How to Get a CASP License Under MiCA: The Complete Authorization Guide

A MiCA CASP license is now the only legal basis for providing crypto-asset services to EU customers. Since July 1, 2026, every crypto exchange, custodian, wallet provider, and crypto advisory firm serving EU clients must hold a Crypto-Asset Service Provider authorization issued under Regulation (EU) 2023/1114.

The MiCA grandfathering period that allowed existing firms to continue operating under old national regimes has ended. ESMA confirmed there will be no extensions. Any firm that does not hold a CASP authorization and is still serving EU clients is now operating in breach of EU law.

This guide covers everything involved in getting authorized: what a CASP license is, who needs one, what regulators assess, how to choose a jurisdiction, what the process looks like step by step, how long it takes, and what your obligations look like after authorization is granted.

Grandfathering Has Ended: Where Firms Stand Now

The MiCA grandfathering period was a transitional arrangement under Article 143(3) of MiCA. It allowed firms that were providing crypto-asset services lawfully before December 30, 2024, to continue operating under their existing national regimes while they applied for full CASP authorization. The outer limit was 18 months from December 30, 2024, which placed the final EU-wide deadline at July 1, 2026.

That deadline has now passed. Out of more than 1,200 entities that held pre-MiCA national registrations, approximately 200 to 210 have converted to full CASP authorization, a conversion rate of roughly 17%. The remaining firms fall into three categories.

Firms that are now fully authorized. These firms hold a CASP authorization from a national competent authority and can provide their licensed services across all 30 EEA countries. Their focus shifts to ongoing compliance obligations, which this guide covers in the post-authorization section below.

Firms that missed the grandfathering window. Grandfathering required both a pre-MiCA lawful operation and a formal CASP application filed before the member state's own deadline. Many firms failed to meet the second condition. For Germany, the Netherlands, Austria, Ireland, Lithuania, and Slovakia, those deadlines closed months before July 1. Firms in those jurisdictions that did not file in time have no transitional protection and must cease EU operations while pursuing fresh authorization. The ESMA non-compliant entity register is now being actively updated.

New entrants seeking CASP authorization. Firms that were not operating under a pre-MiCA national regime, or firms entering the EU market for the first time, go through the standard authorization process described in this guide. They cannot operate until authorization is granted.

The path forward in all cases is the same: formal CASP authorization. The grandfathering period was a one-time transitional mechanism that no longer exists. There is no alternative route, no equivalence regime for non-EU firms, and no reverse solicitation workaround that substitutes for a CASP license. For everything you need to know about what happened during the grandfathering period and its enforcement consequences, see Scorechain's dedicated guide: MiCA Grandfathering Explained: The Rules, the Deadlines, and the Enforcement.

What Is a CASP License?

A CASP license is the formal authorization issued by a national competent authority (NCA) in an EU member state under Title V of Regulation (EU) 2023/1114. It gives a firm the legal right to provide one or more categories of crypto-asset services within the EU.

A CASP authorization is not a registration. Before MiCA, most EU member states ran VASP registration programs that were primarily anti-money laundering in nature. A VASP registration did not require a regulator to assess governance, capital adequacy, or operational resilience. It was an AML compliance framework, not a financial services licensing regime.

A CASP license is fundamentally different. To receive one, a firm must satisfy a national regulator that its management is fit and proper, its capital is adequate for the services it provides, its AML and compliance program meets MiCA standards, its operational infrastructure is resilient, and its procedures for handling client assets, complaints, and conflicts of interest are sound.

Once granted, a CASP authorization passports across all 30 EEA countries: all 27 EU member states plus Iceland, Liechtenstein, and Norway. A single authorization from any EU NCA gives a firm the legal right to provide its licensed services across the entire European Economic Area without requiring a separate application in each country.

The authoritative register of all current CASP authorizations is the ESMA Interim MiCA Register, published as weekly CSV files. Any compliance team conducting counterparty due diligence should verify CASP authorization status directly against this register.

Who Needs a CASP License Under MiCA?

Any legal entity that provides one or more of the ten MiCA crypto-asset services to customers in the EU needs a CASP license. This applies regardless of where the firm is incorporated.

