How to Add Crypto-Asset Services to a Regulated Financial Institution: Licensing, Banking & Infrastructure

What You Need to Add Crypto-Asset Services

A regulated financial institution adding crypto-asset services in 2026 needs five infrastructure components on top of its existing licensed perimeter: a regulatory routing decision (simplified notification or full authorisation), a custody and settlement layer, a banking-and-fiat-rail extension, a compliance overlay covering MiCA, DORA, and the Transfer of Funds Regulation, and a governance and conflicts framework that ring-fences the crypto business from the existing book.

Unlike a crypto-native start-up that builds from zero, an incumbent bank, MiFID investment firm, electronic-money institution, UCITS management company, or AIFM already holds most of the regulatory chassis. A crypto-asset service provider (CASP) is, under MiCA Article 3(1)(15), a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59.^[1]

For an authorised firm the question is not “how do I become a CASP from scratch” but “which of the ten MiCA crypto-asset services do I want to add, and which existing authorisation does each one fit under.” That decision drives every other component on the stack.

Infrastructure Checklist

Choosing the Right Jurisdiction

Jurisdiction selection for an incumbent adding crypto-asset services is rarely a clean-slate choice. A firm in that position already has its primary regulated entity somewhere, and the practical question is whether to add the crypto perimeter inside the existing licensed entity, set up a sister entity in the same jurisdiction, or establish a new subsidiary in a different regime that better fits the target client base.

Four jurisdictions cover the realistic option set for 2026: Estonia and Cyprus inside the EU MiCA passport, the United Arab Emirates for non-EU institutional reach, and Hong Kong for Asia-Pacific banking and asset-management distribution.

Selection turns on four variables: which authorisation framework already governs the firm, where the target clients are located, whether passporting matters, and whether the institution prefers a single-regulator or a federated-regulator structure. An EU credit institution already authorised under the Capital Requirements Directive can in most cases use MiCA Article 60 to notify the home regulator and add crypto services without a separate CASP authorisation; a non-EU bank cannot.

A MiFID investment firm has the same Article 60 advantage but must map each crypto-asset service in MiCA Article 3 against an existing MiFID activity to identify the gap. A US bank-holding company has neither MiCA Article 60 nor a single federal crypto-asset regime, and selects its non-US base on different grounds.

Jurisdiction Comparison

Choose Estonia if the institution is an EU-authorised credit institution, MiFID investment firm, EMI, UCITS management company, or AIFM that wants an EU route to a MiCA-passportable crypto service line, using either an Article 60 notification to Finantsinspektsioon, where the institution is itself authorised in Estonia, or a full CASP authorisation. Estonia’s driving fact pattern is a Northern or Western European bank or broker with EU clients, where the cost of a new authorisation is the binding constraint. An Article 60 notification goes to the institution’s own home authority,^[1] so a group authorised in another Member State either notifies there and passports in, or seeks full CASP authorisation for an Estonian entity. See the full Estonia crypto licensing guide for the file-progress data.

Choose Cyprus if the institution is a Cyprus Investment Firm (CIF) or a non-EU asset manager that wants a credible EU base with both AIFM and MiCA exposure under a single regulator (CySEC) and an established institutional services ecosystem. An existing Cyprus EMI notifies the Central Bank of Cyprus instead, and only for custody and transfer of the e-money tokens it issues.

Cyprus is the natural EU upgrade for a Middle East or CIS-origin asset manager that wants UCITS, AIFMD, and MiCA together with non-domicile tax treatment for senior management. See the full Cyprus crypto licensing guide.

Choose UAE if the target client base is institutional, sovereign, or high-net-worth, and either ADGM (FSRA-regulated, English common law) or DIFC (DFSA-regulated, English common law) better fits the firm’s existing licensing architecture than an EU base. For a global asset manager extending into crypto, a Middle East private bank adding tokenised investment products, or a brokerage that needs a Gulf and South Asia distribution base, the UAE is the standard non-EU institutional jurisdiction. See the full UAE crypto licensing guide.

