The MiCA CASP Licence: Procedure, Cost and Choosing a Jurisdiction

The Perimeter: What Actually Needs a Licence

What is licensed is a closed list of ten services in Article 3(1)(16) of Regulation (EU) 2023/1114:

1. Custody and administration of crypto-assets on behalf of clients.
2. Operation of a trading platform.
3. Exchange of crypto-assets for funds.
4. Exchange for other crypto-assets.
5. Execution of orders.
6. Placing.
7. Reception and transmission of orders.
8. Advice.
9. Portfolio management.
10. Transfer services, meaning moving crypto-assets from one distributed-ledger address to another on a client's behalf (defined in Article 3(1)(26)).

Providing any one of them professionally, to clients, triggers authorisation. How the regime as a whole works — token categories, white papers, the ESMA and EBA supervisory split — is covered in the MiCA overview; this page is only about obtaining the status. The territorial reach is wide: a single authorisation covers all 30 EEA states, Norway, Iceland and Liechtenstein included, and no host-state presence is required.

Article 59 adds requirements about the vehicle itself. The applicant must be a legal person with a registered office in a member state where it carries out at least part of its services, its place of effective management in the Union, and at least one director resident in the Union. That is the statutory floor; national regulators read it considerably more strictly.

Three zones sit outside, and every boundary is moving. A self-hosted wallet is not a service — software the holder controls needs no licence — but transfers to or from such an address above €1,000 pull in travel rule obligations. Genuine peer-to-peer trading without an intermediary is outside the perimeter, yet a venue that matches orders, holds escrow or sets prices is a trading platform with everything that follows.

DeFi is carved out by recital 22 only where a service is provided "in a fully decentralised manner without any intermediary"; the MFSA discussion paper of 12 June 2026 lists the markers of retained centralisation — admin keys, control over protocol upgrades, concentrated governance power, protocol custody of user assets, closed-source code, marketing by an identifiable entity — and reaches a conclusion worth treating as the working rule: almost every system retains some of them.

The Commission opened a targeted consultation on the MiCA review on 20 May 2026, with decentralisation criteria, staking, lending, NFTs and third-country access all explicitly on the table.

The key parameters of the regime are collected in one table.

Notification Instead of a Licence, and the Closed Grandfathering Windows

Not everyone needs the full procedure. Article 60 gives six categories of already-regulated institutions a notification route to their home regulator, at least 40 working days before first providing the service:

1. A credit institution — the full list.
2. An investment firm — services equivalent to its MiFID II permissions.
3. An electronic money institution — custody, administration and transfers of the e-money tokens it issues itself.
4. UCITS management companies and AIFMs — portfolio management, advice, and reception and transmission of orders.
5. A central securities depositary — custody only.
6. A market operator — a trading platform only.

The annexes to a notification largely mirror a licence dossier, but the clock is shorter: the regulator has 20 working days to check completeness, with a further 20 available for missing items.

The Article 60 route is not theoretical. Of nine new German entries on the ESMA register in July 2026, eight were cooperative and regional banks and only one a crypto-native platform; Standard Chartered entered the EU through a Luxembourg subsidiary, taking a CASP and an EMI authorisation together on 29 June 2026. Where a group already holds a banking, investment-firm or EMI licence, notification is almost always faster and cheaper than the full cycle.

The transitional regime is now fully closed. Article 143(3) allowed member states to give incumbent national providers up to 18 months, to shorten that period, or not to apply it at all — and they chose very differently. The official ESMA list records a spread from six to eighteen months: firms in the generous states spent the extra year preparing an application, firms in the strict ones were winding down in mid-2025.

National law could set not only the end of the window but a separate filing cut-off: in the Czech Republic a CASP application had to be filed by 31 July 2025, while operating on a legacy VASP registration was permitted only until 1 July 2026 — Article 26 of the Digital Finance Act 31/2025 Sb. A provider inside the window that missed the filing date lost its basis to operate ahead of the common deadline.

On 17 April 2026 ESMA confirmed there would be no extension, and a statement of 23 June set out what an acceptable exit looks like: stop onboarding and marketing immediately, limit activity to what is needed to sell or transfer client assets, and keep AML controls running to the last client.

The Dossier: Capital, Own Funds, Substance

Capital is the most over-weighted line in the budget. Annex IV sets a permanent minimum by service class, and the class is determined by the heaviest service in the application. The binding constraint, though, is the second limb of Article 67: the prudential buffer is the higher of the Annex IV amount and one quarter of the preceding year's fixed overheads. For any operator with real volumes, that quarter sets the number, while the €50,000 in the table remains the floor.

An insurance policy counts if it comes from an authorised insurer, runs for at least a year, carries 90 days' cancellation notice and is disclosed on the website.

In February 2026 ESMA closed the main loophole in the calculation. Q&A 2349 answers directly: the base is "the total of all the CASP's overhead expenses, both fixed and variable", and only the four items in Article 67(3)(a)–(d) may be deducted — the list is exhaustive and national regulators may not widen it. The practical effect is a step change for operators who had been stripping variable costs out of the base.