A firm based in the United States, Singapore, or the United Arab Emirates that provides custody services, exchange services, or trading platform access to EU-based customers needs a CASP authorization from an EU national competent authority. There is no equivalence arrangement that substitutes for MiCA CASP authorization. There is no reverse solicitation carve-out that can be structured around as an alternative to licensing.

The ten service categories that require CASP authorization under Article 3(1)(16) of MiCA are:

A firm must be authorized for each category it provides. Authorization for service category 1 (custody) does not automatically cover service category 2 (trading platform). An exchange that offers custody, trading, and transfer services needs to be authorized for all three categories in its application.

Certain entities receive a simplified or expedited path to CASP authorization under MiCA. Credit institutions, investment firms, electronic money institutions, UCITS management companies, and other regulated financial entities can notify their existing regulator of their intention to provide crypto-asset services rather than going through the full authorization process. The notification process is faster but still requires compliance with MiCA's substantive standards.

CASP Authorization Requirements: What You Must Have Before Applying

Article 62 of MiCA sets out the content of the authorization application. Article 63 governs the assessment timeline. Article 67 sets capital requirements. Article 68 sets governance and AML program requirements. Together with the ESMA technical standards on CASP authorization, these articles define what a firm must demonstrate before a national competent authority will grant a CASP license. Preparing this documentation thoroughly before submission is the single biggest factor in how quickly an application moves.

‍

The core requirements are:

Legal entity incorporated in the EU. The applicant must be a legal entity established in a member state of the European Union. A branch of a non-EU firm is not sufficient. A genuine EU incorporated entity with genuine substance, including management presence, decision-making capacity, and operational activity, all located in the member state, is required.

Management body fit-and-proper assessment. Every member of the management body must be assessed as fit and proper. This involves submitting detailed information on each director's professional background, qualifications, criminal record, regulatory history, and any prior sanctions or enforcement actions. Regulators expect at least two executive directors. Non-executive directors with genuine governance capacity are expected for larger firms.

Capital requirements. Minimum own funds must be held at all times. The level depends on the service categories for which authorization is sought (see the capital requirements section below).

AML and CFT program. A documented AML/CFT policy, risk appetite statement, customer due diligence procedures, transaction monitoring framework, and suspicious transaction reporting process must be submitted. The program must comply with AMLD6 and with Regulation (EU) 2023/1113 (the Transfer of Funds Regulation, which implements the Travel Rule).

Safeguarding and segregation arrangements. For custodial services, the firm must demonstrate how client crypto-assets are held separately from the firm's own assets and protected in the event of insolvency.

IT and operational resilience. Security policies, incident response plans, business continuity arrangements, and penetration testing evidence are required. ESMA's technical standards on ICT risk management under MiCA build on the DORA framework.

Consumer protection and complaints handling. Written procedures for handling client complaints, managing conflicts of interest, and providing fair, clear, and not misleading disclosures must be submitted.

Business plan and financial projections. A credible business plan showing how the firm will be financially viable and meet capital requirements on an ongoing basis is required.

Capital Requirements for a CASP License

MiCA sets three tiers of minimum own funds based on the type of services the CASP provides.

These are minimum floors, not targets. Under Article 67(1)(b) of MiCA, the capital a CASP must hold is the HIGHER of either the class minimum or one quarter of the firm's fixed overheads for the preceding year. A CASP with 2 million euros in annual fixed overheads must hold 500,000 euros in own funds, not 150,000. National regulators also have discretion to require higher capital based on the size, complexity, and risk profile of the firm. A firm applying to operate a large trading platform serving hundreds of thousands of EU clients will face capital expectations that significantly exceed the statutory minimum.

Ongoing capital maintenance is required at all times. A CASP that falls below its minimum own funds threshold must notify its NCA immediately and submit a remediation plan. Regulatory capital cannot be used to fund operations.

The capital must be held in liquid assets. It cannot consist of goodwill, intangible assets, or deferred tax credits. Most regulators require capital to be held in a regulated bank account within the EEA.

Governance and Fit-and-Proper Requirements

The governance assessment is one of the most time-consuming elements of the CASP authorization process, and it is consistently cited by regulators as a source of delays when applications are incomplete.