Choose Hong Kong if the institution is an Asia-Pacific bank, securities firm, or asset manager already authorised by the HKMA or SFC, and the priority is Asia-Pacific banking and distribution rather than EU passporting. Hong Kong’s strength is the integration between the HKMA Authorised Institution regime, the SFC’s Type 1/4/7/9 licences, and the VATP and stablecoin-issuer frameworks; the weakness is cost and timeline. The Stablecoins Ordinance (Cap. 656) imposes HK$25m paid-up share capital on the issuer, 100% reserve backing, and penalties of up to HK$5m and seven years’ imprisonment for unlicensed issuance; the separate SFC VATP tests require HK$5m paid-up and liquid capital equal to the higher of HK$3m and the basic amount. See the full Hong Kong crypto licensing guide.

Setting Up Your Company

For most institutions adding crypto-asset services, no new entity is needed. Under Article 60 notification (EU) or a variation of the existing licence (UAE, Hong Kong), the crypto perimeter sits inside the existing authorised entity. Only where one of four situations applies does the entity question become material: the firm wants to ring-fence the crypto business from the rest of the group for capital, conflicts, or reputational reasons; the existing authorisation does not extend to the target market and a new jurisdictional base is needed; the existing entity sits in a non-EU jurisdiction and EU access requires a new MiCA-authorised subsidiary; or the firm wants a parallel issuance entity. The permission for that issuer depends on whether the token is an asset-referenced token or an e-money token.^[1]

Where a new entity is needed, the choice between Estonia, Cyprus, UAE, and Hong Kong is the same set canvassed in the previous section, and the formation mechanics are jurisdiction-specific. Estonia uses the osaühing (OÜ); Cyprus uses the private limited company; the UAE uses an ADGM private company limited by shares or DIFC Co Ltd for the financial-services free-zone routes, with the relevant financial-services permission; an ADGM SPV is not an operating company and cannot hire staff; Hong Kong uses the private limited company under the Companies Ordinance (Cap. 622).

An ART issuer established in the Union ordinarily needs authorisation under MiCA Article 21, while a credit institution can use the Article 17 route; the narrow exemptions in Article 16 remain available where their conditions are met. An EMT issuer instead must be a bank or electronic-money institution under Article 48(1). It notifies and publishes the white paper under Article 51 rather than obtaining an extra standalone Title IV authorisation, and separately notifies its intention to offer or seek admission to trading at least 40 working days in advance under Article 48(6). The EMD2 exemptions preserved by Article 48(4)–(5) do not remove the white-paper requirement in Article 48(7).^[1]

Substance and management residency are the most underestimated formation factors for an incumbent adding crypto. EU competent authorities apply substance tests to the management function under MiCA Article 62 read together with MiFID II Article 9, the Capital Requirements Directive, and the relevant national-law overlays; “substance” in this context means a real registered office, real management resident in the jurisdiction, a real MLRO, and real operational personnel.

A holding-company-only entity will not survive the first information request from Finantsinspektsioon or CySEC. The UAE FSRA and DFSA apply equivalent substance and residency standards; Hong Kong applies a similar approach through the SFC’s Manager-in-Charge regime.

Formation by Jurisdiction

Incumbents most often go wrong by incorporating a holding company in a jurisdiction with no operational substance and then discovering, mid-application, that the home regulator treats the operating entity’s parent as part of the regulated perimeter for fit-and-proper purposes. An EU credit institution adding an Estonia OÜ to host its CASP services, with no Estonia-resident management, will face a Finantsinspektsioon information request that effectively requires Estonia substance regardless of where the corporate-group head is registered. The cleaner structure is operating entity in the licensing jurisdiction, one layer of holding above, substance in both places.

