CASP licence under MiCA: requirements, cost and timeline
A CASP licence is the authorisation a crypto-asset service provider needs under the EU's MiCA regulation before it serves clients in the EU. It is granted by the national regulator of the country where the company is established and then works across the EU. The minimum capital is €50,000, €125,000 or €150,000 depending on the services, and the regulator has about 65 working days to decide once you file a complete application.
Who needs a CASP licence
You need it if you provide any of these services to clients in the EU on a professional basis:
- custody and administration of crypto-assets on behalf of clients
- operating a trading platform
- exchanging crypto-assets for funds, or for other crypto-assets
- executing orders on behalf of clients
- placing crypto-assets
- receiving and transmitting orders
- advice on crypto-assets
- portfolio management
- transfer services for crypto-assets on behalf of clients
Banks, investment firms and a few other regulated financial entities do not apply for a CASP licence. They notify their regulator before they start; for banks and investment firms that is at least 40 working days in advance (Article 60).
There is no exemption for "we are based outside the EU". ESMA states that firms established outside the EU cannot provide MiCA services to EU clients or solicit them, including business-to-business (ESMA public statement, 23 June 2026). The transitional period for firms that operated under national law ended on 1 July 2026 across the EU, whether or not a country had adapted its law (Article 143(3); ESMA statements of 17 April and 23 June 2026).
Which capital class applies to you?
Annex IV sets a minimum capital by what you offer. Pick the highest class that applies.
| Class | Services | Minimum capital |
|---|---|---|
| 1 | Execution of orders, placing, transfer services, reception and transmission of orders, advice, portfolio management | €50,000 |
| 2 | Everything in class 1, plus custody and administration, and exchange (for funds or for other crypto-assets) | €125,000 |
| 3 | Everything in class 2, plus operating a trading platform | €150,000 |
Article 67 adds a second test. You must hold at least the higher of the Annex IV amount or one quarter of last year's fixed overheads. Until you have traded for a year, use the fixed overheads you project for your first 12 months.
Example (illustrative). A class 2 exchange that expects €700,000 of fixed overheads in its first year must hold at least €175,000 (one quarter), not €125,000. So €125,000 is a floor, not your budget.
You can hold the safeguards as own funds (Common Equity Tier 1 items) or as an insurance policy or comparable guarantee that meets the Article 67 conditions.
What the application must contain
You apply to the regulator of your home Member State (Article 62). In plain terms it asks for:
- who the company is: legal form, articles of association, legal entity identifier, website and contacts
- a programme of operations: which services, where and how you will market them
- proof of the capital described above
- governance and the repute, knowledge and experience of the management body, with no relevant criminal record or penalties
- the identity and repute of shareholders with qualifying holdings
- internal controls, anti-money laundering and business continuity
- technical documentation of your ICT systems and security
- how client assets and funds are segregated, and how complaints are handled
- service-specific policies: custody policy, trading platform rules, execution policy, pricing method for exchange, and so on
Where the regulator already received some of this under an earlier procedure (e-money, MiFID II, payment services, or national crypto rules from before 29 June 2023), it cannot ask for it again if it is still up to date (Article 62(4)).
Establishment rules (Article 59(2)). Your registered office must be in an EU country where you carry out at least part of your services. Your place of effective management must be in the EU, and at least one director must be resident in the EU.
How long the regulator takes
| Step | Time limit (working days) | Source |
|---|---|---|
| Regulator acknowledges your application | 5 | Art. 63(1) |
| Regulator checks it is complete | 25 | Art. 63(2) |
| Regulator assesses and decides, from a complete application | 40 | Art. 63(9) |
| Regulator may ask for more information once, by working day 20 of the assessment; the clock pauses | up to 20 | Art. 63(12) |
| Regulator notifies you of the decision | 5 after the decision | Art. 63(9) |
That is about 65 working days (roughly 13 weeks) from filing, and up to 85 working days (roughly 17 weeks) if the regulator pauses the clock to request information. If the file is incomplete, you lose time before the 40-day clock starts.
That is the regulator's part only. Before you file, you still have to form the company, raise the capital, hire the people, write the policies and document your ICT systems.
What it costs
The capital in Annex IV is not a fee. It stays on your balance sheet or is covered by insurance. The cost of a licence has four parts:
- Capital or insurance, at least the higher of the Annex IV amount and a quarter of fixed overheads.
- Regulator fees, which each country sets.
- Running the licence: compliance, anti-money laundering, ICT security, audit and the people you need in the EU. These costs recur every year.
