MiCA License: CASP Authorisation and the 1 July 2026 Deadline

What Is MiCA / CASP Authorisation?

MiCA, the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), is the EU-wide framework for crypto-asset markets. A crypto-asset service provider (CASP) authorisation is the individual licence a firm obtains from a national competent authority under MiCA Article 63 to provide one or more of the ten crypto-asset services listed in Article 3.^[1] MiCA is the rulebook; the CASP authorisation is the permission to operate under it. The two are distinct legal objects, which is why converting a national VASP registration into a CASP authorisation is a fresh application, not a renewal.

MiCA applied in two stages. The stablecoin titles, Title III for asset-referenced tokens (ART) and Title IV for e-money tokens (EMT), applied from 30 June 2024. The CASP regime under Title V applied from 30 December 2024, with a transitional regime under Article 143(3) letting pre-existing national VASPs continue under their old registration for a national window of up to 18 months.^[2] That window has a hard EU-wide ceiling, and the ceiling is now in sight.

A CASP authorisation from any one EU or EEA member state passports the authorised services across all 27 member states plus Iceland, Liechtenstein and Norway under MiCA Article 65, after a host-state notification.^[3] The three EEA EFTA states sit inside the passport via EEA Joint Committee Decision No 41/2025 of 20 February 2025.^[4] The United Kingdom, Switzerland and Gibraltar sit outside the regime and require local authorisation for local clients.

The decision is rarely about finding the cheapest member state. It is about finding the lowest-cost state whose regulator, banking ecosystem and substance expectation the operator can actually meet, then passporting from there into the markets that matter. That short sentence is the entire framing of this page. Operators comparing states across capital, timeline and service scope can use the interactive crypto-licensing comparison tool alongside it.

Who Needs a CASP Authorisation?

A CASP authorisation is required by any firm providing one or more of the ten crypto-asset services in MiCA Article 3 to clients in the Union. The trigger is the activity, not the firm's label: holding client crypto-assets, running an exchange or trading venue, executing or transmitting client orders, placing crypto-assets, advising, managing portfolios, or transferring crypto-assets on behalf of clients all fall inside the perimeter. The operators that need to act now are EU VASPs whose national registration expires at the Article 143(3) ceiling.

The ten regulated crypto-asset services

MiCA Article 3 enumerates the services that require authorisation: custody and administration of crypto-assets on behalf of clients; operation of a trading platform; exchange of crypto-assets for funds; exchange of crypto-assets for other crypto-assets; execution of orders on behalf of clients; placing of crypto-assets; reception and transmission of orders on behalf of clients; advice on crypto-assets; portfolio management on crypto-assets; and transfer services for crypto-assets on behalf of clients. A firm is authorised for the specific services it applies for and can passport only those, which is why scoping the service set correctly at application stage is the first decision on every mandate.

EU VASPs facing the 1 July 2026 deadline

The largest population is existing EU VASPs. Any firm holding a national crypto registration, for example a former Estonian, Lithuanian or French VASP, must convert to a CASP authorisation to keep serving EU clients past the transitional ceiling. The conversion is not automatic: the CASP file is materially heavier than the old VASP registration, requiring a programme of operations, a governance and prudential package, and a crypto-asset white paper where the firm offers or seeks admission to trading of crypto-assets other than ARTs or EMTs under MiCA Articles 6 to 8. Firms that wait until spring 2026 to start risk missing the window for a complete application.

The conversion gap

The scale of the gap is the urgency. Only around 204–210 CASPs were authorised across 23 member states by mid-May 2026, against more than 1,200 pre-MiCA national VASP registrations.^[5] The distribution is concentrated: Germany held roughly 53 (more than a quarter of the EU total), the Netherlands around 25, France and Norway about 13 each, Malta 12, Spain around 11, Lithuania around 10, and Austria around 9. Most pre-MiCA VASPs have not yet converted, which means the regulators face a queue and the firms that file early are the ones most likely to clear review before the ceiling. Practitioner observation: the slowest part of a conversion is rarely the regulator; it is the operator assembling the governance, white paper and prudential evidence the CASP file demands and the old VASP registration never did.

