MiCA CASP Licence

What Is MiCA / CASP Authorisation?

MiCA, the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), is the EU-wide framework for crypto-asset markets. A crypto-asset service provider (CASP) authorisation is the individual licence a firm obtains from a national competent authority under MiCA Article 63 to provide one or more of the ten crypto-asset services listed in Article 3. MiCA is the rulebook; the CASP authorisation is the permission to operate under it. The two are distinct legal objects, which is why converting a national VASP registration into a CASP authorisation is a fresh application, not a renewal. We file that fresh application for you.

MiCA applied in two stages. The stablecoin titles, Title III for asset-referenced tokens (ART) and Title IV for e-money tokens (EMT), applied from 30 June 2024. The CASP regime under Title V applied from 30 December 2024, with the Article 143(3) transitional regime letting pre-existing national VASPs continue under their old registration for a national window of up to 18 months. That window has a hard EU-wide ceiling, and the ceiling is now in sight.

A CASP authorisation from any one EU or EEA member state passports the authorised services across all 30 EEA states under MiCA Article 65, after a host-state notification. The United Kingdom, Switzerland and Gibraltar sit outside the regime and require local authorisation for local clients.

The decision is rarely about the cheapest member state. It is the lowest-cost state whose regulator, banking ecosystem and substance expectation you can actually meet, then passporting from there into the markets that matter. That is the first call we make on every mandate. Compare states across capital, timeline and service scope with our crypto-licensing comparison tool alongside it.

Who Needs a CASP Authorisation?

A CASP authorisation is required by any firm providing one or more of the ten crypto-asset services in MiCA Article 3 to clients in the Union. The trigger is the activity, not the firm’s label. The operators that need to act now are EU VASPs whose national registration expires at the Article 143(3) ceiling. We tell you plainly which of your activities trigger the licence, and we file for the right ones.

The ten regulated crypto-asset services

MiCA Article 3 enumerates the services that require authorisation: custody and administration of crypto-assets; operation of a trading platform; exchange of crypto-assets for funds; exchange of crypto-assets for other crypto-assets; execution of orders; placing of crypto-assets; reception and transmission of orders; advice on crypto-assets; portfolio management on crypto-assets; and transfer services for crypto-assets. A firm is authorised for the specific services it applies for and can passport only those, which is why scoping the service set correctly at application stage is the first decision on every mandate.

EU VASPs facing the 1 July 2026 deadline

The largest population is existing EU VASPs. Any firm holding a national crypto registration, for example a former Estonian, Lithuanian or French VASP, must convert to a CASP authorisation to keep serving EU clients past the transitional ceiling. The conversion is not automatic: the CASP file is materially heavier than the old VASP registration, requiring a programme of operations, a governance and prudential package, and a crypto-asset white paper where the firm offers or seeks admission to trading of crypto-assets other than ARTs or EMTs under MiCA Articles 6 to 8. Most pre-MiCA VASPs have not yet converted, so the regulators face a queue and the firms that file early are the ones most likely to clear review before the ceiling. The slow part is rarely the regulator; it is assembling the governance, white paper and prudential evidence the old registration never demanded. That assembly is exactly the work we do in-house and through the in-country specialists we control, so your file lands complete and on time.

Non-EU operators and reverse-solicitation limits

Non-EU operators serving EU clients need an EU-incorporated CASP entity. Reverse solicitation under MiCA Article 61 was tightened by the European Securities and Markets Authority (ESMA) and is the exception, not the rule. The exemption is operationally narrow: targeted advertising, EU-language websites, country-code top-level domains, sponsorship of EU events, EU-based influencers, and affiliate or referral programmes that direct EU traffic all defeat it. It is also confined to the context of the original transaction, so an offshore entity cannot scale a recurring EU-client relationship on it. We form the EU-incorporated entity and file the CASP application for it. The reverse-solicitation explainer sets out the operational triggers in full. US persons are excluded as clients.

Where to Get Licensed

Because a CASP authorisation passports across the whole EU and EEA, the member state of authorisation is a cost-and-speed decision, not a market-access one. The minimum capital is set by MiCA and identical everywhere; what varies is the advisory cost, the regulator’s processing speed, the file language, and the local substance expectation. For most operators the efficient route is to license in a cheap-entry passport state and passport into the larger markets, including Germany, rather than license directly where the file is heaviest. We make that call with you and then file where it makes sense.

