MiCA License

Any business providing crypto-asset services to EU users on a professional basis requires CASP authorization.

MiCA draws the obligation broadly: the activity triggers the requirement, regardless of where the business is incorporated.

MiCA applies to all crypto asset market participants, including issuers, service providers, and other entities involved in the crypto industry. Three categories of businesses face direct authorization obligations.

Issuers of e-money tokens (EMTs)

These are stablecoins pegged to a single official currency, such as a euro-denominated stablecoin. EMT issuers must be authorized as either a credit institution or an electronic money institution and comply with MiCA’s reserve, redemption, and disclosure requirements. Significant EMTs (those exceeding defined user or transaction thresholds) fall under direct EBA supervision.

Issuers of asset-referenced tokens (ARTs)

ARTs are stablecoins backed by a basket of assets (currencies, commodities, or other crypto-assets). ART issuers require NCA authorization and must meet stricter reserve and governance standards than EMT issuers. No pure ART issuers have been authorized under MiCA to date, reflecting both the limited demand and the stringency of the requirements.

Providers of crypto-asset services (CASPs)

This is the broadest category and covers exchanges, custodians, portfolio managers, broker-dealers, transfer agents, and advisory services. Any business performing one or more of the ten enumerated crypto-asset services under MiCA to EU users requires a CASP license.

Third-country firms serving EU users are not exempt. MiCA requires non-EU businesses to establish a legal entity within the EU and obtain authorization before actively marketing or soliciting EU clients.

Establishing a robust business structure within an EU country is essential for meeting MiCA requirements, as the CASP license must be issued by a national authority in an EU country.

Reverse solicitation (where an EU user approaches the firm without any prior promotion) is narrowly defined by ESMA and is not a workable compliance path for scaling a business.

The cost of obtaining CASP authorization depends on the service tier, the member state selected, and the substance requirements the applicant must establish. Capital thresholds are set by MiCA and apply uniformly across the EU. Total project costs vary significantly by jurisdiction.

The figures above represent own funds requirements plus estimated all-in engagement costs (legal preparation, entity setup, registered office, local personnel, and documentation). Annual compliance costs (ongoing AML program, regulatory reporting, DORA-aligned IT resilience obligations) add to the post-authorization budget. LegalBison provides project-specific estimates following an initial business model and jurisdictional assessment.

The total cost reflects the need to meet key requirements under MiCA, including capital thresholds, compliance obligations, and operational mandates.

MiCA defines CASP status by activity, not by corporate structure or label. A business conducting any of the following activities for EU users on a professional basis requires authorization. MiCA regulates a wide range of crypto-related services and services related to the issuance, exchange, and custody of crypto assets.

• Cryptocurrency exchanges and trading platforms that operate a venue where users buy and sell crypto assets or swap crypto assets against fiat or other digital assets in a regulated environment;
• Custodians and wallet providers that hold private keys or control digital assets on behalf of clients. Self-custody wallet software with no key control falls outside scope;
• Crypto broker-dealers and order execution services that execute orders in crypto-assets on behalf of clients or transmit orders to third-party venues for execution;
• Advisory and portfolio management services that provide personal recommendations on crypto-asset transactions or manage a portfolio of digital assets on a discretionary basis;
• Crypto-asset placement agents and transfer services that place crypto-assets with investors on behalf of issuers, or provide transfer services (moving crypto-assets between addresses) on behalf of clients.

Existing regulated entities (credit institutions, investment firms, electronic money institutions, and similar) may notify their NCA to provide crypto-asset services without going through the full CASP authorization process. MiFID-licensed investment firms providing portfolio management or advice on crypto-assets are a notable example.

CASP authorization covers ten defined service categories. A business may be authorized for one or more, and the authorization scope determines which activities it may conduct in all 27 member states under passporting.

• Custody and administration of crypto-assets on behalf of clients, including the safekeeping of private keys and related settlement services;
• Operation of a trading platform for crypto-assets, matching buy and sell orders from multiple parties;
• Exchange of crypto-assets for fiat currency, converting between digital assets and euros, dollars, or other legal tender;
• Exchange of crypto-assets for other crypto-assets, facilitating swaps between different crypto assets as well as between digital assets and fiat currencies, through peer-to-peer or order-book-based mechanisms;
• Execution of orders for crypto-assets on behalf of clients, acting as agent to complete transactions at best available terms;
• Placing of crypto-assets on behalf of issuers, distributing newly issued tokens to investors in a manner functionally equivalent to underwriting or securities placement;
• Reception and transmission of orders for crypto-assets on behalf of clients, receiving client instructions and routing them to a trading venue or executor;
• Providing advice on crypto-assets, giving personal recommendations to clients on specific crypto-asset transactions or strategies;
• Providing portfolio management on crypto-assets, exercising discretion over a client portfolio of digital assets under a management mandate;
• Providing transfer services for crypto-assets on behalf of clients, executing the movement of digital assets between addresses at client instruction.

Minimum own funds range from EUR 50,000 (Class 1 services: advice and order reception) to EUR 125,000 (Class 2: exchange, execution, portfolio management) to EUR 150,000 (Class 3: custody and trading platform operation).

CASPs must also maintain 25% of quarterly fixed overheads as a liquidity buffer.

New entrants without a trading history must prepare a detailed forward-looking cost model;

CASPs conducting public offers of crypto-assets must publish a crypto-asset white paper approved by the NCA.

The white paper must contain specified disclosures on the asset, the issuer, the risks, and the rights of holders.

