Overview
MiCA replaced the patchwork of national VASP registrations that existed across the EU with a single authorisation regime for crypto-asset service providers. It covers custody, trading platforms, exchange against funds or other crypto-assets, order execution and transmission, placing, transfer services, advice and portfolio management. Authorisation is granted by the national competent authority of the Member State where the company has its registered office, and it can then be passported across the EU and EEA through a straightforward notification procedure.
Article 143(3) of MiCA allowed firms already operating under national law to continue during a transitional period of up to 18 months, ending no later than 1 July 2026. Member States could shorten it, and many did: Poland and Latvia chose six months, Lithuania, Slovakia and Germany twelve, while Cyprus, Czechia and Malta notified the full eighteen months. In October 2026 there is no grandfathered operator left anywhere in the Union. A firm that still lacks authorisation must either obtain one, operate under the passport of an authorised group entity, or remain outside MiCA's perimeter.
Regulators have used the transition to raise the bar. The Czech National Bank, for example, reported 251 applications and notifications but only 11 authorisations granted by 1 July 2026, noting that many files lacked a credible business model, transparent ownership or real substance. The message across supervisors is consistent: an application is judged on governance, capital, safeguarding of client assets, ICT resilience under DORA and a working AML framework, not on paperwork alone. The ESMA interim register is the reference point for checking who is authorised.
Outside the Union, the landscape is more varied. The United Kingdom opened its FCA authorisation gateway on 30 September 2026 for a full cryptoasset regime commencing on 25 October 2027, while existing firms remain registered under the Money Laundering Regulations. Hong Kong licenses virtual asset trading platforms through the SFC, and jurisdictions such as Seychelles, Labuan, El Salvador and Georgia offer dedicated VASP frameworks that may suit groups serving non-EU clients. These licences do not give access to EU clients, which is why many groups now combine an EU CASP with a non-EU entity.
Key benefits
- Single authorisation passportable to 30 EU and EEA markets
- Harmonised rulebook reduces legal uncertainty compared with the former national VASP regimes
- Improved access to banking, payment and institutional counterparties that now require MiCA status
- Clear capital tiers allow the licence to be scoped to the actual business model
- Credible supervisory status supports fundraising, partnerships and eventual exit or succession planning
- Non-EU VASP regimes can complement an EU licence for clients outside the Union
Requirements
- Legal person with registered office and place of effective management in the authorising Member State
- At least one director resident in the EU and a management body of sufficiently good repute, knowledge and experience
- Minimum own funds of EUR 50,000, 125,000 or 150,000 by class, or one quarter of prior-year fixed overheads if higher
- Suitability assessment of shareholders with qualifying holdings and documented source of funds
- Programme of operations, governance arrangements and business continuity plan
- AML/CFT policies, travel-rule compliance and sanctions screening
- ICT and security arrangements meeting DORA, with a description of systems and cyber controls
- Client-asset segregation and custody policy where custody is offered
- Complaints-handling, conflicts-of-interest and outsourcing policies
Licence options & capital
Lithuania
Transition ended 31 Dec 2025
Bank of Lithuania licenses CASPs and expects a genuine operational centre in Lithuania rather than an outsourced shell. Established fintech ecosystem, English-language engagement and strong scrutiny of funding sources.
Cyprus
Transition ended 1 Jul 2026
CySEC authorises CASPs and can draw on long experience supervising investment firms. Attractive for groups already running MiFID or forex businesses that want to add crypto services under one supervisory relationship.
Czech Republic
Transition ended 1 Jul 2026
Czech National Bank is the competent authority under Act No. 31/2025 Coll. It received the highest number of MiCA applications in the EU and has authorised only a small fraction, so robust files are essential.
Slovakia
Transition ended 30 Dec 2025
National Bank of Slovakia authorises CASPs under Act No. 248/2024 Coll. Former trade-licence holders lost their rights at the end of 2025. Applicants must also describe their cybersecurity audit.
Poland
No domestic CASP route yet
The national implementing act was vetoed for a third time in June 2026, so no competent authority has been designated. Polish clients are currently served by CASPs authorised elsewhere in the EU via passporting.