Each member of the management body must submit personal declarations covering:

• Full name, date and place of birth, nationality, and tax identification
• Complete professional history for the past ten years with references
• Academic qualifications and professional certifications
• Criminal record certificates from every country of residence in the past ten years
• Details of all directorships and shareholdings held or previously held
• Any regulatory enforcement actions, sanctions, or disqualifications anywhere in the world
• A signed declaration of good repute

For senior management and key function holders (MLRO, Head of Compliance, CTO), the same level of documentation is required.

Regulators assess whether the management body has collectively adequate knowledge of crypto-asset markets, regulatory compliance, AML/CFT, IT security, and financial management. A management team composed entirely of technologists with no financial services regulatory experience will not satisfy most EU regulators.

This does not mean every director must have a traditional finance background. It means the board, taken as a whole, must cover the competencies MiCA requires.

AML Program Requirements for CASP Authorization

The AML program submitted with a CASP license application must be substantive and complete. Regulators reviewing applications have consistently identified AML documentation as the most common source of application deficiencies. A MiCA-compliant AML program covers:

Risk assessment. A documented assessment of the money laundering and terrorist financing risks the firm faces, covering the services it provides, the customers it serves, the geographies it operates in, and the crypto-assets it handles. The risk assessment must be updated regularly.

Policies and procedures. Written policies covering customer due diligence, enhanced due diligence for high-risk relationships, politically exposed persons, sanctions screening, and suspicious transaction reporting. These must be operationally deployed, not theoretical.

Transaction monitoring. A blockchain analytics and transaction monitoring system that covers all crypto-assets and blockchains the firm supports. The system must generate alerts on patterns consistent with money laundering, sanctions exposure, darknet activity, mixer usage, and layering. Scorechain's transaction monitoring tools cover 23 blockchains and are deployed by MiCA-authorized CASPs across 45 countries.

Wallet screening. Continuous screening of customer wallets and transaction counterparties against EU, UN, OFAC, and UK consolidated sanctions lists. Scorechain's wallet screening solution provides real-time risk scoring and sanctions checks across all major blockchains.

Travel Rule infrastructure. The Transfer of Funds Regulation applies to every crypto transfer with no minimum threshold. The CASP must have operational infrastructure for CASP-to-CASP data exchange and self-hosted wallet verification before authorization is granted. See Scorechain's Travel Rule compliance guide for the full operational requirements.

MLRO appointment. A qualified Anti-Money Laundering Reporting Officer (MLRO) must be appointed. The MLRO must be a named individual with clear authority, adequate resources, and direct access to the management body. The MLRO's CV and qualifications are submitted as part of the application.

Choosing the Right EU Jurisdiction for CASP Authorization

Every EU member state is a valid home for CASP authorization under MiCA. The choice matters for practical reasons: regulatory timelines, supervisor style, language of proceedings, capital city presence requirements, and ongoing supervisory relationship all vary meaningfully between member states.

The major jurisdictions and their profiles:

• Malta (MFSA) has become the preferred home for large crypto-native exchanges. The MFSA has the most experience with crypto-asset regulation in the EU, having operated the VFA framework since 2018. OKX, Crypto.com, and Gemini are among the firms authorized here. Authorization timelines at MFSA have been among the fastest in the EU for well-prepared applications.
• Luxembourg (CSSF) is preferred by institutional and fintech-adjacent firms. Coinbase holds its CASP authorization here. The CSSF has a strong track record with financial services authorization and is experienced in managing large cross-border firms. Applications tend to be thorough and take longer, but the supervisory relationship is predictable.
• France (AMF) operated the pre-MiCA DASP voluntary registration regime, giving the regulator significant experience with crypto firms. The AMF is an active supervisor and takes enforcement seriously. Firms that want an engaged regulator relationship and understand the French market often choose Paris.
• Cyprus (CySEC) has processed several major fintech CASP authorizations including Revolut. CySEC is familiar with cross-border financial services and has a track record of processing applications at reasonable speed.
• Lithuania (Bank of Lithuania) built significant crypto regulatory infrastructure before MiCA and has authorized a number of firms. The Bank of Lithuania is considered accessible and has English-language application procedures.
• Germany (BaFin) is the most rigorous EU supervisor for CASP authorization. Application timelines are longer, requirements for substance in Germany are high, and the management body assessment is intensive. Firms that choose BaFin are typically large, well-resourced, and prioritize the regulatory credibility of a German license.
• Ireland (Central Bank of Ireland) requires genuine operational presence in Ireland with local senior management. It does not accept applications where the applicant has no substantive activity in the country. Timelines have been longer than some other member states.

