# The MiCA CASP Licence: Procedure, Cost and Choosing a Jurisdiction

> Annex IV capital of €50k–150k or 25% of overheads under Article 67, a 25+40 working-day clock that runs 9–18 months in practice, and 325 CASPs on the ESMA register.

Author: Gordey Bolotko — Partner, Corporate & Commercial (https://wiki.private.law/en/authors/bolotko)
Last modified: 2026-09-06T04:38:00.000Z
Canonical: https://wiki.private.law/en/casp-license-guide
Topics: banking
Jurisdictions: eu, malta, lithuania, ireland, luxembourg, germany, france, netherlands, cyprus
Product tags: license-vasp-mica, crypto, compliance, custody
Semantic tags: license-vasp-mica, crypto, compliance, custody

---

## The Perimeter: What Actually Needs a Licence

What is licensed is a closed list of ten services in Article 3(1)(16) of [Regulation (EU) 2023/1114](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114):

1. Custody and administration of crypto-assets on behalf of clients.
2. Operation of a trading platform.
3. Exchange of crypto-assets for funds.
4. Exchange for other crypto-assets.
5. Execution of orders.
6. Placing.
7. Reception and transmission of orders.
8. Advice.
9. Portfolio management.
10. Transfer services, meaning moving crypto-assets from one distributed-ledger address to another on a client's behalf (defined in Article 3(1)(26)).
Providing any one of them professionally, to clients, triggers authorisation. How the regime as a whole works — token categories, white papers, the ESMA and EBA supervisory split — is covered in the [MiCA overview](https://wiki.private.law/en/mica-eu); this page is only about obtaining the status. The territorial reach is wide: a single authorisation covers all 30 EEA states, Norway, Iceland and Liechtenstein included, and no host-state presence is required.

Article 59 adds requirements about the vehicle itself. The applicant must be a legal person with a registered office in a member state where it carries out at least part of its services, its place of effective management in the Union, and at least one director resident in the Union. That is the statutory floor; national regulators read it considerably more strictly.

Three zones sit outside, and every boundary is moving. A self-hosted wallet is not a service — software the holder controls needs no licence — but transfers to or from such an address above €1,000 pull in [travel rule](https://wiki.private.law/en/travel-rule) obligations. Genuine peer-to-peer trading without an intermediary is outside the perimeter, yet a venue that matches orders, holds escrow or sets prices is a trading platform with everything that follows.

DeFi is carved out by recital 22 only where a service is provided "in a fully decentralised manner without any intermediary"; the [MFSA discussion paper of 12 June 2026](https://www.mfsa.mt/wp-content/uploads/2026/06/MFSA-Discussion-Paper-on-Decentralised-Finance-DeFi.pdf) lists the markers of retained centralisation — admin keys, control over protocol upgrades, concentrated governance power, protocol custody of user assets, closed-source code, marketing by an identifiable entity — and reaches a conclusion worth treating as the working rule: almost every system retains some of them.

The Commission opened a [targeted consultation on the MiCA review on 20 May 2026](https://finance.ec.europa.eu/regulation-and-supervision/consultations-0/targeted-consultation-review-mica-regulation_en), with decentralisation criteria, staking, lending, NFTs and third-country access all explicitly on the table.

The key parameters of the regime are collected in one table.

- Regulator and law · National competent authority under Title V of Regulation (EU) 2023/1114; ESMA and EBA oversight
- Who is caught · A legal person with an EU office providing any of the ten Article 3(1)(16) services professionally
- Capital · €50,000, €125,000 or €150,000 under Annex IV, or one quarter of the prior year's overheads (Article 67)
- Timeline · 25 + 40 working days under Article 63; nine to eighteen months in practice
- Cost · Application fee €5,000–25,000, preparation €195,000–505,000, perimeter €400,000–900,000 a year
- Territory · One authorisation, 30 EEA states; passporting under Article 65
- Status at date · 325 register entries at 12.08.2026; transitional windows closed from 1 July 2026