Non-EU operators and reverse-solicitation limits

Non-EU operators serving EU clients need an EU-incorporated CASP entity. Reverse solicitation under MiCA Article 61 was tightened by ESMA Guidelines published 26 February 2025 and is the exception, not the rule.^[6] The exemption is operationally narrow: targeted advertising, EU-language websites, country-code TLDs, sponsorship of EU events, EU-based influencers, and affiliate or referral programmes that direct EU traffic all defeat it. ESMA also confines further or same-type marketing to a reverse-solicited client to the context of the original transaction, after which CASP authorisation is required for any ongoing relationship. An offshore entity cannot rely on Article 61 as a market-entry strategy; a non-EU operator cannot scale a recurring EU-client relationship through reverse solicitation alone. The reverse-solicitation explainer sets out the operational triggers in full.

Where to Get Licensed

Because a CASP authorisation passports across the whole EU and EEA, the member state of authorisation is a cost-and-speed decision, not a market-access one. The minimum capital is set by MiCA and identical everywhere; what varies is the advisory cost, the regulator's processing speed, the file language, and the local substance expectation. The efficient play for a boutique-fit operator is to license in a cheap-entry passport state and passport into the larger markets, including Germany, rather than license directly where the file is heaviest.

The license-cheap, passport-in thesis

The structural fact that drives the strategy is concentration of demand, not concentration of supply. Germany held roughly 53 of the 204–210 CASPs authorised across the EU by mid-May 2026, more than a quarter of the total, and is the single largest destination for inbound passporting: 151 of the 180 cross-border CASPs in the register target the German market.^[7] Most of those firms did not license in Germany. They licensed in a cheaper-entry state and passported in, which is the route 86% of authorised CASPs have used. Germany is best understood as a destination you reach by passport, not an origin you license in.

Unlike a cheap-entry CASP file in Lithuania or the Czech Republic, the German BaFin route is slow and expensive: 200-plus-page application files, 12 to 24 month timelines, and advisory budgets of EUR 80,000 to EUR 200,000, with a cohort dominated by large, well-capitalised incumbents.^[8] For an operator that needs a grant before the 1 July 2026 ceiling and does not have a Tier-1 compliance team in place, that path carries both timeline and fit risk. The same EU market is reachable for a fraction of the cost and time from a passport state, and the resulting authorisation is identical in legal effect because MiCA harmonises the substantive rules. Germany, France and the Netherlands are explainer territory on this page, not the recommended route.

The cheap-entry passport states

The cheap-entry cluster spans the Baltics, Central Europe and the Iberian peninsula. Each is an EU member state whose CASP authorisation passports across the Union, and each carries the same MiCA capital floors; they differ on processing speed, file language, ecosystem maturity and how far the national transitional window has already run. The table below compares the eleven states most relevant to a boutique-fit MiCA conversion, with the German destination shown for contrast at the foot.

Lithuania is the most-used Baltic entry point, with a deep fintech ecosystem and a regulator, the Bank of Lithuania, experienced in onboarding crypto and EMI firms; its national VASP transition expired during 2025, so conversions there run as fresh CASP files. The Czech Republic pairs a low cost base with the Czech National Bank as competent authority. Estonia, the original EU crypto-registration hub, and Latvia round out the Baltic options: Estonia runs at the 18-month outer bound to 1 July 2026, while Latvia's national window closed on 30 June 2025, so Latvian conversions also run as fresh CASP files. Each links through to a full jurisdiction page below.

Malta and Cyprus are the established Mediterranean CASP centres, both at the 18-month maximum running to 1 July 2026; Cyprus required existing national-regime CASPs to file a complete MiCA application with CySEC by 27 February 2026, after which they may continue only until a CySEC decision or the EU-wide ceiling, whichever is sooner.^[9] Spain (CNMV) and Portugal (CMVM/Banco de Portugal) are the Iberian options, both at the maximum window. Slovakia is a low-cost Central European entry whose national window expired in 2025.

Romania and Poland sit in a legal-uncertainty cluster: neither had an enacted national MiCA framework as of June 2026.^[10] Poland is the sharper case. President Karol Nawrocki vetoed the national Crypto-Assets Market Act on 1 December 2025 and again on 12 February 2026, and the Sejm's second override attempt failed on 18 April 2026 by 243 votes to the 263 required, leaving Poland without an authorising competent authority.^[11] Polish-registered VASPs lose the right to provide crypto-asset services on 1 July 2026 unless implementing legislation is adopted first; foreign EU-authorised CASPs can passport into Poland, but Polish VASPs cannot passport out.

