How to Become an Authorised Mica CASP in the EU End‑to‑end Practical Guide

Securing MiCA CASP authorisation in the EU is now the single most consequential regulatory milestone for any crypto-asset business that wants to operate lawfully across the European single market. The Markets in Crypto-Assets Regulation (EU) 2023/1114 established a unified licensing framework, and national competent authorities (NCAs) across the bloc moved from preparatory mode into active application processing during 2025–2026. Transition periods for pre-existing virtual-asset service providers have already expired in several member states the CSSF confirmed the end of Luxembourg’s transition window on 1 July 2026 meaning firms that have not yet applied face an immediate compliance gap.

This guide consolidates the legal requirements, documentation checklists, jurisdiction comparison data, realistic timelines and passporting mechanics into a single, actionable resource. It is designed for founders, CTOs, compliance officers and legal advisers who need a clear roadmap rather than a restatement of the regulation.

Quick TL;DR three-step roadmap

1. Prepare: Choose your home NCA, establish a legal entity, and assemble governance, AML, IT and capital evidence.
2. Submit & engage: File the full application bundle via the NCA portal; respond to completeness queries and substantive Q&A rounds.
3. Authorise & scale: Receive the authorisation decision, enter the ESMA register, and passport into other EU member states.

Quick Takeaways Snapshot Checklist

• Typical end-to-end timeline: 3–6 months for clean migrations from pre-existing VASP registrations; 6–12+ months for greenfield applicants, depending on NCA workload and application quality.
• Minimum own-funds capital: Ranges from €50,000 to €150,000 under MiCA, depending on the exact services offered some NCAs expect higher prudential buffers.
• Top documentation categories: Governance & fit-and-proper packs, AML/CFT policies, IT/cyber evidence, prudential calculations, and a crypto-asset white paper where Title II applies.
• Most common reasons for delay: Incomplete governance documentation, weak AML/KYC frameworks, unclear business-model descriptions, and insufficient IT-security evidence all flagged consistently by ESMA’s Supervisory Briefing on CASP Authorisation.
• Passporting advantage: Once authorised in one member state, a CASP may notify host NCAs and offer services across the EU without re-applying.

Step-by-Step Process to Obtain MiCA CASP Authorisation in the EU

The authorisation process is regulator-led and governed principally by Articles 59–65 of MiCA. The steps below reflect the practical workflow that most NCAs follow, aligned with ESMA’s supervisory convergence guidance.

1. Choose and register your legal entity; decide on a home regulator (weeks 0–4). Incorporate (or re-domicile) an EU entity in the jurisdiction of the NCA you intend to apply to. Evaluate branch versus subsidiary structures and confirm that the entity type is eligible.
2. Define exact CASP services and business model (weeks 0–4). Map your product offering to the ten service categories in Article 3(16) of MiCA custody, exchange, transfer, order execution, placement, advice, portfolio management, etc. This scoping exercise determines capital requirements and the depth of documentation needed.
3. Prepare the crypto-asset white paper or confirm non-applicability (weeks 2–6). Where your firm offers or admits to trading a crypto-asset that it issues, Title II of MiCA requires a published white paper notified to the NCA. Confirm whether the obligation applies and, if so, draft in accordance with Annex I disclosure standards.
4. Governance, fit-and-proper mapping and board composition (weeks 4–8). Identify all senior managers, qualifying shareholders and members of the management body. Compile CVs, criminal-record extracts, good-repute declarations and a completed fit-and-proper questionnaire for each individual.
5. AML/CFT policies and KYC flows (weeks 4–8). Draft or update your AML/CFT policy framework, customer due diligence procedures, transaction-monitoring rules, sanctions-screening procedures and suspicious-activity reporting protocols. Register for national AML obligations where required.
6. Operational, IT, custody and cyber controls evidence (weeks 6–12). Prepare architecture diagrams, business-continuity and disaster-recovery plans, custody-arrangement descriptions, outsourcing registers, penetration-test reports and, where available, SOC 2 or ISO 27001 certification evidence.
7. Prudential and capital proof (weeks 2–4). Obtain audited or certified bank statements, shareholder-fund confirmations and, for ongoing compliance, prepare own-funds calculations in line with MiCA’s prudential provisions.
8. Assemble the full application bundle and submit via NCA portal (variable). Collate all documentation into the NCA’s prescribed format many NCAs now mandate electronic portal submissions. Pay the application fee.
9. NCA completeness checks, clarifications and supervisory follow-ups (weeks 12–28). The NCA will acknowledge receipt, perform a completeness review (typically 4–8 weeks), and issue rounds of clarification questions. Substantive Q&A may run for several additional months depending on complexity.
10. Authorisation decision and ESMA register listing (weeks 4–12 post-Q&A completion). On approval the NCA notifies ESMA, and the firm is entered in the EU-wide CASP register. Prepare passporting notifications for any additional member states.

Realistic end-to-end timeline: Clean RFSP-to-CASP migrations typically complete in 3–6 months. Greenfield applicants should budget 6–12+ months, with additional time where complex group structures or cross-sector licences are involved.

Choosing a Home Regulator Jurisdiction Comparison and Selection Criteria

Decision factors

Selecting the right NCA is a strategic choice. Key variables include processing speed, application fees, willingness to engage with innovative business models, availability of English-language forms and guidance, depth of the local corporate-services ecosystem, and ease of recruiting compliance talent locally. The choice of home NCA also affects the firm’s ongoing supervisory relationship and reporting obligations.

Jurisdiction comparison table

Note: fee amounts and processing times are indicative as of July 2026. Applicants should confirm current schedules directly with the relevant NCA.

Key Requirements and Eligibility

Who must be authorised

Under Articles 59–62 of MiCA, any entity that provides one or more crypto-asset services to third parties on a professional basis within the EU must hold an authorisation as a CASP unless an exemption applies. The requirement covers both EU-established firms and third-country entities operating through an EU branch or subsidiary.

Exemptions and overlap with regulated financial-services providers

Article 60 carves out certain regulated financial-services providers (RFSPs) including credit institutions, investment firms, e-money institutions and UCITS management companies that may provide specific CASP services under a notification procedure rather than a full separate authorisation. In practice, the notification still requires submission of a programme of operations, governance documentation and AML arrangements to the NCA, so the workload reduction is partial rather than total. ESMA’s Q&As on MiCA clarify edge cases involving service-definition overlaps.

Fit-and-proper, local presence and supervisory access

NCAs assess the good repute, knowledge, skills and experience of all members of the management body and qualifying shareholders. Applicants must demonstrate effective mind and management within the home member state and provide the NCA with supervisory access including the right to conduct on-site inspections. Key evidence items include:

• Personal questionnaires: Completed fit-and-proper forms for each senior manager and qualifying shareholder.
• Criminal-record extracts: From each relevant jurisdiction of residence.
• Organisational chart: Showing reporting lines, compliance function and internal audit.
• Proof of local presence: Office lease, local director appointments and operational address.

Full Documentation Checklist for MiCA CASP Authorisation

The application bundle divides into six broad categories. The precise format and naming conventions vary by NCA, but the substantive content requirements derive from MiCA and ESMA’s supervisory convergence guidance.

Governance documents

• Constitutional documents: Articles of association, certificate of incorporation, shareholder register.
• Board and committee charters: Terms of reference for the management body, risk committee and audit committee.
• Organisational chart: Including all group entities, reporting lines and outsourced functions.
• Senior-manager CVs and fit-and-proper packs: For each director, compliance officer, MLRO and qualifying shareholder.
• Internal policies: Conflicts-of-interest policy, remuneration policy, complaints-handling procedure.

AML/KYC documentation

• AML/CFT policy: Covering risk assessment, CDD, EDD, PEP and sanctions screening.
• KYC procedures: Onboarding flows, identity-verification technology and ongoing monitoring.
• Transaction-monitoring framework: Rules, thresholds and escalation workflows.
• Suspicious-activity reporting: Internal processes and FIU reporting mechanisms.

Operational and business-continuity documentation

• Operations manual: End-to-end description of service delivery.
• Outsourcing register: All material outsourced functions, due-diligence records and contracts.
• Custodial arrangements: Custody agreements, segregation controls and client-asset safeguarding measures.
• Business-continuity plan: Disaster-recovery procedures, RTO/RPO targets and tested failover capabilities.

