Crypto-Assets Service Provider (CASP) License

Two categories of businesses face the most immediate CASP licensing obligation.

Existing VASP license holders operating in EU member states under pre-MiCA national frameworks (registrations in Estonia, Lithuania, Poland, the Czech Republic, and Malta, among others) must complete CASP license adaptation before July 1, 2026. After that date, the grandfathering provisions in Article 143(3) of MiCA expire. Firms still operating under legacy VASP registrations will be operating without authorization. The consequences are direct: cease-and-desist orders from the relevant NCA, administrative fines that can reach into the millions under Article 111, and reputational exposure with banking partners and institutional clients.

NCAs are already receiving high volumes of CASP applications. The firms that filed early have entered review queues ahead of those that wait. By mid-2025, several NCAs publicly acknowledged backlogs. Firms that have not yet begun their CASP license adaptation process face a compounding problem: even if they file before July 1, 2026, the NCA may not complete review in time to grant authorization before the deadline passes.

New businesses building crypto services with European market ambitions have an equally clear imperative. MiCA creates the most investor-ready, bank-friendly regulatory framework for crypto in any major market. A CASP authorization signals institutional-grade compliance to banking partners, payment processors, and institutional investors: the counterparties most crypto businesses struggle to secure without credible regulation behind them.

The cost of a CASP license has two components: regulatory costs imposed by the framework itself, and service fees for professional assistance.

Regulatory costs vary by jurisdiction and include NCA application fees (ranging from approximately 1,500 EUR in Lithuania to 10,000 EUR+ in some other member states), mandatory share capital requirements (50,000 EUR to 150,000 EUR depending on class), and ongoing annual supervisory fees. Firms must also budget for local office setup, resident director arrangements, and ongoing AML/CTF compliance infrastructure.

LegalBison’s CASP licensing service covers the full application lifecycle. The firm’s approach is structured around five phases: jurisdictional strategy, operational architecture, regulatory navigation, legal foundation, and licensing execution. Fee structures are tailored to the specific class of services sought and the complexity of the applicant’s business model. For a detailed fee breakdown aligned to your business structure, LegalBison provides scoped assessments rather than generic rate cards. The requirements for a Class 1 advisory firm differ substantially from a Class 3 exchange or custody operation.

The firm’s positioning as a licensed Corporate Service Provider with direct operational presence in key EU jurisdictions, including Poland and Estonia, removes the intermediary layer that inflates cost and timeline with third-party providers.

MiCA sets minimum own funds requirements based on the services the CASP intends to provide. Higher-risk service categories carry higher capital thresholds.

A CASP providing services across multiple categories is subject to the highest applicable threshold. Competent authorities may impose additional capital requirements above these minimums based on the specific risk profile of the business model.

CASP authorisation under MiCA requires a complete application package addressing ten areas. Each must be fully documented before submission.

1. EU legal entity. The applicant must be a legal entity established in an EU member state. Branches of non-EU entities cannot hold a CASP authorisation directly.
2. Minimum own funds. See the capital requirements table above. Capital must be deposited in a corporate bank account in the EU.
3. Fit-and-proper management body. All members of the management body must demonstrate good repute, absence of criminal convictions, adequate knowledge and experience, and sufficient time to carry out their duties. Qualifying shareholders are also subject to assessment.
4. Governance framework. The application must document internal controls, risk management procedures, conflict of interest policies, outsourcing arrangements, and a business continuity plan.
5. AML/KYC programme. A written AML/CFT policy aligned with AMLD6 and the applicable national transposition, covering customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk clients, and risk matrices.
6. Travel Rule compliance. FATF Recommendation 16 obligations as transposed through the Transfer of Funds Regulation (TFR): for transfers of EUR 1,000 or more, transmitting and receiving CASPs must exchange originator and beneficiary data.
7. Transaction monitoring. A deployed transaction monitoring system with documented parameters, alert procedures, and periodic review processes tied to the CASP’s risk matrix.
8. MLRO appointment. A qualified Money Laundering Reporting Officer responsible for the AML programme, suspicious transaction reporting, and regulator liaison.
9. ICT and operational resilience. Documented ICT systems and security arrangements, including DORA compliance obligations that apply to CASPs as financial sector entities.
10. Passporting. Once a CASP authorisation is granted by one member state’s competent authority, the CASP can notify other member states and commence services there without a separate application. Passporting covers all 27 EU member states.

Business Plan for CASP Licence

Every CASP application requires a detailed programme of operations, which regulators treat as the business plan for CASP license. It must include: a description of the crypto-asset services to be provided and the business model supporting them; target markets and projected client base; three-year financial projections; IT infrastructure description and security framework; the AML/CFT compliance programme; governance structure and internal controls; and details of outsourcing arrangements with third-party providers. A poorly prepared programme of operations is the single most common reason for application delays.