A third version of the Act passed the Sejm in May 2026 and was transmitted to the President. Until it is signed and in force, operators incorporated in Poland or Romania for a CASP product should plan for relocation or migration against the 1 July 2026 ceiling regardless.

Passport-state comparison

The eleven cheap-entry member states share an identical MiCA capital regime and an identical EU/EEA passport; they differ on processing speed, file language, ecosystem maturity and national transitional status. Germany is shown at the foot as the passporting destination, not a recommended origin. The capital column shows the MiCA Class 1 / Class 2 / Class 3 floor common to every member state. The Year-1 cost column shows each state's total first-year range from our licensing matrix, covering advisory, government fees and substance, with capital treatment as marked; the timeline column shows observed end-to-end ranges from engagement to grant, not the statutory assessment period.

The column to read first is the transitional status. Where a national window has expired or sits in the legal-uncertainty cluster, a fresh CASP file is the only path, and the firms with a complete application on record before 1 July 2026 are the ones that keep operating without a gap. The capital column is constant by design: it is set by MiCA, not by the member state, so it cannot be used to rank jurisdictions.

The statutory clock is not the constraint. MiCA Article 63 gives every competent authority the same timetable: 25 working days for the completeness check plus 40 working days for the substantive assessment; the clock may be suspended once, for up to 20 working days, while the applicant answers the authority’s first request for further information (Article 63(10)) – later requests do not stop it.^[1] That is roughly three months of regulator time, yet the observed end-to-end timelines in the table run 3–18 months across the MiCA states (longer still in Germany).

The gap is the file, not the authority: preparation of the governance, prudential and banking evidence before submission, and stop-the-clock information-request rounds after it, dominate the calendar. An operator budgeting to the statutory clock alone is planning to a calendar that does not exist in practice; the firms that reach grant fastest submit a complete file and answer information requests from a prepared desk.

Editorial position: for a boutique-fit operator the practical shortlist is Lithuania, the Czech Republic, Estonia or Malta, chosen on regulator familiarity with the specific service set and on how quickly the firm can stand up local substance. Germany, France and the Netherlands are where the clients are, reachable by passport. The legal-uncertainty pair, Romania and Poland, should be avoided as an origin until their national frameworks are enacted.

Key Requirements

The MiCA CASP file turns on a small number of pillars that are harmonised across every member state: prudential capital by service class, governance and fit-and-proper management, the crypto-asset white paper where the firm offers crypto-assets to the public, and the prudential safeguards over client assets and funds. The substantive rules are identical EU-wide because they are set by the regulation; what differs between states is the regulator's processing speed and evidence expectation, not the bar itself.

Capital classes 1, 2 and 3

MiCA Article 67 and Annex IV set three prudential classes keyed to the services provided. Class 1 requires EUR 50,000 of minimum capital and covers reception and transmission of orders, execution, placement, advice, and portfolio management. Class 2 requires EUR 125,000 and adds custody and administration of crypto-assets and the exchange of crypto-assets for funds or other crypto-assets. Class 3 requires EUR 150,000 and covers operating a trading platform.^[12] The binding figure is the higher of the class floor and one quarter of the prior year's fixed overheads under Article 67(1), so a firm with a large cost base holds more than the headline number. Because the figures are fixed by the regulation, capital cannot be used to rank one member state cheaper than another.

Governance and fit-and-proper management

Every CASP must have a management body of sufficiently good repute and with adequate knowledge, skills and experience under MiCA Article 68, and shareholders or members holding qualifying participations must themselves be fit and proper. The firm needs sound administrative and accounting procedures, business-continuity arrangements, and effective internal control and risk-assessment mechanisms. Practitioner observation: the governance package is where converting VASPs lose the most time, because a national VASP registration rarely required a documented management body, conflicts policy and outsourcing register at CASP depth, and assembling that evidence cold takes longer than the regulator's own review. A locally substantive board and a senior compliance function are the practical floor.

The crypto-asset white paper

A firm that offers crypto-assets other than ARTs or EMTs to the public, or seeks their admission to trading, must draw up a crypto-asset white paper compliant with MiCA Articles 6 to 8 and notify it to the competent authority.^[13] The white paper sets out the project, the rights and obligations attached to the crypto-asset, the underlying technology, and the risks, and it must include the prescribed mandatory statements and a summary. It is a different document from the offering memorandum many operators already hold: the MiCA content schedule is specific, and a marketing-led document will not satisfy it. Where a CASP only provides services in respect of existing crypto-assets it does not issue, the white-paper obligation may not bite, which is part of scoping the file correctly.