IT and cyber-security evidence

• Architecture diagrams: Network topology, data-flow maps and cloud-infrastructure documentation.
• Security certifications: SOC 2 Type II, ISO 27001 or equivalent where available.
• Penetration-test reports: Recent independent tests covering application and infrastructure layers.
• Incident-response plan: Procedures for breach detection, containment, notification and remediation.

Financial and prudential documentation

• Capital proof: Certified bank statements, auditor comfort letters or shareholder-funding commitments.
• Own-funds calculations: Demonstrating compliance with MiCA minimum-capital thresholds.
• Financial forecasts: Three-year projections, including revenue model and cost assumptions.

White paper requirements (where Title II applies)

If the applicant issues or offers to the public a crypto-asset that is not an asset-referenced token or e-money token, Title II of MiCA requires publication of a crypto-asset white paper. The white paper must include the disclosures specified in Annex I, including risk warnings, a description of the issuer and the project, the rights and obligations attached to the crypto-asset, and the underlying technology. The white paper must be notified to the home NCA before publication.

[Download the full MiCA CASP application checklist (PDF)]

Capital and Prudential Requirements Breakdown and Examples

Minimum capital bands under MiCA

MiCA prescribes three own-funds tiers for CASPs, linked to the services provided:

• €50,000: For firms providing only advice on crypto-assets or order reception and transmission.
• €125,000: For firms providing exchange, execution, placement or transfer services.
• €150,000: For firms operating a trading platform or providing custody and administration of crypto-assets on behalf of clients.

Where a CASP provides multiple services, the highest applicable tier applies. NCAs may also require additional buffers based on their supervisory risk assessment, particularly for firms with high-volume custody operations or complex group structures.

Liquidity, reserved funds and ongoing reporting

Beyond the initial capital requirement, CASPs must maintain own funds on an ongoing basis, submit periodic prudential returns to the NCA, and hold adequate liquidity to wind down operations in an orderly manner. Some NCAs expect applicants to present a wind-down plan as part of the initial application.

Practical tips for demonstrating capital and obtaining banking relationships

Securing a banking relationship remains one of the most frequently cited practical challenges for crypto-native applicants. Industry observers note that applicants who present a clear regulatory narrative, audited financials and a well-structured compliance programme are significantly more successful in onboarding with EU banks. Early engagement with potential banking partners ideally before the NCA application is submitted is advisable.

Submission Process, Fees and Realistic Timelines

NCA submission mechanics

Most NCAs have migrated to electronic portal submissions. The Central Bank of Ireland requires applicants to use its online portal, which has been live for CASP applications since April 2026. The Bank of Lithuania similarly accepts electronic filings through its authorisation platform. Luxembourg’s CSSF operates its own submission system with specific naming conventions for uploaded documents. Applicants should review the relevant NCA’s procedural guidance before compiling the final bundle to avoid unnecessary re-submissions.

Typical fees

Application fees vary by NCA and are typically published on each authority’s fee schedule. Ranges observed as of July 2026 span from a few thousand euros in some jurisdictions to significantly higher amounts in others. Applicants should confirm the exact fee with the chosen NCA before submission, as amounts may be updated annually. In addition to the application fee, firms should budget for ongoing annual supervisory levies post-authorisation.

Realistic timeline map

• Pre-submission preparation: 8–16 weeks (governance, AML, IT evidence, capital assembly).
• Initial NCA completeness review: 4–8 weeks from date of submission.
• Completeness queries and re-submissions: 2–12 weeks, depending on application quality.
• Substantive Q&A and supervisory engagement: 8–20 weeks (may include on-site or remote inspections).
• Final decision and ESMA registration: 4–12 weeks following satisfactory completion of Q&A.

