AMLBot Academy

MiCA License Explained: CASP Requirements, Authorization Process, and EU Passporting

AMLBot Team

• 19 min read
Updated: Sep 30, 2026
MiCA License Explained: CASP Requirements, Authorization Process, and EU Passporting

Summary: "MiCA license" is the market term. The legal concept is authorization as a Crypto-Asset Service Provider under Regulation (EU) 2023/1114. The EU-wide transitional period ended on 1 July 2026, so legacy national VASP status no longer provides a basis for continuing MiCA-regulated services. Authorization is granted for specific crypto-asset services, not for crypto activity in general. Certain already-regulated financial entities use a separate notification route under Article 60 rather than the ordinary Article 63 application. Minimum capital is €50,000, €125,000 or €150,000 depending on the service class, but Article 67 requires prudential safeguards at the higher of that figure or a quarter of the previous year's fixed overheads. Authorization can be passported across Member States through an Article 65 notification. There is no routine annual renewal — but adding a new crypto-asset service requires an extension of authorization.

Note: None of this is legal, tax, or investment advice. National competent authorities apply their own procedures within the MiCA framework. Verify current requirements with the relevant NCA before acting.

Search Regulation (EU) 2023/1114 for the word "licence" applied to a crypto-asset service provider and you will not find it. The instrument everyone calls the MiCA licence is, in the text, an authorization — granted by a national competent authority, scoped to named services, and held by a specific legal entity.

That is not pedantry. It explains almost every practical question that follows. A licence, in ordinary usage, sounds like a permanent credential that covers what you do. A MiCA authorization is closer to a list: these services, this entity, this Member State, with cross-border provision switched on separately.

The framing also matters because the timeline has moved. Until mid-2026, most MiCA coverage was written for firms deciding when to apply. That period is over. The EU-wide MiCA transitional period ended on 1 July 2026, so legacy national VASP status no longer provides a general basis for continuing MiCA-regulated crypto services. ESMA put it plainly in April 2026: after that date, any entity providing crypto-asset services to EU clients without authorization is in breach of EU law and must cease offering those services. A follow-up public statement in June 2026 set out how unauthorized providers were expected to wind down.

(Source: ESMA, "Statement on the End of Transitional Periods under MiCA," ESMA75-113276571-1679, 17 April 2026 — https://www.esma.europa.eu/sites/default/files/2026-04/ESMA75-113276571-1679_Statement_on_the_end_of_transitional_periods_under_MiCA.pdf; ESMA public statement ESMA75-113276571-1710, 23 June 2026)

The questions a crypto business asks about MiCA in late 2026 are different from the ones it asked a year earlier. Not "how long do I have?" but: which of my services require authorization, which route applies to my entity, what does the application actually contain, how does passporting switch on, and what happens when my business changes after approval.

This article works through those in order. For the wider framework — token classification, white papers, the ART and EMT regimes, market abuse — the broader MiCA compliance framework is the place to start; what follows stays on authorization.

What Is a MiCA License and Who Needs CASP Authorization?

"MiCA license" is the common market term for authorization as a Crypto-Asset Service Provider under Regulation (EU) 2023/1114. The regulation itself speaks of authorization. Both refer to the same thing: formal permission from the national competent authority of an EU Member State to provide specified crypto-asset services.

Two features distinguish it from the national registrations it replaced. It is service-specific — the authorization names which crypto-asset services the entity may provide. And it is passportable — once granted, it supports provision across the Union through a notification procedure rather than separate national applications.

What it is not is a blanket permission for anything crypto-related. A firm authorised for custody has permission for custody. If it later wants to run a trading platform, that is a different service requiring a change to the authorization, which the last section of this article covers.

Which Crypto Services Require CASP Authorization?

MiCA defines ten crypto-asset services. Providing any of them professionally in the EU brings a business within the CASP framework:

  • custody and administration of crypto-assets on behalf of clients;
  • operation of a trading platform for crypto-assets;
  • exchange of crypto-assets for funds;
  • exchange of crypto-assets for other crypto-assets;
  • execution of orders for crypto-assets on behalf of clients;
  • placing of crypto-assets;
  • reception and transmission of orders for crypto-assets on behalf of clients;
  • providing advice on crypto-assets;
  • providing portfolio management on crypto-assets;
  • providing transfer services for crypto-assets on behalf of clients.

Authorization is service-specific. A CASP may provide (and passport) only the services listed in its authorization. This is the single most consequential structural point in the regime, and it drives the capital class, the content of the application, the scope of the passport, and what happens when the product roadmap changes.

In practical terms, most real businesses perform several of these at once without thinking of them as separate regulated activities. A platform that lets users buy crypto with euros, trade pairs, hold balances and send funds out is performing exchange for funds, exchange for other crypto-assets, custody, and transfer services — four named services, potentially operation of a trading platform as a fifth, depending on how matching works. The application has to reflect that reality rather than the marketing description.

Not Every Financial Institution Uses the Same CASP Application Route

The older version of this guide implied that any company providing crypto services in the EU needs to go through the standard CASP application. That is too broad.