For a full country-by-country breakdown of requirements, timelines, and capital expectations, see Scorechain's CASP license country guides.

The CASP Authorization Process Step by Step

The authorization process under Article 63 of MiCA follows a defined statutory structure, though the practical experience varies by member state.

Step 1: Incorporate a legal entity in the chosen member state. Before submitting an authorization application, the applicant must exist as an incorporated legal entity in the EU. Most regulators require registration evidence, articles of association, and ownership structure charts with beneficial ownership identified.

Step 2: Build the compliance and governance infrastructure. Attempting to submit an application before the governance, AML, and operational infrastructure is in place is the most common mistake. Regulators do not authorize firms on the basis of promises. The MLRO must be hired, the AML policy written and tested, the transaction monitoring system operational, and the capital held before the application is submitted.

Step 3: Prepare the application package. The application must include all required documentation per ESMA's authorization technical standards. Missing or incomplete documentation will cause the application to be returned as incomplete, restarting the clock.

Step 4: Submit to the national competent authority. Applications are submitted to the NCA of the chosen home member state. Most NCAs have dedicated application portals or submission procedures published on their websites.

Step 5: Completeness check (25 working days). The NCA has 25 working days to confirm whether the application is complete. If documentation is missing, the NCA notifies the applicant with a list of deficiencies. The clock does not restart on the 40-day assessment period until completeness is confirmed.

Step 6: Assessment period (40 working days). From the date the NCA confirms the application is complete, it has 40 working days to make a decision. This period can be suspended for up to 20 working days if the NCA requests further information. The clock pauses and restarts when the NCA receives the applicant's response. In practice, regulators frequently issue information requests during this window, and the practical timeline extends beyond the statutory minimum.

Step 7: Decision. The NCA grants or refuses the application. A refusal must be reasoned. Firms have the right to challenge a refusal through the NCA's administrative review process or through the courts.

Step 8: Passporting notification. Once authorized, the CASP can notify the home NCA of its intention to passport services into other EEA member states. The NCA transmits the notification to the host member state regulator. No separate application is required in the host member state.

How Long Does CASP Authorization Take?

The statutory minimum is 65 working days from confirmed completeness: 25 to confirm completeness plus 40 to make the decision, with a possible 20-day extension. That translates to approximately three to four months in calendar time for a straightforward application at a fast-moving regulator.

In practice, most applications take longer. The reasons include:

Applications submitted with incomplete documentation before the governance and compliance infrastructure is genuinely ready. Regulators return these as incomplete, and the clock restarts on the 25-day completeness check.

Management body assessments require detailed background checks that take time to compile and that regulators scrutinize carefully. A management team that includes individuals with prior regulatory issues anywhere in the world will experience delays.

Regulator workload. Many EU NCAs received high volumes of CASP applications in 2025 and 2026. Application queues at some regulators extended timelines well beyond the statutory period.

Realistic timelines by jurisdiction, based on market experience:

These are estimates. A firm with a genuinely complete application, a strong management team, and an experienced regulatory counsel can achieve timelines at the lower end. A firm submitting its first application with incomplete documentation will be at the higher end or beyond.

MiCA CASP Passporting: Operating Across 30 EEA Countries

MiCA passporting is one of the most commercially valuable features of CASP authorization. A single license from any EU member state gives a CASP the right to provide its authorized service categories across all 30 EEA countries without a separate application in each.

Before MiCA, a firm authorized in Malta could not rely on that authorization to operate in Germany. Each jurisdiction required its own registration, its own supervisory relationship, and its own compliance program calibrated to national rules. For firms wanting to operate across Europe, this meant multiple parallel licensing processes and ongoing multi-regulator compliance management.

Under MiCA, the process is:

1. Obtain CASP authorization from the home NCA.
2. Notify the home NCA of the member states into which the CASP intends to passport.
3. The home NCA transmits the notification to the host member state NCAs.
4. The CASP can begin providing services in host member states within 15 working days of the notification.