Non-EU VASP regimes
Varies by jurisdiction
United Kingdom (FCA registration, new regime from October 2027), Hong Kong (SFC licensing), Seychelles, Labuan, El Salvador and Georgia offer frameworks for business outside the EU. They do not confer EU passporting rights.
Step-by-step process
- 1
Scoping and jurisdiction choice
We map the services, client base and token types against MiCA's definitions, confirm the CASP class and compare jurisdictions on supervisory approach, substance expectations and timeline.
- 2
Corporate set-up and substance
Incorporation, capitalisation, appointment of directors and key function holders, local office and, where needed, banking for the own-funds deposit.
- 3
Application drafting
Preparation of the programme of operations, policies, ICT and DORA documentation, AML framework and fit-and-proper files in the format required by the MiCA technical standards.
- 4
Submission and completeness check
The regulator confirms completeness within 25 working days, or requests missing items. Pre-application dialogue is encouraged by most supervisors.
- 5
Assessment and Q&A
A 40 working day assessment follows a complete file. Information requests can pause the clock for up to 20 working days, and in practice several rounds are common.
- 6
Authorisation and passporting
Once authorised, the CASP is entered in the ESMA register and can notify the services and Member States in which it intends to operate cross-border.
Typical documents
- Constitutional documents and group structure chart
- Programme of operations and three-year business plan with financial projections
- Evidence of own funds and prudential calculations
- Fit-and-proper questionnaires, CVs and criminal record extracts for directors and qualifying shareholders
- Source-of-funds and source-of-wealth evidence for shareholders
- AML/CFT manual, business-wide risk assessment and travel-rule procedures
- ICT security policy, business continuity plan and DORA-aligned documentation
- Custody and client-asset segregation policy where relevant
- Complaints-handling, conflicts-of-interest and outsourcing policies
How Legal Wealth helps
Legal Wealth approaches crypto licensing as part of a client's wider wealth and governance plan rather than as a standalone filing. We help founders and family offices choose a jurisdiction that matches their business and their personal residence and succession objectives, coordinate local counsel and auditors, and prepare applications that reflect how the business genuinely operates. Throughout the process we handle beneficial ownership and source-of-wealth information with strict discretion, and after authorisation we can support ongoing compliance, group restructuring and the integration of the licensed entity into holding and succession structures.
Enquire with Legal WealthFrequently asked questions
Can I still operate under a national VASP registration in the EU?
No. Every MiCA transitional period ended by 1 July 2026 at the latest, and in several states (for example Poland, Lithuania and Slovakia) earlier. Providing crypto-asset services in the EU now requires CASP authorisation or a notification by an eligible financial institution.
How much capital does a CASP need?
The permanent minimum is EUR 50,000 for Class 1 services, EUR 125,000 for Class 2 (adding custody and exchange) and EUR 150,000 for Class 3 (operating a trading platform). If one quarter of the previous year's fixed overheads is higher, that figure applies instead.
How long does authorisation take?
MiCA sets 25 working days for the completeness check and 40 working days for assessment, but requests for information pause the clock. Realistic end-to-end timelines are typically several months, depending on file quality and the regulator's workload.
Does one MiCA licence cover the whole EU?
Yes. After authorisation the CASP notifies its home regulator of the Member States and services it intends to cover, and the home regulator forwards that information to the host authorities.
Do banks and investment firms need a separate CASP licence?
Credit institutions, investment firms, e-money institutions and certain other regulated entities can provide specified crypto services by notifying their regulator under Article 60 of MiCA rather than applying for a full authorisation.
Is a non-EU VASP licence still useful?
It can be, for serving clients outside the Union. It does not permit soliciting EU clients, so groups with European ambitions usually pair it with an EU-authorised CASP.
Last reviewed: 2026-10. Requirements, fees and timelines change. Information is general, reviewed on the date shown, and is not legal or tax advice.
Sources
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), EUR-Lex
- ESMA - List of MiCA grandfathering periods under Article 143(3)
- Czech National Bank - MiCA: CNB granted crypto licences to 11 entities (1 July 2026)
- Davis Polk - FCA's cryptoasset authorisation gateway now open
- Bank of Lithuania - Markets in crypto-assets