Licensing Requirements

A regulated financial institution adding crypto-asset services has two distinct paths in the European Union and a third path outside it: the MiCA Article 60 simplified notification, the full CASP authorisation under MiCA Title V, and the non-EU equivalent (variation of existing UAE FSRA / DFSA permission, HKMA / SFC uplift in Hong Kong, FCA cryptoasset gateway in the UK from 30 September 2026, or state-by-state money-transmitter routing in the US).

Article 60 is the single most important regulatory mechanism for an incumbent because it eliminates the duplicate-authorisation problem that crypto-native firms cannot avoid.

MiCA Article 60 simplified notification

Under MiCA Article 60(1)–(6), the following entities may provide only the crypto-asset services assigned to their institution type, without a separate CASP authorisation, after notifying the competent authority that authorised them:^[1]

• Credit institutions authorised under the Capital Requirements Directive, for the services listed in Article 60(1).
• Central securities depositories authorised under the CSD Regulation, within Article 60(2)’s equivalent scope.
• Investment firms authorised under MiFID II that hold the relevant authorisation for each equivalent crypto-asset service.
• Market operators authorised under MiFID II, for operating a trading platform under Article 60(6).
• Electronic-money institutions authorised under EMD2, only for custody and transfer of their own issued EMTs.
• UCITS management companies authorised under the UCITS Directive, within Article 60(5)’s equivalent scope.
• Alternative investment fund managers authorised under the AIFMD, within Article 60(5)’s equivalent scope.

Notification must be made at least 40 working days before the entity starts providing crypto-asset services and must contain the information set out in MiCA Article 60(7): a programme of operations; the AML/CFT internal controls, risk-assessment framework and business continuity plan; ICT and security documentation; the procedure for segregating clients’ crypto-assets and funds; and, service by service, the custody policy, trading-platform rules, commercial and pricing policy, execution policy, evidence of advisers’ and portfolio managers’ competence, and transfer arrangements.^[1]

Under Article 60(8), the competent authority assesses completeness within 20 working days of receipt. If information is missing, it sets a deadline of no more than 20 working days to supply it; the advance-notice period is suspended until that deadline, but further requests do not suspend it again. The entity may not start the notified services while the notification remains incomplete.^[1]

This is a structural distinction in Article 60 itself: a credit institution under Article 60(1) may provide any of the ten MiCA crypto-asset services under a single notification, whereas an investment firm under Article 60(3) may provide only the crypto-asset services that are equivalent to the MiFID II investment services for which it is already specifically authorised under Directive 2014/65/EU. ESMA Q&A 2088 (29 January 2024) confirms two practical points on top of the statutory text: the credit-institution notification operates without prejudice to the national procedures transposing Directive 2013/36/EU (CRD) for the authorisation of the underlying banking activities (per MiCA Recital 78), and a credit institution that does not hold the underlying CRD authorisation for a service such as custody may in practice have difficulty evidencing the Article 60(7) information requirements for the corresponding crypto-asset service.^[19]

Article 60 Level 2 instruments. Delegated Regulation (EU) 2025/303, adopted by the European Commission on 31 October 2024, and Implementing Regulation (EU) 2025/304 are both in force from 12 March 2025. The Delegated Regulation sets the regulatory technical standards specifying the information an Article 60 notification must contain; the Implementing Regulation sets the implementing technical standards on its standard forms, templates, and procedures.^[18][20]

Since 12 March 2025 a notification uses the form in the Annex to Implementing Regulation (EU) 2025/304, the competent authority acknowledges receipt within five working days, and later changes to the notified information are notified without undue delay on the same form.^[18][20]

Notification under Article 60 does not displace the applicable conduct, organisational, custody, and segregation requirements of MiCA Title V. Article 60(10), however, expressly exempts entities notifying under paragraphs 1–6 from Article 67, so the notifier remains under its sectoral prudential regime rather than acquiring the Annex IV floor or the quarter-fixed-overheads test through this route.^[1]

Service scope depends on the institution type: a credit institution may notify the listed services, an investment firm only the Article 60(3) equivalents for which it has the relevant MiFID II permission, and an EMI only custody and transfer of its own issued EMTs under Article 60(4).^[1]

For project planning, the load-bearing work is extending the existing MiFID or CRR control stack to absorb on-chain settlement, blockchain-address sanctions screening, custody-key governance, and the DORA third-party register entries for the crypto-execution and custody-technology providers. That operational uplift typically runs three to six months in parallel with the Article 60 file rather than after it.

