Crypto Licensing: VASP, CASP & MiCA Authorisation

What Is Crypto Licensing?

A crypto licence is a regulatory authorisation or registration that lets a legal entity provide crypto-asset services to clients in a given jurisdiction. It takes one of three shapes: a registration that adds anti-money-laundering supervision to an otherwise unlicensed activity, a full authorisation that imposes prudential, conduct and governance requirements alongside AML/CFT obligations, or a hybrid that pairs both layers.

Three terminology systems describe the same activity. The Financial Action Task Force (FATF) introduced virtual asset service provider (VASP) in October 2018, framing it around AML/CFT supervision. The European Union built its own term, crypto-asset service provider (CASP), into Regulation (EU) 2023/1114 (MiCA), extending that baseline into a full prudential and conduct regime with passporting rights across all 30 European Economic Area states. Regulators outside the EU mint their own labels, such as Singapore’s DPT and DTSP regimes, Hong Kong’s VATP licence and the UAE’s VARA VASP, but the underlying obligations rhyme.

Crypto licensing sits alongside the other regulated-finance verticals, not inside them. Gambling and iGaming licensing, forex broker licensing, EMI and payment institution licensing, fund and investment structuring and prediction market licensing each have their own regulators, statutes and capital thresholds. The boundaries matter: a crypto-native neobank that touches fiat e-money usually needs at least two of these in parallel. We hold all of them in view when we plan a structure.

This page explains the FATF and EU concepts, where we deliver, what MiCA requires, how we choose a jurisdiction, and how we run a licensing project end to end. If you already know what you are building, the fastest route is to book a free consultation and tell us.

VASP vs. CASP: The Two Terms Explained

VASP and CASP describe the same underlying activity (the provision of crypto-asset services on a professional basis) but they originate from different rule-making bodies and carry different regulatory consequences. The FATF VASP definition is the international AML/CFT baseline. The EU CASP definition is a prudential and conduct framework that sits on top of that baseline. Confusing the two is the most common terminological error in the market.

What Is a VASP?

A virtual asset service provider is any natural or legal person who, as a business, conducts one or more of five activities for another person. The FATF Glossary defines those five activities precisely: (i) exchange between virtual assets and fiat currencies; (ii) exchange between forms of virtual assets; (iii) transfer of virtual assets; (iv) safekeeping or administration of virtual assets or instruments enabling control over them; and (v) participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset.

The framework dates to October 2018, when the FATF revised Recommendation 15 to bring virtual assets and VASPs inside the global AML/CFT perimeter, with the Interpretive Note following in June 2019. Both remain authoritative, and the Travel Rule that flows from them now applies in more than 85 jurisdictions.

For an operator, the effect is binary: if the business model touches any of the five activities, the jurisdiction’s AML/CFT regime applies. Whether that supervision is paired with a full prudential licence (as in MiCA, Singapore, Hong Kong and Switzerland) or stops at registration only (as in the British Virgin Islands, Georgia and most pre-MiCA EU regimes) is a separate question that depends on the jurisdiction’s chosen model. The FATF baseline imposes no minimum capital, no governance rules and no passporting rights; everything beyond AML/CFT is layered on by national legislators.

What Is a CASP?

A crypto-asset service provider is, per Article 3(1)(15) of Regulation (EU) 2023/1114, a legal person or other undertaking whose business is the provision of one or more crypto-asset services to clients on a professional basis, and that is authorised to do so under Article 59. MiCA’s Article 3(1)(16) lists 10 such services, materially broader than the FATF’s five: (a) custody and administration; (b) operation of a trading platform; (c) exchange of crypto-assets for funds; (d) exchange of crypto-assets for other crypto-assets; (e) execution of orders; (f) placing of crypto-assets; (g) reception and transmission of orders; (h) advice; (i) portfolio management; (j) transfer services.

Authorisation is granted by a national competent authority (NCA) under MiCA Article 63 and passports automatically across all 30 EEA states via the European Economic Area (EEA) Agreement. The Article 3(1)(16) services map to three capital classes in MiCA Annex IV, and the prudential floor must be met by Common Equity Tier 1 own funds or an equivalent insurance arrangement. The full MiCA detail, including the Annex IV mapping, is below.

