Mica CASP Authorisation in Denmark Finanstilsynet Practical Guide

The Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114) has created a single, harmonised licensing framework for Crypto-Asset Service Providers (CASPs) across the European Union. For businesses choosing Denmark as their home Member State, the national competent authority is Finanstilsynet the Danish Financial Supervisory Authority which handles every stage of the MiCA CASP Denmark authorisation process, from pre-filing engagement through to final decision. With supervisory standards tightening across the EU in 2026, applicants face elevated scrutiny of governance, real presence, AML controls and outsourcing arrangements. This guide, published by Global Law Experts drawing on a 17-year cross-border network and regulatory compliance experience sets out the eligibility criteria, step-by-step application process, timelines, capital requirements and passporting strategy that every applicant needs to understand before filing with Finanstilsynet.

Quick Facts Denmark CASP Licence at a Glance

• Eligible entities: Legal persons established in the EU seeking authorisation to provide one or more crypto-asset services as defined by MiCA.
• Statutory timelines: Finanstilsynet must acknowledge receipt, carry out a completeness check within 25 working days, and issue a final decision within 40 working days of receiving a complete application with the power to suspend the clock for additional information.
• Minimum initial capital (Annex IV): Class 1 €50,000; Class 2 €125,000; Class 3 €150,000. An ongoing quarter-of-fixed-overheads test also applies.
• Transitional processing: Entities previously registered under Danish AML Act §48 should note the 60-day processing window during the transition to full MiCA authorisation.
• Passporting: A Danish CASP authorisation enables cross-border service provision across the EEA through a notification procedure to host Member State NCAs under MiCA Article 65.

Who Needs a CASP Licence and Which Services Are Covered?

Definitions Crypto-Asset Services Under MiCA

MiCA defines a closed list of crypto-asset services. Any entity performing one or more of the following on a professional basis within the EU requires authorisation:

• Custody and administration of crypto-assets on behalf of clients.
• Operation of a trading platform for crypto-assets.
• Exchange of crypto-assets for funds or for other crypto-assets.
• Execution of orders for crypto-assets on behalf of clients.
• Placing of crypto-assets (distribution).
• Reception and transmission of orders on behalf of clients.
• Providing advice on crypto-assets.
• Portfolio management of crypto-assets.
• Transfer services for crypto-assets on behalf of clients.

Service Classification and Prudential Class Mapping

Applicants should map their business model to one of the three prudential classes set out in MiCA Annex IV. In general: Class 1 (€50,000) covers advice, order reception/transmission, and placing; Class 2 (€125,000) covers exchange, execution and transfer services; Class 3 (€150,000) covers custody and trading-platform operation. Hybrid models offering services across classes must satisfy the highest applicable capital threshold.

When MiCA Overlaps With Other Regimes

Some business models particularly those combining fiat-currency payment services with crypto may trigger parallel licensing under the Payment Services Directive (PSD2) or the Electronic Money Directive. Where crypto-asset instruments qualify as financial instruments, MiFID authorisation may be required instead of, or in addition to, MiCA. Applicants should conduct a regulatory perimeter analysis before filing.

Finanstilsynet’s Role and Filing Routes for MiCA CASP Denmark

Role of Finanstilsynet as Home NCA

Finanstilsynet acts as the home-state national competent authority for any CASP whose registered office is in Denmark. It is responsible for receiving and assessing all authorisation applications, conducting fit-and-proper evaluations, and once authorisation is granted ongoing supervision. Finanstilsynet’s dedicated MiCA page provides the statutory basis and practical guidance for applicants.

Filing Routes: Transition vs Fresh Authorisation

Two practical routes exist, depending on the applicant’s history:

1. Transition from prior AML VASP registration: Entities that held a Danish VASP registration under the Anti-Money Laundering Act (§48) before MiCA’s application date of 30 December 2024 may benefit from a transitional window. During this period Finanstilsynet requires a full MiCA-compliant application but may allow continued operations pending a decision.
2. Fresh MiCA authorisation: New market entrants or firms choosing Denmark as a new home state must file a complete Article 62 application. No crypto-asset services may be provided until authorisation is granted.

For cross-border services only (i.e., providing services into Denmark from another Member State), the entity’s home NCA handles the notification; Finanstilsynet then acts as host authority.

Practical Pre-Filing Steps

Industry observers note that engaging with Finanstilsynet before formal filing significantly reduces completeness-check delays. Recommended pre-filing steps include: setting up portal access, preparing a draft business plan for informal discussion, and identifying the specific CASP services for which authorisation is sought.

Step-by-Step Application Checklist for Finanstilsynet CASP Authorisation

Step 0 Business Model and Scope Mapping

Before any documentation is drafted, clearly define which of the nine MiCA crypto-asset services you intend to offer. This determines your prudential class, governance requirements and the documentation scope.

Step 1 Company Set-Up and Corporate Documentation

The applicant must be a legal person incorporated in an EU Member State. If using Denmark as the home state, this typically means establishing a Danish ApS or A/S, with a registered office, articles of association and a complete shareholder register. Non-EU founders should plan for local directorship and resident agent arrangements.

