This article covers the crypto-asset service provider (CASP) licence under the EU Markets in Crypto-Assets Regulation (MiCA). We explain which services need a licence and who can rely on a notification instead, how long the law gives regulators to review an application, which documents go to the national regulator and why regulators most often refuse or delay a licence. Everything is based on the text of MiCA, European Commission acts and documents of the European Securities and Markets Authority (ESMA).
Checked on 31 October 2026. Rules and sources are current as of this date.
Who needs a CASP licence
MiCA requires a licence from any company that, on a professional basis, provides clients in the EU with at least one of ten crypto-asset services (Article 3(1)(16) and Article 59). It does not matter whether the company calls itself an exchange, an exchanger, a wallet or a broker. What matters is what it actually does for the client.
| Service under MiCA | Business example | Minimum capital |
|---|---|---|
| Reception and transmission of orders, execution of orders, placing of crypto-assets, advice, portfolio management, transfer services | Broker, buy app, token sale platform, transfer service | EUR 50,000 |
| Custody of crypto-assets for clients, exchange of crypto-assets for funds or for other crypto-assets | Custodial wallet, exchanger, OTC desk | EUR 125,000 |
| Operation of a trading platform | Crypto exchange with an order book | EUR 150,000 |
Capital follows the most “expensive” service you provide. If a quarter of the company’s fixed overheads for the previous year is higher, that figure applies instead (Article 67 and Annex IV). The requirement can be met with own funds, an insurance policy or a combination of both. “Fixed overheads” has a specific regulatory meaning here. According to the European Commission’s answer of 18 February 2026 (ESMA Q&A 2349), the calculation includes all overhead expenses, fixed and variable, with only the deductions listed in Article 67(3).
Notification instead of a licence
Banks, investment firms, central securities depositories, e-money institutions, UCITS management companies, authorised alternative investment fund managers (AIFMs) and market operators already hold licences under other EU acts. Under Article 60 they can provide some crypto services after notifying their regulator at least 40 working days before they start. The scope depends on the type of institution. An investment firm, for example, may provide only services equivalent to its investment services, and an e-money institution only custody and transfers of the e-money tokens it issues.
Non-EU company
A third-country company cannot serve clients in the EU without a licence. The exception in Article 61 covers only clients who approach the company on their own exclusive initiative. ESMA reads this reverse solicitation exception very narrowly, and any marketing aimed at EU clients removes it.
Fully decentralised services
Under recital 22, MiCA does not apply to services provided in a fully decentralised manner without an intermediary. A legal entity, a development team or administrative keys do not automatically make a project a service provider. Regulators look at the real degree of decentralisation, the functions performed by identifiable persons, their control over the protocol and their involvement with clients. The exclusion applies only where there is genuinely no intermediary.
Accepting crypto for your own goods
A shop or service that simply accepts crypto as payment for its own goods does not become a CASP. We covered this in our article on how to accept crypto payments legally.
The licence is issued by the regulator of the EU country where the company has its registered office. The place of effective management must also be in the EU, and at least one director must be resident in the EU (Article 59(2)). One licence works across the whole EU through the passport.
Timelines
The transitional period under Article 143(3) ended on 1 July 2026 in all EU countries at once. Some countries had shorter periods, so firms there needed a licence earlier. Today firms providing crypto services to EU clients must, as a rule, hold a CASP licence or qualify for an Article 60 notification. The narrow exception in Article 61 for third-country firms remains, but only under strict conditions.
Completeness check, 25 working days
The regulator checks whether all documents have been filed. If something is missing, it sets a deadline to provide it (Article 63).
Clock startsAssessment, 40 working days
The clock runs from the date the regulator receives a complete application. Within this time it decides whether to grant or refuse the licence.
Pause for questions, up to 20 working days
The regulator may ask for more information. While the applicant answers, the assessment clock stops, but for no more than 20 working days.
Passport to other EU countries
After the licence, the company tells its regulator in which countries it will operate. The regulator passes this on within 10 working days. The company can start once this is done, and in any case from the 15th calendar day after it submitted the information (Article 65).
About three and a half months under the law is the best case. Preparing the file, pre-application meetings with the regulator and answering questions are not included. If the file is incomplete, the 40 working days simply do not start.