Key Differences

Where the two regimes diverge matters operationally. A VASP registration in the BVI does not give a Singapore-incorporated stablecoin issuer the right to onboard Italian retail clients; only a MiCA CASP authorisation issued by an EU NCA grants that right, and even then only within the scope of the services the authorisation explicitly covers.

MiCA: The EU Crypto Regulatory Framework

MiCA is the most consequential single piece of crypto regulation enacted to date. It replaced a patchwork of fragmented national VASP regimes with a single authorisation regime, introduced statutory prudential and conduct standards, and created a passport that allows one CASP authorisation to serve clients in 30 EEA states. The political process behind it took five years; the operational reality of CASP authorisation is now reshaping where crypto-asset businesses incorporate.

What Is MiCA?

MiCA is the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 of 31 May 2023. It was adopted on 31 May 2023 and entered into force on 29 June 2023, applying in phases thereafter. Titles III and IV, governing asset-referenced tokens (ARTs) and e-money tokens (EMTs), became applicable on 30 June 2024. Title V, governing the authorisation and conduct of crypto-asset service providers, became applicable on 30 December 2024. A third category, “other crypto-assets”, covers everything that is neither an ART nor an EMT.

The Article 143(3) transitional regime let Member States grant up to 18 months of grandfathering relief to pre-30 December 2024 incumbents, anchored to the EU-wide outer deadline of 1 July 2026. That deadline has not been extended: unauthorised CASPs must wind down by then, and penalties of up to EUR 5 million or 5% of annual turnover apply afterwards. Several Member States set shorter windows that lapsed during 2025 (see the implementation table below). If you are an incumbent, the runway is short, and we are filing MiCA applications now.

CASP Authorisation Requirements

CASP authorisation under MiCA Title V is a substantive prudential licence, not a registration. Article 68 sets a non-derogable set of governance, capital adequacy, AML/CFT, custody, conflict-of-interest, complaints, ICT-security and business-continuity requirements; each carries Level 2 detail in Commission Delegated Regulations and ESMA Regulatory Technical Standards (RTS). Outsourcing of any MiCA service is permitted under Article 73 but the CASP retains full residual liability.

DORA matters in practice because the Level 2 measures are dense and operational. The Register of Information has triggered real first-year compliance work for every CASP, and the obligation to test ICT third-party risk and, for significant firms, complete threat-led penetration tests, raises the operational floor well above pre-MiCA national regimes. This is the kind of detail we build into the application from the start, rather than discovering it at the regulator’s first request for information.

MiCA Service Categories and Capital Requirements

MiCA Annex IV maps the 10 Article 3(1)(16) services to three minimum-capital classes. The applicant’s permitted services determine the class; a CASP authorised for trading-platform operation is automatically subject to the Class 3 floor even where its other services would otherwise sit in Class 1 or Class 2. These figures sit at the centre of every jurisdictional cost discussion.

Two practitioner observations sit alongside these figures. The “one-quarter of fixed overheads” floor at Article 67(1)(b) often bites harder than the headline capital figure for any CASP with serious operating costs: a Class 2 CASP running EUR 2 million of annual fixed overhead carries a EUR 500,000 own-funds floor, not EUR 125,000. And the Annex IV figures govern the minimum at authorisation; NCAs routinely require materially higher buffers as a pre-condition for issuance, particularly for trading-platform applicants and for stablecoin-adjacent firms that need to demonstrate orderly wind-down funding.

Where We Deliver Crypto Licensing

We obtain crypto licences directly in eight jurisdictions. In each one we form the company, prepare and file the application, and deal with the regulator ourselves — through our own people or vetted in-country specialists we work with directly, never offloaded to a stranger. These are the jurisdictions where we are accountable for the outcome.

Not sure which of these fits? That is the first thing we work out with you. Book a free consultation and we will map your model to the right licence and jurisdiction before any work begins.

The Wider Field: Reference

The tables below cover the broader crypto-licensing landscape for context. We do not deliver licences in every jurisdiction listed here; where a client needs one of them, we say so plainly and discuss the most credible route. Timelines and tax figures are date-stamped to May 2026 and reflect each regulator’s published position.

European Economic Area

The EEA is the only block where a single CASP authorisation under MiCA Article 59 passports across multiple states. Implementation status (transitional, lapsed, fully applicable) varies considerably; the per-Member-State breakdown is in the implementation table further down.

