MiCA CASP Authorisation After the Transition Period
Since 1 July 2026, any firm providing crypto-asset services to clients in the EU needs authorisation under MiCA, or a notification if it is already a regulated financial firm. This guide covers who needs it, how the application works and how long it takes, the capital and governance requirements, the AML/CFT duties that come with it, passporting, and what ESMA expects from firms that are not yet authorised.
MiCA's rules for crypto-asset service providers (CASPs) have applied since 30 December 2024, but most Member States let existing firms keep operating under national law while they applied. Those transitional periods ranged from six to eighteen months, and the last of them expired on 1 July 2026.
For MiCA as a whole — including the rules for asset-referenced and e-money tokens — see our MiCA regulation guide.
Where Things Stand
- The transition is over. ESMA said in April 2026 that from 1 July 2026 anyone serving EU clients without a MiCA licence is in breach of EU law and must stop, and that this applies to business-to-business services too, such as custody delegated to an unauthorised firm.
- Many firms are authorised. By our count of ESMA's interim MiCA register in October 2026, it listed around 370 CASP entries, including regulated firms such as banks that notified under Article 60. Major exchanges including Coinbase, Kraken, OKX and Bybit hold authorisations.
- Supervisors are scrutinising authorisations. A July 2025 ESMA peer review of one authorisation in Malta found that some material issues had not been fully resolved when it was granted, and ESMA asked all regulators to focus on governance, conflicts, intragroup arrangements and ICT.
- Stablecoin exposure. In an October 2026 opinion, ESMA said authorised CASPs should stop providing services involving asset-referenced or e-money tokens that do not comply with MiCA, and remediate legacy exposures within three months.
Who Needs Authorisation
Article 59 prohibits providing crypto-asset services in the EU without authorisation. MiCA lists ten services: custody and administration; operating a trading platform; exchange of crypto-assets for funds; exchange for other crypto-assets; execution of orders; placing; reception and transmission of orders; advice; portfolio management; and transfer services.
Certain regulated firms can provide equivalent services by notifying their home regulator at least 40 working days in advance instead of applying (Article 60):
| Firm type | Crypto-asset services it can notify |
|---|---|
| Credit institution | Any crypto-asset service |
| Investment firm | Services equivalent to its MiFID authorisation |
| Central securities depository | Custody and administration |
| E-money institution | Custody and transfer of the e-money tokens it issues |
| UCITS management company or AIFM | Services equivalent to portfolio management and its non-core services |
| Market operator | Operating a trading platform |
The regulator checks a notification for completeness within 20 working days, and the firm cannot start while it is incomplete. For how crypto firms onboard customers once authorised, see our guide to KYC for crypto exchanges.
The Application Process
Applications go to the regulator of the home Member State (Article 62). They cover the programme of operations, governance, the fitness and propriety of the management body and the good repute of qualifying shareholders, internal controls including money laundering risk management, business continuity, ICT, segregation of client assets, complaints handling, and policies specific to each service, such as custody, execution or trading-platform rules. Delegated Regulation (EU) 2025/305 and Implementing Regulation (EU) 2025/306 set the detailed content and forms.
| Step (Article 63) | Timing |
|---|---|
| Acknowledgement of receipt | Within 5 working days |
| Completeness check | Within 25 working days, with a deadline to supply anything missing |
| Decision | Within 40 working days of a complete application |
| Request for further information | One request, by working day 20, suspends the clock for up to 20 working days |
| Notification of the decision | Within 5 working days of the decision |
A CASP must have its registered office in a Member State where it provides at least part of its services, its place of effective management in the EU, and at least one director resident in the EU (Article 59(2)). ESMA's January 2025 supervisory briefing adds that regulators should expect a full-time chief executive and a three-year business plan, states that "there are no low-risk CASPs", and calls for elevated scrutiny of firms with more than one million active EU users a year or a balance sheet above €3 billion.
Capital Requirements
Under Article 67, a CASP must hold the higher of a permanent minimum capital set by class of service and one quarter of the previous year's fixed overheads, reviewed annually:
| Class | Services | Minimum capital |
|---|---|---|
| 1 | Execution of orders, placing, transfer services, reception and transmission of orders, advice, portfolio management | €50,000 |
| 2 | Class 1 services plus custody, exchange for funds or exchange for other crypto-assets | €125,000 |
| 3 | Class 2 services plus operating a trading platform | €150,000 |
The requirement can be met with Common Equity Tier 1 own funds, an insurance policy or comparable guarantee, or a combination. Insurance must run for at least a year with 90 days' cancellation notice and cover specified risks, including custody losses.
Governance, Custody and Conduct
- People. Management body members must be of good repute with sufficient knowledge, skills, experience and time, and with no convictions for money laundering or terrorist financing; changes must be notified before new members start (Articles 68–69). Acquisitions reaching 20%, 30% or 50% need prior notification, with a 60-working-day assessment (Articles 83–84).
- Client assets. Client funds other than e-money tokens must be placed with a credit institution or central bank by the end of the next business day, in separately identifiable accounts (Article 70). Custodians must segregate client holdings, send statements at least every three months and are liable for losses attributable to them (Article 75).
