CASP Licence Under MiCA: How to Get Authorised in the EU

This guide is a general overview for founders and product teams, not legal advice. Regulations change, so always confirm current requirements with qualified legal advisers.

Under the EU's Markets in Crypto-Assets Regulation (MiCA), companies that provide crypto services to people in the EU need to be authorised as crypto-asset service providers, or CASPs. Authorisation in one member state can then be passported across the EU. Here's what's involved.

Who needs CASP authorisation?

Any business providing crypto-asset services in the EU, including:

Custody and administration of crypto-assets for clients
Operating a trading platform for crypto-assets
Exchanging crypto-assets for funds or other crypto-assets
Executing orders on behalf of clients
Placing crypto-assets
Receiving and transmitting orders
Providing advice and portfolio management
Providing transfer services for clients

Certain regulated financial institutions can provide some services through a notification process instead of full CASP authorisation.

Minimum capital

MiCA sets minimum capital requirements in three classes, based on services provided:

Class 1 (€50,000): services such as reception and transmission of orders, advice, execution of orders, placing, transfer services and portfolio management.
Class 2 (€75,000): class 1 services plus custody and exchange services.
Class 3 (€150,000): includes operating a trading platform.

CASPs must also hold capital linked to their fixed overheads where that's higher, and can use insurance in some cases.

EU presence requirements

A registered office in an EU member state where at least part of the services are provided
Effective management in the EU
At least one director resident in the EU
Management that meets fit and proper requirements

The application process

Choose your home member state and engage with its national competent authority.
Prepare the application: business plan, governance, policies, ICT and security arrangements, AML framework and information on owners and managers.
The regulator checks completeness within a set period (MiCA sets 25 working days).
The regulator assesses the complete application and decides within a set period (MiCA sets 40 working days, which can be paused for questions).
Once authorised, notify to passport services to other member states.

In practice, preparation often takes months, so start early.

What your platform must support

Customer onboarding and due diligence
Segregation and safekeeping of client assets
Travel Rule data for crypto transfers
Clear information on fees, risks and services
Complaints handling inside the product
Systems to detect and report market abuse
Strong ICT security in line with the EU's digital operational resilience rules (DORA)
Record-keeping and regulatory reporting

Choosing a home member state

Consider regulator experience with crypto, language, application timelines, where your team and customers are, and the availability of banking partners. The choice matters because your home regulator supervises you across the EU.

Preparing a strong application

Regulators assess whether your business is well run, not just whether documents exist. A strong application shows a realistic business plan, a governance structure that works in practice, experienced people in key roles, and policies tailored to your actual services. Generic templates are easy to spot. Consider an informal pre-application meeting with your chosen regulator where possible, and respond to questions quickly and thoroughly to avoid delays.

Outsourcing and third parties

Most CASPs rely on third parties for KYC, custody technology, cloud hosting or market data. Under MiCA and the EU's operational resilience rules, you remain responsible for outsourced functions. Document due diligence on providers, contractual rights to audit and exit, and contingency plans if a provider fails. Choose technology partners who can provide the information regulators expect.

Passporting in practice

Decide which member states you'll serve first
Notify your home regulator, which informs host regulators
Localise your product, disclosures and support languages
Follow host-state rules on marketing where they apply
Plan local banking and payment methods for each market

Ongoing supervision

After authorisation, expect regular reporting, notification of material changes, audits and supervisory engagement. Keep your compliance matrix and records up to date, and build regulatory reporting into your platform rather than relying on manual spreadsheets.

Product checklist for an EU CASP

Customer due diligence and ongoing monitoring
Segregated client assets with daily reconciliation
Travel Rule data exchange
Clear fee, risk and service information
Complaints handling inside the app
Market abuse surveillance
ICT security, incident reporting and resilience testing
Regulatory reporting and record-keeping

Timeline planning

From scoping to authorisation, many firms plan for most of a year, depending on readiness and the regulator. Building product features in parallel with the application keeps the timeline realistic, and launching first in your home market lets you refine operations before passporting across the EU.

Technology partners and DORA

The EU's Digital Operational Resilience Act (DORA) applies to CASPs, adding requirements for ICT risk management, incident reporting, resilience testing and management of technology providers. In practice, this means maintaining an inventory of critical systems and providers, testing backups and recovery plans, monitoring security continuously, and having contracts with providers that allow oversight and exit. When choosing development, hosting and custody partners, ask how they support DORA compliance.

Building these capabilities into your platform and processes from the beginning is far more efficient than retrofitting them after authorisation, and it strengthens your application by showing regulators a mature operating model.

Frequently asked questions

Can a non-EU company apply?

It needs an EU entity that meets the presence requirements. Non-EU firms that actively solicit EU customers without authorisation risk breaching MiCA.

How long does authorisation take?

The formal assessment periods are set out in MiCA, but preparing a complete application and answering questions often takes several months overall.

Does MiCA replace national registrations?

Yes, MiCA replaced the patchwork of national crypto registrations, with transitional periods now ended across the EU.

Key takeaways

CASP authorisation is required to serve EU customers.
Capital, presence and governance requirements apply.
Build compliance features into the product.
Passport across the EU once authorised.

Build an EU-ready platform

AnAInfo builds exchanges, wallets and token platforms designed for MiCA, the Travel Rule and GDPR. Read MiCA explained, see our Europe page, or contact us.