Other Regulated Regimes

Major non-EU regulated regimes and emerging-market frameworks. Capital floors and prudential models vary far more than within the MiCA bloc.

Offshore International Finance Centres

IFC regimes range from registration only (BVI, Marshall Islands) to full authorisation (Bermuda, Cayman Phase 2). FATF and EU AML status varies and changes over time; the British Virgin Islands, for example, was added to the FATF grey list in June 2025 and to the EU AML high-risk list in December 2025, which directly affects banking access. We factor that status into any recommendation.

These figures are date-stamped to May 2026 and reflect each regulator’s published position; timelines move with the regulator’s queue and the applicant’s readiness. Where you need a licence in one of these jurisdictions, talk to us and we will tell you honestly whether and how we can deliver it.

Crypto Licensing in the United States: MSB, State Licences and the BitLicense

The United States is the largest crypto market without a single national crypto licence. Its regulatory perimeter is assembled from three cumulative layers: a federal AML registration, a state-by-state money-transmission patchwork, and a securities/commodities split between two federal market regulators. That structure is why the US appears in none of the comparison tables above; there is no one authorisation to put in a row.

Federal Layer: FinCEN MSB Registration and the SEC/CFTC Split

Exchangers and administrators of convertible virtual currency are money transmitters under the Bank Secrecy Act and must register with FinCEN as a money services business (MSB). Registration is an AML/CFT baseline, not a licence: it carries programme, reporting and Travel Rule obligations but no capital requirement, no fit-and-proper test and no authorisation decision. Market oversight then splits by asset: the SEC asserts jurisdiction where a token is offered as a security, while the CFTC supervises derivatives and polices fraud in spot markets, treating bitcoin and ether as commodities.

Federal legislation is only partially landed. The GENIUS Act, enacted in July 2025, created the first federal regime for payment-stablecoin issuers, with implementing rules still being written. The market-structure bill, the Digital Asset Market Clarity Act, passed the House and cleared the Senate Banking Committee but was not yet enacted as of June 2026, so the SEC/CFTC boundary remains enforcement- and case-law-driven.

State Layer: Money Transmitter Licences and the NYDFS BitLicense

Below the federal floor sits a patchwork of roughly 50 state and territory money-transmission regimes, most of which capture crypto exchange and custody. Each state licenses separately, with its own surety bond, net-worth minimum, fees and examinations; the Money Transmission Modernization Act model law and the NMLS filing platform harmonise standards and centralise applications, but there is no passporting between states. New York adds the best-known state-specific regime, the NYDFS BitLicense, required for virtual currency business activity involving the state or its residents. A nationwide US licensing build-out routinely takes one to three years.

Tomberg & Partners does not provide services to US persons; this section is informational only. For everyone else, the single-authorisation regimes covered on this page are almost always the more practical route, and we are happy to explain why on a call.

MiCA Implementation Across EU Member States

A single MiCA regulation does not produce a single national experience. Each EEA state legislated its own implementing law and chose its own Article 143(3) transitional window. The aggregate EU outer deadline is 1 July 2026; per-state windows range from already-lapsed (Latvia and the Netherlands closed on 30 June 2025; Germany, Ireland, Lithuania and Slovakia closed on 30 December 2025) to the full 18-month window (Cyprus, Czech Republic, Estonia, France, Italy, Liechtenstein, Malta, Portugal, Romania and Spain). This is exactly the kind of moving detail we track for clients so a filing lands in the right place at the right time.

The European Securities and Markets Authority (ESMA) maintains the central interim CASP register. As of May 2026 it held roughly 204 to 210 authorised CASPs across 23 member states, with Germany hosting the largest pool, followed by the Netherlands, France, Norway, Malta and Spain. Notable zeros: Portugal, Poland and Romania. Polish operators in particular have had to plan around a national regime that took longer than expected to come into force, with activity migrating to faster EU hubs in the interim.

The pattern matters. Lapsed jurisdictions (Germany, Ireland, Latvia, Lithuania, the Netherlands and Slovakia) now require MiCA authorisation for any crypto-asset service to EU clients; legacy national regimes are closed. Active-transitional jurisdictions still allow incumbents to operate under national law until 1 July 2026, but new applications go directly through MiCA. For jurisdiction selection this is decisive: an applicant ready to file today is on a tighter clock in slow-NCA jurisdictions than in faster ones such as Lithuania, Malta and Cyprus — three of the eight where we deliver.