- Conduct and controls. Free complaints handling, a conflicts policy reviewed at least annually, outsourcing that leaves responsibility with the CASP, and an orderly wind-down plan for certain services (Articles 71–74).
- Operational resilience. CASPs are in scope of DORA, which has applied since 17 January 2025.
- Significant CASPs. A CASP with 15 million or more average active EU users must notify its regulator within two months (Article 85).
AML/CFT Obligations
- Obliged entities. All MiCA CASPs are obliged entities under the current AML directive, and they count as financial institutions under the EU AML Regulation from 10 July 2027.
- Travel rule. Under the Transfer of Funds Regulation (EU) 2023/1113, applying since 30 December 2024, originator and beneficiary information must accompany every crypto-asset transfer, with no minimum amount, and the originator's information must be verified before the transfer.
- Self-hosted wallets. For transfers over €1,000 to or from a self-hosted address, the CASP must assess whether the address is owned or controlled by its customer.
- EBA guidance. The EBA's travel rule guidelines have applied since 30 December 2024.
Our guide to the travel rule for VASPs covers the messaging and counterparty challenges, and our AMLR readiness guide covers the 2027 changes, including the €1,000 CDD threshold for crypto-asset service providers.
Passporting and Reverse Solicitation
- Passporting. An authorised CASP that wants to serve other Member States notifies its home regulator, which passes the information to the host states, ESMA and the EBA within 10 working days. The CASP can start once it receives that communication, and in any case from the 15th calendar day after submitting. No physical presence is needed in host states (Articles 59(7) and 65).
- Reverse solicitation. Article 61 lets a third-country firm serve an EU client only at that client's own exclusive initiative. Any solicitation, promotion or advertising in the EU, including through influencers, disqualifies it. ESMA's February 2025 guidelines read the exemption narrowly and say it cannot be used to circumvent MiCA.
If You Are Not Yet Authorised
ESMA's June 2026 statement sets out what unauthorised CASPs must do now:
- stop onboarding new EU clients and stop marketing immediately;
- limit activity to selling, transferring or closing existing positions;
- hold client assets only for as long as strictly necessary, and tell clients repeatedly, including the deadline after which remaining positions will be closed;
- keep AML/CFT, sanctions and travel rule compliance in place throughout.
Authorised CASPs taking on clients migrating from unauthorised providers should apply robust AML/CFT checks to them. ESMA and national regulators have said they will coordinate on significant cross-border cases and take enforcement action where needed. See our crypto compliance page for how One Constellation supports CASP onboarding and monitoring.
Authorisation Readiness Checklist
- Map every service you provide in the EU to MiCA's ten crypto-asset services, and confirm whether the authorisation or notification route applies.
- Confirm EU substance: registered office, place of effective management and an EU-resident director, with a full-time chief executive.
- Prepare the Article 62 file using the RTS and ITS templates, including a three-year business plan and the AML/CFT risk assessment.
- Calculate the capital requirement for your class of services and fixed overheads.
- Put client-asset segregation, custody policy, complaints, conflicts and wind-down plans in writing.
- Implement travel rule messaging for every transfer and self-hosted-wallet assessment above €1,000.
- Plan passporting notifications and stop any marketing that relies on reverse solicitation.
Frequently Asked Questions
When did the MiCA transitional period end?
On 1 July 2026 at the latest. Member States could shorten it, and several did — to six, nine or twelve months — but no transitional period runs beyond 1 July 2026.
How long does MiCA CASP authorisation take?
The regulator acknowledges an application within 5 working days, checks completeness within 25 working days and decides within 40 working days of a complete application. One request for further information can pause the clock for up to 20 working days.
What is the minimum capital for a MiCA CASP?
€50,000, €125,000 or €150,000 depending on the class of services, or one quarter of the previous year's fixed overheads if that is higher. It can be held as CET1 own funds, insurance or a combination.
Do banks need MiCA authorisation to offer crypto services?
No. Credit institutions can provide crypto-asset services by notifying their home regulator at least 40 working days in advance under Article 60, as can investment firms, CSDs, e-money institutions, fund managers and market operators for the services that match their existing licences.
Does the travel rule apply to small crypto transfers in the EU?
Yes. Under the Transfer of Funds Regulation, originator and beneficiary information must accompany every crypto-asset transfer between providers, with no minimum amount. For transfers above €1,000 involving a self-hosted address, the CASP must also assess whether its customer owns or controls the address.
Can a non-EU crypto firm serve EU clients by reverse solicitation?
Only where the client approaches the firm on their own exclusive initiative. Any solicitation, promotion or advertising in the EU disqualifies the firm, and ESMA has said the exemption cannot be used to circumvent MiCA.
Sources
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA)
- ESMA statement on the end of MiCA transitional periods (April 2026)
- ESMA public statement as MiCA transitional periods end (June 2026)
- ESMA supervisory briefing on the authorisation of CASPs (January 2025)
- ESMA: list of MiCA grandfathering periods
- ESMA: MiCA interim register
- ESMA guidelines on reverse solicitation under MiCA
- Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
Compliance Infrastructure for Authorised CASPs
One Constellation brings crypto-specific KYC, sanctions and wallet screening, travel rule handling and transaction monitoring into one platform, with the evidence a supervisor expects.
