MiCA License: CASP Authorisation After the 1 July 2026 Deadline

What Is MiCA / CASP Authorisation?

MiCA, the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), is the EU-wide framework for crypto-asset markets. A crypto-asset service provider (CASP) authorisation is the individual licence a firm obtains from a national competent authority under MiCA Article 63 to provide one or more of the ten crypto-asset services listed in Article 3.^[1] MiCA is the rulebook; the CASP authorisation is the permission to operate under it.

Because the two are distinct legal objects, converting a national VASP registration into a CASP authorisation is a fresh application, not a renewal.

MiCA applied in two stages. From 30 June 2024, the stablecoin titles applied: Title III for asset-referenced tokens (ART) and Title IV for e-money tokens (EMT). The CASP regime under Title V applied from 30 December 2024, with a transitional regime under Article 143(3) letting pre-existing national VASPs continue under their old registration for a national window of up to 18 months.^[2] That window had a hard EU-wide ceiling, and the ceiling passed on 1 July 2026.

A CASP authorisation from any one EU or EEA member state passports the authorised services across all 27 member states plus Iceland, Liechtenstein, and Norway under MiCA Article 65, after a host-state notification.^[3] The three EEA EFTA states sit inside the passport via EEA Joint Committee Decision No 41/2025 of 20 February 2025.^[4] Outside the regime sit the United Kingdom and Switzerland, along with Gibraltar, where local rules decide whether serving clients needs a local licence or registration.

The decision is rarely about finding the cheapest member state. It is about finding the lowest-cost state whose regulator, banking ecosystem, and substance expectation the operator can actually meet, then passporting from there into the markets that matter. Operators comparing states across capital, timeline, and service scope can use the interactive crypto-licensing comparison tool alongside it.

Who Needs a CASP Authorisation?

Any firm providing one or more of the ten crypto-asset services in MiCA Article 3 to clients in the Union requires a CASP authorisation, unless it is an eligible financial entity: a credit institution, central securities depository, investment firm, e-money institution, UCITS management company, AIFM or market operator may provide the services Article 60 matches to its existing licence by notifying its home authority at least 40 working days before starting.^[1] Activity is the trigger, not the firm's label: holding client crypto-assets, running an exchange or trading venue, executing or transmitting client orders, placing crypto-assets, advising, managing portfolios, or transferring crypto-assets on behalf of clients all fall inside the perimeter. The operators that need to act now are former EU VASPs whose national registrations expired at the Article 143(3) ceiling on 1 July 2026 without a granted authorisation in hand.

The ten regulated crypto-asset services

Article 3 of MiCA enumerates the services that require authorisation:

1. Custody and administration of crypto-assets on behalf of clients
2. Operation of a trading platform for crypto-assets
3. Exchange of crypto-assets for funds
4. Exchange of crypto-assets for other crypto-assets
5. Execution of orders for crypto-assets on behalf of clients
6. Placing of crypto-assets
7. Reception and transmission of orders for crypto-assets on behalf of clients
8. Advice on crypto-assets
9. Portfolio management on crypto-assets
10. Transfer services for crypto-assets on behalf of clients

A firm is authorised for the specific services it applies for and can passport only those, which is why scoping the service set correctly at application stage is the first decision on every mandate.

EU VASPs after the 1 July 2026 deadline

Former EU VASPs are the largest population. Any firm that held a national crypto registration, for example a former Estonian, Lithuanian or French VASP, had to convert to a CASP authorisation to keep serving EU clients past the transitional ceiling. Conversion is not automatic: the CASP file is materially heavier than the old VASP registration, requiring a programme of operations and a governance and prudential package, plus a crypto-asset white paper where the firm offers or seeks admission to trading of crypto-assets other than ARTs or EMTs under MiCA Articles 6 to 8. That window is now closed: a firm that missed it has a fresh CASP authorisation as its only path back to the EU market (an eligible financial entity could instead notify under Article 60), and operating without one is an enforcement matter, not a filing delay.^[1] ESMA's public statement of 23 June 2026 set the exit terms: an unauthorised provider must stop onboarding new EU clients and all marketing at once and limit its services to selling, transferring, or closing client positions.^[19]

The conversion gap

Numbers explain what happened at the ceiling. ESMA’s register listed 338 CASPs across 24 member states as at 24 September 2026, a count that includes banks and other financial entities providing crypto-asset services by Article 60 notification, and still far below the number of national VASP registrations before MiCA.^[5] The distribution is concentrated: Germany held 95 (more than a quarter of the EU total, nearly half of them cooperative banks), France 36, the Netherlands 28, Cyprus 24, Malta 22, Spain 15, Luxembourg 13, and the Czech Republic and Ireland 12 each.