Any business providing crypto-asset services to clients in the EU on a professional basis requires CASP authorization. The scope of permitted activities maps to the three classes defined above, but in practice covers the following business types operating in the EU.

• Centralised Exchanges (CEX): Spot and derivatives trading platforms matching buyer and seller orders. Class 3 authorization required for operating the trading platform itself; Class 2 covers execution of orders where the firm matches orders externally rather than running its own order book;
• Brokerages and OTC Desks: Firms exchanging crypto assets for fiat or other crypto assets (including OTC desk operations) require Class 2 authorization. Execution of orders on behalf of clients is a Class 1 activity, as is advice on specific crypto-asset positions;
• Custodial Wallets and Custody Providers: Any firm holding private keys on behalf of clients requires at minimum Class 2 authorization, as custody and administration of crypto assets on behalf of clients is a Class 2 service under Annex IV. This includes exchange wallets, institutional custody solutions, and hot/cold storage services offered to third parties;
• Crypto Payment Processors and Gateways: Firms processing crypto payments on behalf of merchants or providing fiat-crypto conversion in payment flows require at minimum Class 2 authorization, and in many cases Class 1 advisory authorization depending on how the service is structured;
• Issuance-Related Services (ICOs, IEOs, Launchpads): Firms placing crypto assets on behalf of issuers, managing token sale processes, or providing subscription-related services around new issuances need Class 1 authorization: placing of crypto assets is defined as a Class 1 activity under Annex IV. Additional services such as custody of proceeds or exchange functions would trigger Class 2;
• Crypto P2P Platforms: Platforms that match buyers and sellers directly without running a centralized order book operate in a nuanced zone. Where the platform itself executes matching and settlement, Class 3 authorization applies. Where users transact directly with no platform intermediation in the trade, the activity analysis becomes more fact-specific;
• GameFi and Play-to-Earn Platforms: projects and play-to-earn platforms that issue, distribute, or enable trading of in-game tokens as crypto assets fall within MiCA’s scope where those tokens meet the definition of crypto assets under the regulation;
• Portfolio Management Services: Firms managing discretionary crypto portfolios on behalf of clients require Class 1 authorization.

The VASP framework, as implemented across EU member states under FATF Recommendation 15 and the EU’s Fifth and Sixth AMLD, was a registration or notification regime focused primarily on AML/CTF identity controls. It was not a full authorization framework. A VASP registration told the regulator who you were. It did not confirm you had the governance, capital, technology, or compliance infrastructure to operate safely.

A CASP license under MiCA is a full prudential authorization. It confirms all of the above. Capital requirements, governance standards, asset segregation, technology resilience, conflict of interest rules, and ongoing supervisory reporting are built into the authorization itself. The CASP license is what a VASP registration was not: a genuine financial-services-grade operating license with passporting rights across the entire EU single market.

Jurisdiction selection is one of the most consequential decisions in the CASP application process. It affects application timeline, NCA responsiveness, banking availability, substance requirements, and ongoing supervisory burden. The following jurisdictions represent the most operationally viable options for CASP incorporation.

Lithuania processes CASP applications through the Bank of Lithuania, which has invested in digital-asset regulatory capacity and has one of the shorter expected review timelines among EU NCAs. Banking infrastructure for crypto businesses is more accessible than in many other EU markets. For existing VASP holders already registered in Lithuania, CASP license adaptation can build directly on the existing regulatory relationship.

Czech Republic offers a straightforward incorporation environment and the CNB (Czech National Bank) as a technically capable NCA. Operational costs are lower than Western European alternatives, and the jurisdiction has attracted a growing number of crypto businesses over the past three years.

Poland combines strong FinTech legal infrastructure, active NCA engagement with digital-asset regulation, and LegalBison’s direct operational presence. For firms working with LegalBison, Poland’s Warsaw office provides in-country support throughout the application and post-authorization phases.

Estonia was the original EU pioneer for VASP registration and retains institutional knowledge of crypto business models. It offers now one of the most affordable and effective route to secure a CASP license.

Ireland offers English-language regulation, a sophisticated financial services NCA in the Central Bank of Ireland, and access to common law legal infrastructure alongside EU regulation. Corporate tax positioning is a secondary consideration for firms with substance requirements that go beyond nominal registration.

Austria has a developed financial markets regulatory environment through the FMA and has shown reasonable receptiveness to crypto business applications from firms with institutional-grade governance.

Malta was an early mover in crypto regulation but has faced reputational headwinds from historical quality-control issues in its VASP regime. Post-MiCA, Malta’s MFSA is rebuilding under the harmonized framework, and it remains an advantageous option given its business environment and low tax rates.