## Notification Instead of a Licence, and the Closed Grandfathering Windows

Not everyone needs the full procedure. Article 60 gives six categories of already-regulated institutions a notification route to their home regulator, at least 40 working days before first providing the service:

1. A credit institution — the full list.
2. An investment firm — services equivalent to its MiFID II permissions.
3. An electronic money institution — custody, administration and transfers of the e-money tokens it issues itself.
4. UCITS management companies and AIFMs — portfolio management, advice, and reception and transmission of orders.
5. A central securities depositary — custody only.
6. A market operator — a trading platform only.
The annexes to a notification largely mirror a licence dossier, but the clock is shorter: the regulator has 20 working days to check completeness, with a further 20 available for missing items.

The Article 60 route is not theoretical. Of nine new German entries on the ESMA register in July 2026, eight were cooperative and regional banks and only one a crypto-native platform; Standard Chartered entered the EU through a Luxembourg subsidiary, taking a CASP and an EMI authorisation together on 29 June 2026. Where a group already holds a banking, investment-firm or [EMI licence](https://wiki.private.law/en/emi-license-luxembourg), notification is almost always faster and cheaper than the full cycle.

The transitional regime is now fully closed. Article 143(3) allowed member states to give incumbent national providers up to 18 months, to shorten that period, or not to apply it at all — and they chose very differently. The [official ESMA list](https://www.esma.europa.eu/sites/default/files/2024-12/List_of_MiCA_grandfathering_periods_art._143_3.pdf) records a spread from six to eighteen months: firms in the generous states spent the extra year preparing an application, firms in the strict ones were winding down in mid-2025.

National law could set not only the end of the window but a separate filing cut-off: in the Czech Republic a CASP application had to be filed by 31 July 2025, while operating on a legacy VASP registration was permitted only until 1 July 2026 — Article 26 of the Digital Finance Act 31/2025 Sb. A provider inside the window that missed the filing date lost its basis to operate ahead of the common deadline.

On 17 April 2026 ESMA [confirmed there would be no extension](https://www.esma.europa.eu/sites/default/files/2026-04/ESMA75-113276571-1679_Statement_on_the_end_of_transitional_periods_under_MiCA.pdf), and a [statement of 23 June](https://www.esma.europa.eu/sites/default/files/2026-06/ESMA75-113276571-1710_Public_Statement_MiCA_transitional_period_ends.pdf) set out what an acceptable exit looks like: stop onboarding and marketing immediately, limit activity to what is needed to sell or transfer client assets, and keep AML controls running to the last client.

| **Date** | **Milestone** |
| --- | --- |
| 30 June 2024 | Titles III and IV apply — the ART and EMT regimes |
| 30 December 2024 | Title V: the CASP regime applies, applications open |
| 30 June 2025 | Six-month windows expire: Latvia, Hungary, Netherlands, Poland, Slovenia, Finland |
| 31 July 2025 | Czech Republic: cut-off for filing a CASP application (Article 26 of Act 31/2025 Sb.); the window for operating on a VASP registration itself closed on 1 July 2026 |
| 30 September 2025 | Sweden (nine months) |
| 30 December 2025 | Germany, Ireland, Lithuania, Austria, Slovakia, Norway (twelve months) |
| 2 March 2026 | EBA no-action letter expires: EMT transfers require a second, PSD2 authorisation |
| 30 June 2026 | Last eighteen-month windows: France, Italy, Spain, Cyprus, Malta, Luxembourg, Belgium and others, plus Iceland and Liechtenstein. From 1 July authorisation is mandatory in the EEA |
| 30 September 2026 | Commission MiCA review consultation closes (deadline extended from 31 August 2026) |
| 30 June 2027 | Commission report on the application of MiCA (Article 140) — the starting gun for "MiCA 2" |
| 10 July 2027 | The single EU AML Regulation applies |
| 2028 | AMLA begins direct supervision of selected obliged entities |
| Mid-2027 to mid-2029 | Expected application of the package moving CASP supervision to ESMA |

