A MiCA licence is the authorisation a firm needs to provide crypto-asset services in the European Union. Its formal name is authorisation as a crypto-asset service provider, or CASP, under the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. One national regulator grants it, and the firm can then serve clients in every other member state by notification, a process known as passporting.
MiCA replaced the national registration schemes that each member state ran before it. Those schemes mainly checked anti-money laundering controls. MiCA is a full operating authorisation: the regulator assesses the business model, the directors, the shareholders, capital, custody of client assets, conflicts of interest, outsourcing, technology and resilience, alongside financial crime controls.
| Date | What happened |
|---|---|
| 9 June 2023 | MiCA published in the Official Journal of the EU |
| 30 June 2024 | Rules for stablecoin issuers (Titles III and IV) applied |
| 30 December 2024 | CASP authorisation regime (Title V) applied in full |
| 17 January 2025 | DORA, the EU digital operational resilience law, applied to CASPs |
| 1 July 2026 | Last national transitional period ended in every member state |
The authority that grants the licence is called the national competent authority, meaning the financial regulator designated by each member state. The European Securities and Markets Authority (ESMA) keeps the EU-wide register of authorised CASPs and works with national regulators so that they assess applications in the same way.
MiCA allowed member states to let firms already operating under national law continue for up to 18 months after 30 December 2024 while they applied. That transitional period, often called grandfathering, ended on 1 July 2026 at the latest in every member state. ESMA confirmed in its statement of 17 April 2026 that from that date any firm providing crypto-asset services to EU clients without MiCA authorisation is acting in breach of EU law.
Many member states chose shorter periods. ESMA's list of national transitional periods, first published in December 2024, shows six months in the Netherlands, Finland, Latvia, Hungary, Slovenia and Poland, and 12 months in Germany, Ireland, Austria, Lithuania and Slovakia. Those periods had all closed before the EU-wide end date.
Banks, payment processors and institutional counterparties now check the ESMA register before onboarding a crypto firm. A MiCA authorisation has become the starting point for EU banking as well as for serving clients.
Any firm that provides one or more of the ten crypto-asset services listed in Article 3 of MiCA, on a professional basis, to clients in the EU needs CASP authorisation. The test is what the firm actually does, not what it calls itself. A retail exchange app may need custody, exchange and transfer services; an OTC desk may need order execution and reception and transmission of orders.
| Service | What it covers in practice | Capital class |
|---|---|---|
| Custody and administration | Holding client crypto-assets or the private keys that control them | Class 2 |
| Operating a trading platform | Running a venue that matches buyers and sellers of crypto-assets | Class 3 |
| Exchange of crypto-assets for funds | Buying or selling crypto for euros or other money, using own capital | Class 2 |
| Exchange of crypto-assets for other crypto-assets | Crypto-to-crypto swaps using own capital | Class 2 |
| Execution of orders for clients | Carrying out client orders on a venue or with a counterparty | Class 1 |
| Placing of crypto-assets | Marketing a token to buyers for an issuer or offeror | Class 1 |
| Reception and transmission of orders | Passing client orders to another firm for execution | Class 1 |
| Advice on crypto-assets | Personal recommendations to clients | Class 1 |
| Portfolio management | Managing crypto portfolios for clients on a discretionary basis | Class 1 |
| Transfer services | Moving crypto-assets from one address or account to another for clients | Class 1 |
The firms caught include exchanges, brokers, custodians, wallet providers that hold keys for clients, OTC desks, client-facing market makers, advisers, portfolio managers, token launch platforms and payment processors that convert or move crypto for merchants. Software that lets users hold their own keys, with no control by the provider, generally sits outside MiCA.
Crypto-assets that qualify as financial instruments fall under MiFID II, the EU investment services law, not MiCA. Unique, non-fungible tokens, services provided in a fully decentralised way with no intermediary, and central bank digital currencies are also outside scope. ESMA has published guidance on where tokens sit, and regulators look at substance: a collection of NFTs issued in a large series, or a protocol with an identifiable operator, can still be caught.