The right jurisdiction depends on your business model, existing banking relationships, timeline constraints, and ownership structure. There is no universal “best” option, only the jurisdiction that aligns best with your specific operational profile. LegalBison’s jurisdictional strategy work covers exactly this analysis before any incorporation steps are taken.

Czech Republic

The Czech National Bank (CNB) serves as the designated National Competent Authority for CASP authorisation, with the jurisdiction offering comparatively lower capital thresholds and streamlined procedural requirements within the MiCA framework. Entities registered prior to 31 December 2024 qualify for an 18 months transitional period under Article 143 provisions.

Key characteristics:

• Regulator: Czech National Bank (CNB)
• Transitional period: Until 1 July 2026 for pre-registered entities
• Capital requirements: 1 CZK for a Limited company + applicable capital requirements for the designated activity under the MiCA Regulation
• Processing timeline: Approximately 30 to 60 days for registration procedures

Poland

The Polish Financial Supervision Authority (Komisja Nadzoru Finansowego, or KNF) administers the VASP registry, while the competent authority for the CASP license Poland authorisation procedure is still subject to being decided. 

Key characteristics:

• Regulator: not yet appointed, potentially the Polish Financial Supervision Authority (KNF)
• Capital requirements: Applicable capital requirements for the designated activity under the MiCA Regulation
• Processing timeline: Approximately 3 to 6 months, subject to application completeness
• Substance requirements: In line with Article 59(2) the CASP needs to have their place of effective management in the country of registration and at least one of the directors is ordinarily resident in the EU. In practice the regulator will require more people on the ground than less to issue an authorization.

Lithuania

The Bank of Lithuania (Lietuvos bankas) serves as the designated National Competent Authority for CASP license in Lithuania applications, building upon the jurisdiction’s established fintech regulatory infrastructure and developed banking ecosystem supporting crypto-asset businesses.

Key characteristics:

• Regulator: Bank of Lithuania
• Captal requirements: Applicable capital requirements for the designated activity under the MiCA Regulation
• Processing timeline: from 3 months
• Infrastructure: Established fintech ecosystem with accessible banking services

Estonia

Estonia introduced its VASP licensing framework in 2017, establishing the jurisdiction among the earliest EU Member States to implement dedicated crypto-asset regulatory oversight. The Estonian Financial Supervision Authority (Finantsinspektsioon, FSA) administers CASP authorisation under a reformed framework imposing enhanced substance requirements, including local management presence and comprehensive AML/CFT control infrastructure.

Key characteristics:

• Regulator: Estonia’s Financial Supervision Authority (Finantsinspektsioon, FSA)
• Capital requirements: Applicable capital requirements for the designated activity under the MiCA Regulation
• Processing timeline: from 3 months
• Substance requirements: In line with Article 59(2) the CASP needs to have their place of effective management in the country of registration and at least one of the directors is ordinarily resident in the EU. In practice the regulator will require more people on the ground than less to issue an authorization.

Germany

The Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, or BaFin) administers CASP authorisation under a comprehensive supervisory framework characterised by rigorous fit and proper assessments, extensive documentation requirements, and detailed scrutiny of governance arrangements and AML/CFT control infrastructure. Processing timelines for BaFin authorisation typically extend to 6 to 12 months or longer, reflecting the authority’s thorough evaluation procedures, with the jurisdiction’s regulatory standing within the European financial services ecosystem corresponding to these elevated supervisory standards and comprehensive compliance obligations.

France

The Autorité des Marchés Financiers (AMF) serves as the designated National Competent Authority for CASP authorisation, building upon the jurisdiction’s PSAN (Prestataires de Services sur Actifs Numériques) registration framework introduced in 2019, which established France among the earliest EU Member States to implement comprehensive digital asset oversight predating MiCA. The AMF’s established supervisory procedures and France’s position as a significant European financial market provide authorised entities with access to substantial consumer and institutional client bases within a developed fintech ecosystem.

Malta

The Malta Financial Services Authority (MFSA) administers CASP authorisation, building upon the jurisdiction’s Virtual Financial Assets (VFA) Act framework established in 2018, which positioned Malta among the earliest EU Member States to implement comprehensive digital asset regulatory oversight.

Comparative Overview of CASP Requirements by Jurisdiction

The following table presents a comparative analysis of CASP authorisation parameters across key EU Member States, enabling jurisdictional assessment based on own funds thresholds, substance requirements, and procedural timelines under the harmonised MiCA framework.

The optimal CASP jurisdiction depends on business model, substance capacity, and timeline. The options below represent the most commonly pursued routes. LegalBison maintains an active practice in each of these member states.