Retail clients receive a 14-day withdrawal right on direct purchases from issuers;

Management body members must meet competence, experience, and integrity standards. Conflicts of interest must be identified and managed.

CASPs must establish robust internal policies and governance principles covering areas such as anti-money laundering, risk management, conflict of interest management, data protection, safeguarding of client assets, cybersecurity, and business continuity.

These internal policies and governance principles should align with those of other regulated financial institutions to ensure proper oversight and compliance. All policies must be documented and operational at the time of authorization.

Regulatory requirements also include measures to prevent market manipulation and ensure fair trading practices;

CASPs are subject to the Digital Operational Resilience Act (DORA), which requires documented ICT risk management frameworks, incident reporting procedures, third-party vendor risk assessments, and periodic resilience testing.

From early 2026, DORA compliance is verified as part of the CASP authorization assessment in most member states;

The authorized entity must be incorporated in an EU member state, maintain a registered office and genuine management presence in the territory, and appoint at least one EU-resident director.

Brass-plate structures do not satisfy the substance requirement.

A CASP authorization from any one EU member state grants passporting rights across all 27. The business applies in its chosen home member state, is authorized by that country’s NCA, and then notifies both the home NCA and the relevant host-country authority before commencing services in each additional market. There is no separate application per country and no local subsidiary required for each market. One authorization covers 450 million potential EU consumers. MiCA’’s framework establishes the detailed obligations and operational processes that enable seamless cross-border provision of crypto-asset services.

The passporting mechanism is the single most commercially significant aspect of MiCA for international crypto businesses. Before MiCA, an exchange serving German, French, and Italian users needed to navigate three separate national frameworks. Now, a single CASP authorization from Lithuania or Ireland covers all three markets under one regulatory relationship.

The practical constraint is that the business must maintain genuine substance in the home member state. Regulatory relationships, compliance functions, and management control must be present in the EU, not delegated offshore. See the VASP license guide for a comparison of pre-MiCA VASP registration approaches still in use in non-EU jurisdictions.

Request a free consultation with our experts

Jurisdiction selection is a strategic decision. The correct home member state depends on the business model, team location, target markets, timeline, and budget. There is no universally optimal choice.

LegalBison evaluates jurisdictional fit across all active EU licensing environments. The analysis begins with the business model (which CASP service categories are required), followed by substance capacity (where the team can establish a genuine presence), and then regulatory processing realities (which NCAs are currently moving applications efficiently). The jurisdiction widget on this page provides indicative guidance; the recommendation for any specific project comes from the feasibility assessment. A thorough regulatory perspective is essential for selecting the optimal jurisdiction and ensuring compliance with MiCA. View MiCA regulation by member state for jurisdiction-specific details.

LegalBison manages the full CASP authorization process as a structured engagement, from initial business model assessment through to NCA submission and regulatory liaison. The firm’s team spans legal, compliance, and corporate administration functions across EU jurisdictions, covering the complete scope of requirements that MiCA places on applicants. LegalBison supports clients through every stage of MiCA’’s implementation, ensuring readiness for the new regulatory environment.

The engagement begins with a jurisdictional feasibility assessment: identifying which CASP service categories apply to the client’s model, which member states are viable given the team and timeline, and what substance needs to be established before any application is made. That assessment determines the project scope before any costs are committed.

LegalBison then structures the local entity, arranges registered office and local directorship where required, drafts the full AML/CFT policy suite and documentation framework, supports fit-and-proper preparation for key personnel, and prepares and submits the authorization application. Post-submission, the firm manages NCA correspondence through to a decision.

For businesses already holding a VASP registration under a pre-MiCA national regime and facing the July 1, 2026 transitional deadline, LegalBison structures MiCA license adaptation and renewal engagements that build on existing compliance infrastructure rather than starting from zero. See the MiCA compliance guide for the current state of transitional periods and what VASP-to-CASP conversion requires.

For token issuers requiring white paper preparation and NCA notification, and for businesses looking to add token issuance to an existing or planned CASP structure, LegalBison handles the regulatory classification analysis and documentation. For businesses operating crypto exchange or on/off ramping services, the authorization scope is mapped to the specific service activities conducted. LegalBison also assists with compliance for related services impacted by MiCA, such as custody, trading, and advisory activities.

Free consultation for your crypto company set-up

A CASP authorization is now the primary requirement for operating a credible crypto business in the world’s largest single-regulated market. Its commercial value goes beyond regulatory compliance. MiCA’’s provisions regulate the issuance, trading, and custody of certain crypto assets, including security tokens, to ensure market integrity and investor protection.

• Banking access. Banks and payment processors in the EU now require CASP authorization as a prerequisite for account opening. Unlicensed crypto businesses have been progressively cut off from fiat rails across the EU. Licensed CASPs operate with the banking relationships that an unlicensed entity cannot access;

• Institutional capital. Venture funds, institutional LPs, and strategic investors operating in or targeting the EU treat CASP authorization as a threshold condition. MiCA compliance is increasingly written into term sheets and investment mandates as a required milestone, not a future consideration;

• Regulatory certainty. Operating under MiCA authorization eliminates the exposure to sudden enforcement action that has shut down unlicensed platforms in France, Italy, and the Netherlands. Over EUR 540 million in penalties have been issued under MiCA since full enforcement began. A licensed CASP knows its obligations precisely. An unlicensed one does not.

In 2026, a MiCA license is not a nice-to-have for EU market participants. It is the infrastructure on which a durable crypto business is built.