## The Dossier: Capital, Own Funds, Substance

Capital is the most over-weighted line in the budget. Annex IV sets a permanent minimum by service class, and the class is determined by the heaviest service in the application. The binding constraint, though, is the second limb of Article 67: the prudential buffer is the higher of the Annex IV amount and one quarter of the preceding year's fixed overheads. For any operator with real volumes, that quarter sets the number, while the €50,000 in the table remains the floor.

| **Class** | **Services** | **Annex IV minimum** |
| --- | --- | --- |
| 1 | Execution of orders, placing, reception and transmission of orders, advice, portfolio management, transfer services | €50,000 |
| 2 | Custody and administration, exchange of crypto-assets for funds, exchange for other crypto-assets | €125,000 |
| 3 | Operation of a trading platform | €150,000 |
| Permitted form | CET1 own funds under Articles 26–30 of Regulation (EU) 575/2013, an insurance policy, or a combination | Article 67(1)–(4) |

An insurance policy counts if it comes from an authorised insurer, runs for at least a year, carries 90 days' cancellation notice and is disclosed on the website.

In February 2026 ESMA closed the main loophole in the calculation. [Q&A 2349](https://www.esma.europa.eu/publications-data/questions-answers/2349) answers directly: the base is "the total of all the CASP's overhead expenses, both fixed and variable", and only the four items in Article 67(3)(a)–(d) may be deducted — the list is exhaustive and national regulators may not widen it. The practical effect is a step change for operators who had been stripping variable costs out of the base.

Then come the items that cost real money. Article 70 requires segregation: client crypto-assets must be held so that the provider's creditors cannot reach them in insolvency, and client funds must be placed with a credit institution or a central bank by the end of the business day following receipt, in accounts separately identifiable from the firm's own, with any use for own account prohibited.

Article 73 permits outsourcing of operational functions but forbids delegating responsibility, altering the client relationship or changing the conditions of authorisation. On top of that: a programme of operations with a three-year plan, group structure and fit-and-proper assessments for all key function holders, ICT architecture and third-party register under DORA, conflicts-of-interest policy, complaints handling, AML procedures including the travel rule, and an executable wind-down plan. Which of these must physically exist before filing, rather than appear as a PDF, is set out in the [operator's compliance stack](https://wiki.private.law/en/compliance-stack).

The statute is terse on substance — one EU-resident director — and regulators are generous in interpretation. The practical minimum across most jurisdictions: two executives with local presence, regulator-approved compliance officer, MLRO and risk manager as dedicated roles, a local auditor, a bank account in the country of authorisation, and a credible answer to where decisions are actually taken. Keeping core systems outside the EEA is formally possible but converts into a separate evidentiary burden on regulator access, recovery and vendor control.

## Procedure: the 25 + 40 Formula Versus Practice

Article 63 reads quickly.

| Stage | Time limit |
| --- | --- |
| Acknowledgement of receipt | 5 working days |
| Completeness check, with a deadline for missing items | 25 working days |
| Decision from a complete application | 40 working days |
| Single stop of the clock for further information | up to 20 working days |
| Notification of the applicant | 5 working days |
| Information passed to ESMA | 2 working days |
| Home regulator circulates the notification to host states (Article 65) | 10 working days |
| Start of services in a host state | from receipt of that communication, at the latest the fifteenth calendar day after submission |

The clock stops only once: subsequent requests for further information do not suspend it, and passporting after the decision is nearly instant.

Practice runs several times longer, and it is the pre-filing phase that stretches it. Luxembourg's CSSF operates a pre-application channel and puts a realistic first-time applicant at six to nine months from engagement to decision. The Dutch AFM budgets around 105 working days; France's AMF allows up to four months from a complete application, to which two to three months of clarification rounds are typically added in practice. Add it up and the working horizon from "we are doing this" to licence in hand in 2026 is nine to eighteen months. An application filed without prior supervisory dialogue almost invariably enters a remediation loop: the clock does not stop again after the first suspension, but nothing prevents a regulator from demanding a fresh complete application.