Most pre-MiCA VASPs had not converted by the ceiling, which meant the regulators faced a queue and the firms that filed early were the ones most likely to clear review in time. Practitioner observation: the slowest part of a conversion is rarely the regulator; it is the operator assembling the governance, white paper, and prudential evidence the CASP file demands and the old VASP registration never did.

Non-EU operators and reverse-solicitation limits

Non-EU operators serving EU clients need an EU-incorporated CASP entity. Reverse solicitation under MiCA Article 61 was tightened by ESMA Guidelines published 26 February 2025 and is the exception, not the rule.^[6] In operation, the exemption is narrow: ESMA lists targeted advertising, EU country-code domains, sponsorship of EU events, paid EU-based influencers, affiliate or referral programmes that direct EU traffic, and websites in an EU language not customary in international finance among the signs that a firm is likely to be soliciting EU clients, judged on all the facts, and a firm that solicits EU clients cannot rely on the exemption.

ESMA also confines further or same-type marketing to a reverse-solicited client to the context of the original transaction. What lapses once material time has passed is that further marketing, not the service relationship the client initiated: ESMA states in Final Report paragraph 50 that the time element does not apply to the relationship resulting from the service initiated at the client’s own exclusive initiative.

Marketing new types of crypto-asset or service to that client is barred outright by Article 61(2), and further same-type marketing is confined to the context of the original transaction. Article 61 does not authorise solicitation of EU clients or prohibited further marketing. The relationship resulting from a client’s own exclusive initiative may continue without a time limit; recurrence alone is not prohibited. Operational triggers are set out in full in the reverse-solicitation explainer.

Where to Get Licensed

Because a CASP authorisation passports across the whole EU and EEA, the member state of authorisation is a cost-and-speed decision, not a market-access one. The Annex IV class floors and Article 67 prudential-safeguard test are set by MiCA and identical everywhere; what varies is the advisory cost, the regulator's processing speed, the file language, and the local substance expectation. An operator can compare a direct German file with authorisation in another Member State and an Article 65 notification for Germany. The decision depends on case-specific quotations, substance and the service model, not an established general cost advantage. That choice rests on national supervision, which the Commission proposed on 4 December 2025 to transfer to ESMA for all CASPs; the proposal is not yet law.^[21]

Selecting a home state for Article 65 passporting

What drives the strategy is a structural fact: the passport, not the home state, decides market access. As at 24 September 2026 Germany was home to 95 of the 338 CASPs on the register across the EU, more than a quarter of the total and the largest home state. Of the 217 CASPs whose services are notified in at least one member state beyond home (61% of the 357 in the EEA-wide register), 182 have notified the German market from a home state other than Germany, and 136 notify every other EEA state, so passporting reaches all the large markets rather than concentrating on Germany.^[7]

None of those 182 firms needed a German licence to serve German clients. Germany can be either the home state of authorisation or a destination reached through Article 65 passporting; the operating model determines the suitable route.

BaFin publishes no elapsed-time or cost figures for a CASP authorisation: it applies the MiCA Article 63 assessment periods and charges a fee based on the time its review takes, payable even where an application is withdrawn or rejected.^[8] For an operator that needs a grant to enter or re-enter the market and does not have a Tier-1 compliance team in place, that path carries both timeline and fit risk.

A CASP authorised in another EU member state can reach the German market through Article 65 notification. MiCA harmonises the authorisation framework, but BaFin publishes no cost or timing figure against which a like-for-like advantage for every alternative state could be established. Germany, France, and the Netherlands remain explainer territory on this page; the choice of an authorisation state depends on the service set and substance plan.

EU home-state options

The comparison includes Baltic, Central European, and Iberian home-state options. Each is an EU member state whose CASP authorisation passports across the Union, and each carries the same MiCA capital floors; they differ on processing speed, file language, ecosystem maturity, and when the national transitional window closed. The table below compares the eleven states most relevant to a boutique-fit MiCA conversion, with Germany shown at the foot as a further home-state or passport-destination option.