The home NCA remains the primary supervisor. Host member state regulators have consumer protection oversight but supervisory primacy sits with the home regulator.

This has two practical implications for compliance teams.

First, when reviewing a counterparty CASP on the ESMA register, the authorizing regulator shown is the home NCA. A firm authorized in Malta but operating across ten EU countries is supervised by the MFSA, not by the regulators in those host countries.

Second, if a passported CASP causes consumer harm in a host member state, the host NCA can take immediate protective measures, but the supervisory investigation and enforcement action runs through the home NCA.

Common Reasons CASP Applications Are Rejected or Delayed

Based on feedback from national regulators and regulatory counsel experience across EU member states, the most common application failure modes are:

• Incomplete AML documentation. Policies submitted as templates with blank fields, AML programs that describe procedures that are not yet operational, or MLRO appointments where the named individual does not have adequate qualifications or availability.
• Management body assessment failures. Directors who cannot demonstrate fit-and-proper status due to prior regulatory issues, insufficient professional experience for the service categories applied for, or incomplete criminal record certificates from all required jurisdictions.
• Insufficient capital. Own funds held below the required minimum at the time of application, capital held in non-qualifying assets (cryptocurrency, goodwill, deferred tax), or capital that is pledged or encumbered.
• No genuine establishment. Applications where the legal entity exists on paper but the management, operational activity, and decision-making capacity are not genuinely in the member state. Regulators now scrutinize substance requirements carefully.
• Business plan not credible. Financial projections that do not support ongoing compliance costs, staffing, capital maintenance, and operational resilience, or business plans that do not coherently explain the firm's competitive position and EU market strategy.
• Missing or inadequate safeguarding documentation. For custodial services, applications that do not demonstrate how client assets are segregated and protected.

Post-Authorization Obligations

Authorization is the beginning of a continuous compliance obligation, not the end of the process. MiCA compliance for authorized CASPs is an ongoing program covering:

• Transaction monitoring. Continuous blockchain analytics across all supported networks. A CASP offering TRON-based transfers that monitors only Bitcoin has a coverage gap regulators will identify.
• Wallet screening. Continuous screening of customer wallets and transaction counterparties against EU, UN, OFAC, and UK consolidated sanctions lists. Onboarding checks alone are not sufficient.
• Travel Rule compliance. Verified originator and beneficiary data on every crypto transfer with no minimum threshold, under Regulation (EU) 2023/1113.
• Annual reporting. CASPs must submit annual compliance and financial reports to the home NCA. For trading platforms, real-time order book reporting in standardized JSON format is required per ESMA technical standards published in November 2025.
• Material change notifications. Any material change to the business, such as new service categories, new management body members, significant changes in ownership, changes in capital, must be notified to the home NCA and may require NCA approval before implementation.
• Incident reporting. Major operational incidents and security breaches must be reported to the NCA within defined timeframes. ESMA's ICT incident classification standards set the thresholds for what constitutes a reportable major incident.

CASP License by Country: Full Guide

For requirements, timelines, application procedures, and capital expectations specific to each EU member state, see Scorechain's country-by-country CASP license guides:

• CASP License Country Guides Hub
• CASP License Lithuania
• CASP License Slovakia
• CASP License France
• CASP License Germany
• CASP License Netherlands
• CASP License Malta
• CASP License Austria
• CASP License Cyprus
• CASP License Czech Republic
• CASP License Poland
• CASP License Estonia

Frequently Asked Questions

What is a CASP license under MiCA?

A CASP license is the formal authorization under Title V of Regulation (EU) 2023/1114 that gives a firm the legal right to provide crypto-asset services to EU customers. It is issued by a national competent authority in any EU member state and passports across all 30 EEA countries. It is a financial services license, not a registration, and requires a full regulatory assessment before it is granted.

Who needs a CASP license?

Any firm providing one or more of the ten MiCA crypto-asset services to EU customers needs a CASP license, regardless of where the firm is incorporated. This includes exchanges, custodians, wallet providers, crypto advisors, portfolio managers, and transfer service providers. Non-EU firms serving EU clients are not exempt.

What are the capital requirements for a CASP license?