Common Requirements Across Jurisdictions

A small number of requirements recur across virtually every VASP and CASP regime worldwide. They sit at the FATF baseline and are extended (rather than replaced) by national prudential overlays. Operators planning multi-jurisdictional structures should treat these as the irreducible minimum.

AML/CFT programme. A documented anti-money-laundering and counter-terrorist-financing programme is universal: written policies, designated MLRO/AML officer, customer due diligence (CDD), enhanced due diligence for higher-risk customers, ongoing monitoring, sanctions screening, suspicious-activity reporting, training and independent testing. Programmes must be risk-based per FATF Recommendation 10 and operationalised through a transaction-monitoring tool (typically a third-party blockchain analytics platform) with sanctions and PEP screening overlays.

Travel Rule. Originator and beneficiary information must accompany crypto-asset transfers. The EU Transfer of Funds Regulation imposes no de minimis for CASP-to-CASP transfers; the EUR 1,000 threshold triggers only the additional self-hosted-wallet verification obligation. The EBA Travel Rule Guidelines operationalise these information-accompaniment obligations, and comparable rules now apply in more than 85 jurisdictions worldwide.

Fit-and-proper testing. Directors, senior managers, UBOs and significant shareholders are typically subject to clean-criminal-record requirements, financial-soundness checks, prior-regulatory-history disclosure and minimum experience standards (typically three to five years in a relevant role). MiCA codifies this at Article 68 with the qualifying-holdings threshold of 10% at Article 84; comparable thresholds apply elsewhere.

Custody segregation. Client crypto-assets must be segregated from CASP proprietary assets, individually accounted for at the client level, and protected from CASP insolvency. MiCA Article 70 imposes strict liability for loss except where the CASP can prove the event was beyond reasonable control. Hong Kong’s SFC requires ≥98% cold storage with approved insurance for VATPs; the UAE’s VARA requires 100% one-to-one like-kind reserve assets with daily reconciliation.

Operational substance. Mailbox-only structures are now effectively extinct in any FATF-compliant jurisdiction. Singapore requires a Singapore-resident executive director and compliance officer; Hong Kong requires at least one HK-resident Responsible Officer; the UAE VARA requires two UAE-resident Responsible Individuals; MiCA Member States require an effective head office in the authorising state with a locally-resident management body. Even BVI and Cayman now require local Authorised Representatives and AML officers.

Cybersecurity and operational resilience. EU CASPs face DORA, in force from January 2025, which sets ICT risk-management, incident reporting, threat-led penetration testing and ICT third-party risk obligations. Outside the EU, Singapore’s MAS TRM Guidelines, Hong Kong’s SFC technology standards, the UAE’s VARA Technology Rulebook and the counterparty-driven benchmarks (NIST CSF 2.0, SOC 2 Type II, ISO/IEC 27001) operate as the de-facto floor.

Reporting and audit. Annual audited financials (typically IFRS), periodic prudential and AML returns, material-change notifications and SAR/STR reporting are universal. EU CASPs additionally face DORA supervisory reporting and the MiCA Article 88 disclosure regime. Hong Kong SFC monthly FRR returns and Singapore MAS half-yearly returns are the most demanding cadences in the major jurisdictions.

How to Choose the Right Jurisdiction

Jurisdiction selection is rarely a one-variable decision. The five most decision-relevant axes are EU market access, total cost of ownership, banking accessibility, applicant timeline tolerance and the regulator’s substance expectations. Each axis pushes toward a different short-list.

If EU market access is the requirement. Authorisation must be obtained from an EU/EEA NCA under MiCA; nothing else passports. Faster NCAs include MFSA in Malta (4–8 months, including the Article 143(6) simplified procedure for VFA Category A incumbents), CySEC in Cyprus (5–8 months), and Lietuvos bankas (4–7 months). Slower NCAs include BaFin in Germany and the Central Bank of Ireland, though their authorisations carry a credibility premium with institutional counterparties.

If cost is the binding constraint and EU passporting is not required. Estonia, Lithuania and the Czech Republic sit at the lower end of the MiCA cost spectrum. BVI, Cayman Islands and Bermuda are the institutional-grade offshore options; Seychelles, Saint Kitts and Saint Lucia sit in the mid-tier offshore band.

