MiCA License: CASP Authorisation After the 1 July 2026 Deadline

What Is MiCA / CASP Authorisation?

MiCA, the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), is the EU-wide framework for crypto-asset markets. A crypto-asset service provider (CASP) authorisation is the individual licence a firm obtains from a national competent authority under MiCA Article 63 to provide one or more of the ten crypto-asset services listed in Article 3.^[1] MiCA is the rulebook; the CASP authorisation is the permission to operate under it.

Because the two are distinct legal objects, converting a national VASP registration into a CASP authorisation is a fresh application, not a renewal.

MiCA applied in two stages. From 30 June 2024, the stablecoin titles applied: Title III for asset-referenced tokens (ART) and Title IV for e-money tokens (EMT). The CASP regime under Title V applied from 30 December 2024, with a transitional regime under Article 143(3) letting pre-existing national VASPs continue under their old registration for a national window of up to 18 months.^[2] That window had a hard EU-wide ceiling, and the ceiling passed on 1 July 2026.

A CASP authorisation from any one EU or EEA member state passports the authorised services across all 27 member states plus Iceland, Liechtenstein, and Norway under MiCA Article 65, after a host-state notification.^[3] The three EEA EFTA states sit inside the passport via EEA Joint Committee Decision No 41/2025 of 20 February 2025.^[4] Outside the regime sit the United Kingdom and Switzerland, along with Gibraltar, each requiring local authorisation for local clients.

The decision is rarely about finding the cheapest member state. It is about finding the lowest-cost state whose regulator, banking ecosystem, and substance expectation the operator can actually meet, then passporting from there into the markets that matter. Operators comparing states across capital, timeline, and service scope can use the interactive crypto-licensing comparison tool alongside it.

Who Needs a CASP Authorisation?

Any firm providing one or more of the ten crypto-asset services in MiCA Article 3 to clients in the Union requires a CASP authorisation. Activity is the trigger, not the firm's label: holding client crypto-assets, running an exchange or trading venue, executing or transmitting client orders, placing crypto-assets, advising, managing portfolios, or transferring crypto-assets on behalf of clients all fall inside the perimeter. The operators that need to act now are former EU VASPs whose national registrations expired at the Article 143(3) ceiling on 1 July 2026 without a granted authorisation in hand.

The ten regulated crypto-asset services

Article 3 of MiCA enumerates the services that require authorisation:

1. Custody and administration of crypto-assets on behalf of clients
2. Operation of a trading platform for crypto-assets
3. Exchange of crypto-assets for funds
4. Exchange of crypto-assets for other crypto-assets
5. Execution of orders for crypto-assets on behalf of clients
6. Placing of crypto-assets
7. Reception and transmission of orders for crypto-assets on behalf of clients
8. Advice on crypto-assets
9. Portfolio management on crypto-assets
10. Transfer services for crypto-assets on behalf of clients

A firm is authorised for the specific services it applies for and can passport only those, which is why scoping the service set correctly at application stage is the first decision on every mandate.

EU VASPs after the 1 July 2026 deadline

Former EU VASPs are the largest population. Any firm that held a national crypto registration, for example a former Estonian, Lithuanian or French VASP, had to convert to a CASP authorisation to keep serving EU clients past the transitional ceiling. Conversion is not automatic: the CASP file is materially heavier than the old VASP registration, requiring a programme of operations and a governance and prudential package, plus a crypto-asset white paper where the firm offers or seeks admission to trading of crypto-assets other than ARTs or EMTs under MiCA Articles 6 to 8.

That window is now closed: a firm that missed it has a fresh CASP authorisation as its only path back to the EU market, and operating without one is an enforcement matter, not a filing delay.

The conversion gap

Numbers explain what happened at the ceiling. Only 303 CASPs were authorised across 23 member states as at 12 August 2026, against more than 1,200 pre-MiCA national VASP registrations.^[5] The distribution is concentrated: Germany held 70 (close to a quarter of the EU total), France 34, the Netherlands 28, Cyprus 24, Malta 22, Spain 15, Luxembourg 13, and Ireland 12.

Most pre-MiCA VASPs had not converted by the ceiling, which meant the regulators faced a queue and the firms that filed early were the ones most likely to clear review in time. Practitioner observation: the slowest part of a conversion is rarely the regulator; it is the operator assembling the governance, white paper, and prudential evidence the CASP file demands and the old VASP registration never did.