The license-cheap, passport-in thesis

The strategy is driven by concentration of demand, not supply. Germany is the single largest CASP market and the largest destination for inbound passporting, yet most firms serving German clients did not license there; they licensed in a cheaper-entry state and passported in, the route the large majority of authorised CASPs have used. A cheap-entry file in Lithuania or the Czech Republic is faster and lighter than the German BaFin route, with its lengthy files, long timelines and cohort of large, well-capitalised incumbents. For an operator needing a grant before the ceiling, that direct route carries both timeline and fit risk; the same EU market is reachable far faster from a passport state, and the authorisation is identical in legal effect because MiCA harmonises the substantive rules. We license you where the grant is achievable and passport you into the markets you actually serve.

The cheap-entry passport states

The cheap-entry cluster spans the Baltics, Central Europe and the Iberian peninsula. Each is an EU member state whose CASP authorisation passports across the Union and carries the same MiCA capital floors; they differ on processing speed, file language, ecosystem maturity and how far the national transitional window has already run.

Lithuania is the most-used Baltic entry point, with a deep fintech ecosystem and a regulator, the Bank of Lithuania, experienced in onboarding crypto and EMI firms; its national VASP transition expired during 2025, so conversions there run as fresh CASP files. The Czech Republic pairs a low cost base with the Czech National Bank as competent authority. Estonia, the original EU crypto-registration hub, and Latvia round out the Baltic options: Estonia runs at the 18-month outer bound to 1 July 2026, while Latvia’s national window closed on 30 June 2025, so Latvian conversions also run as fresh CASP files.

Malta and Cyprus are the established Mediterranean CASP centres, both at the 18-month maximum running to 1 July 2026; Cyprus required existing national-regime CASPs to file a complete MiCA application with CySEC by 27 February 2026. Spain (CNMV) and Portugal (CMVM/Banco de Portugal) are the Iberian options, both at the maximum window, and Slovakia is a low-cost Central European entry whose window expired in 2025.

Romania and Poland sit in a legal-uncertainty cluster: neither had an enacted national MiCA framework as of June 2026. Poland is the sharper case. President Karol Nawrocki twice vetoed the national Crypto-Assets Market Act and the Sejm’s override failed on 18 April 2026, leaving Poland without an authorising competent authority. Polish VASPs lose the right to provide crypto-asset services on 1 July 2026 unless legislation is adopted first; foreign CASPs can passport in, but Polish VASPs cannot passport out. A third version of the Act passed the Sejm in May 2026, but until it is signed and in force, operators incorporated in Poland or Romania for a CASP product should plan for relocation against the ceiling regardless.

Passport-state comparison

The eleven cheap-entry states below share an identical MiCA capital regime and EU/EEA passport, differing on processing speed, file language, ecosystem maturity and transitional status. Germany is shown at the foot as the passporting destination, not a recommended origin. The capital column shows the MiCA Class 1 / 2 / 3 floor common to every state; the timeline column shows observed end-to-end ranges from engagement to grant, not the statutory assessment period. Tell us your service set and we will tell you what each state costs to license in for your business.

Read the transitional-status column first. Where a national window has expired or sits in the legal-uncertainty cluster, a fresh CASP file is the only path, and the firms with a complete application on record before 1 July 2026 are the ones that keep operating without a gap.

The statutory clock is not the constraint. MiCA Article 63 gives every authority the same timetable, roughly three months of regulator time, yet observed end-to-end timelines run from a few months to well over a year, and longer in Germany. The gap is the file, not the authority: assembling the governance, prudential and banking evidence before submission, and clearing the stop-the-clock information rounds after it, dominates the calendar. For most operators the practical shortlist is Lithuania, the Czech Republic, Estonia or Malta, chosen on regulator familiarity with the service set and on how quickly we can stand up local substance. Germany, France and the Netherlands are where the clients are, reachable by passport; we avoid Romania and Poland as an origin until their frameworks are enacted.

Key Requirements

The MiCA CASP file turns on a small number of pillars, harmonised EU-wide because they are set by the regulation: prudential capital by service class, governance and fit-and-proper management, the crypto-asset white paper where the firm offers crypto-assets to the public, and prudential safeguards over client assets and funds. What differs between states is the regulator’s processing speed and evidence expectation, not the bar itself. We build each pillar for you to the depth the chosen authority expects.

Capital classes 1, 2 and 3

MiCA Article 67 and Annex IV set three prudential classes keyed to the services provided. Class 1 requires EUR 50,000 and covers reception and transmission of orders, execution, placement, advice, and portfolio management. Class 2 requires EUR 125,000 and adds custody and administration of crypto-assets and the exchange of crypto-assets for funds or other crypto-assets. Class 3 requires EUR 150,000 and covers operating a trading platform. The binding figure is the higher of the class floor and one quarter of the prior year’s fixed overheads under Article 67(1), so a firm with a large cost base holds more than the headline number.

