MiCA CASP Licence: EU Crypto Authorisation, Capital, Timeline and Passport

The ten crypto-asset services under MiCA

MiCA Article 3(1)(16) defines the services that need authorisation. The licence lists each service the firm may provide, and adding a service later requires an extension of the authorisation.

• - Custody and administration of crypto-assets on behalf of clients
• - Operation of a trading platform for crypto-assets
• - Exchange of crypto-assets for funds
• - Exchange of crypto-assets for other crypto-assets
• - Execution of orders for crypto-assets on behalf of clients
• - Placing of crypto-assets
• - Reception and transmission of orders for crypto-assets on behalf of clients
• - Providing advice on crypto-assets
• - Providing portfolio management on crypto-assets
• - Providing transfer services for crypto-assets on behalf of clients

Capital requirements under Article 67 and Annex IV

A CASP must hold, at all times, prudential safeguards equal to the higher of its Annex IV permanent minimum capital and one quarter of its fixed overheads for the previous year, reviewed annually. A new firm uses the projected fixed overheads for its first 12 months from its application.

The safeguards can be Common Equity Tier 1 own funds, an insurance policy covering the EU territories where services are provided, or a combination. A qualifying policy must have an initial term of at least one year, at least 90 days' notice of cancellation, an authorised third-party insurer, defined cover including business disruption and, where relevant, gross negligence in safeguarding client assets, and must be disclosed on the firm's website.

Who can apply and where

The applicant applies to the competent authority of its home member state. MiCA Article 59 requires a registered office in a member state where it carries out at least part of its services, its place of effective management in the EU and at least one director resident in the EU.

ESMA's supervisory briefing of January 2025 tells regulators how to test substance. At least one executive board member should be resident in the authorising member state, the chief executive should as a rule work full time for the CASP, other executive board members should give at least half their time, the local entity must be able to decide its EU policy autonomously, and there should be a significant local team. Outsourcing is limited so the entity never becomes a shell.

What the application must contain

Article 62(2) sets the contents, and ESMA's technical standards add the detail. Every competent authority asks for the same core information:

• - Identity, legal form, articles of association, website and legal entity identifier
• - A programme of operations: services, target markets and how they will be marketed
• - Proof of the Article 67 prudential safeguards
• - Governance arrangements, internal controls, risk management and business continuity
• - Fit and proper evidence for the management body and for shareholders with qualifying holdings
• - Money laundering and terrorist financing controls
• - Technical documentation of ICT systems and security, with a non-technical description
• - Segregation of client crypto-assets and funds, and complaints handling
• - Service-specific policies: custody policy, trading platform rules and market abuse detection, exchange pricing methodology, execution policy, adviser competence, and the manner of providing transfer services

Transitional periods by member state

Article 143(3) allowed firms already operating under national law before 30 December 2024 to continue until 1 July 2026, or until their MiCA application was decided. Member states could shorten or remove that period. The periods notified to ESMA are below. In October 2026 every one of them has ended.

Passporting across the EU

MiCA Article 59(7) lets a CASP provide services throughout the EU through a branch or across borders, without a physical presence in host states. The firm notifies its home regulator of the target states, services, start date and any non-MiCA activities. The home regulator passes this to host states, ESMA and the EBA within 10 working days. Services may start from the date the firm is told of that communication or, at the latest, from the 15th calendar day after it notified.

Host regulators can still act on conduct and marketing in their markets, and national consumer, marketing and tax rules outside MiCA continue to apply.

The Article 60 route for existing financial institutions

Reverse solicitation and non-EU firms

Article 61 exempts a non-EU firm only where an EU client initiates the service on the client's own exclusive initiative. Any solicitation, promotion or advertising in the EU, by the firm or anyone acting for it, removes the exemption, and contract clauses or disclaimers saying otherwise have no effect. The exemption never allows the firm to market new crypto-assets or services to that client. ESMA has issued guidelines on what counts as solicitation and on supervisory detection of circumvention.

Rules that run alongside MiCA

• - DORA, Regulation (EU) 2022/2554: ICT risk management, incident reporting, resilience testing and ICT third-party oversight, applying to CASPs since 17 January 2025
• - Transfer of Funds Regulation, Regulation (EU) 2023/1113: the Travel Rule for crypto-asset transfers, applying since 30 December 2024
• - Anti-money laundering: national law implementing Directive (EU) 2015/849 today, and the EU AML Regulation (EU) 2024/1624 from 10 July 2027
• - PSD2: custody and transfer of e-money tokens for clients have required a payment licence or a licensed partner since 2 March 2026, following the EBA no-action letter of 10 June 2025
• - Client funds: placed with a credit institution or central bank by the end of the next business day (MiCA Article 70)

After authorisation

• - Capital maintained at all times and recalculated annually against fixed overheads
• - Supervisory reporting and fees in the home member state
• - Prior assessment of acquisitions of qualifying holdings under Articles 83 and 84
• - A wind-down plan for firms providing custody, trading platform, exchange, execution or placing services (Article 74)
• - Withdrawal if the authorisation is not used within 12 months or no services are provided for nine consecutive months (Article 64)
• - Enhanced ESMA oversight for significant CASPs with at least 15 million active EU users (Article 85)

8 January 2027: removing non-MiCA-compliant stablecoins

On 8 October 2026 ESMA published an opinion telling national regulators that authorised CASPs should stop providing services in non-MiCA-compliant stablecoins to clients in the EU. A stablecoin is non-compliant where the MiCA conditions for a lawful offer to the public or admission to trading are not met. For an e-money token, that means the issuer is not a credit institution or an electronic money institution with a notified white paper (MiCA Article 48(1)). For an asset-referenced token, it means the issuer is not authorised under MiCA (Article 16(1)).

The opinion covers every crypto-asset service, from trading platforms and exchange to custody, transfers, advice and portfolio management. Remaining client exposures must be remediated as soon as possible and no later than three months after publication, which is 8 January 2027. ESMA says warnings, disclosures and client acknowledgements do not cure the problem. Any services kept running for existing holdings must be limited to liquidation, conversion, withdrawal, transfer or safekeeping, time-limited, clearly communicated and closely supervised.

ESMA's interim register update of 19 October 2026 lists 50 e-money token white paper entries from 25 issuers, 44 of them from electronic money institutions and 5 from credit institutions. It lists no authorised issuer of asset-referenced tokens.