Step 2 Governance and Fit-and-Proper Assessment

ESMA’s supervisory briefing on CASP authorisation emphasises that NCAs must rigorously assess the collective competence, experience and integrity of the management body. Prepare: detailed CVs for all board members and senior managers; criminal record certificates (not older than six months); declarations of conflicts of interest; and a collective competence matrix demonstrating the board’s combined expertise in technology, compliance, finance and crypto markets.

Step 3 Capital and Prudential Safeguards

Applicants must demonstrate initial capital at or above the MiCA Annex IV thresholds (Class 1: €50,000; Class 2: €125,000; Class 3: €150,000). Additionally, own funds must at all times equal or exceed one quarter of the preceding year’s fixed overheads. Evidence takes the form of bank confirmations, audited accounts or auditor-certified financial projections.

Step 4 AML/KYC and ML/TF Risk Framework

The application must include a comprehensive AML/KYC policy aligned with both MiCA and the Danish Anti-Money Laundering Act. This covers customer due diligence procedures, ongoing monitoring, suspicious transaction reporting, record-keeping obligations and a documented ML/TF risk assessment specific to the applicant’s service scope and client base.

Step 5 ICT and Security (DORA Interplay)

CASPs are subject to ICT resilience requirements under MiCA, increasingly reinforced by the Digital Operational Resilience Act (DORA). Applicants must provide: an ICT security policy, business continuity and disaster recovery plans, incident reporting procedures, and evidence of penetration testing. Finanstilsynet expects documentation to be specific, not generic templates.

Step 6 Outsourcing and Third-Party Risk

The ESMA supervisory briefing devotes significant attention to outsourcing. Finanstilsynet will verify that the applicant retains effective control over outsourced functions, that outsourcing does not hollow out local substance, and that contractual safeguards (audit rights, termination clauses, data protection) are in place. Poorly controlled outsourcing has been cited in recent Danish refusals.

Step 7 Operational Readiness Evidence

Prepare evidence of: custody segregation policies, client onboarding flows, complaints-handling procedures, and market-abuse detection (where the applicant operates a trading platform). Finanstilsynet reviews these for practical adequacy, not merely formal compliance.

Step 8 Documentation Bundle

The full Article 62 documentation package must include:

• Application form (Finanstilsynet prescribed format).
• Business plan covering projected volumes, target markets, revenue model and three-year financial projections.
• Detailed organisational chart with reporting lines.
• Shareholder register and qualifying-holding disclosures.
• KYC/AML policy and ML/TF risk assessment.
• IT/security policy and DORA-aligned controls.
• Outsourcing agreements with third-party risk assessment.
• Audited accounts or auditor-certified projections.
• Fixed overheads calculation.
• Client segregation and custody policy.
• Complaints-handling policy.
• Management CVs and criminal record certificates (≤6 months).
• Proof of capital (bank confirmations, subscription agreements).

A comprehensive Finanstilsynet CASP checklist and CASP documentation templates can help applicants ensure nothing is omitted from the documentation bundle.

Physical Presence and Management Tests How to Satisfy Finanstilsynet

Legal Requirement vs Practical Expectations

MiCA itself does not prescribe a single EU-wide “substance test,” but it empowers NCAs to verify that the applicant has adequate arrangements for the services proposed. Finanstilsynet has interpreted this requirement with increasing rigour. In a published April 2026 refusal, the authority rejected a CASP application citing among other grounds insufficient documented presence in Denmark, excessive outsourcing and a lack of effective local decision-making control. This decision serves as an important signal for all applicants considering Denmark as a home state.

How to Demonstrate Presence (Practical Evidence)

• Denmark-based board meetings: Documented meeting minutes held in Denmark at regular intervals.
• Senior managers resident in Denmark: At least one and preferably more senior management members with Danish tax residence.
• Office lease and local staff: A physical office with compliance, operational and IT personnel on site.
• Documented decision logs: Evidence that key business and compliance decisions are made in Denmark, not delegated abroad.
• Control over outsourced functions: Contracts and governance structures that retain oversight in Denmark.

Guidance on how to demonstrate real presence in Denmark for a MiCA licence can assist firms in structuring their local operations to satisfy Finanstilsynet’s expectations.

Management Fit-and-Proper Checks

Criminal record certificates must be recent (within six months). CVs should detail relevant supervisory and industry experience. Any prior regulatory sanctions, investigations or supervisory restrictions must be disclosed. Structuring submissions clearly and pre-empting queries saves significant time.

Timeline, Fees and Typical Reasons for Rejection

MiCA Statutory Timelines

Under MiCA Articles 62–63, the process follows a defined cadence: acknowledgement of receipt, a 25-working-day completeness check, and a final decision within 40 working days of the application being deemed complete. Finanstilsynet may suspend the decision clock to request additional information and in practice, complex applications frequently trigger at least one suspension.

Finanstilsynet Operational Timings

For entities transitioning from prior VASP registration, Finanstilsynet has published a 60-day processing note applicable during the transition period. New applications outside the transitional window should anticipate total elapsed time of three to six months, accounting for preparation, completeness queries and remediation rounds.