Equivalence mapping between MiFID II investment services and MiCA crypto-asset services

MiCA Article 60(3) sets out an equivalence table between the MiFID II investment services in Section A of Annex I and the ten MiCA crypto-asset services in Article 3(1)(16).^[1] The mapping is direct:

• Reception and transmission of orders: maps to the same crypto-asset service.
• Portfolio management: maps to portfolio management of crypto-assets.
• Investment advice: maps to advice on crypto-assets.
• Execution of orders: maps to execution of orders for crypto-assets on behalf of clients.
• Placing of financial instruments: maps to placing of crypto-assets.
• Operation of an MTF or OTF: maps to the operation of a trading platform for crypto-assets.
• Safekeeping and administration of financial instruments for the account of clients under MiFID II Annex I Section B point 1: maps to custody and administration of crypto-assets on behalf of clients.
• Dealing on own account under MiFID II Annex I Section A point 3: maps to both exchange of crypto-assets for funds and exchange of crypto-assets for other crypto-assets.

Investment firms may provide each mapped crypto-asset service only where they already hold the relevant MiFID II permission. Transfer services have no Article 60(3) MiFID II equivalent and therefore need a separate permission route. The mappings do not create a universal menu for every financial institution; banks, central securities depositories, market operators, fund managers, and electronic-money institutions each remain within the distinct scope and conditions assigned to them by Article 60.^[1]

Capital and own funds

Article 60(10) exempts an eligible financial entity notifying under Article 60(1)–(6) from MiCA Article 67. Its existing sectoral prudential requirements continue to apply, but the notification route does not add the Annex IV class floor or Article 67’s quarter-fixed-overheads safeguard.^[1]

A separate ordinary CASP authorisation remains subject to Article 67. For that route, MiCA Annex IV sets three classes:^[1]

• Class 1: EUR 50,000 (reception and transmission, advice, execution, placing, portfolio management, transfer).
• Class 2: EUR 125,000 (custody and administration, exchange).
• Class 3: EUR 150,000 (full Class 2 plus operation of a trading platform).

For an ordinary CASP, Article 67 requires prudential safeguards equal to the higher of the applicable Annex IV floor and one quarter of the preceding year’s fixed overheads. That ordinary-authorisation rule must not be imported into the distinct Article 60 notifier route.^[1]

MiFID II / MiCA boundary

Crypto-assets that qualify as financial instruments under MiFID II Section C of Annex I (transferable securities, money-market instruments, units in collective investment undertakings, derivatives) remain inside MiFID II and outside MiCA. MiCA Recital 14 and Article 2(4) draw this boundary explicitly: a tokenised bond, a tokenised equity, a tokenised fund unit, or a security token is regulated under MiFID II, the Prospectus Regulation, and the relevant national-law overlays, not under MiCA.^[2]

Operational since 23 March 2023, the EU DLT Pilot Regime (Regulation (EU) 2022/858) provides a parallel sandbox for DLT-based market infrastructures.^[6] The boundary matters because firms adding tokenised securities, tokenised funds, or asset-referenced derivative products are doing MiFID II business with a DLT settlement layer, and the authorisation route is a MiFID II variation rather than a CASP authorisation.