Application documents
The list of information is in Article 62(2) of MiCA. Commission Delegated Regulation 2025/305 sets out the details, and Implementing Regulation 2025/306 sets a single application form. A file usually has four blocks.
Company and business
Constitutional documents, website, a three-year programme of operations with financial projections, the list of services and crypto-assets, target countries and proof of capital under Article 67.
People
Information on members of the management body: experience, education, criminal record certificates and the time each will commit to the company. Separately, details of shareholders with qualifying holdings and the source of their funds.
Policies and controls
Governance, internal control, risk management and compliance, anti-money laundering (AML) policy, conflicts of interest, client complaints handling, business continuity plan and outsourcing arrangements.
Technology and client assets
A description of IT systems and security under the Digital Operational Resilience Act (DORA), segregation of client assets, custody policy, trading platform rules, order execution policy or the exchanger’s commercial policy, depending on the services.
ESMA considers money laundering risks of CASPs to be generally high. We covered sender and recipient data for transfers in our article on the Travel Rule for crypto companies. If the company also issues tokens, it needs separate documents, see our article on how to run a token sale legally.
Common reasons for refusal
Article 63(10) of MiCA sets out the grounds for refusal. They include a management body that threatens sound management, unsuitable managers or shareholders, and the risk that the company will not meet the Regulation. In January 2025 ESMA published a briefing for national regulators on how to review applications. It shows where applicants stumble most often.
Letter-box company
At least one executive director should be located in the licensing country. If more functions are performed outside the EU than inside, the regulator assesses this critically. The company itself must prove that decisions are taken in the EU.
Part-time management
These are supervisory expectations from ESMA’s January 2025 briefing, not time thresholds set by MiCA itself, and regulators apply them proportionately to the size and complexity of the firm. Members of the executive management board should devote at least half of their time to the company, and the CEO as a rule full time. All of them should understand how crypto-assets and the company’s services work. ESMA also pays close attention to the independence of the chair.
Too much outsourcing
Responsibility for AML always stays with the CASP itself, and outsourcing AML functions is tightly limited by EU and national rules. Some operational tasks may be outsourced where the law allows, but the company must keep enough expertise, staff and real control. Compliance and risk management cannot be outsourced to an extent that undermines governance or the regulator’s powers. Custody can be outsourced only to a licensed CASP. If outsourcing prevents effective supervision, ESMA recommends refusing the application.
Unrealistic business plan
Projections should rely on real figures where the business already operates. The plan covers three years with interim milestones so the regulator can compare it with results. You need to show what happens if revenue falls well below plan.
Track record of managers and owners
Regulators look at past breaches, ongoing criminal proceedings and the group’s supervisory history, including through the European supervisors’ information system. A past breach does not mean refusal by itself, but it must be disclosed and explained.
IT not ready for DORA
IT third-party risk is reviewed against DORA. Extra scrutiny applies where key IT staff work through a contractor, and to key management and hack protection.
Regulator decision
ESMA ran a fast-track peer review of how the Maltese regulator MFSA licensed one CASP. The authorisation process was rated “partially meeting expectations”. ESMA questioned why the licence was granted while material issues remained unresolved and why they were not required to be fixed first. In ESMA’s view the regulator did not adequately assess the firm’s supervisory history, growth plans, conflicts of interest, IT systems, custody and some money laundering risks.
What it means for the market. ESMA recommended that all national regulators assess business plans with growth in mind, review IT against DORA before granting a licence and make sure a firm can block malicious transactions after a hack. Since this review regulators have become stricter, and “we will fix it later” no longer works.
Case study
The exchange service operates from a third country, its website is in English and its ads target all of Europe. It has no CASP licence. After 1 July 2026 it cannot serve these clients. Reverse solicitation will not help, because the service attracts clients through advertising.
There are three options. First, get a licence through a company in an EU country with a real office and a local director. Second, work through a licensed CASP partner so that the partner, not the exchanger, serves the client. Third, close access for the EU with geoblocking and no marketing. In its statement of 17 April 2026 ESMA said that unlicensed firms had to carry out their wind-down plans by 1 July. This also covers B2B arrangements, such as outsourcing custody to an unlicensed entity.
How to prepare an application step by step
Map your services
Break the product down into services under Article 3(1)(16). This sets the licence class, capital and list of policies.