MiCA sets three capital tiers: 50,000 euros for Class 1 services (advice, order reception, placing), 125,000 euros for Class 2 services (exchange, execution, portfolio management), and 150,000 euros for Class 3 services (custody, trading platform, transfer services). Regulators may require higher capital based on the firm's size and risk profile.

How long does it take to get a CASP license?

The statutory timeline under Article 63 of MiCA is 25 working days to confirm completeness plus 40 working days to make a decision. In practice, timelines range from four months at faster-moving regulators like Malta's MFSA and Lithuania's Bank of Lithuania to nine to fourteen months at Germany's BaFin and Ireland's Central Bank.

Can a non-EU company get a CASP license?

A non-EU company cannot hold a CASP license directly. However, a non-EU company can incorporate a subsidiary in an EU member state and apply for CASP authorization through that subsidiary. The EU entity must have genuine operational substance in the member state, including local management and decision-making capacity. A shell entity created solely to hold the license will not satisfy regulators.

What is CASP passporting under MiCA?

CASP passporting allows an authorized CASP to provide its licensed services across all 27 EU member states and the three EEA countries after notifying the home NCA of the member states it intends to operate in. No separate application is required in each country. The home NCA remains the primary supervisor regardless of which countries the CASP operates in.

What is the difference between MiCA grandfathering and CASP authorization?

MiCA grandfathering was a one-time transitional arrangement under Article 143(3) of Regulation (EU) 2023/1114 that allowed firms operating lawfully before December 30, 2024, to continue under their existing national regimes while applying for CASP authorization. It ended on July 1, 2026, with no extensions. CASP authorization is the permanent licensing framework. It is what every firm serving EU crypto clients must now hold. Grandfathering no longer exists as an option. For the full breakdown of how grandfathering worked, which member states had early deadlines, and what the enforcement consequences are, see Scorechain's guide: MiCA Grandfathering Explained: The Rules, the Deadlines, and the Enforcement.

What is the difference between a VASP and a CASP?

A VASP (Virtual Asset Service Provider) was an AML registration used in the pre-MiCA national regimes and referenced in FATF standards. It confirmed that a firm had registered for AML purposes. A CASP authorization under MiCA is a full financial services license requiring capital, governance, AML program, Travel Rule infrastructure, and operational resilience assessments. Once granted, it passports across 30 EEA countries. VASP registrations ceased to have legal effect for EU operations after July 1, 2026.

Which EU country is best for CASP authorization?

There is no single best jurisdiction. Malta is preferred by large crypto-native exchanges for its speed and experience. Luxembourg suits institutional firms. France suits firms wanting an active regulator with pre-MiCA crypto experience. Lithuania offers accessible English-language procedures. Germany provides maximum regulatory credibility for firms willing to invest in the longer process. The right choice depends on your business model, timeline, capital, and management team.

What happens if a CASP application is rejected?

A rejected application must be accompanied by written reasons from the NCA. The firm can submit a revised application addressing the identified deficiencies, challenge the decision through the NCA's administrative review process, or appeal to the relevant administrative tribunal or court. A rejected application does not permanently bar the firm from reapplying but does extend the timeline significantly.

What are the ongoing compliance obligations after CASP authorization?

Post-authorization obligations under MiCA include continuous transaction monitoring across all supported blockchains, ongoing wallet and sanctions screening, Travel Rule compliance under Regulation (EU) 2023/1113, annual reporting to the home NCA, material change notifications, and operational incident reporting. Authorization is the start of a continuous compliance program.

How Scorechain Supports CASP Authorization and Ongoing Compliance

Scorechain is a European blockchain analytics and crypto compliance company covering 23 blockchains across 45 countries. We work with firms going through the MiCA CASP authorization process and with authorized CASPs managing their post-authorization compliance obligations.

For authorization applications, Scorechain provides the transaction monitoring, wallet screening, and Travel Rule infrastructure that regulators expect to see in operation before granting a CASP license.

For authorized CASPs, Scorechain covers transaction monitoring, wallet screening, Travel Rule support, KYT, sanctions screening, blockchain investigations, and entity intelligence.

Request a Demo

Need a fast one-time wallet risk check? Scorechain AI generates instant wallet intelligence reports with no enterprise contract required.