MiCA CASP licence: one authorisation covering 27 countries

Who needs CASP authorisation

Anyone providing crypto services to clients in the EU: custody, exchange, execution of orders, operating a trading platform, advice, portfolio management and transfers. The transitional periods for incumbent firms are running out — operating without authorisation becomes grounds for being forced out of the EU market.

Requirements

• Capital — by class of service: from the base level for advisory work up to the maximum for trading platforms, plus prudential add-ons based on turnover.
• Governance: local management, fit and proper shareholders, and internal policies covering each category of risk.
• Protection of client assets: segregation, client rights on insolvency, and rules on key custody.
• White papers and marketing — a separate regime governs public offers of tokens.

Choosing the country of entry

Passporting turns the choice of country into a tactical one: the speed and predictability of the regulator, the language, the cost of staff. The first waves of authorisations showed timelines differing several-fold between member states under identical requirements — picking the right regulator has become a competitive decision in its own right.

MiCA’s own vocabulary — and why the member state choice matters

Authorisation under MiCA is granted not by Brussels but by the national competent authority (NCA) of the member state you apply in — BaFin in Germany, the AMF in France, and so on — with ESMA and the EBA setting the technical standards and keeping the registers. The regulation classifies tokens into e-money tokens (EMTs), asset-referenced tokens (ARTs) and other crypto-assets, and each class carries its own white-paper and authorisation obligations; “significant” EMTs and ARTs move under enhanced supervision. A CASP application is also assessed against neighbouring EU law — most notably DORA, the operational-resilience regulation covering your technology and outsourcing arrangements, and the AML framework — plus MiCA’s own conduct rules: complaints handling, conflicts of interest and the market-abuse regime in Title VI.

The transitional (“grandfathering”) period for firms that operated under national regimes was capped at 1 July 2026, and several member states chose shorter windows — so for new entrants the practical question is no longer whether to seek authorisation but where. Application timelines have differed several-fold between NCAs under the same rulebook, which makes the choice of member state a strategic decision, not an administrative one.

The passporting benefit gets all the attention, but the real strategic decision is which member state you authorise through in the first place — we’ve watched identical applications move at very different speeds depending on the regulator, even under the same rulebook. Founders who treat ‘which NCA’ as an afterthought often end up regretting it more than any single compliance requirement in the file.

Mark Eichorn · Managing Partner