Article 60 of MiCA lets certain firms already authorised under other EU financial services laws provide crypto-asset services by notifying their regulator instead of applying for a new authorisation. They must notify at least 40 working days before they start, and the regulator has 20 working days to confirm the notification is complete.
| Type of firm | Crypto services it may offer by notification |
|---|---|
| Credit institution (bank) | Any crypto-asset service |
| Central securities depository | Custody and administration only |
| Investment firm (MiFID II) | The crypto equivalent of the investment services it is already authorised for |
| Electronic money institution | Custody and transfer services, limited to the e-money tokens it issues |
| UCITS management company or AIFM | Portfolio management, advice and reception and transmission of orders, where already authorised |
| Market operator | Operating a crypto trading platform |
The notification route is not a general exemption. The firm still meets the MiCA conduct, custody and resilience rules for the services it adds, and its regulator reviews the same core documents. An EMI that wants to run an exchange, for example, needs full CASP authorisation.
Article 61 allows a non-EU firm to serve an EU client only where the client approached the firm entirely on its own initiative. Any marketing, promotion or approach to EU clients by the firm or anyone acting for it removes the exception. ESMA's guidelines on reverse solicitation treat it as a narrow exception for individual approaches, so it cannot support a business that serves EU clients as a matter of course.
MiCA sets a permanent minimum capital in Annex IV, in three classes according to the services authorised. A firm in more than one class holds the highest applicable amount. The requirement can be met with own funds (share capital and reserves of the highest quality), an insurance policy, or a combination of the two.
| Class | Services | Minimum capital |
|---|---|---|
| Class 1 | Reception and transmission of orders, advice, execution of orders, placing, transfer services, portfolio management | €50,000 |
| Class 2 | Any Class 1 service plus custody, exchange for funds, or exchange for other crypto-assets | €125,000 |
| Class 3 | Any Class 2 service plus operating a trading platform | €150,000 |
The ongoing requirement under Article 67 is the higher of that minimum and one quarter of the firm's fixed overheads for the previous year, reviewed every year. Fixed overheads are the running costs that do not vary with business volume, such as salaries, rent and core technology. A new firm uses the fixed overheads in its projections for the first year.
An exchange offering custody and crypto-for-euro exchange is a Class 2 firm with a €125,000 minimum. If its projected fixed overheads are €900,000 a year, one quarter is €225,000, so it must hold €225,000. The financial model in the application should show that figure, the buffer above it, and how capital keeps pace as the team grows.
Each national regulator sets its own application and annual supervision fees, and several have revised them since MiCA applied. Confirm the current schedule on the home regulator's website before budgeting. The regulator's fee is usually a small part of the total.
Firms that already run a regulated entity in another sector, such as an EMI or an investment firm, can reuse much of their governance and financial crime framework, which reduces the preparation effort.
Article 59 requires a CASP to have its registered office in a member state where it provides at least part of its services, its place of effective management in the EU, and at least one director resident in the EU. Regulators test whether decisions are genuinely taken in the EU. A registered address with management and staff abroad does not meet the requirement.
Every member of the board must be of good repute and have the knowledge, skills and experience to run a crypto business, and must give the role enough time. Regulators assess each person through a questionnaire, CV, criminal record checks and, in most member states, an interview. The roles regulators most expect to see filled locally are the chief executive or managing director, the compliance officer and the MLRO.
Any shareholder holding 10% or more of the capital or voting rights, directly or through other companies, is assessed for good repute. The application shows the full ownership chain up to the individuals at the top, and evidence of the source of the funds being invested. Clear, documented source of funds and source of wealth for the founders and investors is one of the areas regulators examine most closely.
Article 62 lists what a CASP application must include, and the regulators use common forms and technical standards adopted under MiCA, so the core file is similar in every member state. The central document is the programme of operations, which describes the services, the clients, how and where the firm will market, its three-year financial projections, and how each regulated function will run. With annexes it commonly runs to well over 100 pages.
Regulators also expect supporting policies on conflicts of interest, outsourcing, record keeping, staff training and wind-down. Consistency across all documents matters: the financial model, the staffing plan and the programme of operations should describe the same business.
MiCA sets the regulator's timetable in Article 63. The statutory clock runs to about four months from submission, with suspensions for questions. In practice the period before an application is accepted as complete is where most time is spent, so firms should plan around 3 to 5 months from submission to decision, plus 2 to 3 months to prepare the file.
| Stage | Statutory time limit | What happens |
|---|---|---|
| Acknowledgement | 5 working days | The regulator confirms receipt |
| Completeness check | 25 working days | The regulator checks all required information is present and sets a deadline for anything missing |
| Assessment | 40 working days from a complete file | The regulator assesses the application and adopts a reasoned decision |
| Questions during assessment | Up to 20 working days suspension | Requests made by the 20th working day pause the clock until the firm answers |
| Notification | 5 working days from decision | The firm is told the outcome |
The quality of the first submission decides how many rounds of questions follow. A file that answers the regulator's standard questions in advance, with named people in post and capital ready, moves through completeness quickly. Material changes to the business model, the shareholders or the management team during review restart parts of the assessment.
The Regulation is the same everywhere, so the choice of home member state turns on practical factors: where the management team and staff are, the regulator's language and working style, the depth of local compliance talent, banking access, tax and operating cost. ESMA's work on supervisory convergence means a model that a regulator in one member state would not accept is unlikely to be accepted in another.
| Member state | Competent authority | Often chosen by |
|---|---|---|
| Lithuania | Bank of Lithuania | Fintech and crypto firms wanting an English-language process and an established fintech workforce |
| Malta | Malta Financial Services Authority (MFSA) | Trading platforms and exchanges; Malta has regulated crypto since the Virtual Financial Assets Act 2018 |
| Germany | BaFin | Banks, institutional custody and firms targeting German-speaking markets |
| Netherlands | Authority for the Financial Markets (AFM) | On-ramps, brokers and consumer crypto apps |
| France | Autorité des marchés financiers (AMF) | Firms with French operations or French-speaking markets |
| Ireland | Central Bank of Ireland | Groups wanting an English-speaking common law base |
| Luxembourg | CSSF | Institutional and cross-border groups |
| Cyprus | CySEC | Brokers and investment groups already licensed in Cyprus |
| Czech Republic | Czech National Bank | Central European businesses |
| Estonia | Finantsinspektsioon (Estonian FSA) | Groups with existing Estonian operations |
A detailed comparison of timelines, fees and supervision style is in our guide to the best EU country for a MiCA licence, and the Lithuanian process is covered in how to obtain a MiCA CASP licence in Lithuania.
MiCA works alongside the EU anti-money laundering rules. A CASP carries out customer due diligence, monitors transactions, screens against sanctions lists, applies enhanced checks to higher-risk clients and countries, reports suspicious activity to the national financial intelligence unit and keeps records for at least five years. The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027 and will set these rules directly across the EU.
The Transfer of Funds Regulation, Regulation (EU) 2023/1113, applied from 30 December 2024 and requires CASPs to send and receive information on the originator and beneficiary with every crypto-asset transfer, with no minimum amount. For transfers above €1,000 to or from a wallet the client controls, the CASP also verifies that the client owns or controls that wallet. The data flow is best designed into the product from the start.
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied to CASPs since 17 January 2025. It requires an ICT risk framework approved by the board, classification and reporting of major ICT incidents, resilience testing, and management of technology suppliers with a register of those arrangements. Crypto firms rely heavily on cloud hosting, wallet infrastructure, blockchain analytics and identity providers, so supplier oversight and exit plans are where regulators ask the most questions. Our article on why DORA marks a turning point for financial services explains the framework in more detail.
A CASP that holds client crypto-assets keeps a register of each client's positions, segregates client assets from its own, and has a custody policy that clients can obtain on request. It may not use client crypto-assets for its own account. Under Article 75 it is liable to clients for the loss of crypto-assets caused by an incident attributable to it, up to the market value at the time of the loss.
Client money received in euros or another currency is placed with a credit institution or a central bank by the end of the business day after receipt, in accounts kept separate from the firm's own. Where custody is delegated to an institutional wallet provider, the CASP remains responsible and shows how it oversees that provider, how keys are controlled and how assets are returned to clients on exit.