Start hereChoose a country
Consider the regulator’s language, real timelines, local staff requirements and office costs. One licence covers the whole EU anyway.
Build an EU team
Directors with enough time and experience, a separate compliance officer and AML officer, and at least one executive director in the licensing country.
Write policies for your business
Regulators recognise templates at once. Policies should describe your real processes, systems and contractors.
Sort out IT and DORA
Review IT contracts, the continuity plan, key storage and incident response before filing, not after.
File a complete application
Use the form under Implementing Regulation 2025/306 and check every item of Article 62(2). An incomplete file means the review has not even started.
What matters after you get the licence
A licence can be lost. Under Article 64 the regulator must withdraw it if the company has not started within 12 months, renounces the licence, has not provided services for nine months in a row, obtained the licence through false statements, no longer meets the conditions and does not fix this in time, has no effective systems against money laundering and terrorist financing, or seriously breaches MiCA, including client protection and market integrity rules. A breach of national AML rules can also lead to withdrawal. Any change in the management body must be notified to the regulator before the new members start (Article 69).
In December 2025 the European Commission proposed moving CASP licensing and supervision directly to ESMA, with a transitional period for existing licences and pending applications. On 9 October 2026 the Council of the EU agreed key elements of its negotiating position, under which ESMA would directly supervise only the most significant CASPs, not all of them. Negotiations with the European Parliament are still ahead. The law has not been adopted, and licences are still issued by national regulators.
Almost anyone providing crypto-asset services to EU clients needs a CASP licence or an Article 60 notification, and there is no transitional period any more. Regulators look first at real presence in the EU, committed management, reasonable outsourcing, AML and IT. Firms that solve these issues before filing get through faster.
The regulator licenses a company that is genuinely run from the EU, not a set of documents.LegalBit team
FAQ
How much does a CASP licence cost and how long does it take?
Under MiCA the regulator checks completeness within 25 working days and assesses the file within 40 working days, with a pause for questions of up to 20 working days. Preparing the file takes extra time. Minimum capital is EUR 50,000, 125,000 or 150,000 depending on the services. Regulator fees and office and staff costs depend on the country.
Can I serve EU clients with a licence from another country?
No. Third-country licences do not work in the EU. The reverse solicitation exception in Article 61 applies only if the client came on their own and the company did nothing to attract them in the EU.
Does a non-custodial wallet need a licence?
If the company only provides software and the user controls keys and assets, this is usually not custody under MiCA. But if the service also exchanges crypto-assets, transmits orders or transfers funds for the client, each function needs to be checked separately.
What happens if I operate without a licence after 1 July 2026?
National regulators can impose sanctions, including fines and bans, and ESMA expects unlicensed firms to wind down their EU services. ESMA advises clients to check providers in the interim MiCA register and move assets to a licensed provider or a self-hosted wallet.
Can I get the licence first and fix AML and IT later?
Do not count on it. After the Malta review ESMA recommended that regulators have material issues fixed before granting a licence and review IT against DORA in advance.
See also: Travel Rule for crypto companies; ESMA and non-MiCA stablecoins; Case study. Preparing a crypto start-up for MiCA.
Sources11 documents
- EUR-Lex: Regulation (EU) 2023/1114 (MiCA), Articles 3, 59–65, 67, 69, 143 and Annex IV
- EUR-Lex: Commission Delegated Regulation (EU) 2025/305 on information in a CASP licence application
- EUR-Lex: Commission Implementing Regulation (EU) 2025/306, CASP application form
- ESMA: Statement on the end of transitional periods under MiCA, 17 April 2026
- ESMA: Supervisory briefing on authorisation of CASPs, 31 January 2025
- ESMA: Fast-track peer review on CASP authorisation and supervision in Malta, 10 July 2025
- ESMA: Final report on guidelines on reverse solicitation under MiCA
- European Commission: Q&A on the market integration package, 4 December 2025
- Council of the EU: press release on key elements of the market integration package position, 9 October 2026
- Council of the EU: document 13779/1/26 REV 1, draft general approach on the market integration package, 30 October 2026
- ESMA: Q&A 2349 on the calculation of fixed overheads, European Commission answer of 18 February 2026
This is what we do
How we help crypto companies:
