# White-label CASP: crypto services under third-party MiCA licence > How white-label works under a CASP licence in the EU, VASP→CASP transition, hard MiCA deadline of 1 July 2026, passporting and how to verify provider authorisation via ESMA register. Author: Алёна Дунаева — юрист, Family Office (https://wiki.private.law/authors/dunaeva) Last modified: 2026-07-21T10:22:00.000Z Canonical: https://wiki.private.law/en/white-label-casp Topics: banking Jurisdictions: eu Semantic tags: neobank --- ## Concept > 🔗 **Related** > [embedded finance](https://wiki.private.law/en/embedded-finance) MiCA introduced a single EU regime for crypto business: national VASP status (an FATF term) gives way to CASP authorisation (crypto-asset service provider). Since 30 December 2024 no new applications are accepted under the old VASP regime, and the transition to CASP is under way. Operating white-label under a CASP licence means running on an established provider's authorisation: you launch a branded exchange, wallet or custody service without holding your own MiCA licence, while the authorised CASP carries the regulatory obligations. The value is the passport: a single CASP authorisation granted in any EU country confers the right to serve clients across all 27. This is the same [licence-rental model](https://wiki.private.law/en/license-for-rent) that already runs through payments and funds — see [embedded finance](https://wiki.private.law/en/embedded-finance). > 🍓 Only full CASP authorisation confers the passport. A national "transitional" status is valid only in its own country and does not confer passporting rights — easy to overlook when choosing a white-label partner. ## Where the regime came from VASP is an FATF term: since 2019 crypto business has fallen under anti-money-laundering requirements and the Travel Rule, but it registered under national rules and the status did not cross borders. The EU consolidated these scattered regimes into a single financial one — MiCA introduced CASP authorisation, which works as a full licence with a passport across all 27 countries. White-label grew directly out of that transition: while one player works through authorisation, another launches under its licence without waiting for its own. The same regulation also brought [stablecoins](https://wiki.private.law/en/stablecoins) (ART and EMT) into scope — a neighbouring regime with its own requirements. ## How it works The authorised CASP holds the MiCA licence and is responsible for governance, capital, custody of client assets, market-abuse controls and AML. The white-label partner gains access to the infrastructure and the licence: the brand, the client interface and distribution. The CASP's set of permitted services — custody, exchange, execution, placing, advice and the transfer of crypto-assets — determines exactly what may be offered under that licence. ## Deadlines: the 1 July 2026 deadline Grandfathering: a firm that was providing crypto services under national law before 30 December 2024 may continue until 1 July 2026, or until its MiCA authorisation is granted or refused. 1 July 2026 is the hard deadline: every national transitional period expires, and without CASP authorisation (or an application filed in time) regulated services in the EU must stop. No extensions are available. An important detail: Member States chose different transitional lengths. Six months — which expired back on 30 June 2025 — was taken by the Netherlands, Finland, Latvia, Hungary, Poland and Slovenia; the full 18 months was granted by France, Luxembourg, Malta and Estonia; Spain extended its period from 12 to 18 months. In most countries the application window had already closed during 2025, so white-label through a provider with full CASP authorisation became, for many, the fastest legal entry into the EU. ESMA confirmed this: in a statement of 17 April 2026 the regulator stated directly that, from 1 July 2026, providing MiCA-regulated services without authorisation breaches EU law. National supervisors are preparing to withdraw transitional statuses without separate notice, so the margin of time is minimal. ## What is needed - **Route.** Either operate under an established CASP's authorisation (white-label), or obtain your own MiCA authorisation. - **Foundation.