Issuing a stablecoin is regulated separately from providing CASP services. An e-money token, or EMT, references one official currency and may only be issued by a credit institution or an electronic money institution. An asset-referenced token, or ART, references other assets or a basket and needs its own authorisation. A CASP that only lists or transfers stablecoins issued by others does not need issuer authorisation. Our guide to the MiCA stablecoin licence for EMT and ART issuers covers the issuer route.
Some services involving e-money tokens, such as transferring them for clients or holding them in custodial wallets used for payments, are also payment services under PSD2, the EU Payment Services Directive. The European Banking Authority gave CASPs a transition to 2 March 2026 to obtain PSD2 authorisation for these services. Its Opinion of 12 February 2026 asks national regulators to require firms that do not meet its conditions to stop those services until authorised. A firm with stablecoin payment flows should map them against MiCA, PSD2 and e-money rules before it fixes its licensing plan.
UK firms lost EU passporting rights on 31 December 2020, and a UK registration or authorisation does not give access to EU clients. A UK or other non-EU group serves the EU through an EU subsidiary with its own CASP authorisation, EU-resident management and local substance. Partnering with an authorised CASP is the alternative for groups that do not want their own EU entity.
The UK is introducing its own regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102). The FCA application window opened on 30 September 2026 and runs to 28 February 2027, and the regime commences on 25 October 2027; until then the existing FCA cryptoasset registration under the Money Laundering Regulations applies. Many groups run the UK and EU applications in parallel, sharing the core business plan and policies while keeping separate entities, capital and management. The UK route is set out in our guide to FCA cryptoasset authorisation under the new regime.
Regulators approve applications that show a real business, run by experienced people in the EU, with controls built for its own products. The areas that most often lead to extra rounds of questions, or a suggestion to withdraw and resubmit, are predictable and can be addressed before submission.
A firm whose regulator suggests withdrawal can resubmit, but the earlier file stays on record, so it pays to submit once the file is ready rather than early.
Under Article 65 the CASP tells its home regulator which member states it will serve and which services it will provide there. The home regulator forwards the information to the host states, ESMA and the EBA within 10 working days, and the CASP may start from the date it receives that confirmation or, at the latest, from the 15th calendar day after it submitted the notification. A passport covers only the services in the authorisation; new services need an extension of the authorisation first.
Authorisation is withdrawn if the firm has not used it within 12 months or has not provided crypto-asset services for nine consecutive months, so launch planning should run alongside the application. Our guide to ongoing CASP compliance under MiCA sets out the annual cycle, and the firm's MiCA CASP authorisation service covers the application itself.
It is authorisation as a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. One national regulator grants it, and the firm can then serve clients across the EU by passporting.
The minimum is €50,000, €125,000 or €150,000 depending on the services. The firm must hold the higher of that minimum and one quarter of its fixed overheads for the previous year.
The statutory clock is about four months from submission, including 25 working days for completeness and 40 working days for assessment. Firms should plan around 3 to 5 months from submission to decision, plus 2 to 3 months of preparation.
No. The last national transitional periods ended on 1 July 2026, and firms serving EU clients now need MiCA authorisation, the Article 60 notification route for regulated financial firms, or a genuine exclusion.
Not directly. It sets up an EU company with its registered office and effective management in a member state and at least one EU-resident director, and applies there.
Banks, investment firms, EMIs and certain other regulated firms can use the Article 60 notification route for the services MiCA allows them, notifying at least 40 working days before they start. An EMI is limited to custody and transfer of the e-money tokens it issues.
It depends on where the management team, staff, clients and banking will be. Lithuania, Malta, Germany, the Netherlands, France and Ireland are the most common home states.
Yes, but the regulator must assess the buyer before completion, and the authorisation covers only the services, people and controls already approved. Acquiring 10% or more, or crossing 20%, 30% or 50%, needs prior assessment.
Buckingham Capital Consulting has obtained payments and e-money authorisations across the UK and the EU since 2013, including the Central Bank of Ireland EMI licence for Own Solutions and the UK EMI licence for EuroPanPay. For MiCA, the firm prepares the CASP application, the EU substance and staffing plan and the regulator correspondence, and arranges banking for the authorised entity.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.