MiCA CASP licence in the EU

MiCA is one authorisation for twenty-seven countries. A crypto-asset service provider authorised in any member state may serve clients across the whole European Economic Area after a notification — no second licence, no second capital. This page is the map: what the regime covers, what it costs, which national regulators are actually issuing, and how to choose between them.

The national era is over

Until 2026 every country ran its own crypto register: VASP in Estonia and Lithuania, VFA in Malta, PSAN in France, and so on. Those regimes were transitional shelters under MiCA, and they have closed. Lithuania ended its period on 31 December 2025, Estonia and Malta on 1 July 2026 — the backstop set by Article 143(3). A national registration issued before those dates is no longer a permission anywhere in the Union.

This is the single most common misunderstanding we are asked to fix. If your paperwork says «VASP» or «VFA», it describes a status that expired, not a licence you hold.

What a CASP authorisation covers

• custody and administration of crypto-assets on behalf of clients;
• exchange of crypto-assets for funds and for other crypto-assets;
• operating a trading platform for crypto-assets;
• execution of orders, reception and transmission of orders;
• placement of crypto-assets;
• transfer services, portfolio management, advice.

Separate regimes apply to issuers of asset-referenced tokens and e-money tokens; a stablecoin project is not covered by a CASP authorisation alone.

Capital: three tiers, identical everywhere

Own-funds requirements come from MiCA, not from national law, which is why «the cheapest EU jurisdiction» no longer exists as a category.

• € 50 000 — advice, reception and transmission, execution of orders, placement, transfer services;
• € 125 000 — operating a trading platform;
• € 150 000 — custody and administration, exchange of crypto-assets.

The applicable figure is the higher of the tier above and one quarter of the previous year's fixed overheads.

Timeline: the regulator's clock and yours

MiCA gives the competent authority 25 working days to confirm that the application is complete and 60 working days after that to decide. Those 85 working days are the visible part. The invisible part is preparation — assembling a fileable application takes most teams three to six months, and hiring resident senior staff takes longer than writing policies. Plan four to twelve months from first call to authorisation.

Choosing a member state

Since the rulebook is identical, choose on four things that are not.

• Throughput. How many CASPs has this regulator actually authorised? Malta had around a dozen by May 2026 and sits in the EU top five. A regulator that accepts applications is not the same as one that decides them.
• Language and correspondence. You will exchange letters with this authority for years. Malta supervises in English; elsewhere expect the national language.
• Adjacent licences. If you also need payment or e-money permissions, a regulator experienced in both saves a year. Lithuania is strong here.
• Cost of substance. Resident management, premises and staff differ by country far more than the fees do.

The jurisdictions we work in

Estonia — supervision moved from the financial intelligence unit to Finantsinspektsioon; state application fee € 3 300. Malta — MFSA, crypto framework since 2018, English-language supervision. Lithuania — Bank of Lithuania, strong payments and e-money practice. Outside MiCA we also handle the United Kingdom, where the FCA gateway is open from 30 September 2026 to 28 February 2027, Canada, the United States and Singapore.

What every regulator checks

• fit and proper assessment of directors, senior managers and beneficial owners;
• real substance: management resident in the country, premises, staff, local decision-making;
• AML/CFT programme, MLRO, transaction monitoring, sanctions screening, Travel Rule;
• ICT and operational resilience under DORA, outsourcing and incident reporting;
• segregation and safekeeping of client crypto-assets, custody policy, key management;
• governance, conflicts of interest, complaints handling, marketing communications;
• capital, prudential safeguards and an orderly wind-down plan.

Frequently asked questions

Which EU country gives a crypto licence fastest?

The statutory clock is the same everywhere: 25 plus 60 working days. Real differences come from regulator workload and from how complete your file is on day one.

Can I buy a company that already holds a CASP authorisation?

A change of control requires the regulator's approval, and the authorisation is tied to the approved programme of operations. It is not a shelf product.

Do I need to be in the EU to serve EU clients?

Yes, unless the client approached you entirely on their own initiative. Soliciting clients in the Union without authorisation is unauthorised activity.

Does a CASP authorisation cover the United Kingdom?

No. The UK is outside MiCA and runs its own FSMA regime with a fixed application window.

We only issue a token — is that a CASP matter?

Not necessarily. Offering crypto-assets to the public has its own white-paper and notification obligations, and stablecoins fall under the ART/EMT regimes. Start with a perimeter review, not with a licence application.

Reviewed: August 2026, against Regulation (EU) 2023/1114 (MiCA) and the transitional deadlines applied by member states.