Lithuania is a common Baltic entry point, with a deep fintech ecosystem and a regulator, the Bank of Lithuania, experienced in authorising e-money institutions and, since 2025, MiCA CASPs; its national VASP transition expired during 2025, so conversions there run as fresh CASP files. In the Czech Republic, the Czech National Bank is the competent authority; the budget needs to reflect the service set and local substance rather than an assumption of low cost. Estonia, the original EU crypto-registration hub, and Latvia round out the Baltic options: Estonia ran at the 18-month outer bound to 1 July 2026, while Latvia's filing window closed on 30 June 2025 and providers that had applied by then could continue until Latvijas Banka decided, within the 1 July 2026 ceiling;^[22] with the ceiling now passed, conversions in both run as fresh CASP files. Each links through to a full jurisdiction page below.

Malta and Cyprus are the established Mediterranean CASP centres; both ran the 18-month maximum to 1 July 2026. Cyprus required existing national-regime CASPs to apply to CySEC for MiCA authorisation by 27 February 2026, after which they could continue only until a CySEC decision or the EU-wide ceiling, whichever came sooner.^[9]

Iberia offers a pathway through Spain (CNMV) and Portugal (Banco de Portugal/CMVM), both at the maximum window. Slovakia serves as a low-cost Central European entry whose national window expired in 2025.

Romania and Poland sit in a legal-uncertainty cluster: neither had designated a MiCA competent authority as of 10 July 2026.^[10] Poland is the sharper case. President Karol Nawrocki vetoed the national Crypto-Asset Market Act on 1 December 2025 and again on 12 February 2026, and the Sejm's second override attempt failed on 17 April 2026 by 243 votes to the 263 required, leaving Poland without an authorising competent authority.^[11]

Polish-registered VASPs lost the right to provide crypto-asset services at the 1 July 2026 ceiling, and with no implementing law none could obtain a Polish authorisation; foreign EU-authorised CASPs can passport into Poland, but a Polish national registration offers no route out.

A third version of the Act passed the Sejm in May 2026, and the President vetoed it on 11 June 2026, his third rejection of the framework.^[11] Poland therefore crossed the 1 July ceiling with no national MiCA act in force and no Polish authorisation route open, and on 4 September 2026 the Sejm failed to override that veto (241 votes; 266 required), so the Act cannot enter into force.^[18] Operators incorporated in Poland or Romania for a CASP product should plan for relocation or migration to a licensed member state; there is no domestic path to wait for on any reliable timeline.

Passport-state comparison

The nine states with an operating authorisation route share an identical MiCA capital regime and an identical EU/EEA passport; they differ on processing speed, file language, ecosystem maturity, and national transitional status. Romania and Poland are in the table for completeness, not as options: neither has a designated competent authority, so neither can grant an authorisation to passport from.

Germany is shown at the foot with its unquantified costs and timing; those gaps prevent a like-for-like ranking. The capital column shows the Annex IV Class 1 / 2 / 3 floors. Article 67 requires at least the higher of that floor and 25% of previous-year fixed overheads (projected first-12-month overheads for a new firm), using qualifying own funds, insurance or a comparable guarantee, or a combination.

Year-1 cost follows the licensing matrix and excludes funding the separate Article 67 prudential safeguards. Most rows combine statutory and build costs; Estonia is the fully outsourced configuration. Malta is the typical Class 2/3 build alone, with statutory fees additional. Spain also shows a build-only estimate excluding an unvalidated statutory tariff; Portugal’s build is also its statutory-inclusive Year-1 figure, because neither the Banco de Portugal nor, as of October 2026, the CMVM charges a CASP fee. Germany shows no figure because BaFin publishes none. These exceptions are labelled and cannot be ranked as like-for-like totals. The timeline column gives planning ranges, not statutory assessment periods.

Start with the transitional status column. Every national window has now closed at or before the 1 July 2026 ceiling, so a fresh CASP file is the only path everywhere for a firm that is not an eligible financial entity under Article 60; only a granted CASP authorisation preserved continuity past 1 July 2026, because Article 143(3) let a legacy VASP continue only until its authority decided or until the ceiling, whichever came first.^[1] Capital stays constant by design: it is set by MiCA, not by the member state, so it cannot be used to rank jurisdictions.

The statutory clock is not the constraint. MiCA Article 63 gives every competent authority the same timetable: it checks completeness within 25 working days of receiving the application and decides within 40 working days of receiving a complete one; the assessment may be suspended once, for up to 20 working days, while the applicant answers the authority’s first request for further information (Article 63(12)), and later requests do not stop it.^[1] Authorities differ on whether the 40 working days run from the filing of a complete application or from their confirmation that it is complete: Národná banka Slovenska, for example, counts them from its completeness assessment.^[23] The statutory regulator phase is therefore roughly two to three months, or up to about four with a full suspension. The end-to-end planning ranges in the table nonetheless run 4–18 months across the MiCA states.

