How to Get a CASP License Under MiCA: EU Authorisation Step by Step

The short version: To provide crypto-asset services in the EU, a firm needs either an authorisation as a crypto-asset service provider (CASP) under Article 63 of MiCA, Regulation (EU) 2023/1114, or, if it is already a bank, investment firm, e-money institution, fund manager, central securities depository or market operator, a notification under Article 60. The application goes to the competent authority of the member state where the firm has its registered office. The file follows a single EU template (Delegated Regulation (EU) 2025/305 and Implementing Regulation (EU) 2025/306). Minimum capital is €50,000, €125,000 or €150,000 depending on the services. The authority has 25 working days to check completeness and 40 working days to decide on a complete file. One authorisation can then be passported to every other member state. National transitional periods ended on 1 July 2026 at the latest, so today every new provider goes through this route.

A summary of MiCA, its technical standards and ESMA, EBA and national authority pages, linked in each paragraph. Not legal advice. VASP Tracker is an independent project, not affiliated with ESMA, the EBA, the European Commission or any national competent authority.

Step 1: Map Your Business to the Ten MiCA Services

Article 3(1)(16) of MiCA lists ten crypto-asset services: (a) custody and administration of crypto-assets on behalf of clients; (b) operating a trading platform; (c) exchanging crypto-assets for funds; (d) exchanging crypto-assets for other crypto-assets; (e) executing orders on behalf of clients; (f) placing; (g) receiving and transmitting orders; (h) advice; (i) portfolio management; and (j) transfer services on behalf of clients (MiCA). Under Article 59(1), nobody may provide these services in the Union unless authorised under Article 63 or allowed to provide them as one of the financial entities listed in Article 60.

The mapping matters for three reasons. First, the authorisation names the specific services a firm may provide (Article 59(6)); adding a service later is a formal extension request, processed under the same Article 63 procedure (Article 59(8)). Second, the services decide the minimum capital class (Step 4). Third, several services carry their own rules and their own parts of the application: custody (Article 75), trading platforms (Article 76), exchange (Article 77), execution (Article 78), placing (Article 79), reception and transmission (Article 80), advice and portfolio management (Article 81) and transfer services (Article 82). Serving EU clients from outside the Union without authorisation is possible only on the client's own exclusive initiative (Article 61). ESMA's guidelines on reverse solicitation read that exemption narrowly.

The chart shows which of the ten services firms in ESMA's interim register actually hold; our register analysis has the full breakdown by home state.

Step 2: Set Up the Entity, Registered Office and Management in the EU

Article 59(2) sets three location conditions for an Article 63 authorisation. The applicant must have its registered office in a member state where it carries out at least part of its crypto-asset services. Its place of effective management must be in the Union. And at least one of its directors must be resident in the Union. The applicant is normally a legal person; Article 59(3) allows other undertakings only where their legal form protects third parties as well as a legal person would and they are subject to equivalent prudential supervision. The conditions apply for the life of the authorisation, not only on the day it is granted (Article 59(4)).

ESMA's supervisory briefing on CASP authorisation (31 January 2025) shows how authorities read these words in practice. Home authorities should make sure the firm has sufficient in-country personnel and at least one executive board member located in the member state. In member states with fewer than one million inhabitants, that member may be based elsewhere if available for an in-person meeting at no more than two business days' notice. Executive board members should be able to give the CASP at least half of their time, and the chief executive should, as a rule, work for the CASP full-time. The burden of proof is on the applicant: the authority must be convinced that decisions are not in fact taken elsewhere in the group.

The briefing also limits outsourcing. A firm must not become a “letter-box entity”. A set-up where more functions are performed outside the EU than inside it is assessed critically. Outsourcing to a jurisdiction where the authority cannot obtain information is incompatible with Article 73(1)(d). And custody can be outsourced only to an entity authorised under MiCA (ESMA). For a group whose main operations sit outside the EU, this step is usually the biggest piece of work, not the paperwork.

Step 3: Choose the Home Member State and Its Authority

The home member state of a CASP is the one where it has its registered office (Article 3(1)(33)). Each member state designates its own competent authority and notifies it to ESMA and the EBA (Article 93). Some split the work: in the Netherlands the application form has a separate prudential and qualifying holdings section for De Nederlandsche Bank next to the AFM (AFM forms). In Germany, BaFin asks for a copy of the file to go to the Deutsche Bundesbank (BaFin).

The legal requirements are the same everywhere, but authorities are not identical in practice. ESMA's briefing tells every authority that “there are no low-risk CASPs” and lists factors that call for elevated scrutiny: more than 1,000,000 yearly active users in the EU or a balance sheet of €3 billion, more than 200,000 yearly active users outside the home member state, a complex group, many services combined, token issuance alongside services, heavy outsourcing (especially outside the EU) and a poor supervisory history (ESMA). In July 2025 ESMA published a fast-track peer review of one CASP authorisation granted in Malta, with recommendations for the Maltese authority and for authorities generally (ESMA peer review; MFSA response). Choosing a home state for a quick or light review is therefore a weak strategy. Practical points matter more: the language of the procedure, whether the authority offers pre-application meetings, and the fees.

Fees are set nationally and are not harmonised. Three published examples:

• Netherlands (AFM): €200 per hour for a CASP licence application, up to a maximum of €100,000, plus €700 per person for the properness assessment and €2,900 per person for the suitability assessment. The fees are set by the Dutch Ministry of Finance (AFM).
• Cyprus (CySEC): a fee for each service applied for, from €5,000 (exchange or transfer services) to €8,000 (execution, placing, reception and transmission, advice, portfolio management), €10,000 (custody) and €30,000 (trading platform), plus annual fees (CySEC Directive DI 73-2009-04, English text for information).
• Germany (BaFin): the fee depends on the time spent, under the German fees regulation, and is also charged if the application is withdrawn or rejected. BaFin does not publish a fixed amount (BaFin).

For other member states we have not checked fee schedules for this guide; treat the cost as varying by authority and check the authority's own page.

Step 4: Hold the Minimum Capital

Article 67 requires prudential safeguards equal to the higher of two amounts: the permanent minimum capital in Annex IV, or one quarter of the previous year's fixed overheads, reviewed every year. A firm that has not been in business for a year uses the projected fixed overheads in its first-12-month forecast (Article 67(1)–(3)). The Annex IV minimums are:

• Class 1, €50,000: execution of orders, placing, transfer services, reception and transmission of orders, advice and/or portfolio management.
• Class 2, €125,000: any Class 1 service plus custody and administration, exchange for funds and/or exchange for other crypto-assets.
• Class 3, €150,000: any Class 2 service plus operating a trading platform.

The safeguards can be own funds (Common Equity Tier 1 items), an insurance policy or a comparable guarantee, or a combination (Article 67(4)). A policy must be disclosed on the firm's website, have an initial term of at least one year and a notice period for cancellation of at least 90 days, and be taken out with an authorised insurer; Article 67(6) lists the risks it must cover. In the application, the prudential section asks for the calculation and its assumptions, a three-year forecast with stress scenarios and, for firms still being incorporated, a statement from a credit institution certifying that the funds are deposited (RTS 2025/305, Art. 3).

Step 5: Line Up the Management Body and Qualifying Shareholders

Members of the management body must be of sufficiently good repute and have the knowledge, skills and experience to do the job, individually and collectively, and must commit enough time (Article 68(1)). Shareholders with qualifying holdings (10% or more of capital or voting rights, or significant influence: Article 3(1)(36)) must also be of sufficiently good repute (Article 68(2)). Neither group may have convictions for money laundering or terrorist financing, or other offences affecting their good repute.

Authorities assess both groups under the joint EBA and ESMA guidelines on suitability (EBA/GL/2024/09, ESMA75-453128700-10), applicable since 4 February 2025 (EBA). For each management body member, the RTS asks for identity, residence and work history covering ten years, a CV, references, a criminal record certificate issued no more than three months before submission, conflicts of interest, time commitment and the applicant's own suitability assessment (RTS 2025/305, Art. 7). For qualifying holders, it refers to the information list in Delegated Regulation (EU) 2025/414 (Art. 8).

ESMA's briefing adds three practical points. All executive board members need a good understanding of how crypto-assets and the services work. Limited management experience can be offset by board colleagues with experience in regulated finance. And past supervisory problems, such as operating without a registration elsewhere, are assessed case by case, including interviews and contact with the other authorities involved (ESMA).

Step 6: Build the Application File

Article 62(2) lists what an application must contain, points (a) to (s). The RTS turns that list into detailed content, and the ITS supplies the standard form (the Annex to Regulation 2025/306) and the submission rules. BaFin, for example, asks applicants to use that form for a standard authorisation (BaFin). In outline, the file covers:

• General information: legal name, LEI, legal form, registered office, branches, websites and social media accounts, and a contact person (RTS, Art. 1).
• Programme of operations for three years: group context, services and types of crypto-assets, target member states and client numbers, marketing channels and languages, human, financial and ICT resources and where they sit, outsourcing, and a forecast accounting plan with stress scenarios (Art. 2).
• Prudential requirements (Art. 3) and governance: organisation chart, heads of internal functions, internal control, whistleblowing, record-keeping, market abuse detection, auditors and conflicts of interest policy (Art. 4).
• Business continuity, including the loss of key people (Art. 5), and AML/CFT: risk assessment, policies, the responsible officer, training and compliance with the transfer-of-funds rules in Regulation (EU) 2023/1113 (Art. 6).
• Management body and qualifying holders (Arts. 7–8; see Step 5).
• ICT and security: how the firm meets the Digital Operational Resilience Act (DORA), its ICT third-party arrangements and, if available, a third-party cybersecurity audit covering vulnerability scans, penetration tests and, where smart contracts are used, a source-code review (Art. 9).
• Service-specific policies: segregation of client assets and funds, complaints handling, custody policy, trading platform operating rules, exchange and execution policies, advice and portfolio management arrangements and transfer service procedures (Arts. 10–17).

Two rules help firms that are already regulated. An authority may not ask again for information it already holds under the e-money, MiFID II or payment services regimes, or under a national crypto regime that applied before 29 June 2023, if that information is still up to date (Article 62(4)). Under ESMA's briefing, the business plan should start from current activity where there is any, with realistic three-year projections, intermediate milestones and a pessimistic scenario (ESMA). The AFM asks for a cover note, a document overview and clear page references from the form to supporting documents, so that fewer rounds of questions are needed (AFM).

Step 7: Submit and Get Through the Completeness Check

Each authority must name a contact point for applications and publish its details (ITS 2025/306, Art. 1). Channels differ: the AFM takes applications through its secure Cryptshare service (AFM). BaFin accepts them by post to Division K 4 in Bonn or electronically, with copies to its Division ZK 4 and the Bundesbank (BaFin). Both offer a discussion before filing: an optional pre-scan at the AFM, an initial meeting at BaFin.

Under Article 63, the authority acknowledges receipt within 5 working days and has 25 working days to assess whether the application is complete. If something is missing, it sets a deadline for the applicant to supply it and may refuse to review an application that is still incomplete after that deadline. BaFin says it follows an ESMA recommendation of four weeks for this deadline (BaFin); the AFM gives 5 to 20 working days (AFM). The authority then tells the applicant promptly that the file is complete.

Step 8: The Assessment and the Decision

From a complete application, the authority has 40 working days to assess whether the applicant meets the requirements and to take a fully reasoned decision. The decision is notified within 5 working days (Article 63(9)). By the 20th working day of the assessment at the latest, the authority may request further information. The clock stops until the answer arrives, for no more than 20 working days, and later requests do not stop it again (Article 63(12)). One rule is easy to miss: if the applicant updates its own file during the procedure, the 40 working days start again from receipt of the update (ITS 2025/306, Art. 4(2)).

The authority must consult the authorities of other member states where the applicant is a subsidiary of, or under common control with, a firm they regulate (Article 63(5)). It may also consult AML/CFT authorities and financial intelligence units (Article 63(6)). Where close links exist, authorisation is granted only if they do not prevent effective supervision (Article 63(7)). An authorisation is refused where there are objective and demonstrable grounds that the management body threatens sound and prudent management, its members or the qualifying holders do not pass the tests in Article 68, or the applicant fails or is likely to fail any requirement of Title V (Article 63(10)). Once it grants an authorisation, the authority informs ESMA within 2 working days, and ESMA adds the firm to its register (Article 63(13)).

The statutory periods add up to roughly five months, but in practice it often takes longer. The AFM puts the maximum statutory period at about 105 working days and says that, in its experience, even a best-case CASP application takes at least five months, usually with one to three supervisory meetings (AFM).

Not public: an EU-wide average decision time or approval rate for CASP applications, and comparable figures for most national authorities. ESMA's register shows authorisation dates but not filing dates, so processing times cannot be worked out from it.

Step 9: Passport Across the EU

An authorised CASP may provide its services throughout the Union, through a branch or under the freedom to provide services, without a physical presence in the host member state (Article 59(7)). Before doing so, it sends its home authority the list of member states, the services, the start date and any other activities (Article 65(1)). The home authority forwards that information within 10 working days to the single points of contact of the host states, ESMA and the EBA. The CASP may start once its authority has confirmed the forwarding, or at the latest from the 15th calendar day after it submitted the information (Article 65). The application already has to say where and how the services will be marketed (Article 62(2)(d)), and the programme of operations names the target member states (RTS 2025/305, Art. 2), so passporting plans belong in the file from the start.

