What Is a MiCA CASP License? Requirements, Capital & EU Passporting in 2026

The Markets in Crypto-Assets Regulation, known as MiCA and formally Regulation (EU) 2023/1114, is the European Union's single rulebook for crypto. It replaces the patchwork of national regimes with one harmonized framework, and at its centre sits the crypto-asset service provider, or CASP. A CASP license is the authorization that lets a firm provide crypto-asset services to clients in the EU on a professional basis. For the wider context of the regulation itself, our MiCA explained guide walks through the full framework.

The provisions covering CASPs became applicable on 30 December 2024. From that date, providing crypto-asset services in the EU requires authorization as a CASP, with limited transitional relief for firms that were already operating lawfully under national law. The licence is issued by a competent national authority, such as a financial regulator in the member state where the firm is established, and once granted it is recognized across the entire bloc.

Crucially, a CASP must be a legal person with a registered office and effective management inside an EU member state. This is a step up from the older national registration model that many crypto businesses previously relied on. If your starting point is the legacy regime, our explainer on what a VASP is and how it is defined sets out exactly how the old and new categories relate.

MiCA does not grant a single, blanket crypto licence. Instead, Article 3 of the regulation defines ten distinct crypto-asset services, and a CASP is authorized only for the specific services it lists in its application. The activities a firm intends to carry out therefore drive both the scope of its licence and the capital class it must satisfy.

The ten services are: custody and administration of crypto-assets on behalf of clients; operation of a trading platform; exchange of crypto-assets for funds; exchange of crypto-assets for other crypto-assets; execution of orders for clients; placing of crypto-assets; reception and transmission of orders; advice on crypto-assets; portfolio management of crypto-assets; and providing transfer services for crypto-assets. Each carries its own conduct rules layered on top of the common authorization requirements.

Choosing the right combination is a strategic decision rather than a formality. An exchange that wants to hold customer assets and run an order book sits in the highest capital class, while an advisory or order-routing business sits in the lowest. Mapping your real business model to these service definitions is the first step we take with any client preparing an application.

MiCA ties minimum capital to the type of service a CASP provides, sorting them into three classes set out in Annex IV of the regulation. The figure is a floor, not a target: a firm must hold permanent minimum own funds equal to the higher of its class amount or one quarter of the previous year's fixed overheads. The riskier the activity, especially holding client assets, the higher the requirement.

Class 1, at EUR 50,000, applies to lighter-touch services such as reception and transmission of orders, advice, portfolio management, and transfer services. Class 2, at EUR 125,000, covers exchange against funds or other crypto-assets, execution of orders, and placing. Class 3, at EUR 150,000, is reserved for the highest-risk activities: custody and administration, and operating a trading platform. A firm offering services across classes must meet the highest applicable figure.

Capital is only one piece of the prudential picture. Applicants also need professional indemnity cover or comparable safeguards, sound governance, and segregation of client funds and crypto-assets. Our MiCA compliance service models the exact capital and prudential position for each licence class before an application is filed.

The single biggest advantage of a MiCA CASP license is passporting. Under the old national regimes, a firm registered in one country had no automatic right to serve customers in another; it had to register again, jurisdiction by jurisdiction. MiCA replaces this with one harmonized authorization that is valid across all 27 EU member states plus the EEA states of Norway, Iceland, and Liechtenstein.

In practice, a CASP authorized by its home regulator notifies that regulator of the member states where it intends to operate. The home authority passes the notification to the host authorities, and after a short notice period the firm can provide its services into those markets without a fresh licence. One application, one supervisor, and access to a market of roughly 450 million people. Our EU regulation hub tracks how each member state supervises CASPs in practice.

There is an important catch on timing. The passport only activates once full CASP authorization is granted. A firm relying on transitional grandfathering can keep operating in its home state, but it cannot passport into the rest of the EU until it holds the licence. For any business with cross-border ambitions, that makes early authorization a commercial priority, not just a compliance one.

Before MiCA, most EU crypto firms operated as virtual asset service providers registered under their country's anti-money-laundering rules. That registration confirmed the firm had AML controls in place, but it said nothing about capital, governance, or consumer protection, and it carried no right to operate elsewhere in the EU. The CASP regime is a different animal: a full financial-services authorization, not a registration.

The practical differences are stark. A legacy VASP could often launch with minimal capital and a single AML officer. A CASP must meet a defined capital class, segregate client assets, pass fit-and-proper governance tests, publish disclosures, manage conflicts of interest, and submit to ongoing prudential supervision. In exchange, it gains the EU passport that a national VASP registration never offered.

The most important point for existing operators is that a national VASP registration does not convert into a CASP authorization automatically. Firms must apply afresh under MiCA, and once the transitional window closes the old registration ceases to authorize crypto-asset services. Treating the transition as a simple renewal is the most common and most costly misunderstanding we see.

MiCA gave firms that were already providing crypto-asset services under national law before 30 December 2024 a grandfathering period to keep operating while they pursued CASP authorization. Under Article 143(3), this transitional regime runs until 1 July 2026, or until the firm's CASP application is granted or refused, whichever comes first. After that point, providing crypto-asset services to EU clients without a MiCA licence is a breach of EU law.

The single biggest trap is that member states were allowed to shorten the window. Several did so significantly: Latvia, Hungary, the Netherlands, Poland, Slovenia, and Finland set six-month transitional periods, while others chose nine or twelve months, and only some kept the full eighteen. A firm cannot assume it has until July 2026; the effective deadline depends entirely on the country where it operates.

Grandfathering is also jurisdiction-specific and does not include passporting. A grandfathered firm may continue serving clients only in the member state where it was originally authorized, and it gains no EU-wide reach until full authorization is granted. With application timelines running into many months, firms that have not yet filed are now working against the clock.

CASP authorization follows a defined path. The five steps below describe the core workflow, from choosing a jurisdiction to receiving the licence and switching on the passport. The detail varies by member state, but the sequence and the statutory Article 63 timeline are consistent across the EU. Our MiCA compliance team runs this end to end as part of a licensing engagement.