Non-EU operators and reverse-solicitation limits

Non-EU operators serving EU clients need an EU-incorporated CASP entity. Reverse solicitation under MiCA Article 61 was tightened by ESMA Guidelines published 26 February 2025 and is the exception, not the rule.^[6] In operation, the exemption is narrow: targeted advertising, EU-language websites, country-code TLDs, sponsorship of EU events, EU-based influencers, and affiliate or referral programmes that direct EU traffic all defeat it.

ESMA also confines further or same-type marketing to a reverse-solicited client to the context of the original transaction. What lapses once material time has passed is that further marketing, not the service relationship the client initiated: ESMA states in Final Report paragraph 50 that the time element does not apply to the relationship resulting from the service initiated at the client’s own exclusive initiative.

Marketing new types of crypto-asset or service to that client is barred outright by Article 61(2), and anything beyond the initiated relationship needs CASP authorisation. An offshore entity cannot rely on Article 61 as a market-entry strategy; a non-EU operator cannot scale a recurring EU-client relationship through reverse solicitation alone. Operational triggers are set out in full in the reverse-solicitation explainer.

Where to Get Licensed

Because a CASP authorisation passports across the whole EU and EEA, the member state of authorisation is a cost-and-speed decision, not a market-access one. Minimum capital is set by MiCA and identical everywhere; what varies is the advisory cost, the regulator's processing speed, the file language, and the local substance expectation. The efficient play for a boutique-fit operator is to license in a cheap-entry passport state and passport into the larger markets, including Germany, rather than license directly where the file is heaviest.

The license-cheap, passport-in thesis

What drives the strategy is a structural fact: concentration of demand, not concentration of supply. As at 12 August 2026 Germany held 70 of the 303 CASPs authorised across the EU, close to a quarter of the total, and is the single largest destination for inbound passporting: of the 199 CASPs whose services are notified in at least one member state beyond home (66% of the register), 166 target the German market from a home state other than Germany.^[7]

Most of those firms did not license in Germany; they licensed in a cheaper-entry state and passported in. Germany is best understood as a destination reached by passport, not an origin to license in.

Unlike a cheap-entry CASP file in Lithuania or the Czech Republic, the German BaFin route is slow and expensive: 200-plus-page application files and 12 to 24 month timelines, with advisory budgets of EUR 80,000 to EUR 200,000 and a cohort dominated by large, well-capitalised incumbents.^[8] For an operator that needs a grant to enter or re-enter the market and does not have a Tier-1 compliance team in place, that path carries both timeline and fit risk.

From a passport state the same EU market is reachable for a fraction of the cost and time, and the resulting authorisation is identical in legal effect because MiCA harmonises the substantive rules. Germany, France, and the Netherlands are explainer territory on this page, not the recommended route.

The cheap-entry passport states

Cheap-entry states cluster in the Baltics and Central Europe, with the Iberian peninsula alongside. Each is an EU member state whose CASP authorisation passports across the Union, and each carries the same MiCA capital floors; they differ on processing speed, file language, ecosystem maturity, and how far the national transitional window has already run. The table below compares the eleven states most relevant to a boutique-fit MiCA conversion, with the German destination shown for contrast at the foot.

Lithuania is the most-used Baltic entry point, with a deep fintech ecosystem and a regulator, the Bank of Lithuania, experienced in onboarding crypto and EMI firms; its national VASP transition expired during 2025, so conversions there run as fresh CASP files. In the Czech Republic, a low cost base pairs with the Czech National Bank as competent authority. Estonia, the original EU crypto-registration hub, and Latvia round out the Baltic options: Estonia ran at the 18-month outer bound to 1 July 2026, while Latvia's national window closed on 30 June 2025; with the ceiling now passed, conversions in both run as fresh CASP files. Each links through to a full jurisdiction page below.

Malta and Cyprus are the established Mediterranean CASP centres; both ran the 18-month maximum to 1 July 2026. Cyprus required existing national-regime CASPs to file a complete MiCA application with CySEC by 27 February 2026, after which they could continue only until a CySEC decision or the EU-wide ceiling, whichever came sooner.^[9]

Iberia offers a pathway through Spain (CNMV) and Portugal (CMVM/Banco de Portugal), both at the maximum window. Slovakia serves as a low-cost Central European entry whose national window expired in 2025.

Romania and Poland sit in a legal-uncertainty cluster: neither had an enacted national MiCA framework as of June 2026.^[10] Poland is the sharper case. President Karol Nawrocki vetoed the national Crypto-Assets Market Act on 1 December 2025 and again on 12 February 2026, and the Sejm's second override attempt failed on 18 April 2026 by 243 votes to the 263 required, leaving Poland without an authorising competent authority.^[11]

Polish-registered VASPs lost the right to provide crypto-asset services on 1 July 2026, since no implementing legislation was adopted in time; foreign EU-authorised CASPs can passport into Poland, but a Polish national registration offers no route out.

