MiCA, the EU Markets in Crypto-Assets Regulation, sets the same rules for crypto-asset service providers (CASPs) in every member state: the same ten services, the same capital of €50,000, €125,000 or €150,000, the same governance, custody, AML and DORA requirements, and the same statutory review periods. Once authorised, a CASP can passport its services to every other member state. The choice of home state is therefore a business decision, not a search for easier rules.
What differs is the regulator you deal with every day and the place where your team works. The factors that decide the right home state are:
ESMA, the European Securities and Markets Authority, works with national regulators so that they assess applications in the same way. A business model that one regulator would not accept is unlikely to be accepted in another, so the choice should follow where the business will genuinely operate.
MiCA's transitional periods ended on 1 July 2026 at the latest in every member state, and ESMA confirmed in its statement of 17 April 2026 that firms without authorisation must stop serving EU clients from that date. Several states ended their periods earlier: ESMA's list shows six months in the Netherlands, Latvia, Finland, Hungary, Slovenia and Poland, and 12 months in Germany, Ireland, Austria, Lithuania and Slovakia.
For new applicants this removes one factor from the decision. There is no longer any advantage in choosing a state for the length of its transitional period; every applicant now needs full authorisation before it serves EU clients, wherever it applies.
The tables below compare the main home states for CASP authorisation. Every regulator applies the MiCA statutory timetable: 25 working days to check completeness and 40 working days to assess a complete application, with up to 20 working days of suspension for questions, which is about four months in total. In practice firms should plan around 3 to 5 months from submission to decision, and longer where documents must be translated.
| Member state | Competent authority | Working language |
|---|---|---|
| Lithuania | Bank of Lithuania | English accepted |
| Malta | Malta Financial Services Authority (MFSA) | English |
| Germany | BaFin | German, with English accepted for some documents by agreement |
| Ireland | Central Bank of Ireland | English |
| Netherlands | Authority for the Financial Markets (AFM), with De Nederlandsche Bank for AML supervision | Dutch and English |
| France | Autorité des marchés financiers (AMF) | French, with English accepted for some documents |
| Luxembourg | CSSF | English, French or German |
| Cyprus | CySEC | English |
| Czech Republic | Czech National Bank | Czech; confirm English documents with the regulator |
| Estonia | Finantsinspektsioon (Estonian FSA) | Estonian; confirm English documents with the regulator |
| Latvia | Latvijas Banka | Latvian; confirm English documents with the regulator |
| Spain | CNMV | Spanish |
| Austria | Financial Market Authority (FMA) | German |
| Member state | Often chosen for | Points to weigh |
|---|---|---|
| Lithuania | Efficient mainstream fintech and crypto entry | Large fintech workforce in Vilnius; the regulator expects real local management |
| Malta | Exchanges and trading platforms | Crypto regulation since the Virtual Financial Assets Act 2018; smaller local talent pool |
| Germany | Institutional credibility, banks and custody | Thorough review, German-language supervision, high substance expectations |
| Ireland | English-speaking and US-heritage groups | Rigorous process; strong standing with institutional counterparties |
| Netherlands | On-ramps, brokers and consumer crypto apps | Mature supervisor of crypto-native platforms |
| France | French and Southern European markets | French-language process; strong links with traditional finance |
| Luxembourg | Institutional, fund and wealth groups | Experienced in cross-border financial groups |
| Cyprus | Brokers and investment groups already in Cyprus | Long experience of retail brokerage supervision |
| Czech Republic, Estonia, Latvia | Lean central and northern European operations | Smaller talent pools; confirm banking access first |
| Spain and Austria | Spanish-speaking and German-speaking markets | Local-language supervision |
The Bank of Lithuania is the central bank and the MiCA competent authority. It has authorised a large number of EMIs and payment institutions since 2017, works in English and offers newcomers structured contact before they apply. It expects the chief executive, compliance officer and MLRO to be based in Lithuania and examines AML frameworks and source of funds closely. Lithuania suits groups that want a credible, efficient EU base with access to an experienced Vilnius compliance workforce, and it is often the first EU entity for UK groups.