Reverse solicitation under MiCA Article 61

A third-country firm may provide crypto-asset services to clients established in the EU at the exclusive initiative of the client, without authorisation under MiCA, under MiCA Article 61(1). The carve-out is narrow. ESMA Guidelines on reverse solicitation under MiCA (ESMA35-1872330276-2030), published 26 February 2025 and applicable from 27 April 2025, list targeted advertising into the EU, EU country-code domains, sponsorship of EU events, paid EU-based influencers, affiliate or referral programmes that direct EU traffic, and websites in an EU language not customary in international finance among the signs that a firm is likely to be soliciting EU clients, judged on all the facts; a firm that solicits EU clients cannot rely on the carve-out.^[7]

Article 61(2) bars the firm from marketing new types of crypto-assets or crypto-asset services to a client who came at its own initiative, and the Guidelines permit same-type offers only in the context of the original transaction.^[7] The relationship specifically relating to the service the client initiated may continue under Article 61(1), but the exemption cannot become a distribution channel: a US or APAC institution that plans to acquire EU clients, or to market to them beyond the original transaction, needs an EU subsidiary or an Article 60 notification through an EU-authorised entity.

Non-EU licensing pathways

United Kingdom. In the UK, transition runs from the FCA cryptoasset registration regime under the Money Laundering Regulations 2017 to a full regulated-activities regime under SI 2026/102 (the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made 4 February 2026). The FCA’s application period runs from 30 September 2026 to 28 February 2027, and the regime commences fully on 25 October 2027; firms already authorised under FSMA, such as UK banks, apply to vary their existing Part 4A permission to add the new regulated cryptoasset activities.^[11]

United States. A federal-state matrix operates. Signed into law on 18 July 2025, the GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025) becomes effective on the earlier of 18 January 2027 or 120 days after the primary federal payment-stablecoin regulators issue final implementing regulations (Section 20).

Treasury’s interim final rule of 30 September 2026 establishes procedures for certifying state regulatory regimes. Submission of certifications still awaits Paperwork Reduction Act approval and Treasury notification; certification of a state regime does not itself authorise an issuer. The rule identifies 18 January 2027 as the GENIUS Act’s effective date.^[21]

State money-transmitter licences remain required for non-bank crypto-asset transfer services in most states; OCC Interpretive Letter IL 1183 of 7 March 2025 rescinded the IL 1179 supervisory non-objection process and reaffirmed crypto-asset custody as permissible, and IL 1184 of 7 May 2025 confirmed that national banks may provide and outsource crypto-asset custody and execution services, subject to safe and sound operation, applicable law and appropriate risk management, including third-party risk management.^[17]

Alongside GENIUS, the Digital Asset Market Clarity (CLARITY) Act, which addresses crypto-asset market structure and the SEC/CFTC perimeter for digital commodities, passed the U.S. House on 17 July 2025 (294 to 134) and was advanced by the Senate Banking Committee on 14 May 2026 (15 to 9); on 15 September 2026 the Senate failed to invoke cloture on the motion to proceed (49 to 50), a motion to reconsider was entered, and the bill has not been enacted.

United Arab Emirates. Three routes compared here are VARA for Dubai virtual-asset activity, ADGM FSRA for Abu Dhabi free-zone financial services, and DIFC DFSA for Dubai financial-centre activity, each with its own permission structure and capital floors. The wider UAE perimeter also includes the federal CMA, which replaced SCA on 1 January 2026, and CBUAE for payment-token services. An institutional firm typically routes through ADGM or DIFC rather than VARA; a retail-facing crypto exchange routes through VARA.

Hong Kong. VATP and tokenised-securities activity fall to the SFC; stablecoin issuance and Authorised-Institution banking activity fall to the HKMA. In force since 1 August 2025, the Stablecoins Ordinance (Cap. 656) requires a licence to issue any fiat-referenced stablecoin in Hong Kong, or a Hong Kong dollar-referenced stablecoin anywhere.^[14]

Banking

Banking is rarely the binding constraint for an incumbent adding crypto-asset services in the way it is for a crypto-native start-up. Correspondent banking, treasury operations, and SEPA / SWIFT access are already in place for the existing book. Crypto-specific banking questions are narrower: where does the crypto-fiat conversion sit, which segregated client-money account holds the fiat leg of crypto-asset trades, and which institution clears the on-ramp and off-ramp flows.

