Licensing practice · Crypto
Crypto Licence in Europe 2026: CASP Authorisation under MiCA
The transitional period closed on 1 July 2026. Authorisation is now the only door into the EU market.
Verified against the register.
Every claim about authorisation, ours or a seller’s, gets checked against the ESMA MiCA register. A “licensed” company that is not in the register is not licensed. It is that simple now.
What changed on 1 July 2026, in plain terms
Article 143(3) of MiCA let firms that operated legally before 30 December 2024 keep working under old national rules while their application was pending. That window has now closed everywhere. There is no extension mechanism in the regulation. The market has split into authorised CASPs with an EEA passport, and firms that must stop serving EU clients.
Swipe the table sideways to see all columns
| Parameter | Position | Practical meaning |
|---|---|---|
| Transitional period | Closed 1 July 2026 | Several states closed earlier (Germany and Ireland on 31 December 2025; the Netherlands, Poland, Latvia, Hungary and Slovenia after 6 months). Now it is closed everywhere |
| Legacy VASP registrations | No longer a licence | Of 1,200+ pre-MiCA registrations, fewer than 18 percent converted. A "registered" shell has no regulatory value and no resale value |
| Capital, Class 1 | €50,000 | Execution of orders, advice, reception and transmission, placing, transfer services |
| Capital, Class 2 | €125,000 | Custody and administration; exchange of crypto-assets for funds or other crypto-assets |
| Capital, Class 3 | €150,000 | Operating a trading platform. Own funds: the higher of the class minimum or a quarter of prior-year fixed overheads |
| Passporting | 1 authorisation → EEA | Authorise once with one national regulator, notify, and operate across the single market |
| Penalties | €5M / 12.5% | Up to EUR 5,000,000 for individuals and up to 12.5 percent of annual turnover for companies operating without authorisation (Article 111) |
| Realistic timeline | 6–12+ months | The 25 to 40 working day completeness stage is only the opening move. ESMA has directed heightened scrutiny of late files |
Summarised from Regulation (EU) 2023/1114, ESMA statements and the interim MiCA register as at July 2026. We verify the current position at engagement.
Conversion rate from legacy VASP to full CASP. The scarcity cuts both ways: harder to be in the club, more valuable once you are.
Authorised CASPs by mid-2026, concentrated in Malta, the Netherlands, Cyprus, France and Ireland. The register grows weekly.
Typical change-of-control review when acquiring an authorised CASP. Often the fastest lawful entry for a funded buyer.
The ten MiCA services. If you touch one, you need the authorisation
MiCA works by service, not by buzzword. The question is never "are we a crypto company" but "which of these ten do we actually perform for EU clients". That answer sets your capital class and your application scope.
Custody and administration
Holding clients' crypto-assets or the means of access to them. The service most exchanges underestimate in their scoping.
Operating a trading platform
Running the venue where buy and sell interests meet. The highest capital class and the deepest governance review.
Exchange for funds or crypto
Crypto to fiat and crypto to crypto dealing against your own book. Covers most brokerage-style products.
Execution and order handling
Executing client orders, reception and transmission, placing crypto-assets. The classic broker permission set.
Advice and portfolio management
Personal recommendations and managed portfolios in crypto-assets. Suitability duties apply, much like MiFID.
Transfer services
Moving crypto-assets between addresses for clients. Where the Travel Rule bites hardest in daily operations.
Issuing stablecoins sits outside this list: e-money tokens need an EMI or bank authorisation, asset-referenced tokens have their own regime. Groups that issue and trade usually need an EMI plus a CASP. We run those as one project; the EMI side is covered on the fintech licence page.
Member states compared for CASP applications
Market access is identical everywhere thanks to the passport. What you are really choosing is a regulator: its speed, its expectations on local substance, its comfort with your product, and how its name reads to a bank.
Swipe the table sideways to see all columns
| Route | Realistic timeline | First-year budget | Character of the route |
|---|---|---|---|
| Malta (MFSA) | 6–12 months | €150k–€400k+ | The largest authorised population and the most experienced NCA. Strong for exchanges and custody; substance expectations are real |
| Lithuania (Bank of Lithuania) | 6–12 months | €120k–€300k+ | Fintech-literate regulator, natural pairing with a Lithuanian EMI for fiat rails |
| Czech Republic (CNB) | 6–12 months | €100k–€300k+ | Cost-efficient EU entry with a competitive professional-services market |
| Poland (KNF) | 6–12 months | €100k–€300k+ | Large domestic market and a growing CASP practice |
| Cyprus (CySEC) | 6–12+ months | €150k–€400k+ | Deep investment-services expertise; a natural home for trading-led models |
Budgets include incorporation, substance, policies, DORA and Travel Rule implementation and professional fees, on top of paid-in capital. The Netherlands, France and Ireland also host large CASP populations and enter the comparison where the model fits. All figures are market orientation; your written comparison carries verified numbers.
What goes into a CASP application
An Article 63 application is judged on completeness and coherence. Regulators told ESMA the same thing all year: file quality, not product type, decides who gets through. These are the chapters that decide it.