If timeline pressure dominates. Georgia (2–4 months) and Comoros / Anjouan (2–4 months) are the fastest; counsel-caution applies to the AOFA framework, which is not recognised at the Union Government of the Comoros level. Lithuania, Marshall Islands and Costa Rica (no bespoke regime; light AML supervision) sit at the 1–4 month band.

If tax efficiency matters most. BVI, Cayman and Bermuda (0% corporate income tax, with a 15% Pillar Two top-up for in-scope multinationals), Estonia (0% on retained earnings, 22% only on distributions) and the Marshall Islands (0%, but note the EU non-cooperative list) sit at the favourable end. Always read the tax position alongside FATF and EU AML status: the BVI’s 2025 FATF grey-listing and EU high-risk listing, for instance, directly affect banking access. We never let a headline tax rate drive a structure that a bank will then refuse to open.

If banking access is the dealbreaker. Banking is downstream of jurisdiction, not independent of it. Accounts are easier to open from well-regarded jurisdictions such as Cyprus, Malta, Lithuania and Switzerland than from grey-listed ones. As a supporting service, we help arrange banking and payment relationships once the licence is in hand — our banking and payments page covers how we approach it.

A good way to read the choice: pick the two axes your business actually depends on, then narrow to the jurisdictions that score on both. Selecting on a single axis — usually cost — is the most common mistake we see, and it is one we will steer you away from.

Entity Requirements

Every VASP and CASP regime requires the applicant to be a legal entity registered or authorised in the relevant jurisdiction. The form, capital structure and governance of that entity must align with the licence; we plan formation backward from the licence specification rather than forward from a “favourite” structure.

For MiCA CASP applicants, the entity must be a legal person established in an EU Member State (or EEA state via the Agreement), with its central administration in that state. Article 59 prohibits authorisation of pure-paper entities; the principal place of business must align with the authorising state, not with a parent group’s preferred jurisdiction. We form that entity ourselves, so it is built to satisfy the substance test from day one. See European Company Formation for the EU formation detail.

For offshore VASP applicants, local incorporation is universal. BVI requires a BC (Business Company) under the BVI Business Companies Act 2004, with an Authorised Representative and registered office locally. Cayman uses the Exempted Company or LLC under the Companies Act. Bermuda uses the Exempted Company. The Marshall Islands offers the DAO LLC under the Marshall Islands DAO Act 2022, which is a corporate vehicle rather than a financial licence. See Offshore Company Formation for the offshore decision matrix.

For non-EU regulated regimes, entity formation rules are typically prescriptive. Singapore requires a Singapore-incorporated company (Pte Ltd) with a Singapore-resident director. Hong Kong requires an HK Limited company with at least one HK-resident director under the Companies Ordinance. UAE VARA requires a Dubai mainland or DIFC/ADGM entity depending on the free zone strategy. The Company Formation Hub carries the cross-jurisdictional formation matrix and the decision framework for entity-licence alignment.

How We Work

We run crypto licensing as a five-stage project, with entity formation, the licence application and supporting banking moving in parallel rather than one after another. We do the work ourselves — in-house, or through vetted in-country specialists we work with directly and stand behind. You have one accountable firm and one point of contact from first call to issued licence.

1. Pre-filing assessment. We scope your business model, map the activities to the FATF five-activity list and the MiCA Article 3(1)(16) services, and recommend the jurisdictions that fit. The output is a straight written assessment, not a sales deck.

2. Jurisdiction selection. We weigh the shortlist on capital, timeline, banking realism, substance and the regulator’s recent behaviour with applicants like you, then agree the choice with you before any incorporation begins. Reversing a wrong jurisdiction six months in is the most expensive mistake in the lifecycle, so we get this right first.

3. Entity formation and substance. We incorporate the company, appoint local directors and senior compliance hires, and put the real substance in place — office, MLRO/AML officer, IT infrastructure and transaction-monitoring tooling. For EU applicants the entity is operational ahead of the MiCA filing, because the timing shapes how the regulator reads substance.

4. Application and submission. We draft the regulatory business plan, AML policies, ICT and DORA documentation, governance arrangements and the prudential annexes, then file and deal with the regulator directly — we handle the questions, the requests for information and the back-and-forth, not you.