Typical Fees and Cost Drivers

Finanstilsynet’s application fees are set by Danish statutory instruments and are modest relative to total project cost. The significant cost drivers are: external legal and compliance advisory fees, technical remediation (ICT policies, penetration testing), capital set-up and operational infrastructure (office, staff, banking). Typical commercial estimates for a full MiCA CASP authorisation project in Denmark range from €100,000 to €300,000 depending on complexity and service scope these are estimates only and vary significantly by applicant.

Common Reasons for Rejection

Based on published Finanstilsynet decisions including the April 2026 refusal the most common grounds for refusal include:

• Insufficient real presence: No meaningful decision-making or operational staff in Denmark.
• Excessive or poorly controlled outsourcing: Critical functions delegated without adequate contractual safeguards or local oversight.
• Inadequate AML/KYC framework: Policies that are generic, incomplete or not tailored to the applicant’s risk profile.
• Weak governance: Management body lacking collective competence, incomplete fit-and-proper documentation, or undisclosed conflicts.
• Insufficient capital or own funds: Failure to demonstrate capital at or above Annex IV thresholds.
• Incomplete documentation: Missing or outdated items in the Article 62 bundle.

Passporting and EU Market Access Strategy

How Passporting Works Under MiCA

Once authorised as a CASP in Denmark, Article 65 of MiCA permits the firm to provide services cross-border throughout the EEA via a notification procedure. The home NCA (Finanstilsynet) receives the notification and forwards it to the host Member State NCA. There is no separate host-state authorisation though host NCAs retain certain supervisory powers over conduct-of-business rules.

Denmark vs Common Alternative Home States Quick Comparison for CASP Applicants

Note: Capital thresholds are set by MiCA Annex IV and apply uniformly across the EU. Supervisory emphasis on presence and outsourcing varies by NCA, as highlighted in the ESMA supervisory briefing.

Go-to-Market Options From Denmark

Denmark offers a credible supervisory reputation, access to Nordic banking relationships, and a regulator experienced in fintech supervision. Strategic considerations include: the quality of local banking partnerships (important for fiat on/off-ramps), the regulatory language environment, and proximity to key target markets. Industry observers note that Denmark’s stricter approach may ultimately benefit licence holders through higher credibility with counterparties and banking partners.

Recommended Passporting Roadmap

1. Obtain full MiCA CASP authorisation from Finanstilsynet.
2. Prepare host-state notification dossier (services, target markets, marketing plans).
3. File notification with Finanstilsynet for each target host state.
4. Engage with host-state NCAs on local conduct-of-business requirements.
5. Implement local language and consumer-protection measures as required.

Detailed guidance on the EU passporting process under MiCA is available for firms planning multi-jurisdictional rollouts.

Key Eligibility Requirements Summary Checklist

• EU legal person: Incorporated in an EU/EEA Member State with a registered office.
• Transparency and AML checks: Full shareholder and beneficial ownership disclosure; robust AML/KYC framework.
• Minimum initial capital: Per MiCA Annex IV class, plus the ongoing fixed-overheads test.
• Fit-and-proper management: Board and senior management meeting ESMA/EBA collective competence and integrity standards.
• Adequate ICT and outsourcing arrangements: DORA-aligned ICT security, business continuity, and controlled outsourcing.
• Local presence evidence: Documented decision-making and operational control in the home Member State, as required by Finanstilsynet.

Case Study Anonymised Client Example

A European fintech startup offering crypto exchange and custody services selected Denmark as its home Member State, attracted by the country’s reputation for regulatory credibility and strong Nordic banking relationships. During the pre-filing review, significant gaps were identified: the management body was entirely based outside Denmark, critical compliance and IT functions were outsourced to a non-EU provider without adequate contractual controls, and the AML risk assessment was based on a generic template not tailored to the firm’s service scope.

The remediation plan involved: appointing two Denmark-resident senior managers with direct supervisory experience; establishing a Copenhagen office with local compliance and IT oversight staff; renegotiating the outsourcing agreement to include audit rights, termination provisions and Danish-law governing clauses; and commissioning a bespoke ML/TF risk assessment. After a four-month preparation phase and a clean submission, the application cleared the completeness check without suspension. Finanstilsynet issued authorisation within the statutory 40-working-day window. The case illustrates that proactive remediation particularly around presence and outsourcing control is the single most effective way to avoid the refusal patterns seen in 2026 enforcement decisions.

Sources

• EUR-Lex Regulation (EU) 2023/1114 (MiCA) full text including Articles 62–65, Article 67, and Annex IV on capital requirements.
• Finanstilsynet MiCA information page Danish NCA guidance on MiCA implementation and application procedures.
• Finanstilsynet Decision refusing CASP authorisation (April 2026) published refusal citing insufficient presence and outsourcing deficiencies.
• ESMA Supervisory Briefing on Authorisation of CASPs (January 2025) guidance on substance, governance, outsourcing and fit-and-proper standards.
• European Banking Authority (EBA) MiCA regulatory products and guidance level-2 regulatory technical standards and governance guidelines.
• Finanstilsynet AML Act §48 registration and transitional processing note 60-day processing window for transitioning VASP registrations.