Look to the file, not the authority: preparation of the governance, prudential, and banking evidence before submission, and the time taken to complete the file and answer the regulator’s requests after it, dominate the calendar. An operator budgeting to the statutory clock alone is planning to a calendar that does not exist in practice; the firms that reach grant fastest submit a complete file and answer information requests from a prepared desk.

Editorial position: for a boutique-fit operator the practical shortlist is Lithuania, the Czech Republic and Estonia, chosen on regulator familiarity with the specific service set and on how quickly the firm can stand up local substance. Malta belongs on a different shortlist: the table shows a substantial build budget, but for an operator running custody or a trading platform at scale, the MFSA's converted-VFA supervisory track record and a possible 5% combined effective tax result after Malta’s 35% company tax and a qualifying 6/7 shareholder refund on distributed trading profits may matter to the model.^[17] It is a considered trade, not a low-cost route. Germany, France, and the Netherlands are where the clients are, reachable by passport. Romania and Poland, the legal-uncertainty pair, should be avoided as an origin until their national frameworks are enacted.

Key Requirements

Harmonised across every member state, the MiCA CASP file turns on a small number of pillars: prudential capital by service class, governance, and fit-and-proper management, the crypto-asset white paper where the firm offers crypto-assets to the public, and the safeguarding of client assets and funds. The substantive rules are identical EU-wide because they are set by the regulation; what differs between states is the regulator's processing speed and evidence expectation, not the bar itself.

Capital classes 1, 2 and 3

MiCA Article 67 and Annex IV set three prudential classes keyed to the services provided.^[12]

Under Article 67(1) the binding figure is the higher of the class floor and one quarter of the prior year's fixed overheads, so a firm with a large cost base holds more than the headline number. Because the figures are fixed by the regulation, capital cannot be used to rank one member state cheaper than another.

Governance and fit-and-proper management

Every CASP must have a management body of sufficiently good repute and with adequate knowledge, skills, and experience under MiCA Article 68, and shareholders or members holding qualifying participations must themselves be of sufficiently good repute. Sound administrative and accounting procedures are also required, together with business-continuity arrangements and effective internal control and risk-assessment mechanisms. Practitioner observation: the governance package is where converting VASPs lose the most time, because a national VASP registration rarely required a documented management body, conflicts policy, and outsourcing register at CASP depth, and assembling that evidence cold takes longer than the regulator's own review. A locally substantive board and a senior compliance function are the practical floor.

The crypto-asset white paper

Where a firm offers crypto-assets other than ARTs or EMTs to the public, or seeks their admission to trading, a crypto-asset white paper compliant with MiCA Articles 6 to 8 is required and must be notified to the competent authority.^[13] Its content covers the project, the rights and obligations attached to the crypto-asset, the underlying technology, and the risks, and it must include the prescribed mandatory statements and a summary. It is a different document from the offering memorandum many operators already hold: the MiCA content schedule is specific, and a marketing-led document will not satisfy it. Where a CASP only provides services in respect of existing crypto-assets it does not issue, the white-paper obligation may not bite, which is part of scoping the file correctly.

Safeguarding of client assets

MiCA imposes strict safeguarding of client holdings. Under Article 70, a CASP must safeguard clients' ownership rights over their crypto-assets and funds, in particular in the event of its insolvency, and, unless it is itself a credit institution, e-money institution, or payment institution, must place client funds other than e-money tokens with a central bank or a credit institution by the end of the following business day, in an account separately identifiable from its own. CASPs providing custody under Article 75 must keep a position register and segregate clients' crypto-assets from their own; they are liable for the loss of clients' crypto-assets through an incident attributable to them, capped at the market value of the crypto-assets lost at the time of the loss.^[14] Editorial position: the firms that clear review cleanly are the ones whose client-asset segregation and the supporting banking are confirmed before the substantive review opens, not the ones that treat banking as a post-grant task.