5. Banking and ongoing compliance. As a supporting step, we help arrange banking and payment relationships through our controlled network of vetted institutions. After authorisation we manage the first-year compliance cadence — periodic reporting, the DORA Register of Information, AML programme reviews — to keep the licence in good standing. Our banking and payments page covers that side in more detail.

A MiCA mandate typically runs 6 to 12 months end to end, and an offshore one 4 to 8. The right time to start is governed by the regulator’s queue, not only by your readiness — which is why we tell clients to begin the conversation early. Book a free consultation and we will tell you exactly what your route looks like.

Frequently Asked Questions

Concepts

What is a VASP?

A virtual asset service provider (VASP) is a person or business that, on a professional basis, conducts one or more of five activities defined in the FATF Glossary: exchange between virtual assets and fiat, exchange between forms of virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets, or participation in and provision of financial services related to a virtual-asset issuance. The FATF introduced the term in October 2018 by revising Recommendation 15. The framework brings crypto-asset firms inside the global anti-money-laundering perimeter but imposes no capital, no governance and no passporting rights on its own; everything beyond AML/CFT is added by national legislators.

What is a CASP?

A crypto-asset service provider (CASP) is the EU-specific term defined in Regulation (EU) 2023/1114 (MiCA), Article 3(1)(15). MiCA’s Article 3(1)(16) identifies 10 crypto-asset services that a CASP can be authorised to provide: custody and administration; trading-platform operation; exchange for funds; exchange for other crypto-assets; execution of orders; placing; reception and transmission of orders; advice; portfolio management; and transfer services. CASP authorisation is granted by a national competent authority under MiCA Article 63 and passports automatically across all 30 EEA states under the EEA Agreement.

MiCA

What is MiCA?

MiCA is the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 of 31 May 2023. It is the EU’s first comprehensive crypto regulatory framework, covering stablecoin issuance (asset-referenced tokens and e-money tokens), CASP authorisation, market-integrity rules and consumer-protection standards. It entered into force on 29 June 2023, with stablecoin provisions applicable from 30 June 2024 and CASP authorisation requirements applicable from 30 December 2024. MiCA replaced the patchwork of national VASP regimes with a single passportable authorisation, and operates alongside the Transfer of Funds Regulation (EU) 2023/1113 and DORA (EU) 2022/2554.

When does MiCA take full effect?

MiCA is fully in force as of May 2026. The Article 143(3) transitional regime for pre-30 December 2024 incumbents ends on 1 July 2026 across the entire EU; ESMA confirmed in its 17 April 2026 statement (ESMA75-113276571-1679) that the deadline has not been extended. Several Member States set shorter windows that have already lapsed: Latvia and the Netherlands closed on 30 June 2025; Germany, Ireland, Lithuania and Slovakia closed on 30 December 2025. Operators without a MiCA CASP authorisation by 1 July 2026 must cease serving EU clients or face penalties of up to EUR 5 million or 5% of annual turnover.

How much capital do I need for MiCA CASP authorisation?

MiCA Annex IV maps the 10 CASP services to three minimum-capital classes. Class 1 (reception and transmission of orders, execution, placing, advice, portfolio management, transfer services) requires EUR 50,000. Class 2 adds custody and administration, exchange for funds and exchange for other crypto-assets, with a EUR 125,000 floor. Class 3 adds trading-platform operation and requires EUR 150,000. The Article 67(1)(b) “one-quarter of prior-year fixed overheads” floor applies in parallel and often exceeds the headline figure; a CASP running EUR 2 million of annual fixed overhead carries a EUR 500,000 own-funds requirement, not the Annex IV minimum.

Do I need an EU company for MiCA?

Yes. MiCA Article 59 requires CASP applicants to be legal persons established in an EU Member State or, via the EEA Agreement, in Iceland, Liechtenstein or Norway. The applicant’s central administration must align with the authorising state; pure-paper structures are not authorisable, and ESMA’s Q&A series repeatedly emphasises the substance test. Reverse solicitation under Article 61 does not substitute for authorisation: it is narrowly drafted, voided by any EU-targeted marketing, and covers only the type of service the client specifically requested. We form the EU entity and obtain the licence as a single coordinated project.

Process & Eligibility

Do I need a crypto licence to operate an exchange?