Governance and fit-and-proper management

Every CASP must have a management body of sufficiently good repute and with adequate knowledge, skills and experience under MiCA Article 68, and holders of qualifying participations must themselves be fit and proper. The firm needs sound administrative and accounting procedures, business-continuity arrangements, and effective internal control and risk-assessment mechanisms. Governance is where converting VASPs lose the most time, because a national registration rarely required a documented management body, conflicts policy and outsourcing register at CASP depth. We assemble it for you and stand up the locally substantive board and senior compliance function the regulator expects.

The crypto-asset white paper

A firm that offers crypto-assets other than ARTs or EMTs to the public, or seeks their admission to trading, must draw up a crypto-asset white paper compliant with MiCA Articles 6 to 8 and notify it to the competent authority. It sets out the project, the rights and obligations attached to the crypto-asset, the underlying technology and the risks, with prescribed mandatory statements and a summary. It is a different document from the offering memorandum many operators hold: the MiCA content schedule is specific, and a marketing-led document will not satisfy it. Where a CASP only services existing crypto-assets it does not issue, the obligation may not bite. We scope that correctly and draft the white paper where it is required.

Prudential safeguards over client assets

MiCA imposes strict safeguarding of client holdings. Under Article 70, a CASP holding client funds that are not e-money tokens must place them with a central bank or a credit institution by the end of the following business day, segregate them from its own assets, and protect client ownership rights, in particular in insolvency. CASPs providing custody under Article 75 must keep a position register, segregate clients’ crypto-assets from their own, and are liable for their loss up to market value. The firms that clear review cleanly confirm client-asset segregation and the supporting banking before the substantive review opens, rather than treating banking as a post-grant task. We arrange that banking in parallel with the application.

AML and operational resilience

Two horizontal regimes sit over the CASP file. The EU AML Reform Package (the AMLR, AMLA Regulation and the sixth AML Directive) applies from 10 July 2027, with AMLA already operational; from that date the AMLR prohibits anonymous accounts and accounts using anonymity-enhancing coins and sets an EU-wide EUR 10,000 cash-payment limit. The Digital Operational Resilience Act (DORA) has applied since 17 January 2025, mandating an ICT risk-management framework, a register of ICT third-party providers, and incident reporting. We size DORA and AML readiness into the application timeline rather than leave it as a post-grant build.

How We Deliver It

We run MiCA CASP authorisation as a single mandate. The jurisdiction call, company formation, CASP application, white paper, governance and prudential build, and EU passport notification all run in parallel rather than in sequence, with the 1 July 2026 ceiling as the fixed point. We do the work ourselves and through the in-country lawyers, accountants and licensed specialists we have vetted and work with directly, never handing you to an unverified third party, and we are accountable for the outcome.

The first work item is a service-scope and jurisdiction call. A converting VASP running an exchange and custody, needing Class 2 capital and a fast grant, gets a different recommendation than an advisory-only firm needing only Class 1. We do not recommend a state before mapping your services against MiCA Article 3, the markets you target, and whether you issue any crypto-asset that triggers the white-paper obligation. We pick the state on regulator familiarity with your service set and on how quickly we can stand up local substance, because the capital floors are identical everywhere.

Once the state is selected, we form the company in parallel with the application: a locally substantive entity with a fit-and-proper management body and registered office in place before we submit, and senior-management interviews scheduled where the authority requires them. We deliver that formation through our company formation service at the depth the authorisation requires, scope the file so you passport only the services you need, then deal with the regulator directly and answer information requests from a prepared desk. The white paper, AML manual, governance and conflicts policies, risk-management framework and DORA readiness are sequenced into the timeline so that on grant you go live and notify the passport, not start a fresh build. Once granted, we file the Article 65 passport notifications into your destination markets and handle the ongoing reporting, qualifying-holding changes and supervisory milestones that fall due. The broader context sits on the crypto licensing pillar page.

Banking is a supporting workstream we run alongside the application. Because a CASP must place client funds with a central bank or a credit institution by the next business day under Article 70, confirmed client-asset banking is a gating requirement, not an afterthought. We arrange it with credit institutions and licensed EU payment providers that work with authorised crypto firms, so it is in place before the substantive review opens. See banking for regulated businesses for how this fits the wider mandate.

Frequently Asked Questions

The deadline and the regime

What happens on 1 July 2026 under MiCA?