Then come the items that cost real money. Article 70 requires segregation: client crypto-assets must be held so that the provider's creditors cannot reach them in insolvency, and client funds must be placed with a credit institution or a central bank by the end of the business day following receipt, in accounts separately identifiable from the firm's own, with any use for own account prohibited.

Article 73 permits outsourcing of operational functions but forbids delegating responsibility, altering the client relationship or changing the conditions of authorisation. On top of that: a programme of operations with a three-year plan, group structure and fit-and-proper assessments for all key function holders, ICT architecture and third-party register under DORA, conflicts-of-interest policy, complaints handling, AML procedures including the travel rule, and an executable wind-down plan. Which of these must physically exist before filing, rather than appear as a PDF, is set out in the operator's compliance stack.

The statute is terse on substance — one EU-resident director — and regulators are generous in interpretation. The practical minimum across most jurisdictions: two executives with local presence, regulator-approved compliance officer, MLRO and risk manager as dedicated roles, a local auditor, a bank account in the country of authorisation, and a credible answer to where decisions are actually taken. Keeping core systems outside the EEA is formally possible but converts into a separate evidentiary burden on regulator access, recovery and vendor control.

Procedure: the 25 + 40 Formula Versus Practice

Article 63 reads quickly.

The clock stops only once: subsequent requests for further information do not suspend it, and passporting after the decision is nearly instant.

Practice runs several times longer, and it is the pre-filing phase that stretches it. Luxembourg's CSSF operates a pre-application channel and puts a realistic first-time applicant at six to nine months from engagement to decision. The Dutch AFM budgets around 105 working days; France's AMF allows up to four months from a complete application, to which two to three months of clarification rounds are typically added in practice. Add it up and the working horizon from "we are doing this" to licence in hand in 2026 is nine to eighteen months. An application filed without prior supervisory dialogue almost invariably enters a remediation loop: the clock does not stop again after the first suspension, but nothing prevents a regulator from demanding a fresh complete application.

Choosing a Jurisdiction: What the Register Shows

ESMA maintains an interim register of five CSV files — white papers, ART issuers, EMT issuers, authorised CASPs and the non-compliant list — refreshed weekly, but it publishes no aggregate figure. Industry trackers do the counting: 325 records as at 12 August 2026 on one, 329 records and 322 unique active firms on the same date on another. The gap is duplicates and withdrawn authorisations; there is no official number, and every figure should be read as an estimate. For scale, the Commission's May consultation worked with "around 170 CASPs from 18 member states" — roughly half the current count, three months before the deadline.

Two corrections are mandatory before using these numbers. First, the register mixes full Article 63 authorisations with Article 60 notifications, so "325 CASPs" is not 325 crypto companies but the sum of venues and regulated institutions that have bolted on a crypto service. Second, heavy licences are rare: as at 4 July 2026 only about 17 of 280 entries carried permission to operate a trading platform.

Three conclusions matter more than the numbers themselves. Lithuania is a warning that a legacy VASP register does not convert into the new status: six authorisations for the former registration leader. Italy tells the same story in figures — on industry trackers as at 12 August 2026, 138 legacy registrations as at 30 June 2025 against nine register entries after the transition; Consob publishes no aggregate of its own. Poland is a warning of a different kind: without a national implementing act the regulator cannot open a procedure at all, leaving Polish businesses to authorise elsewhere and passport back in.

The idea of a soft jurisdiction died on 10 July 2025. That day ESMA published its fast-track peer review of the Maltese MFSA's authorisation practice: on supervisory resources and expertise the MFSA scored full marks, but the authorisation stage was found only partially to meet expectations, with material issues left unresolved when the licence was granted.

More important than the verdict is the attached checklist addressed to every EEA regulator: forward-looking assessment of growth plans, conflicts of interest in multi-service models, intragroup outsourcing and governance, ICT architecture under DORA, exposure to Web3 and promotion of unregulated products, and honest risk warnings in the user journey.

Since July 2025 that has been the de facto common question set in every member state, and the dossier is built to it; the Article 62 minimum covers only the formal part. Where the wider perimeter is heading is mapped in the trends overview.

Segregation, Custodian Liability and the Limits of Protection

A CASP licence delivers three things to an asset owner and withholds a fourth.

• Segregation under Article 70: client coins are legally separated from the venue's balance sheet and the client's fiat balance sits at a bank or central bank rather than in its working capital.
• Custodian liability: the provider answers for loss of assets or means of access attributable to it, though compensation is capped at the market value of the asset at the time of loss.
• A supervisor with an address to complain to.

It does not deliver a guarantee scheme: MiCA has no analogue of €100,000 deposit insurance, and the distinction between "regulated" and "insured" is decisive here — the same logic that applies to money held at an EMI after the payments reform.

The practical check takes five minutes. The check runs against the specific legal entity servicing the account in the ESMA register rather than the brand: global groups run their European perimeter through a separate company, and the parent's status is irrelevant to the client's assets.

