CASP authorisation under MiCA: steps, timelines and what differs by country

CASP authorisation is the permission a crypto-asset service provider needs to serve clients in the EU under the Markets in Crypto-Assets Regulation (MiCA). A firm applies to the authority of the member state where it has its registered office, which has 25 working days to check the file is complete and 40 working days from a complete file to decide. Once authorised, the firm can serve the other member states by notification. Since 1 July 2026, no country's transitional period is left.

This guide follows the procedure step by step. The MiCA checklist covers what an exchange runs once authorised, and what a crypto exchange licence costs compares fees across regulators. This is general information, not legal advice.

Who needs CASP authorisation

Article 59 of MiCA (Regulation (EU) 2023/1114) says a person "shall not provide crypto-asset services, within the Union" unless it is authorised as a crypto-asset service provider (CASP) under Article 63, or is one of the financial entities that Article 60 lets in. The services are the ten in Article 3(1)(16):

1. custody and administration of crypto-assets on behalf of clients;

2. operation of a trading platform for crypto-assets;

3. exchange of crypto-assets for funds;

4. exchange of crypto-assets for other crypto-assets;

5. execution of orders on behalf of clients;

6. placing of crypto-assets;

7. reception and transmission of orders on behalf of clients;

8. advice on crypto-assets;

9. portfolio management on crypto-assets;

10. transfer services on behalf of clients.

The authorisation names each service the firm may provide, and adding one later is an extension request to the same authority, assessed the same way (Article 59(6) and (8)). An exchange with an order book, custody and conversions asks for at least the first four.

Banks, investment firms, e-money institutions, market operators, central securities depositories and fund managers do not apply afresh. Under Article 60 they notify their authority at least 40 working days before starting, for the services their existing licence matches.

An authorised CASP needs a registered office in a member state where it provides at least part of its services, its place of effective management in the EU, and at least one director resident in the EU (Article 59(2)).

CASP registration, CASP licence or authorisation?

Buyers search for all three, and for "digital asset service provider licence". MiCA's word is authorisation, and the firm becomes a CASP. Registration is the older model: before MiCA, many countries registered virtual asset service providers (VASPs) for anti-money laundering purposes only.

Spain is an example. Since May 2021 the Bank of Spain kept a register of firms exchanging virtual currency for fiat and providing custodial wallets, under Law 10/2010 on money laundering, the CNMV explains. That register checked anti-money laundering controls. MiCA authorisation covers the whole business, capital and conduct included.

Step 1: the application (Article 62)

Article 62(2) lists what the application must contain, in 19 points. Grouped:

• Who you are. Legal name, legal entity identifier, website, address, legal form and articles of association.

• What you will do. A programme of operations setting out the services, "including where and how those services are to be marketed", and the type of crypto-asset each relates to.

• The money. Proof that the firm meets the prudential safeguards of Article 67.

• People and owners. Governance arrangements, proof that the management body is of good repute and has the knowledge, skills and experience to run the firm, and the identity and good repute of every shareholder with a qualifying holding, each with proof of no criminal record or relevant penalties (Article 62(3)).

• Controls and systems. Internal controls and risk management, money laundering risks included, the business continuity plan, technical documentation of the ICT systems and security, the segregation of clients' crypto-assets and funds, and complaints handling.

• Service by service. A custody policy for custody; the operating rules and the system to detect market abuse for a trading platform; a non-discriminatory commercial policy and pricing method for exchange; an execution policy for executing orders.

The forms come from two Commission acts that BaFin points applicants to: Delegated Regulation (EU) 2025/305 on the content and Implementing Regulation (EU) 2025/306 with the standard forms. An authority does not ask again for anything it already holds from an earlier licence or pre-MiCA registration, if it is still up to date (Article 62(4)).

Much of the file describes systems: transaction monitoring, the Travel Rule, market-abuse detection, segregation and ICT security. You can see systems of that kind in Marengo, our exchange, which has KYC, transaction monitoring, the Travel Rule and market-abuse detection built in. The licensed operator remains responsible for how they are used.

Step 2: the review and its clock (Article 63)

Article 63 sets the timeline in working days:

1. Acknowledgement, within 5 working days of receipt.

2. Completeness check, within 25 working days. If something is missing, the authority sets a deadline, and may refuse to review a file still incomplete after it. BaFin, following an ESMA recommendation, gives four weeks.

3. Assessment, within 40 working days of a complete application. The authority may ask for more information until the 20th working day; the clock stops while the firm answers, for at most 20 working days, and later questions do not stop it again.

4. Decision, fully reasoned, notified within 5 working days.

5. Register. Within 2 working days of granting, the authority informs ESMA, which lists the firm in its register.

Before deciding, the authority may consult anti-money laundering authorities and financial intelligence units. It refuses where the management body or qualifying shareholders fail the suitability tests, or where the firm "fails to meet or is likely to fail to meet" MiCA's requirements (Article 63(10)). None of these limits covers the preparation before filing.