Conversion architecture is largely an operational question, but client-fund placement is a regulatory one. MiCA Title V does not prescribe a single banking model, and Article 60(10) does not exempt a notifying firm from Article 70. Three settlement components make up the standard model: a fiat segregated client-money account for client deposits and withdrawals, a treasury account for the firm’s own balances, and a flow account for the conversion leg between client crypto and client fiat.^[1]

Article 70(5) disapplies the client-fund rules in Article 70(2) and (3) to a CASP that is itself a credit institution, EMI or payment institution; for an existing bank or EMI, the accounts can sit inside the institution and its sectoral rules still apply. A MiFID investment firm, UCITS management company, or AIFM is not exempt on that basis. Where it holds client funds other than EMTs, whether in the client-money account or a flow account carrying client fiat, it must protect clients’ ownership rights, must not use those funds for its own account, and must place them with a credit institution or a central bank by the end of the business day following receipt, in an account separately identifiable from its own-fund accounts.^[1]

An account at an EMI is not automatically that placement. The treasury account holds the firm’s own balances and can sit at one or more credit institutions or EMIs that have explicit crypto-business onboarding capability. A payment flow run by a separately authorised payment service provider, where the firm never holds the client funds itself, is a different arrangement from the firm’s own Article 70 placement.

The cross-border banking complication for an incumbent extending into crypto is that not every existing correspondent will tolerate crypto-flows on the wire. A European bank’s US correspondent may impose new flow-monitoring conditions, restrict the volume of stablecoin-related settlement, or in some cases withdraw from the relationship.

Jagelski & Partners’ partner network spans ninety-plus banking and payment institutions across the EU, UK, Middle East, Asia-Pacific, Caribbean, and Americas, including institutions with institutional-grade crypto onboarding. Through that partner network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025.

We match the firm to one or more institutions based on the specific crypto-asset services, the client geography, and the existing correspondent footprint, and we pre-qualify each institution before any formal application goes in. There is no markup and no onboarding fee on the banking line.

Ongoing Compliance

Compliance is where the gap between a crypto-native firm and an incumbent adding crypto-asset services narrows fastest. The incumbent is already running MiFID II conduct and conflicts frameworks, MAR market-abuse surveillance, AML transaction monitoring, suspicious activity reporting, and ICT-risk governance. Adding crypto-asset services extends each of these into a new asset class rather than building from zero, but the extension is non-trivial: most existing systems were calibrated for cash equities, fixed income, FX, and derivatives, and the parametrisation for crypto-asset volatility, on-chain flow-tracing, sanctions screening against blockchain addresses, and DLT-specific operational risk has to be added.

Dual-regime obligations

A MiFID investment firm providing crypto-asset services under Article 60 notification operates under MiFID II conduct rules and MiCA Title V conduct rules in parallel; where the two diverge, the firm applies the more stringent requirement. Within MiCA Title V, the conduct overlay covers fair-and-honest treatment of clients (Article 66), conflicts of interest (Article 72), outsourcing (Article 73), and the operating rules for trading platforms (Article 76). Title II separately governs offers to the public and admission to trading, including the white paper, and Title VI governs market abuse.

For an existing trading venue operator extending into crypto-asset trading platforms, the MiFID II MAR regime sits on top of MiCA Title VI market-abuse provisions, and the firm must run a single market-abuse surveillance function that catches both.

DORA

Since 17 January 2025 the Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied to credit institutions, investment firms, payment institutions, electronic-money institutions, central securities depositories, central counterparties, alternative investment fund managers, UCITS management companies, and CASPs.^[3] An incumbent already in DORA scope as a credit institution or MiFID firm is already subject to DORA for its existing business; scope alone does not establish compliance. Adding crypto-asset services requires an assessment of actual compliance and gaps in ICT risk management, as well as extension of the ICT third-party risk register, the digital operational resilience testing programme, and the major ICT-related incident reporting framework to include crypto-asset service providers, custody-technology providers, and any DLT-infrastructure dependencies.