Swipe the table sideways to see all columns
| Chapter | What the regulator checks | Notes from practice |
|---|---|---|
| Programme of operations | Which of the ten services, for whom, on what infrastructure | Scope only what you will launch. Every extra service raises capital, questions and time |
| Prudential plan | Capital class, own funds forecast, wind-down plan | The wind-down plan is read carefully post-transition. Thin ones get sent back |
| AML and CFT programme | Risk assessment, CDD, monitoring, a named MLRO who can defend it in an interview | Crypto-specific typologies expected: mixers, bridges, unhosted wallet exposure |
| Travel Rule implementation | Originator and beneficiary data collection and transmission | Named tooling and counterparty protocols, not a paragraph of intent |
| DORA documentation | ICT risk framework, incident response, resilience testing, vendor register | Applies since January 2025 and carries near-AML weight in review |
| Custody and conflicts policies | Segregation of client assets, key management, conflicts of interest | Where exchange-plus-custody models earn their Class 2 capital |
| Governance and substance | Local management, key functions, real decision-making in the member state | Letterbox structures fail. Regulators check where decisions actually happen |
| Fit and proper files | Identity, source of wealth and history of qualifying shareholders and managers | We run this check before the regulator does. Surprises sink files |
We draft every chapter in-house and coordinate local counsel where national law requires it. One checklist, one point of contact.
Apply for authorisation, or acquire an authorised CASP
With conversion under 18 percent, authorised CASPs became the scarce asset of the European crypto market. Some are for sale. Buying one is legal and often faster, provided the home regulator approves the new owners first.
New CASP application
- ✓Scope and capital class built around your exact product
- ✓No inherited clients, liabilities or supervisory history
- ✓Realistic horizon of 6 to 12 months or longer
- ✓Full first-year budget from roughly €100k to €400k plus capital
- ✓The right call when the launch date can wait for the regulator
Acquisition of an authorised CASP
- ✓The passport is already live; time is set by the change-of-control review, typically 2 to 6 months
- ✓Verified against the ESMA register before any negotiation starts
- ✓Due diligence on authorisation scope, supervisory correspondence, AML history and client book
- ✓Priced by scope and cleanliness; scarce assets carry a premium
- ✓The right call for funded buyers who cannot wait out an application
One warning worth repeating: a pre-MiCA "VASP registered" company is not a shortcut into this market. After 1 July 2026 it carries no authorisation and no resale value as a licence. If a seller's pitch rests on a registration rather than an ESMA register entry, walk away.
Five stages from scoping to a passported CASP
Route assessment
Services mapped to the ten MiCA categories, capital class set, member states compared in writing. Apply or acquire, answered with numbers.
Structure and substance
EU entity, governance, local key functions. Built to the NCA's expectations, not the minimum rumour.
Application package
Programme of operations, prudential and wind-down plans, AML and Travel Rule programme, DORA chapters, fit and proper files.
NCA review
Completeness stage, substantive questions, managed dialogue through to decision. The regulator decides.
Launch and passporting
Passport notifications, bank and safeguarding accounts, fiat rails through an EMI where needed, ongoing compliance.
Frequently asked questions
Is a VASP registration still valid in the EU?
No. The transitional period ended on 1 July 2026 in every member state, and several closed earlier. National VASP registrations no longer give a legal basis for serving EU clients. Firms without CASP authorisation must wind down EU activity or face penalties of up to €5,000,000 for individuals and up to 12.5 percent of annual turnover for companies.
How much capital does a CASP need?
Three classes. Class 1 at €50,000 covers execution, advice, transfers and placing. Class 2 at €125,000 covers custody and exchange. Class 3 at €150,000 covers operating a trading platform. Own funds must stay at the higher of the class minimum or a quarter of the previous year's fixed overheads.
How long does authorisation take in 2026?
The completeness stage runs 25 to 40 working days, but end to end you should plan for 6 to 12 months or more. ESMA told national authorities to apply heightened scrutiny to late applications, so there is no fast lane. For funded buyers, acquiring an authorised CASP with a 2 to 6 month change-of-control review is often quicker.
Which member state is best?
The passport makes market access equal, so you are choosing a regulator, not a market. Around 210 CASPs held authorisation across 23 states by mid-2026, concentrated in Malta, the Netherlands, Cyprus, France and Ireland. We compare 3 or 4 realistic states on regulator capacity, substance, tax and banking against your specific model.
What is the full cost of a crypto licence?
Beyond capital of €50,000 to €150,000, a realistic first year runs from about €100,000 to €400,000 or more: professional fees, incorporation, substance, policies, DORA and Travel Rule implementation, first-year supervision and audit. Advisory fees alone commonly run €40,000 to €150,000 across the market for complex files. We put all five cost layers in writing per route before you commit.
Can I buy a CASP-authorised company?
Yes, and they do change hands. The acquisition of a qualifying holding needs prior approval from the home regulator, typically a 2 to 6 month review of the new owners. We verify the target against the ESMA register, examine the authorisation scope, supervisory correspondence and AML history, then manage the filing end to end.
Which services trigger the authorisation requirement?
MiCA lists ten: custody and administration, operating a trading platform, exchange for funds, exchange for other crypto-assets, execution, placing, reception and transmission, advice, portfolio management, and transfer services. Touch any of them for EU clients and the requirement applies, wherever your company is incorporated.
Does MiCA reach companies outside the EU?
Yes. It follows the client, not the company. A non-EU exchange that markets to or accepts EU clients needs authorisation, usually via an EU subsidiary. Reverse solicitation covers only clients who come entirely on their own initiative, and regulators read that exception narrowly.
What about the Travel Rule?
CASPs must collect and transmit verified originator and beneficiary data with crypto transfers under Regulation (EU) 2023/1113. Regulators expect a working plan inside the authorisation file: named tooling, counterparty protocols and screening of unhosted wallet exposure. We treat it as a core chapter, not an appendix.
Do stablecoins need the same licence?
No. Issuing an e-money token requires an EMI or bank authorisation, and asset-referenced tokens have a separate regime. Trading or custodying stablecoins for clients falls under CASP services. Groups that issue and trade usually need an EMI plus a CASP; details on the fintech licence page.