The Article 60 Route for Firms Already Regulated

Credit institutions, central securities depositories (custody only), investment firms (services equivalent to their MiFID authorisation), e-money institutions (custody and transfer only, for the e-money tokens they issue), UCITS management companies and AIFMs, and market operators (trading platforms) can notify instead of applying (Article 60). The notification must arrive at least 40 working days before the firm first provides the services. The authority checks completeness within 20 working days, and missing information must be supplied within no more than 20 working days, during which the periods are suspended. The firm cannot start while the notification is incomplete (Article 60(7)–(8)). The content and forms are set by Delegated Regulation (EU) 2025/303 and Implementing Regulation (EU) 2025/304. Articles 62, 63, 64, 67, 83 and 84 do not apply to these firms (Article 60(10)), but the right falls away if the underlying authorisation is withdrawn (Article 60(11)). The AFM charges €200 per hour for a notification, up to a maximum of €50,000 (AFM); CySEC charges €10,000 (CySEC).

Transitional Periods Have Ended

Firms that provided crypto services under national law before 30 December 2024 could continue under Article 143(3) until their national transitional period ended, and 1 July 2026 at the latest. The optional simplified procedure in Article 143(6) only covered applications submitted between 30 December 2024 and 1 July 2026. Both are now history: a firm that is not authorised or notified today is outside the regime. Our analysis of the end of the transition covers the member-state deadlines, ESMA's wind-down expectations and which major exchanges made it.

After Authorisation in Brief

• Use it or lose it: the authority withdraws an authorisation that is not used within 12 months or has not been used for nine consecutive months (Article 64).
• Ongoing conduct: act honestly, fairly and professionally, warn clients of the risks, publish pricing, costs and fee policies, and publish climate and environmental impact information on the consensus mechanisms of the crypto-assets they serve (Article 66). Client funds go to a credit institution or central bank by the end of the next business day (Article 70).
• Governance changes: notify the authority of changes to the management body (Article 69); anyone who decides to acquire a qualifying holding, or to increase it to 20%, 30% or 50% or so that the CASP becomes a subsidiary, must notify the authority in advance, and the authority has 60 working days to assess the acquisition (Articles 83–84).
• Records and resilience: keep records for five years, or up to seven on request (Article 68(9)), and meet DORA's ICT requirements (Article 68(7)–(8)).
• Size: a CASP with at least 15 million active users in the Union on average over a calendar year is significant. It must notify its authority within two months, and the authority reports on it to ESMA (Article 85).
• Stablecoins: what a CASP may list or offer depends on the issuer's own MiCA status; see our stablecoin analysis.

The MiCA Route Next to the UK and Brazil

MiCA gives one authorisation from one national authority, with a passport to all member states and a fixed legal clock (25 plus 40 working days). The UK will instead bring crypto activities under its existing FSMA regime from 25 October 2027, with a national FCA permission, a six-month statutory decision period and capital from £75,000 to £750,000 depending on permissions; see our UK hub and how to get a UK crypto license. Brazil authorises virtual-asset service providers (SPSAVs) at the Central Bank under Law 14,478/2022 and BCB Resolutions 519 and 520 of 2025; see our Brazil hub and how to get a VASP license in Brazil. Neither UK nor Brazilian authorisation gives access to the EU: a firm needs a MiCA authorisation or notification for that.

Practical Checklist Before You File

1. List every service you provide or plan to provide against the ten MiCA services, including transfers and custody that happen in the background.
2. Work out the Annex IV class and the fixed-overheads figure. Decide on own funds, insurance or both, and have the funds deposited before filing if the company is new.
3. Pick the home member state where the registered office, management and at least part of the services will actually be. Read that authority's page, form and fee schedule.
4. Appoint the management body, with at least one director resident in the Union and an executive who can meet the authority at short notice. Plan for a full-time chief executive and real local staff.
5. Map the ownership chain down to every qualifying holder and collect criminal record certificates no older than three months at the time of filing.
6. Write the three-year programme of operations and forecasts with a pessimistic scenario and milestones the authority can check.
7. Prepare the policies the RTS requires: governance, internal control, conflicts of interest, complaints, business continuity, AML/CFT and the travel rule, custody, segregation and execution.
8. Document ICT and outsourcing against DORA, including third-party providers and any cybersecurity audit or penetration test.
9. Book a pre-application meeting if the authority offers one, then file the complete set using the ITS form, with a document index.
10. Keep the team available: answers within the authority's deadline keep the clock running. Plan passporting notifications for after authorisation.

Checked against EUR-Lex (MiCA, Delegated Regulations 2025/303, 2025/305 and 2025/414, Implementing Regulations 2025/304 and 2025/306), ESMA and EBA documents, and AFM, BaFin, CySEC and MFSA pages on 23 Oct 2026. Where nothing has been published (EU-wide processing times, approval rates, fee schedules for authorities we have not checked), we say so rather than estimate.