Prudential safeguards over client assets

MiCA imposes strict safeguarding of client holdings. Under Article 70, a CASP holding client funds that are not e-money tokens must place them with a central bank or a credit institution by the end of the following business day, segregate them from its own assets, and protect client ownership rights, in particular in the event of insolvency. CASPs providing custody under Article 75 must keep a position register, segregate clients' crypto-assets from their own, and are liable for loss of clients' crypto-assets up to the market value of the assets lost.^[14] Editorial position: the firms that clear review cleanly are the ones whose client-asset segregation and the supporting banking are confirmed before the substantive review opens, not the ones that treat banking as a post-grant task.

AML and operational resilience

Two horizontal regimes sit over the CASP file. On AML, the EU AML Reform Package (Regulation (EU) 2024/1624, the AMLR; Regulation (EU) 2024/1620 establishing AMLA; Directive (EU) 2024/1640) applies from 10 July 2027, with AMLA operational since 1 July 2025; the AMLR prohibition on anonymous accounts and accounts using anonymity-enhancing coins under Article 79 and the EU-wide EUR 10,000 cash-payment limit under Article 80 both take effect from 10 July 2027.^[15] On operational resilience, the Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to in-scope financial entities, mandating an ICT risk-management framework, a register of ICT third-party providers, and incident reporting; CASPs should size DORA readiness into the application timeline rather than treat it as a post-grant build.^[16]

How Jagelski & Partners Helps

Jagelski & Partners coordinates MiCA CASP authorisation as a single mandate that runs the jurisdiction call, the CASP application, the white paper, governance and prudential build, banking placement, and the EU passport notification in parallel rather than in sequence. We assess the operator's service set first, then recommend the cheap-entry passport state that fits the firm's substance, timeline and banking tolerance, then sequence the workstreams so the capital, governance and banking arrive ahead of the regulator asking, with the 1 July 2026 ceiling as the fixed point.

The first work item on every mandate is a service-scope and jurisdiction call. A converting VASP running an exchange and custody, needing Class 2 capital and a fast grant before the ceiling, gets a different recommendation than an advisory-only firm that needs only Class 1 and can afford a slower file. We do not recommend a member state before mapping the operator's crypto-asset services against MiCA Article 3, the markets it actually targets, and whether it issues any crypto-asset that triggers the white-paper obligation. The recommendation is driven by regulator familiarity with the specific service set and how quickly the firm can stand up local substance, not by headline fee, because the MiCA capital floors are identical everywhere.

Once the state is selected, we run formation in parallel with the CASP application. That means a locally substantive entity with a fit-and-proper management body and registered office in place before the file is submitted, with senior-management interviews scheduled where the competent authority requires them. We coordinate formation through our company formation service at the depth the authorisation requires, not the cheapest depth available, and we scope the file so the firm passports only the services it actually needs.

The banking placement runs alongside, not after. A CASP is a high-risk category at every acquirer and EMI, and the Article 70 requirement to place client funds with a central bank or credit institution by the next business day makes pre-qualification a gating item, not a post-grant task. Pre-qualification with institutions that have an active programme for licensed crypto firms is the difference between a four-week banking timeline and a four-month one. Editorial position: the operators who land their CASP grant cleanly are not the ones with the strongest paperwork. They are the ones whose client-asset banking was confirmed before the competent authority opened the substantive review. Banking pre-qualification is handled through our high-risk business accounts workflow.

The white paper, AML manual, governance and conflicts policies, risk-management framework, and DORA readiness are sequenced into the application timeline so that on the day the authorisation is granted the operator can go live and notify the passport, not start a three-month build. Post-grant we handle the Article 65 passport notifications into the destination markets, ongoing reporting, qualifying-holding changes, and the supervisory milestones that fall due. The broader crypto-licensing context, including the full jurisdiction set, sits on the crypto licensing pillar page.

For licensing work, Jagelski & Partners is engaged by the client on a fixed-fee or fixed-fee-plus-success basis depending on the mandate. For banking placement coordinated alongside, Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional banking or EMI pricing, and we do not charge a banking onboarding fee. The institutional rates the client sees on banking onboarding documentation are the rates the institution applies.

Frequently Asked Questions

References