## Choosing a Jurisdiction: What the Register Shows

ESMA maintains an interim register of five CSV files — white papers, ART issuers, EMT issuers, authorised CASPs and the non-compliant list — refreshed weekly, but it [publishes no aggregate figure](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica). Industry trackers do the counting: 325 records as at 12 August 2026 on one, 329 records and 322 unique active firms on the same date on another. The gap is duplicates and withdrawn authorisations; there is no official number, and every figure should be read as an estimate. For scale, the Commission's May consultation worked with ["around 170 CASPs from 18 member states"](https://finance.ec.europa.eu/document/download/62be7015-f066-4fac-b74e-71bacdbcc9f5_en?filename=2026-mica-review-targeted-consultation-document_en.pdf) — roughly half the current count, three months before the deadline.

Two corrections are mandatory before using these numbers. First, the register mixes full Article 63 authorisations with Article 60 notifications, so "325 CASPs" is not 325 crypto companies but the sum of venues and regulated institutions that have bolted on a crypto service. Second, heavy licences are rare: as at 4 July 2026 only about 17 of 280 entries carried permission to operate a trading platform.

| **Jurisdiction** | **Regulator** | **CASPs at 12.08.2026** | **What drives the choice** |
| --- | --- | --- | --- |
| Germany | BaFin | 70 | Much of the growth is banks arriving via Article 60. German-language dossier, the most demanding supervisor, and the licence counterparties respect most |
| France | AMF and ACPR | 35 | Former PSAN registrants got a streamlined transition. Formal filings in French, local senior management expected |
| Netherlands | AFM | 29 | The only large regulator working fully in English with a published hourly tariff. Its grandfathering window closed first, so the market is already filtered |
| Cyprus | CySEC | 25 | The natural home for MiFID brokers adding crypto. Cheaper than average, but two authorisation revocations are already on the record |
| Malta | MFSA | 22 | Fast VFA-to-MiCA continuity and global venues in the portfolio. Since the ESMA peer review, Maltese files attract extra attention — plus two outright refusals |
| Luxembourg | CSSF | 13 | The premium door: pre-application channel, CASP plus EMI under one supervisor, institutional clientele. Expensive and slow at entry |
| Ireland | Central Bank of Ireland | 12 | Bank-style supervision, English language, high expectations on independent directors. One of the longest cycles |
| Lithuania | Bank of Lithuania | 6 | The VASP-era champion did not convert: the window closed as early as 30 December 2025 and the bar is high after the payments clean-up |
| Poland | KNF | 0 | No national implementing act: the Crypto-Assets Market Act of 15 May 2026 was vetoed by the President. No competent authority, no applications accepted |

Three conclusions matter more than the numbers themselves. Lithuania is a warning that a legacy VASP register does not convert into the new status: six authorisations for the former registration leader. Italy tells the same story in figures — on industry trackers as at 12 August 2026, 138 legacy registrations as at 30 June 2025 against nine register entries after the transition; Consob publishes no aggregate of its own. Poland is a warning of a different kind: without a national implementing act the regulator cannot open a procedure at all, leaving Polish businesses to authorise elsewhere and passport back in.

The idea of a soft jurisdiction died on 10 July 2025. That day ESMA published its [fast-track peer review of the Maltese MFSA's authorisation practice](https://www.esma.europa.eu/sites/default/files/2025-07/ESMA42-2004696504-8164_Fast-track_peer_review_on_a_CASP_authorisation_and_supervision_in_Malta.pdf): on supervisory resources and expertise the MFSA scored full marks, but the authorisation stage was found only partially to meet expectations, with material issues left unresolved when the licence was granted.