A third version of the Act passed the Sejm in May 2026, and the President vetoed it on 11 June 2026, his third rejection of the framework.^[11] Poland therefore crossed the 1 July ceiling with no national MiCA act in force and no KNF authorisation route open. Operators incorporated in Poland or Romania for a CASP product should plan for relocation or migration to a licensed member state; there is no domestic path to wait for on any reliable timeline.

Passport-state comparison

The nine states with an operating authorisation route share an identical MiCA capital regime and an identical EU/EEA passport; they differ on processing speed, file language, ecosystem maturity, and national transitional status. Romania and Poland are in the table for completeness, not as options: neither has a designated competent authority, so neither can grant an authorisation to passport from.

Germany is shown at the foot as the passporting destination, not a recommended origin. The capital column shows the MiCA Class 1 / Class 2 / Class 3 floor common to every member state.

Year-1 cost gives each state's total first-year range from our licensing matrix, covering advisory and government fees as well as substance. Every row excludes the locked regulatory capital, which is the basis the matrix stores and the only basis on which the column can be read comparatively; Germany's cell is an advisory budget alone, not a Year-1 total. The timeline column shows observed end-to-end ranges from engagement to grant, not the statutory assessment period.

Start with the transitional status column. Every national window has now closed at or before the 1 July 2026 ceiling, so a fresh CASP file is the only path everywhere; only a granted CASP authorisation preserved continuity past 1 July 2026, because Article 143(3) let a legacy VASP continue only until its authority decided or until the ceiling, whichever came first. Capital stays constant by design: it is set by MiCA, not by the member state, so it cannot be used to rank jurisdictions.

The statutory clock is not the constraint. MiCA Article 63 gives every competent authority the same timetable: 25 working days for the completeness check plus 40 working days for the substantive assessment; the clock may be suspended once, for up to 20 working days, while the applicant answers the authority’s first request for further information (Article 63(12)) – later requests do not stop it.^[1]

That is roughly three months of regulator time, yet the observed end-to-end timelines in the table run 3–18 months across the MiCA states (longer still in Germany).

Look to the file, not the authority: preparation of the governance, prudential, and banking evidence before submission, and stop-the-clock information-request rounds after it, dominate the calendar. An operator budgeting to the statutory clock alone is planning to a calendar that does not exist in practice; the firms that reach grant fastest submit a complete file and answer information requests from a prepared desk.

Editorial position: for a boutique-fit operator the practical shortlist is Lithuania, the Czech Republic and Estonia, chosen on regulator familiarity with the specific service set and on how quickly the firm can stand up local substance. Malta belongs on a different shortlist: it is the dearest row in the table and no kind of cheap entry, but for an operator running custody or a trading platform at scale, the MFSA's converted-VFA supervisory track record and Malta's 5% effective rate can repay the premium.

It is a considered trade, not a low-cost route. Germany, France, and the Netherlands are where the clients are, reachable by passport. Romania and Poland, the legal-uncertainty pair, should be avoided as an origin until their national frameworks are enacted.

Key Requirements

Harmonised across every member state, the MiCA CASP file turns on a small number of pillars: prudential capital by service class, governance, and fit-and-proper management, the crypto-asset white paper where the firm offers crypto-assets to the public, and the prudential safeguards over client assets and funds. The substantive rules are identical EU-wide because they are set by the regulation; what differs between states is the regulator's processing speed and evidence expectation, not the bar itself.

Capital classes 1, 2 and 3

MiCA Article 67 and Annex IV set three prudential classes keyed to the services provided.^[12]

Under Article 67(1) the binding figure is the higher of the class floor and one quarter of the prior year's fixed overheads, so a firm with a large cost base holds more than the headline number. Because the figures are fixed by the regulation, capital cannot be used to rank one member state cheaper than another.

Governance and fit-and-proper management

Every CASP must have a management body of sufficiently good repute and with adequate knowledge, skills, and experience under MiCA Article 68, and shareholders or members holding qualifying participations must themselves be fit and proper. Sound administrative and accounting procedures are also required, together with business-continuity arrangements and effective internal control and risk-assessment mechanisms. Practitioner observation: the governance package is where converting VASPs lose the most time, because a national VASP registration rarely required a documented management body, conflicts policy, and outsourcing register at CASP depth, and assembling that evidence cold takes longer than the regulator's own review. A locally substantive board and a senior compliance function are the practical floor.