1 July 2026 is the hard ceiling of the MiCA Article 143(3) transitional regime, the EU-wide outer bound after which no pre-MiCA national VASP registration can carry crypto-asset services in the Union. Member States set their own shorter windows: France, Luxembourg, Malta, Cyprus, Estonia, Spain, Italy and Bulgaria run to the 18-month maximum at 1 July 2026; Germany, Ireland, Slovakia, Austria and Lithuania saw their windows expire during 2025, and Latvia and the Netherlands closed theirs on 30 June 2025. After the ceiling, a VASP without a granted CASP authorisation or a complete, timely application must stop providing services. The conversion is not automatic: a VASP registration and a CASP authorisation are different legal objects with different files.

What is the difference between MiCA and a CASP authorisation?

MiCA, Regulation (EU) 2023/1114, is the EU-wide rulebook. A CASP authorisation is the individual licence a firm obtains from a national competent authority under MiCA Article 63 to provide one or more of the ten crypto-asset services in Article 3. A single CASP authorisation from any one EU or EEA member state passports the authorised services across all 30 EEA states under Article 65, after a host-state notification. Stablecoins sit in a separate Title III/IV regime for asset-referenced and e-money tokens.

Choosing a jurisdiction

Why not just get a German BaFin CASP licence directly?

Germany is the single largest CASP market and the top destination for cross-border passporting, but the BaFin route is slow and expensive: lengthy application files, 12 to 24 month timelines, and a cohort dominated by large, well-capitalised firms. For a boutique-fit operator the efficient play is to license in a cheaper-entry passport state and passport into Germany under MiCA Article 65, which is exactly what the large majority of CASPs holding cross-border rights have done. Germany is best understood as a destination you reach by passport, not an origin you license in.

Does MiCA passporting give me access to the whole EU?

Yes. A CASP authorisation from any one EU or EEA national competent authority passports the authorised services across all 30 EEA states. Under MiCA Article 65 the home authority notifies the host authorities of the firm’s intention to operate cross-border, and the firm may begin once the notification process completes. The passport covers only the services for which the firm is actually authorised: a Class 1 advisory CASP cannot passport custody or exchange services it does not hold. The large majority of authorised CASPs hold cross-border rights, which is the structural reason the license-cheap-passport-in route works.

Capital, stablecoins and scope

How much CASP capital do I need under MiCA?

MiCA Article 67 and Annex IV set three prudential classes by service. Class 1 requires EUR 50,000 and covers advice, reception and transmission of orders, execution and placement. Class 2 requires EUR 125,000 and adds custody and administration of crypto-assets plus the exchange of crypto-assets for funds or other crypto-assets. Class 3 requires EUR 150,000 and covers operating a trading platform. The binding figure is the higher of the fixed minimum and one quarter of the prior year’s fixed overheads under Article 67(1), so a firm with large operating costs holds more than the class floor. The figures are set by the regulation and identical in every member state.

Can a non-EU operator serve EU clients through reverse solicitation instead of a CASP licence?

Not as a market-entry strategy. Reverse solicitation under MiCA Article 61 is the only narrow exception to the Article 59 requirement that crypto-asset services to clients in the Union be provided by an authorised CASP, and ESMA tightened it in Guidelines. The exemption is defeated by targeted advertising into the EU, EU-language websites, country-code top-level domains, sponsorship of EU events, EU-based influencers, and affiliate or referral programmes that direct EU traffic. It is also confined to the context of the original transaction, so a third-country firm cannot scale a recurring EU-client relationship on it. Sustained EU-client business requires an EU-incorporated, CASP-authorised entity.

Does MiCA cover stablecoins, and is that the same as a CASP authorisation?

MiCA covers stablecoins under a separate regime from CASP services. Asset-referenced tokens (ARTs) are governed by Title III and e-money tokens (EMTs) by Title IV, both applying since 30 June 2024, ahead of the CASP rules in Title V from 30 December 2024. Issuing an ART requires authorisation as an ART issuer or a credit institution; issuing an EMT requires authorisation as a credit institution or an electronic money institution. A CASP authorisation lets a firm provide services in respect of crypto-assets, including stablecoins, but does not by itself permit the firm to issue an ART or an EMT. Issuance and service provision are distinct permissions; an operator that both issues and services a stablecoin needs both.

Banking & Payments

A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Related Services

• Crypto Licensing (VASP / CASP / MiCA): The full crypto-licensing pillar across all jurisdictions
• Reverse Solicitation: The MiCA Article 61 explainer and its operational limits
• High-Risk Business Banking: Supporting banking for authorised CASP operators
• Company Formation: Corporate substance for authorised CASPs