More important than the verdict is the attached checklist addressed to every EEA regulator: forward-looking assessment of growth plans, conflicts of interest in multi-service models, intragroup outsourcing and governance, ICT architecture under DORA, exposure to Web3 and promotion of unregulated products, and honest risk warnings in the user journey.

Since July 2025 that has been the de facto common question set in every member state, and the dossier is built to it; the Article 62 minimum covers only the formal part. Where the wider perimeter is heading is mapped in the [trends overview](https://wiki.private.law/en/regulatory-perimeter-trends).

## Segregation, Custodian Liability and the Limits of Protection

A CASP licence delivers three things to an asset owner and withholds a fourth.

- Segregation under Article 70: client coins are legally separated from the venue's balance sheet and the client's fiat balance sits at a bank or central bank rather than in its working capital.
- Custodian liability: the provider answers for loss of assets or means of access attributable to it, though compensation is capped at the market value of the asset at the time of loss.
- A supervisor with an address to complain to.
It does not deliver a guarantee scheme: MiCA has no analogue of €100,000 deposit insurance, and the distinction between "regulated" and "insured" is decisive here — the same logic that applies to money held at an EMI after the [payments reform](https://wiki.private.law/en/psd3-psr).

The practical check takes five minutes. The check runs against the specific legal entity servicing the account in the ESMA register rather than the brand: global groups run their European perimeter through a separate company, and the parent's status is irrelevant to the client's assets.

Next comes which services the authorisation actually covers — custody and operating a trading platform are separate lines, and a venue authorised only to exchange is not, legally, a custodian. Last comes relocation after the transition; passporting makes that invisible in the interface but changes who supervises the entity.

How this feeds into holding structures for a large position is covered in [crypto for private wealth](https://wiki.private.law/en/crypto-private-wealth) and [tokenisation of real-world assets](https://wiki.private.law/en/tokenization-rwa). And note that issuing a [stablecoin](https://wiki.private.law/en/stablecoins) is not a CASP service at all: only a bank or an EMI may issue an e-money token.

## Project Budget, Alternatives and Enforcement

The governing figure is the cost of the project as a whole. Official fees are heterogeneous and rarely published; the Dutch AFM is the exception with a published tariff, and everything else rests on market estimates.

| Budget line | Amount | Source |
| --- | --- | --- |
| CASP application, AFM | €200 per hour, capped at €100,000 | Published tariff |
| Article 60 notification, AFM | €50,000 | Published tariff |
| Propriety assessment, AFM | €700 | Published tariff |
| Suitability assessment per senior manager, AFM | €2,900 | Published tariff |
| Application fee, other states | €5,000–25,000 | Market estimates |
| Annual supervisory levy, Cyprus and Malta | from €7,500 | Market estimates |
| Annual supervisory levy, Germany | €25,000–60,000 | Market estimates |
| Pre-authorisation project cost | €195,000–505,000 | Market estimates |
| Running the regulatory perimeter, a year | €400,000–900,000 | Market estimates |

These are industry estimates, not published tariffs, and are checked against the specific regulator on the filing date. The order of magnitude is stable, though: Annex IV capital is low single-digit percentages of the real budget.

MiCA contains no agency regime. In the payments world PSD2 and the forthcoming PSD3 let a principal register agents and share the perimeter with them; here Article 73 permits outsourcing of operational functions but not of responsibility or of the client relationship. What remains for an EU-established firm is white-labelling under another firm's authorisation (set out below), where the principal remains the regulated person and the partner becomes its distribution channel, with all the dependency that implies.

Reverse solicitation under Article 61 is not available to that firm at all: the exemption is written for a third-country firm whose services are requested at the own exclusive initiative of a client established in the Union, and it falls away once the firm solicits clients or advertises services in the EU. In its statement of 23 June 2026 ESMA reminded firms established outside the EU that the prohibition on solicitation also covers dealings with professional counterparties. The economics of renting status are set out in the [licence-for-rent hub](https://wiki.private.law/en/license-for-rent).