- Preparing the application: legal and advisory work and the documents listed above.
Where licences are actually granted
The ESMA interim MiCA register shows which regulators have listed CASPs. As of its latest update (15 October 2026) it contained 376 entities.
| Home country | Entries | Regulator |
|---|---|---|
| Germany | 106 (mostly banks and investment firms notified under Art. 60) | BaFin |
| France | 36 | AMF |
| Netherlands | 29 | AFM |
| Cyprus | 25 | CySEC |
| Malta | 23 | MFSA |
| Spain | 16 | CNMV |
| Luxembourg | 13 | CSSF |
| Lithuania | 6 | Bank of Lithuania |
| Estonia | 3 | EFSA |
| Poland | 0 | No competent authority designated |
Read these numbers with care. The register mixes Article 63 authorisations with Article 60 notifications, and for several countries (France, Cyprus and Malta among them) the legal basis field is empty, so the two cannot be split. The register is interim and depends on each regulator reporting. A high count says nothing about how easy or fast the procedure is.
A CASP authorised in one country can serve the others. It informs its home regulator of the countries and services; the regulator passes this on within 10 working days, and the CASP can start in the other country at the latest on the 15th calendar day after it filed the information (Article 65).
Poland has no CASP regulator yet, so the route runs through another EU country
Poland's crypto-asset act, which would designate the Financial Supervision Authority (KNF), has been vetoed three times, most recently on 11 June 2026. On 4 September 2026 the Sejm did not override the veto (241 for, 198 against; 25 votes short of the 3/5 majority).
The Office of the KNF stated that no national authority is currently designated as competent for CASPs, and that a licence procedure in Poland becomes possible only after a law designates one. Firms that relied on the national transitional period lost it on 1 July 2026. CASPs authorised in other EU countries can still serve clients in Poland (UKNF position, September 2026).
For a founder based in Poland, the practical route is to get authorised in another EU country and meet the establishment rules above: registered office there, management in the EU, at least one director resident in the EU. See also Malta vs Estonia for a CASP licence.
"Reverse solicitation" is not a workaround
MiCA lets a client in the EU request a service from a non-EU firm on the client's own exclusive initiative. ESMA's guidelines (26 February 2025) read this narrowly and read "solicitation" broadly: it includes online ads, emails, social media, events, retargeting, and general brand advertising aimed at a wide public. A disclaimer does not override the facts, and the firm should keep records showing the client approached it first. If you market to EU clients, you need the licence.
What happens without one
ESMA expects firms without authorisation to stop onboarding EU clients and to wind down in an orderly way while protecting client assets. Using a name or marketing that suggests you are a CASP when you are not is itself prohibited (Article 59(5)). Clients are told to check their provider in the ESMA register.
How OnScale supports you
OnScale advises you and runs the process with you, at every stage and after you file. The regulator decides on the licence, so we promise no outcome. We tell you early what slows a file and what we need from you.
Planning a CASP application?
Tell us which services you offer and where your team sits. We will tell you which class applies, which countries fit, and what we need from you.
FAQ
Crypto-asset service provider: a company authorised under MiCA to provide services such as custody, exchange or a trading platform to clients in the EU.
It has several parts: capital of €50,000, €125,000 or €150,000 depending on the services (or a quarter of fixed overheads if higher), regulator fees that differ by country, and the cost of running and preparing the licence.
Once you file a complete application, the regulator has about 65 working days to decide, up to about 85 with a request for information. Preparing the company and the file comes before that.
Yes, if you serve or solicit clients in the EU. A non-EU firm cannot provide MiCA services to EU clients, and the client-initiative exception is narrow.
Not at present. No competent authority has been designated by law (UKNF position, September 2026), so founders use another EU country.
Yes. Once authorised, a CASP can serve clients across the EU, after notifying its home regulator of the countries and services (Articles 59(7) and 65).
Sources
- Regulation (EU) 2023/1114 (MiCA): Articles 59, 60, 61, 62, 63, 65, 67, 143 and Annex IV (Official Journal of the EU).
- ESMA, statements on the end of MiCA transitional periods, 17 April 2026 and 23 June 2026.
- ESMA, Guidelines on reverse solicitation under MiCA, 26 February 2025 (ESMA35-1872330276-2030).
- ESMA, interim MiCA register, CASP file (updated 15 October 2026).
- Office of the Polish Financial Supervision Authority (UKNF), position on the absence of a designated competent authority for the crypto-asset market, September 2026.
General information, not legal advice. Rules and national implementation change; check the sources above and take advice before you act.