Yes, in every major jurisdiction. The EU requires MiCA CASP authorisation under Articles 59–74. Singapore requires DPT licensing under the Payment Services Act 2019 and (from 30 June 2025) DTSP authorisation under FSMA Part 9 for offshore-targeting services. Hong Kong requires SFC VATP licensing under the SFO plus AMLO registration. The UK currently requires FCA cryptoasset registration under the MLRs 2017 and will, from 25 October 2027, require full authorisation under SI 2026/102. The United States requires FinCEN MSB registration plus state Money Transmitter Licences in most states. Operating an unlicensed crypto exchange is unlawful in all of the above; criminal penalties apply in Lithuania (from 1 January 2026), Singapore and most EU Member States. If you are building an exchange, talk to us early — the licence shapes the whole structure.

Do US operators need a licence in every state?

For nationwide money-transmission activity, effectively yes. There is no federal crypto licence and no passporting between states: each state issues its own money transmitter licence, and the overwhelming majority of states treat crypto exchange and custody as money transmission. The Money Transmission Modernization Act model law and the NMLS platform harmonise standards and centralise filings, but they do not replace per-state approval. New York additionally requires the NYDFS BitLicense (23 NYCRR Part 200) for virtual currency business activity involving the state or its residents. FinCEN MSB registration is a federal AML baseline that sits alongside, not instead of, state licences. The United States section above carries the full explainer; Tomberg & Partners does not provide services to US persons.

Which countries require VASP registration?

The VASP terminology is most common in offshore IFCs and emerging markets: the BVI (VASP Act 2022), Cayman Islands (Virtual Asset (Service Providers) Act, 2024 Revision), Georgia (NBG Order 94/04), Saint Kitts (Virtual Asset Act, Cap. 21.29), Saint Lucia (Virtual Asset Business Act No. 27 of 2022), Vanuatu (VASP Act No. 3 of 2025), the Marshall Islands (DAO LLC under the DAO Act 2022, a corporate vehicle rather than a financial licence), the UAE (VARA VASP under Dubai Law 4 of 2022) and Kyrgyzstan (Law on Virtual Assets No. 12 of 21 January 2022). EU Member States used “VASP” or equivalent national terms before MiCA; those regimes have now been superseded by CASP authorisation.

Which EU country is best for MiCA CASP authorisation?

There is no single best jurisdiction; the right answer depends on the applicant. Malta and Cyprus offer the fastest authorisation paths (4–8 months and 5–8 months respectively) with strong English-language regulatory infrastructure and established CASP populations. Lithuania is the lowest-cost MiCA jurisdiction with the fastest processing at Lietuvos bankas. Estonia retains a strong English-language regulator (Finantsinspektsioon) and the 0% retained-earnings tax structure. Germany (BaFin) and Ireland (Central Bank of Ireland) carry the highest credibility premium with institutional counterparties but require longer timelines and higher all-in cost. We deliver MiCA CASP authorisation in Lithuania, Cyprus and Malta, and will tell you plainly which of the three fits your model.

Working With Us

Where do you deliver crypto licences?

We obtain crypto licences directly in Lithuania, Cyprus, Gibraltar, Malta, Poland, Switzerland, Bosnia and Liberia. In each one we form the company, prepare and file the application, and deal with the regulator ourselves — through our own people or vetted in-country specialists we work with directly, never offloaded to a stranger. We are accountable for the outcome.

What does it cost and how long does it take?

Cost depends on the jurisdiction, the services you want authorised, your capital strategy and how ready the business is to demonstrate substance, so we quote on a case-by-case basis rather than publishing a price list. As a guide to timelines, a MiCA mandate typically runs 6 to 12 months end to end and an offshore one 4 to 8. Book a free consultation and we will give you a clear scope and a quote for your situation.

Banking & Payments

A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Related Services

• Lithuania Crypto Licensing: the fastest MiCA route, through Lietuvos bankas
• Cyprus Crypto Licensing: MiCA CASP authorisation through CySEC
• Malta Crypto Licensing: MiCA CASP authorisation through the MFSA
• Reverse Solicitation Under MiCA Article 61: what it permits and why it is not a market-entry route
• Company Formation: EU and offshore entity structuring for licensed crypto businesses
• Banking & Payments: arranging banking for licensed crypto and fintech operators