** An EU legal entity, an AML/KYC package, established custody and monitoring processes. - Partner verification. The provider's status is checked against the [public register of authorised CASPs maintained by ESMA](https://www.esma.europa.eu/publications-and-data/registers-and-data) (around 200 authorisations across 23 countries by spring 2026): national VASP status is not equivalent to CASP authorisation and does not confer passporting rights. > ⚙️ Before launching under a third-party licence, make sure your partner holds CASP authorisation (not "pending" and not old VASP) and that the services you need fall within its scope. Both passporting and legality depend on it. ## Why take white-label Most often it is a way to add crypto quickly to a working product. A neobank or payment service plugs in the purchase and custody of coins; a broker adds crypto-asset trading; a consumer brand launches a wallet or exchange under its own name. For a non-European player, white-label is a legal entry point into the EU for the time it takes to build its own authorisation (that route — for example, [a CASP in Luxembourg](https://wiki.private.law/en/fintech-license-map)). Legally, white-label rests on distribution and outsourcing: MiCA has no formal tied-agent institution with a passport, as [in payments](https://wiki.private.law/en/payment-agents-eu). The client must therefore be left in no doubt that the regulated service is provided by the authorised CASP, while the partner is responsible for the brand and the shopfront. Outsourcing does not remove responsibility: governance, custody of client assets and [AML](https://wiki.private.law/en/aml-kyc-private-client) remain with the licence-holder. ## Compliance Under MiCA: requirements on governance and capital, segregation and protection of client assets, market-abuse rules, complaints handling and disclosure. Operational resilience is governed by DORA (third-party ICT risk, in force since 17 January 2025). AML/CFT follow the general EU regime. Responsibility for compliance stays with the authorised CASP. ## Applicable regulation > 🔗 **Related** > [regulatory perimeter](https://wiki.private.law/en/regulatory-perimeter-trends) · [BaaS and sponsor banks](https://wiki.private.law/en/baas-sponsor-bank) · [crypto-friendly jurisdictions](https://wiki.private.law/en/crypto-jurisdictions) · [MiCA](https://wiki.private.law/en/mica-eu) · [stablecoins](https://wiki.private.law/en/stablecoins) MiCA (Regulation (EU) 2023/1114) and ESMA's technical standards set the CASP regime and the transition from VASP — a general overview is in [the article on MiCA](https://wiki.private.law/en/mica-eu) ([ESMA, MiCA](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica)). Operational resilience is added by DORA (Regulation (EU) 2022/2554). The principle that responsibility cannot be outsourced, and the related trends, sit in [the regulatory perimeter](https://wiki.private.law/en/regulatory-perimeter-trends). Neighbouring licence-rental models: payments — [agents in payments](https://wiki.private.law/en/payment-agents-eu), banking — [BaaS and sponsor banks](https://wiki.private.law/en/baas-sponsor-bank), crypto jurisdictions in general — [crypto-friendly jurisdictions](https://wiki.private.law/en/crypto-jurisdictions); a general breakdown of the scheme — [licence rental](https://wiki.private.law/en/license-for-rent). > 🍓 White-label remains the fastest legal entry into the EU crypto market — provided the partner holds full CASP authorisation, the services you need fall within its scope, and the client understands who the regulated provider is. It is the rental of someone else's licence: both the speed of launch and the dependence on another's status come as a package. ## Frequently asked questions **Can you still operate in the EU under old VASP status after 1 July 2026?** No: the transitional periods expire. You need CASP authorisation or an application filed in time, otherwise services must stop. **Does white-label give an EU passport?** Yes, if the partner is a fully authorised CASP. National transitional status does not passport. **How is CASP different from VASP?** VASP was a national AML registration with no cross-border effect; CASP is a MiCA financial authorisation that passports across the whole EU. *This material is prepared as an expert overview and does not constitute individual legal advice.* --- ## Sources - [public register of authorised CASPs maintained by ESMA](https://www.esma.europa.eu/publications-and-data/registers-and-data) - [ESMA, MiCA](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica) --- ## Factual claims - The value is the passport: a single CASP authorisation granted in any EU country confers the right to serve clients across all 27. - VASP is an FATF term: since 2019 crypto business has fallen under anti-money-laundering requirements and the Travel Rule, but it registered under national rules and the status did not cross borders. - Grandfathering: a firm that was providing crypto services under national law before 30 December 2024 may continue until 1 July 2026, or until its MiCA authorisation is granted or refused. - ESMA confirmed this: in a statement of 17 April 2026 the regulator stated directly that, from 1 July 2026, providing MiCA-regulated services without authorisation breaches EU law. - MiCA (Regulation (EU) 2023/1114) and ESMA's technical standards set the CASP regime and the transition from VASP — a general overview is in the article on MiCA (ESMA, MiCA). - Can you still operate in the EU under old VASP status after 1 July 2026?