The MFSA has supervised crypto since the Virtual Financial Assets Act 2018, before MiCA, which gives it the longest crypto-specific record in the EU. The process is in English, and Malta's corporate law and international business community suit groups with complex structures. It is the most common EU home for exchanges and trading platforms. The local talent pool is smaller than in larger states, so groups often relocate senior staff or recruit across the EU.
BaFin authorises and supervises CASPs, and German banks and investment firms have used the notification route in large numbers to add crypto services. A BaFin authorisation is the strongest signal of quality to banks, institutional counterparties and investors. The review is thorough, supervision is conducted in German, and the regulator expects a substantial local team. Germany suits institutional custody, banking-adjacent models and firms targeting German-speaking clients.
The Central Bank of Ireland is the competent authority and works in English within a common law system. It has a rigorous authorisation process and high expectations of governance, with senior management and key control functions in Ireland. Ireland suits US-heritage and institutional groups that want an English-speaking EU base with strong links to global banks, and groups that already hold an Irish EMI or payment institution licence.
The AFM in the Netherlands has deep experience with consumer crypto platforms and on-ramps. The AMF in France authorises CASPs with input from the ACPR and suits firms with French operations or clients. The CSSF in Luxembourg suits fund, wealth and institutional groups that already operate there.
No regulator can go faster than the file allows, and none is permitted to go slower than MiCA's statutory limits once a file is complete. The differences in practice come from three things: how quickly the regulator confirms completeness, whether the file must be translated, and how well the file answers the regulator's standard questions first time.
Lithuania, Malta, Ireland and Cyprus all work in English, which removes translation time. The Bank of Lithuania has authorised a large number of EMIs and payment institutions since 2017 and runs a structured process for newcomers. The MFSA has regulated crypto under the Virtual Financial Assets Act since 2018 and has the longest crypto-specific supervisory record in the EU.
A file with these in place typically moves through completeness in one round, and most of the remaining time is the 40-working-day assessment and the answers to its questions.
Startups and growth-stage firms usually weigh salaries, office costs and the speed of hiring local staff as heavily as the regulator itself.
Lean does not mean light. Every regulator expects the chief executive or managing director, the compliance officer and the MLRO to be real, experienced and present, and a lean structure works when it outsources support functions while keeping decision-making local.
ESMA's interim MiCA register lists every authorised CASP and is updated weekly; check it for current numbers before relying on any count. The register shows clear patterns in who chooses which home state.
Withdrawn authorisations remain on the register with the date the withdrawal took effect, which is useful for checking a counterparty's history.
Malta is the natural first choice for an exchange. The MFSA has supervisory experience with order books, market surveillance, custody at scale and exchange operations, and several major trading platforms chose Malta as their EU home.
Ireland is the alternative for institutional or US-headquartered exchanges that want an English-speaking common law base with strong banking links; its process is rigorous. Cyprus suits retail brokerage groups adding crypto to an existing CySEC-regulated business.
Whatever the home state, an exchange must meet MiCA's trading platform rules, including settlement initiated within 24 hours of a trade, and ESMA's position that an EU platform may not share its order book with a non-EU platform. Lithuania, the Netherlands and Germany also authorise exchanges, usually where the group's people or clients are already there.
Germany carries the highest standing with banks, institutional counterparties, enterprise clients and investors. BaFin's CASPs include regulated banks, broker-banks and institutional custodians. The trade-offs are a thorough review, German as the language of supervision and substance expectations at the upper end of the EU range.
The Netherlands is a strong second, particularly for crypto-native platforms serving consumers at scale. Ireland follows, particularly for US-heritage groups, and Luxembourg for fund and wealth groups. A Germany, Ireland or Luxembourg authorisation suits firms whose growth depends on institutional banking partners, large corporate clients or institutional capital.
Banking is often the deciding factor. A CASP needs an operating account, accounts for client money at a credit institution or central bank, and payment connections for deposits and withdrawals. MiCA authorisation improves access, but banks still run their own due diligence.
Banking due diligence should run alongside the jurisdiction choice, not after authorisation. The firm's banking and payment processing service arranges accounts for newly authorised CASPs.
Article 59 of MiCA requires a registered office in a member state where the CASP provides part of its services, effective management in the EU and at least one EU-resident director. National regulators apply this as a substance test: who decides, where, and with what local team.