Next comes which services the authorisation actually covers — custody and operating a trading platform are separate lines, and a venue authorised only to exchange is not, legally, a custodian. Last comes relocation after the transition; passporting makes that invisible in the interface but changes who supervises the entity.

How this feeds into holding structures for a large position is covered in crypto for private wealth and tokenisation of real-world assets. And note that issuing a stablecoin is not a CASP service at all: only a bank or an EMI may issue an e-money token.

Project Budget, Alternatives and Enforcement

The governing figure is the cost of the project as a whole. Official fees are heterogeneous and rarely published; the Dutch AFM is the exception with a published tariff, and everything else rests on market estimates.

These are industry estimates, not published tariffs, and are checked against the specific regulator on the filing date. The order of magnitude is stable, though: Annex IV capital is low single-digit percentages of the real budget.

MiCA contains no agency regime. In the payments world PSD2 and the forthcoming PSD3 let a principal register agents and share the perimeter with them; here Article 73 permits outsourcing of operational functions but not of responsibility or of the client relationship. What remains for an EU-established firm is white-labelling under another firm's authorisation (set out below), where the principal remains the regulated person and the partner becomes its distribution channel, with all the dependency that implies.

Reverse solicitation under Article 61 is not available to that firm at all: the exemption is written for a third-country firm whose services are requested at the own exclusive initiative of a client established in the Union, and it falls away once the firm solicits clients or advertises services in the EU. In its statement of 23 June 2026 ESMA reminded firms established outside the EU that the prohibition on solicitation also covers dealings with professional counterparties. The economics of renting status are set out in the licence-for-rent hub.

There is a specific trap for anyone touching stablecoins. In an opinion of 2 June 2025 the EBA accepted that transfers of e-money tokens fall simultaneously under MiCA and PSD2, and granted a nine-month no-action period; it expired on 2 March 2026, after which a venue transferring EMTs needs a second, payments authorisation. More than a hundred CASPs were already engaging with regulators on this by February 2026. Plan the dual status early: pairing an EMI with a CASP under one supervisor costs less than bolting a payments licence on afterwards.

Enforcement as at August 2026 is strikingly asymmetric. ESMA's non-compliant list carries 167 entries as at 6 August 2026, of which more than 160 came from Italy's Consob, one from the Dutch AFM (MEXC, decision of 16 September 2025) and one from Slovakia's NBS. That reflects differing appetites for maintaining lists, not the geography of misconduct. Revocations and refusals remain rare: 29 records as at 3 May 2026 — seventeen voluntary exits, five regulator-driven revocations, three failed regime transitions and only two outright refusals, both Maltese. What filters the market is applications that are never completed.

Under Someone Else's Authorisation

While its own licence is still in the works, an operator launches under the authorisation of an existing CASP: the principal carries the regulatory duties — governance, capital, segregation of client assets, AML — while the partner supplies brand, interface and distribution. The client must be left in no doubt which entity provides the regulated service.

Before launch the partner is checked on three points, and the ESMA register answers all three.

• A live authorisation, not an application. The register must show an Article 63 decision or an Article 60 notification, not a "pending" status and not a legacy national VASP registration: since 1 July 2026 the latter is no basis for operating, and it never carried a passport.
• The scope of services. An authorisation is granted for named items from the Article 3(1)(16) list. A partner authorised only to exchange cannot cover custody, and operating a trading platform is a separate line that only a small share of holders carried in 2026.
• Jurisdiction after passporting. Check the specific legal entity and the state that granted the authorisation: passporting makes a change of home supervisor invisible in the interface, yet it determines who supervises the partner, where a complaint goes, and under which law client assets are unwound if it fails.

The dependency runs both ways: the principal may change the terms or switch off the channel at any time, and a revocation or surrender of its authorisation stops the partner's storefront the same day. White-labelling is therefore planned as a temporary entry with an application of one's own already running, not as an end-state configuration.

What Changes Before 2028

Three vectors belong in the architecture now. The first is AML: the single regulation applies from 10 July 2027, and AMLA is preparing its first selection of directly supervised entities — national supervisors collected data until 15 August 2026, a provisional list is expected by end-September 2026, the selection cycle runs in 2027 and direct supervision starts in 2028. Cross-border CASPs are obvious candidates; what changes procedurally is covered in the EU AML package.

The second is supervision itself. The Commission's Market Integration and Supervision Package of 4 December 2025 moves CASP authorisation and ongoing supervision to ESMA; application is expected 12 to 24 months after adoption, putting it somewhere between mid-2027 and mid-2029. The practical implication is blunt: choosing a lenient regulator today means optimising for an authority that will not hold the role for long.

The third is the substance of MiCA. Consultation responses close on 30 September 2026, the Commission having extended the original 31 August deadline; the formal Article 140 report is due by 30 June 2027, and a "MiCA 2" legislative package realistically arrives no earlier than 2028. Until then staking, lending and DeFi sit outside the perimeter and therefore outside its protections: building a regulated product on them is premature, and building an unregulated one alongside a licence is a direct route to the peer-review checklist questions.