Anti-money-laundering and the Transfer of Funds Regulation

The recast Transfer of Funds Regulation (Regulation (EU) 2023/1113) has applied to crypto-asset service providers since 30 December 2024, in parallel with MiCA’s full application date.^[4] Originator and beneficiary information is required under the TFR on every crypto-asset transfer, with no de-minimis threshold for CASP transfers; for an existing bank or EMI, this extends the existing FATF Recommendation 16 wire-transfer infrastructure to the crypto rail.

From 10 July 2027 the new AML Regulation (Regulation (EU) 2024/1624) applies generally, including to CASPs, tightening the customer-due-diligence, beneficial-ownership, and risk-based-supervision framework; professional football clubs and football agents enter its scope from 10 July 2029.^[5]

Conflicts of interest and internal segregation

MiCA Article 72, read together with MiFID II Article 23 and the relevant national overlays, requires CASPs to identify, prevent, manage, and disclose conflicts of interest. For an incumbent providing crypto-asset services alongside an existing investment-services book, the conflicts framework must address: cross-trading between crypto and non-crypto assets, internalisation of client crypto orders, proprietary trading in crypto-assets that the firm also recommends to clients, and the conflicts that arise where the firm acts as both custodian and exchange counterparty. Internal segregation typically requires functional separation, Chinese walls, and where necessary structural separation through a sister entity or sub-licensed subsidiary.

Upcoming regulatory milestones

The next milestones are the UK application-window close, the MiCA review, and the UK regime commencement. Under Article 140, the European Commission’s MiCA review is scheduled for 30 June 2027, with consultation activity during 2026. The UK FCA cryptoasset authorisation gateway opened on 30 September 2026; the application period closes on 28 February 2027, and UK-domiciled banks and brokers already authorised under FSMA apply within it to vary their existing permissions before the new regime commences on 25 October 2027.^[11]

Realistic Timeline and Costs

For an incumbent adding crypto-asset services in 2026, the realistic end-to-end timeline runs from four months (MiCA Article 60 notification through an existing EU-authorised entity) to eighteen months (full CASP authorisation in a new EU subsidiary, or a non-EU regime with no existing footprint). Procedurally, the notification path is compressed; the authorisation path is not.

Where the firm holds an existing CRR-authorised credit-institution licence or an EU MiFID II investment firm authorisation, the timeline anchor is the 40 working-day notification window plus three to six months of parallel preparation for the operational and compliance overlay.

Where the firm needs a new authorisation, the anchor is the regulator’s authorisation timeline, which sits in the six to eighteen-month range depending on jurisdiction and file quality.

Professional fees for an Article 60 notification through an existing EU entity are quoted case by case by the independent specialist. The scope depends on the crypto-asset services to be notified and the work needed to adapt the existing operational and compliance documentation.

A full CASP authorisation in a new EU subsidiary requires a separate professional-fee quote. Ask the specialist to state the services covered, assumptions, exclusions, and any additional charges for regulator follow-up.

Professional fees for the UAE FSRA or DFSA route and for a Hong Kong VATP licence are also quoted case by case by the independent specialist. Regulatory capital, banking float, and technology procurement sit outside that quote, so ask the specialist to state which legal, regulatory, compliance, and project-management work it covers. Jagelski & Partners takes no fee from the client on any line; independent specialists quote and charge for their own work.

Indicative Cost by Phase

Inside these ranges, the single biggest cost driver is the custody-and-technology line. Firms that elect self-custody with on-chain settlement carry a much heavier integration burden than firms that sub-custody to a qualified custodian and treat the crypto-asset book as a settlement layer on top of an external infrastructure. Regulation does not force the choice: MiCA Article 75 permits both. Instead the choice is operational and strategic, and it is the most important architectural decision the project will make.

Frequently Asked Questions

References