AML and operational resilience

CASPs already face national AML obligations, the Travel Rule, and DORA. The AMLR adds a directly applicable EU rulebook from 10 July 2027; it does not postpone the existing duties.^[15][16][24]

The Travel Rule has applied since 30 December 2024. Regulation (EU) 2023/1113 requires originator and beneficiary information for in-scope crypto-asset transfers regardless of amount. For a transfer exceeding EUR 1,000 to or from a self-hosted address, the CASP must also assess whether its client owns or controls that address. Person-to-person transfers without a CASP are outside the Regulation.^[24]

DAC8 requires Member States to apply crypto-asset tax reporting rules from 1 January 2026. Reporting providers need user due diligence and records of reportable transactions for the 2026 reporting year. National law sets the provider's filing deadline; the first exchanges between tax authorities are due by 30 September 2027. Check the chosen state's implementing rules before budgeting the reporting build.^[25]

EMT payment services can require a separate permission

MiCA authorisation alone does not cover every payment service involving e-money tokens. The EBA treats client EMT transfers and custodial wallets enabling transfers to and from third parties as payment services, while excluding crypto-asset exchange and crypto-purchase intermediation with EMTs from its advice on dual authorisation. MiCA Article 70(4) allows payment services through an appropriately authorised PSP or under the CASP's own authorisation.^[26]

The EBA transition ended on 2 March 2026. Its non-binding supervisory advice permits temporary continuation for pending applicants only under specified conditions and supervisory agreement, without marketing those EMT payment services or taking on new clients for them. An application alone is not permission to continue. Scope the payment-service route before choosing the entity and banking arrangements.^[26]

How Jagelski & Partners Helps

An independent specialist introduced by Jagelski & Partners coordinates MiCA CASP authorisation as a single mandate that runs the CASP application, the white paper, governance, and prudential build, banking placement, and the EU passport notification in parallel rather than in sequence. Working from the written jurisdiction assessment made at scoping and the passport state chosen in it, the specialist sequences the workstreams so the capital, governance, and banking arrive ahead of the regulator asking, against the operator's own market-entry date now that the transitional calendar no longer sets the pace.

Every mandate starts with a written service-scope and jurisdiction assessment. A former VASP running an exchange and custody, needing Class 2 capital and the fastest possible route back to market, gets a different recommendation than an advisory-only firm that needs only Class 1 and can afford a slower file. We do not recommend a member state before mapping the operator's crypto-asset services against MiCA Article 3 and the markets it actually targets, and asking whether it issues any crypto-asset that triggers the white-paper obligation. The recommendation is driven by regulator familiarity with the specific service set and how quickly the firm can stand up local substance, not by headline fee, because the MiCA capital floors are identical everywhere.

Once the state is selected, formation runs in parallel with the CASP application. That means a locally substantive entity with a fit-and-proper management body and registered office in place before the file is submitted, with senior-management interviews scheduled where the competent authority requires them. An independent specialist introduced through our company formation service handles formation at the depth the authorisation requires, not the cheapest depth available, and the written scope limits the file to the services the firm actually needs to passport.

Banking placement runs alongside, not after. A CASP is a high-risk category at every acquirer and EMI, and the Article 70 requirement for a CASP that is not itself a credit institution, e-money institution, or payment institution to place client funds other than e-money tokens with a central bank or credit institution by the next business day makes pre-qualification a gating item, not a post-grant task.

Practitioner estimate: pre-qualification with institutions that have an active programme for licensed crypto firms can be the difference between a banking timeline of about four weeks and one of about four months. Editorial position: the operators who land their CASP grant cleanly are not the ones with the strongest paperwork; they are the ones whose client-asset banking was confirmed before the competent authority opened the substantive review. Banking pre-qualification is handled through our high-risk business accounts workflow.

An independent specialist introduced by Jagelski & Partners sequences the white paper, AML manual, governance and conflicts policies, risk-management framework, and DORA readiness into the application timeline so that on the day the authorisation is granted the operator can go live and notify the passport, not start a three-month build.

Post-grant the compliance partner handles the Article 65 passport notifications into the destination markets, ongoing reporting, qualifying-holding changes, and the supervisory milestones that fall due. Broader crypto-licensing context, including the full jurisdiction set, sits on the crypto licensing pillar page.

For licensing work, the partner who carries the mandate pays Jagelski & Partners for the introduction, and Jagelski & Partners does not bill the client; independent specialists quote their own professional fees separately, and statutory charges remain payable. For banking introductions, Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional banking or EMI pricing, and we do not charge a banking onboarding fee. The institutional rates the client sees on banking onboarding documentation are the rates the institution applies.

Frequently Asked Questions

References