Step 3: capital (Article 67 and Annex IV)

Article 67 requires prudential safeguards of at least the higher of two amounts: the permanent minimum for the firm's class in Annex IV, or a quarter of the previous year's fixed overheads, reviewed every year.

A new firm uses the fixed overheads projected for its first 12 months in the application. With illustrative projected overheads of €800,000, a quarter is €200,000, so a trading platform holds €200,000 rather than €150,000.

The safeguards can be own funds (Common Equity Tier 1), an insurance policy or a comparable guarantee, or a mix. The policy is disclosed on the firm's website, has an initial term of at least a year and a cancellation notice of at least 90 days.

Step 4: passporting (Article 65)

An authorised CASP may serve the whole EU, through a branch or across borders, and needs no physical presence in a host state (Article 59(7)). Under Article 65, it tells its home authority the member states, the services, the starting date and its other activities. The authority passes this to the host states, ESMA and the EBA within 10 working days. The CASP may start once it hears that this was done, or "at the latest from the 15th calendar day" after it notified.

The transitional periods (Article 143)

Article 143(3) let firms that served clients under national law before 30 December 2024 continue until 1 July 2026, or until they were authorised or refused, whichever came first. Member states could shorten the period or not apply it. ESMA's list shows the choices:

• 6 months: Latvia, Hungary, the Netherlands, Poland, Slovenia, Finland.

• 9 months: Sweden.

• 12 months: Germany, Ireland, Lithuania, Austria, Slovakia; Norway in the EEA.

• 18 months: Belgium, Bulgaria, Czechia, Denmark, Estonia, Greece, Spain, France, Croatia, Italy, Cyprus, Luxembourg, Malta, Portugal, Romania; Iceland and Liechtenstein.

Some countries also set an application deadline, such as Czechia (before 31 July 2025) and Italy (by 30 December 2025 for registered VASPs). The period only covered the firm in its own country: the CNMV notes that a firm in transition at home could not serve Spain unless it also qualified for Spain's period.

All of it is over. ESMA's statement of 17 April 2026 says the period would "officially expire across the EU on 1 July 2026", after which unlicensed firms must stop and have wound down. It also reminds firms outside the EU that, beyond the "narrow exception" of reverse solicitation, they may not serve EU clients, business clients included.

What differs by country

MiCA is a regulation, so the file, the clock, the capital and the passport are the same everywhere. What differs is the authority, its fees, its manuals and forms, and how it runs the process.

Spain. Applications go to the CNMV, which publishes a manual for the CASP authorisation application and a model notification for financial entities. Its MiCA page says Spain's 18-month transitional period ended on 1 July 2026. It covered those on the Bank of Spain register on 30 December 2024, for the services they already provided, and firms that effectively provided only services the register could not cover, such as advice or portfolio management. The register stays for information and takes no new entries. A CASP authorised elsewhere may serve Spain once it has notified its intention, and the CNMV lists the CASPs that can.

Germany. BaFin reviews applications with the Deutsche Bundesbank, under the Cryptomarkets Supervision Act (KMAG); Germany's transitional period was 12 months, by ESMA's list. BaFin offers an initial discussion before filing, asks applicants to document compliance with DORA, the EU's operational resilience act, and charges a fee based on the time spent, also when an application is withdrawn or rejected. An authorisation is published in the Federal Gazette, BaFin's database and ESMA's interim MiCA register.

Outside the EU the model is different again. For the UAE, see VARA, ADGM or DIFC.

Frequently asked questions

Is CASP registration the same as CASP authorisation? No. MiCA knows authorisation, and for some already regulated firms a notification, but no registration. National VASP registrations stopped giving any right to serve clients when the transitional periods ended.

How long does CASP authorisation take? On MiCA's clock, 25 working days to confirm the file is complete, then 40 working days to decide, which one request for information can pause for up to 20 more. The time to prepare the file comes first and is not counted.

Can a CASP authorised in another member state serve clients in Spain? Yes, once it has notified its home authority under Article 65 of its intention to serve Spain. It needs no separate Spanish authorisation, and may start at the latest on the 15th calendar day after notifying.

Does a firm outside the EU need CASP authorisation? To serve EU clients, yes, through an EU entity with its registered office, management and a resident director in the EU. Serving clients at their own exclusive initiative is the only exception, and soliciting them by any means ends it (Article 61).

See it working

The authorisation is the operator's; the file describes the systems the operator runs. To weigh the software side, compare white-label crypto exchange options, open Marengo at marengo.paynoramic.com, or see how our white-label crypto exchange is built and handed over to the licensed operator who runs it.