There is a specific trap for anyone touching stablecoins. In an [opinion of 2 June 2025](https://www.eba.europa.eu/publications-and-media/press-releases/eba-publishes-no-action-letter-interplay-between-payment-services-directive-psd23-and-markets-crypto) the EBA accepted that transfers of e-money tokens fall simultaneously under MiCA and PSD2, and granted a nine-month no-action period; [it expired on 2 March 2026](https://eba.europa.eu/publications-and-media/press-releases/eba-advises-national-authorities-actions-take-end-transition-period-under-its-no-action-letter), after which a venue transferring EMTs needs a second, payments authorisation. More than a hundred CASPs were already engaging with regulators on this by February 2026. Plan the dual status early: pairing an [EMI](https://wiki.private.law/en/emi-license-lithuania) with a CASP under one supervisor costs less than bolting a payments licence on afterwards.

Enforcement as at August 2026 is strikingly asymmetric. ESMA's non-compliant list carries 167 entries as at 6 August 2026, of which more than 160 came from Italy's Consob, one from the Dutch AFM (MEXC, decision of 16 September 2025) and one from Slovakia's NBS. That reflects differing appetites for maintaining lists, not the geography of misconduct. Revocations and refusals remain rare: 29 records as at 3 May 2026 — seventeen voluntary exits, five regulator-driven revocations, three failed regime transitions and only two outright refusals, both Maltese. What filters the market is applications that are never completed.

## Under Someone Else's Authorisation

While its own licence is still in the works, an operator launches under the authorisation of an existing CASP: the principal carries the regulatory duties — governance, capital, segregation of client assets, AML — while the partner supplies brand, interface and distribution. The client must be left in no doubt which entity provides the regulated service.

Before launch the partner is checked on three points, and the ESMA register answers all three.

- **A live authorisation, not an application.** The register must show an Article 63 decision or an Article 60 notification, not a "pending" status and not a legacy national VASP registration: since 1 July 2026 the latter is no basis for operating, and it never carried a passport.
- **The scope of services.** An authorisation is granted for named items from the Article 3(1)(16) list. A partner authorised only to exchange cannot cover custody, and operating a trading platform is a separate line that only a small share of holders carried in 2026.
- **Jurisdiction after passporting.** Check the specific legal entity and the state that granted the authorisation: passporting makes a change of home supervisor invisible in the interface, yet it determines who supervises the partner, where a complaint goes, and under which law client assets are unwound if it fails.
The dependency runs both ways: the principal may change the terms or switch off the channel at any time, and a revocation or surrender of its authorisation stops the partner's storefront the same day. White-labelling is therefore planned as a temporary entry with an application of one's own already running, not as an end-state configuration.

## What Changes Before 2028

Three vectors belong in the architecture now. The first is AML: the single regulation applies from 10 July 2027, and AMLA is preparing its first selection of directly supervised entities — national supervisors collected data until [15 August 2026, a provisional list is expected by end-September 2026, the selection cycle runs in 2027 and direct supervision starts in 2028](https://www.amla.europa.eu/amla-takes-next-step-toward-2027-selection-entities-direct-supervision_en). Cross-border CASPs are obvious candidates; what changes procedurally is covered in the [EU AML package](https://wiki.private.law/en/eu-aml-package).

The second is supervision itself. The Commission's Market Integration and Supervision Package of 4 December 2025 moves CASP authorisation and ongoing supervision to ESMA; application is expected 12 to 24 months after adoption, putting it somewhere between mid-2027 and mid-2029. The practical implication is blunt: choosing a lenient regulator today means optimising for an authority that will not hold the role for long.

The third is the substance of MiCA. Consultation responses close on 30 September 2026, the Commission having extended the original 31 August deadline; the formal Article 140 report is due by 30 June 2027, and a "MiCA 2" legislative package realistically arrives no earlier than 2028. Until then staking, lending and DeFi sit outside the perimeter and therefore outside its protections: building a regulated product on them is premature, and building an unregulated one alongside a licence is a direct route to the peer-review checklist questions.