Common reasons for delay and rejection

• Incomplete governance documentation: Missing fit-and-proper packs, unclear reporting lines or absent committee charters.
• Weak AML/CFT frameworks: Generic policies not tailored to the specific crypto-asset services offered.
• Unclear business model: Failure to map product features to MiCA service definitions.
• Insufficient IT controls: Absence of penetration-test reports, outdated architecture diagrams or no disaster-recovery plan.
• Complex group structures: Opaque ultimate-beneficial-ownership chains or unresolved intra-group outsourcing arrangements.

EU Passporting Process After Authorisation How to Scale Across the EU

Notification process to host NCAs

Once authorised, a MiCA CASP may provide its licensed services in any other EU member state by notifying its home NCA, which in turn communicates with the host NCA. The notification must include the list of member states in which the CASP intends to operate, the services to be provided, and confirmation that the firm’s infrastructure and compliance arrangements can support cross-border operations. Host NCAs do not grant a separate authorisation the process is a notification, not an application.

Practical checklist for cross-border market entry

• Local tax obligations: Assess VAT, corporate tax and withholding-tax implications in each host state.
• Marketing and consumer-protection rules: Adapt promotional materials to comply with host-state advertising restrictions and language requirements.
• Regulatory reporting: Confirm whether the host NCA imposes additional reporting or record-keeping obligations on inbound passported firms.

NCA Notes Typical Differences and Practical Tips

• CSSF (Luxembourg): Emphasises consumer-protection disclosures and marketing compliance. Actively enforcing the end of transition-period carve-outs; firms without authorisation must cease services.
• Bank of Lithuania: Publishes detailed applicant expectations on its website; known for a structured, checklist-driven review process. English is widely accepted.
• Central Bank of Ireland: Issues sectoral guidance notes and reporting templates; portal submission is mandatory. Expect detailed queries on governance and operational resilience.
• CySEC (Cyprus): Leverages MiFID-era supervisory experience; publishes circulars on MiCA implementation. Strong professional-services ecosystem supports applicants.

Downloadable Assets and Templates

• MiCA CASP application checklist (PDF): Comprehensive document-by-document checklist aligned to MiCA and ESMA guidance.
• Sample governance matrix: Editable template mapping board, committee and senior-management responsibilities.
• Milestone timeline (PNG): Visual timeline from preparation to passporting.
• White paper template (Title II checklist): Annex I disclosure checklist with drafter prompts.

Appendix Resources and Next Steps

The following authoritative resources form the foundation of any MiCA CASP authorisation project and should be consulted throughout the application process. Applicants are advised to confirm all requirements, fees and timelines directly with their chosen NCA, as supervisory practices continue to evolve.

• Primary legislation: Regulation (EU) 2023/1114 Markets in Crypto-Assets (MiCA)
• Supervisory convergence: ESMA Supervisory Briefing on Authorisation of CASPs (January 2025)
• ESMA Q&As: Questions and Answers on MiCA
• NCA guidance Ireland: Central Bank of Ireland MiCAR guidance
• NCA guidance Luxembourg: CSSF CASP page
• NCA guidance Lithuania: Bank of Lithuania CASP authorisation
• NCA guidance Cyprus: CySEC MiCA communications
• Supporting deep dive: MiCA capital & prudential requirements detailed technical explainer on own-funds calculations.

For further detail on MiCA capital and prudential requirements, best EU jurisdictions for MiCA CASP authorisation, MiCA white paper drafting obligations, and downloadable application checklist templates, supporting content within the Global Law Experts resource library provides jurisdiction-specific and topic-specific analysis.

Caveat: This guide constitutes practical guidance published by Global Law Experts and is current as of 21 July 2026. It does not constitute legal advice. Applicants should confirm all regulatory requirements, fees and timelines with the relevant national competent authority before proceeding.

Sources

• Regulation (EU) 2023/1114 Markets in Crypto-Assets (MiCA) EUR-Lex
• Supervisory Briefing on Authorisation of CASPs under MiCA (January 2025) ESMA
• Questions and Answers on MiCA ESMA
• Markets in Crypto-Assets Regulation Central Bank of Ireland
• MiCA Transition Period for VASPs Ended on 1 July 2026 CSSF
• Crypto-Asset Service Providers (CASP) CSSF
• Authorisation of Crypto-Asset Service Providers Bank of Lithuania
• MiCA Communications CySEC