory when the aforementioned services are exercised/operated within the Portuguese territory. The following entities are considered to operate within Portuguese territory: 

• legal persons incorporated in Portugal to carry out activities with virtual assets; 
• natural persons or legal persons with a domicile or establishment in Portugal engaged in activities with virtual assets; and 
• natural persons or legal persons who, due to the exercise of activities with virtual assets, are obliged to submit a statement of start of activity to the Portuguese Tax Authority. 

After the submission of all required documentation to the Bank of Portugal, the institution undertakes a comprehensive review of the application. The standard timeframe for this analysis is set at six months (in business days). If the Bank of Portugal deems it necessary to request additional information or clarification during this period, the application review process may be extended. This variability primarily depends on the complexity of the application, the completeness of the initial submission, and any additional inquiries or requests for information from the Bank of Portugal.

Portugal lacks specific regulations for promotion of virtual assets, in general, and nor are there any requirements for issuers of cryptoassets to publish a white paper (at present). As mentioned above, with the gradual entry into force of MiCA that is set to change (e.g., the obligation to publish a white paper in respect to certain tokens). Yet, there are general legal frameworks that offer a layer of protection for consumers, namely in the financial sector, thereby indirectly influencing promotions of cryptoassets, in accordance with certain sector-specific rules. The following are some of those examples:

• Pre-contractual information requirements: according to Decree-Law No. 95/2006, where a cryptoasset is considered a financial instrument and there is a transaction made by means of a distance contract (a financial service). Some of the obligations established therein include providing information about the entity offering the services, detailing the product’s characteristics and explaining how consumers can exercise their rights, among others.
• Advertising regulations: in respect to, for example, NFTs and utility tokens, there are advertising regulations in place which would be applicable (Decree-Law No. 330/90, of 23 October 1990, and Decree-Law No. 57/2008, of 26 March 2008) which are designated to protect consumers as well as other market participants from unfair commercial practices and false advertising.

According to the Portuguese AML/CFT Law, VASPs who offer those specific services set in the law in question, shall be considered “obligated entities”. This means that, under Portuguese law, VASPs are legally required to comply with all applicable AML/CFT legal dispositions, which include, but are not limited to, risk management, transaction monitoring, “Know Your Customer” (KYC) and due diligence obligations, and adequate technical, material, and human resources (which include a specific Money Laundering Reporting Officer) and responsible board member with AML/CFT responsibilities. 

In addition, VASPs must be aware that their type of activity entails the reinforcement of certain more common identification procedures and customer due diligence as an additional risk is presumed to exist in products or operations that favour anonymity, in new products or commercial activities, in new distribution mechanisms and payment methods, and in the use of new technologies or developing technologies. 

Further, more recently, the Bank of Portugal issued Notice No. 1/2023, of 24 January 2023, which aims, inter alia, to harmonise national legislation with the international framework on AML/CTF, pre-emptively including some of the content expected to be included in the EU AML Package (the legislative package aimed at AML/CTF, see finance.ec.europa.eu/publications/anti-money-laundering-and-countering-financing-terrorism-legislative-package_en), which is now in an advanced negotiation stage. It is also driven by Recommendation 15 of the Financial Action Task Force (FATF), reviewed in 2018 to include provisions on VASPs, as well as by FATFs “Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers” (see fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html), published in 2021, as is evident, for example, in the inclusion of the travel rule in the Notice. Concretely, this new Notice issued by the Bank of Portugal addresses the execution of preventive duties on AML/CFT by VASPs which are subject to the Bank of Portugal’s supervision for AML/CFT purposes. The breach of preventive duties by VASPs may constitute an administrative offence.

It should be made clear, however, that in relation to VASPs, the Bank of Portugal’s competence is limited to AML/CFT issues and does not extend to prudential, behavioural or other areas of supervision (this will change with the enactment of new rules on the competent national authorities as foreseen under MiCA, however it has not yet been determined by which authority the various different types of entities who provide services with cryptoassets will be supervised under the new rules).

From a natural person’s perspective, there are no specific restrictions or licensing requirements for owning, buying or selling cryptoassets, on your behalf, unless those are qualified as securities, in which case the traditional rules applicable to the latter would apply. In the event of a dispute over ownership of a cryptoasset, the legal landscape lacks specific regulations or established case law. In such cases, a judge would likely consider various factors deemed relevant. Among these, possession of the private key could be a crucial aspect, indicating control and ownership. Additionally, factors such as blockchain analysis, tracing cryptocurrency to a VASP in the claimant's name, or linking it to mining activities attributable to the individual may be taken into consideration. Ultimately, the resolution of the dispute would depend on a comprehensive assessment of the circumstances involved.

Portuguese jurisdiction does not have specific regulations or legal frameworks designed for DAOs. As a result, DAOs do not hold legal recognition under Portuguese law. Nevertheless, due to some features of DAOs, namely their largely automated organisation and decentralised nature of the management body (which may be replaced by a mix of management by members and automated management through smart contracts) it is possible to subsume them to certain existing archetypes under the existing legal provisions. 