> 🍓 A CASP licence is a nine-to-eighteen-month project costing hundreds of thousands of euros, in which the Annex IV capital is the smallest line and the binding number is one quarter of overheads under Article 67 as read by Q&A 2349. The jurisdiction is chosen for compatibility with the product stack and for the language of supervision: since the Malta peer review the question set is the same everywhere, and the transfer of supervision to ESMA will retire the arbitrage. For a group that already holds a bank, investment firm or EMI, the Article 60 notification is the fastest legal entry.

## Q/A

### What does a CASP licence really cost and how long does it take?

Capital is €50,000, €125,000 or €150,000 under Annex IV, or one quarter of the prior year's overheads if higher; since ESMA Q&A 2349 that base includes variable overheads too. The market puts application preparation at €195,000–505,000 and annual perimeter maintenance at €400,000–900,000; official fees are modest against that, the AFM charging €200 an hour capped at €100,000. Article 63 allows 25 working days for completeness and 40 for the decision, but in practice the project runs nine to eighteen months, most of it pre-application.

### Our group already has a bank, investment firm or EMI — do we need full authorisation?

No. Article 60 gives a notification route to the home regulator at least 40 working days before launch: a credit institution may offer the full list, an investment firm those services equivalent to its MiFID II permissions, an EMI custody, administration and transfers of its own e-money tokens, management companies portfolio management and advice, a CSD custody only, a market operator a trading platform only. The annexes mirror a licence dossier but completeness takes 20 working days. Eight of nine new German entries in July 2026 came this way.

### Can we operate under someone else's licence — does MiCA have an agency regime?

MiCA has no agency regime of the PSD2 kind: you cannot appoint an agent and share the perimeter. Article 73 permits outsourcing operational functions but forbids delegating responsibility, altering the client relationship or changing the authorisation conditions. What remains is white-labelling: an authorised CASP provides the service on its status while you supply brand and distribution — legal and fast, but the principal stays the regulated person. Reverse solicitation under Article 61 is no channel and is unavailable to an EU firm in any case: the exemption is written for third-country firms approached at a Union client's own exclusive initiative, and ESMA's statement of 23 June 2026 reminded those firms that the ban on solicitation covers professional clients too.

### Which country should we file in during 2026?

Three compatibilities decide it, and speed is not among them. Product: a stablecoin issuer needs an EMI perimeter under the same supervisor (Luxembourg, France), a MiFID broker fits CySEC or BaFin, a retail venue needs a regulator resourced for passported scale. Language: the AFM, Ireland and Lithuania work fully in English, while Germany, France and Spain require filings in their own language. Reputation: partners read a licence by the name of its supervisor. Poland drops off the list: no competent authority is designated and the KNF cannot accept applications.

---

## Factual claims

- What is licensed is a closed list of ten services in Article 3(1)(16) of Regulation (EU) 2023/1114:
- Article 59 adds requirements about the vehicle itself.
- The Commission opened a targeted consultation on the MiCA review on 20 May 2026, with decentralisation criteria, staking, lending, NFTs and third-country access all explicitly on the table.
- The annexes to a notification largely mirror a licence dossier, but the clock is shorter: the regulator has 20 working days to check completeness, with a further 20 available for missing items.
- The Article 60 route is not theoretical.
- An insurance policy counts if it comes from an authorised insurer, runs for at least a year, carries 90 days' cancellation notice and is disclosed on the website.
- In February 2026 ESMA closed the main loophole in the calculation.
- Article 73 permits outsourcing of operational functions but forbids delegating responsibility, altering the client relationship or changing the conditions of authorisation.

---

Source: wiki.private.law — the private.law legal knowledge base. When quoting, cite the canonical page URL.
Consultation with a lawyer: https://t.me/private_law_bot