A company that exists in the home state on paper while the business is run from elsewhere does not meet the requirement in any member state. Outsourcing support functions to the group is acceptable when the local entity keeps the expertise to oversee them.
Each regulator sets its own application and annual supervision fees, and several have revised their schedules since MiCA applied. Malta, for example, sets its fees in the Markets in Crypto-Assets Act (Fees) Regulations (S.L. 647.01), and Germany charges under its federal cost rules for BaFin. Confirm the current figure on the regulator's own fee page before budgeting.
Regulator fees are a small part of the total. The larger costs are capital, local senior staff, office, technology and the preparation of the file, set out in our MiCA licence guide.
| Business model | Natural home states | Why |
|---|---|---|
| German-speaking retail fintech | Germany or Austria | Supervision in the clients' language and market |
| Pan-European retail exchange | Malta or Lithuania | Exchange experience and English-language supervision |
| Institutional custody for US or UK funds | Ireland or Luxembourg | Institutional standing and English-speaking legal systems |
| Consumer on-ramp or broker app | Netherlands or Lithuania | Experience with crypto-native consumer platforms |
| Spanish-speaking markets | Spain | Supervision in Spanish |
| Bank or investment firm adding crypto | Its existing home state | The Article 60 notification route avoids a new authorisation |
A UK firm entering the EU often chooses Lithuania, Ireland or the Netherlands. A US group often chooses Ireland, Luxembourg or the Netherlands. An EU EMI or payment institution adding crypto usually stays in its existing home state, where the regulator already knows its management and controls.
Where speed to revenue matters most, Lithuania and Malta lead. Where institutional banking or fundraising matters most, Germany, the Netherlands or Ireland lead. Many groups start in one and add a second EU entity later.
Before committing, confirm that the chief executive, compliance officer and MLRO can be hired or relocated, that an office is available, and that a bank has indicated it will onboard the entity. A default that suits most fintech models is Lithuania; for exchanges, Malta; for institutional and banking-adjacent models, Germany.
The Lithuanian route is covered in detail in how to obtain a MiCA CASP licence in Lithuania, and the position for firms serving Polish clients in how to obtain a MiCA CASP licence in Poland.
MiCA has no mechanism to transfer an authorisation from one member state to another. A firm that wants to move applies for a new authorisation in the target state and then surrenders the original. Its supervisory record helps, but the new regulator runs its own full assessment.
Because passporting already gives access to every member state, moving is rarely needed for market access. Groups more often add a second entity, for example a Lithuanian or Maltese CASP for retail clients and a German or Irish entity for institutional business, and choose the first home state with that path in mind. After authorisation, the ongoing MiCA compliance programme is the same wherever the firm is based.
There is no single best. Lithuania suits most fintech models, Malta suits exchanges, and Germany carries the most institutional credibility; the right choice follows where your management, staff, clients and banking will be.
Every regulator applies the same statutory limits: 25 working days for completeness and 40 working days to assess a complete file. English-language processes in Lithuania, Malta, Ireland and Cyprus avoid translation time, and file quality decides the rest.
The statutory clock is about four months from submission. Firms should plan around 3 to 5 months from submission to decision, plus 2 to 3 months to prepare the file.
Malta is the most common EU home for exchanges. Ireland suits institutional or US-headquartered exchanges, and Cyprus suits retail brokerage groups adding crypto.
Each regulator sets its own fees and they change, so confirm them on the regulator's fee page. Fees are a small part of the total cost compared with capital, staff and office.
Yes, through an EU company with its registered office and effective management in the home state and at least one EU-resident director.
Not directly. The firm applies for a new authorisation in the target state and surrenders the original; adding a second EU entity is more common.
Yes, to serve EU clients. UK firms have had no EU passport since 31 December 2020, so they serve the EU through an EU entity with its own MiCA authorisation.
Buckingham Capital Consulting has obtained payments and e-money authorisations across the UK and the EU since 2013, including the Central Bank of Ireland EMI licence for Own Solutions, and works with regulators including the Bank of Lithuania, the MFSA, BaFin and the Central Bank of Ireland. For MiCA, the firm assesses the home state against the business model, prepares the CASP application and substance plan, and arranges banking for the authorised entity.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.