The crypto-asset white paper

Where a firm offers crypto-assets other than ARTs or EMTs to the public, or seeks their admission to trading, a crypto-asset white paper compliant with MiCA Articles 6 to 8 is required and must be notified to the competent authority.^[13] Its content covers the project, the rights and obligations attached to the crypto-asset, the underlying technology, and the risks, and it must include the prescribed mandatory statements and a summary.

It is a different document from the offering memorandum many operators already hold: the MiCA content schedule is specific, and a marketing-led document will not satisfy it. Where a CASP only provides services in respect of existing crypto-assets it does not issue, the white-paper obligation may not bite, which is part of scoping the file correctly.

Prudential safeguards over client assets

MiCA imposes strict safeguarding of client holdings. Under Article 70, a CASP holding client funds that are not e-money tokens must place them with a central bank or a credit institution by the end of the following business day and segregate them from its own assets, protecting client ownership rights, in particular in the event of insolvency. CASPs providing custody under Article 75 must keep a position register and segregate clients' crypto-assets from their own; they are liable for loss of clients' crypto-assets up to the market value of the assets lost.^[14] Editorial position: the firms that clear review cleanly are the ones whose client-asset segregation and the supporting banking are confirmed before the substantive review opens, not the ones that treat banking as a post-grant task.

AML and operational resilience

Two horizontal regimes sit over the CASP file, and both carry dates that fall on either side of a typical application.^[15][16]

The DORA date is the one that catches applicants: it is already in force for in-scope financial entities, so readiness belongs in the application timeline rather than in a post-grant build.

How Jagelski & Partners Helps

Jagelski & Partners coordinates MiCA CASP authorisation as a single mandate that runs the jurisdiction call, the CASP application, the white paper, governance, and prudential build, banking placement, and the EU passport notification in parallel rather than in sequence. We assess the operator's service set first, then recommend the cheap-entry passport state that fits the firm's substance and timeline as well as its banking tolerance, then sequence the workstreams so the capital, governance, and banking arrive ahead of the regulator asking, against the operator's own market-entry date now that the transitional calendar no longer sets the pace.

Every mandate starts with a service-scope and jurisdiction call. A former VASP running an exchange and custody, needing Class 2 capital and the fastest possible route back to market, gets a different recommendation than an advisory-only firm that needs only Class 1 and can afford a slower file. We do not recommend a member state before mapping the operator's crypto-asset services against MiCA Article 3 and the markets it actually targets, and asking whether it issues any crypto-asset that triggers the white-paper obligation. The recommendation is driven by regulator familiarity with the specific service set and how quickly the firm can stand up local substance, not by headline fee, because the MiCA capital floors are identical everywhere.

Once the state is selected, formation runs in parallel with the CASP application. That means a locally substantive entity with a fit-and-proper management body and registered office in place before the file is submitted, with senior-management interviews scheduled where the competent authority requires them. We coordinate formation through our company formation service at the depth the authorisation requires, not the cheapest depth available, and we scope the file so the firm passports only the services it actually needs.

Banking placement runs alongside, not after. A CASP is a high-risk category at every acquirer and EMI, and the Article 70 requirement to place client funds with a central bank or credit institution by the next business day makes pre-qualification a gating item, not a post-grant task.

Pre-qualification with institutions that have an active programme for licensed crypto firms is the difference between a four-week banking timeline and a four-month one. Editorial position: the operators who land their CASP grant cleanly are not the ones with the strongest paperwork; they are the ones whose client-asset banking was confirmed before the competent authority opened the substantive review. Banking pre-qualification is handled through our high-risk business accounts workflow.

We sequence the white paper, AML manual, governance and conflicts policies, risk-management framework, and DORA readiness into the application timeline so that on the day the authorisation is granted the operator can go live and notify the passport, not start a three-month build.

Post-grant the compliance partner handles the Article 65 passport notifications into the destination markets, ongoing reporting, qualifying-holding changes, and the supervisory milestones that fall due. Broader crypto-licensing context, including the full jurisdiction set, sits on the crypto licensing pillar page.

For licensing work, the partner who carries the mandate pays Jagelski & Partners for the introduction; there is no fee payable by the client. For banking placement coordinated alongside, Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional banking or EMI pricing, and we do not charge a banking onboarding fee. The institutional rates the client sees on banking onboarding documentation are the rates the institution applies.

Frequently Asked Questions

References