Most scholars have suggested that one potential solution is to classify DAOs as non-commercial society (sociedade civil), subject to the civil law partnership regime outlined in Articles 980 to 1021 of the Portuguese Civil Code. This framework only requires the existence of an agreement between two or more partners (the articles of association), which does not need to be formally documented (except if any of the partners’ contributions consists of the transfer of a property right over immovable property in which case the contract must be in writing, with a notarised deed or a public deed). 

This means that two or more partners must contribute with assets and/or services for a joint commercial activity, with profits distributed accordingly. However, it should be noted that applying civil law partnership provisions to DAOs may raise some limitations, such as the lack of legal personality for those which are not duly registered and, subsequently, joint liability of partners. It should be noted that these provisions were originally drafted for small businesses and may not fully meet the needs of DAOs considering that these are generally organisations with a large number of token holders. 

Given the current partnership framework, DAOs governed under Portuguese laws may choose to have a legal wrapper which is usually a commercial company incorporated by the founders of the DAO. However, the incorporation of this legal wrapper will often collide with the decentralisation principle as a commercial company in Portugal needs to designate a management board (which will represent the company before third parties). The connection between the DAO and its legal wrapper is therefore a complex issue (both regarding legal and financial perspectives) since these two realities operate in very distinct worlds which may be difficult to relate and to match.

Essentially, DAOs are possible under Portuguese law (even though by default it would be challenging to define if Portuguese law would be applicable to a DAO) but token holders are likely be fully, personally and jointly responsible for any losses of the DAO, since the DAO does not have legal personality.

The insolvency proceedings are construed as a universal execution procedure aimed at satisfying the claims of the insolvent debtor’s creditors. This goal is achieved either by the economic restructuring of the insolvent debtor, or, if not possible, by the liquidation of the insolvent estate and the distribution of the proceeds among the debtor’s creditors.

According to Article 46(1) of the Portuguese Insolvency and Companies’ Recovery Code, the insolvent estate “covers all of the debtor’s assets on the date of the declaration of insolvency”, which includes cryptoassets. 

However, in practice, given the lack of regulation governing cryptoassets, it could be difficult for the insolvency administrator to find any trace of them in the accounting elements of the debtor to which they will have access, and, in consequence, to include them in the insolvent estate.

Additionally, it may not be an easy task to seize and liquidate cryptoassets. If, however, the insolvency administrator can seize cryptocurrencies, they should, if possible, convert these currencies immediately into fiat through an exchange. In the case of NFTs, they should try selling them through the blockchain or an exchange. Both procedures require the administrator’s technical expertise.

Finally, note that under Portuguese law, creditors can obtain a secured or first priority claim against cryptocurrencies in an exchange (notwithstanding the exchange’s own regulations). Beneficiaries of in rem security will benefit from a special preferential ranking over the proceeds of the sale of the specific assets, over which such security is granted, as those proceeds are directly applied in the repayment of the underlying secured obligations, in case no other special preferential ranking applies.

The legal status of smart contracts is not specifically addressed. However, according to the general principle established under Article 219 of the Portuguese Civil Code, contracts are not subject to formal requirements unless the law imposes specific formalities (e.g., real estate transfers and testaments). To be recognised as legal contracts in Portugal, smart contracts only need to fulfil the basic requirements of having an offer and acceptance, as established under Articles 232 and 233 of the Civil Code. 

Furthermore, if smart contracts are designed to enable automatic execution, they may fall under the category of electronic contracts in accordance with Decree-Law No. 7/2004, of 7 January 2004. In this context, smart contracts can be deemed legal contracts in Portugal if the statements made via this medium adhere to the legal formal requirements when stored in a medium that ensures reliability, intelligibility, and integrability, as specified in Article 26(1) of the aforementioned Decree-Law. In essence, it is crucial that the involved parties can understand the content and attribute their declarations of intent of said agreements.

Individuals who fall victim to crypto fraud have the option to commence a legal process. If there is sufficient data available to determine the crypto exchange or the suspected wrongdoer, it becomes feasible to freeze their account/wallet and ultimately take control of their cryptocurrency holdings. The freezing of digital assets and the issuance of third-party disclosure orders typically require the initiation of a criminal procedure, with the relevant legal authority deeming it necessary to acquire such information. In Portugal, there is no specific civil process tailored for the recovery of cryptocurrency following a fraud or theft. However, victims of fraud can still pursue remedies through general civil processes. It's important to note that these procedures lack the coercive measures inherently present in criminal cases. While general legal principles apply, the absence of specialised regulations means that victims may face challenges in recovering cryptoassets through civil proceedings. As a result, the recovery process may require a thorough exploration of existing legal frameworks, potentially involving contractual, property, or tort law, to address the specific circumstances of the fraud or theft. Therefore, in the event of falling prey to crypto fraud, it is advisable to promptly file criminal charges and request the immediate suspension of assets that have been unlawfully transferred by notifying the exchange.

In Portugal, the main ongoing legal and regulatory development in the pipeline is related to MiCA. The enactment of that regulation implies that the Portuguese competent authorities (the CMVM and the Bank of Portugal) adapt the current legal framework to the new rules established therein and further develop it.