Article 59 sets the general rule: crypto-asset services may be provided by a legal person authorised as a CASP under Article 63, or by certain already-regulated financial entities that meet the conditions in Article 60. Entities in the second group — including certain credit institutions, investment firms, electronic money institutions and other categories specified in MiCA — may provide relevant crypto-asset services through a notification framework to their competent authority instead of the ordinary authorization procedure, where the conditions are met.

(Source: ESMA Interactive Single Rulebook, MiCA Article 59 — Authorization — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-59-authorisation)

Which route applies depends on what the entity already is and which services it intends to provide. It is a legal analysis rather than a preference, and it should be settled before any application work begins — starting an Article 63 project when Article 60 applies wastes months, and the reverse is worse.

MiCA CASP License Requirements

Capital and Prudential Safeguards

The capital figures circulate widely and are frequently mapped to the wrong services, including in the earlier version of this article. The correct allocation under Annex IV runs by class:

Class 1 — €50,000. Reception and transmission of orders, execution of orders on behalf of clients, placing of crypto-assets, providing transfer services, advice on crypto-assets, and portfolio management on crypto-assets.

Class 2 — €125,000. Everything in Class 1, plus custody and administration of crypto-assets on behalf of clients, exchange of crypto-assets for funds, and exchange of crypto-assets for other crypto-assets.

Class 3 — €150,000. Everything in Class 2, plus operation of a trading platform for crypto-assets.

(Source: ESMA Interactive Single Rulebook, MiCA Annex IV — Minimum capital requirements for crypto-asset service providers — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/minimum-capital-requirements-crypto-asset)
Note the structure: the classes are cumulative, not alternative. A custodian that also operates a trading platform sits in Class 3, not in two separate buckets.

The Annex IV minimum is not always the actual prudential requirement. Article 67 requires a CASP to hold prudential safeguards equal to at least the higher of two amounts: the permanent minimum capital for its class, or one quarter of the preceding year's fixed overheads. For a newly authorised business with no full year behind it, the calculation uses the projected fixed overheads from the programme of operations.

(Source: ESMA Interactive Single Rulebook, MiCA Article 67 — Prudential requirements — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-67-prudential-requirements)

This is the provision that catches growing firms. A Class 2 CASP with €125,000 in capital and €1.2 million in annual fixed overheads needs €300,000 in prudential safeguards, not €125,000 — and nothing about its licence changed to trigger that. The requirement moves with the cost base, and it is reviewed annually. Article 67 also allows those safeguards to be held as own funds, as an insurance policy or comparable guarantee, or as a combination of the two, provided the conditions in the Regulation are met. That flexibility is useful for firms where tying up cash is expensive, and it is often missed by applicants working from summaries.

Governance, Management, and EU Substance

MiCA sets substance requirements that determine where a CASP can be established, not merely how it should be run.

For the ordinary Article 63 route, Article 59 requires the applicant to have its registered office in a Member State where it carries out at least part of its crypto-asset services, its place of effective management in the Union, and at least one director resident in the Union.

That rules out a common structure: incorporating in one Member State purely for the licence while running everything from outside the EU. The registered office has to correspond to real activity.

Beyond location, the authorization assessment covers the suitability of the management body, the suitability of persons holding qualifying holdings in the applicant, the governance structure and reporting lines, internal control mechanisms, and business continuity arrangements. Regulators look at whether the people named can actually run the described business and whether control functions have enough independence to work.

What the regulation does not do is set universal staffing numbers or require independent directors as a matter of course. National competent authorities have their own expectations within the framework, and those should be checked against the specific NCA's published guidance rather than assumed from another country's practice.

AML, Travel Rule, and Operational Readiness

Here is a distinction that applicants routinely collapse: MiCA authorization is not the entire EU rulebook a CASP operates under.

MiCA governs authorization, prudential requirements and conduct. Alongside it, an authorised CASP is subject to the applicable AML/CFT framework as an obliged entity, to Regulation (EU) 2023/1113 — the Transfer of Funds Regulation — for crypto transfer traceability, to DORA where applicable for ICT risk and operational resilience, and to whatever national supervisory implementation applies in its home Member State.

One factual correction is needed here, because the previous version of this guide stated it incorrectly and the error is widespread. There is no general €1,000 de minimis threshold for relevant CASP-to-CASP crypto transfers under the EU Travel Rule. The TFR applies to relevant CASP-mediated transfers without such a blanket exemption. The €1,000 figure has a narrower function: it relates to certain transfers involving self-hosted addresses, where the CASP must assess whether the address is owned or controlled by its customer. Those are different rules doing different work, and configuring a screening threshold at €1,000 on the assumption that smaller transfers fall outside the regime produces a compliance gap. The mechanics are set out in full under EU Travel Rule requirements for CASPs.

On the AML side, a second timing point matters. AMLR — Regulation (EU) 2024/1624 — is in force as legislation but generally applies from 10 July 2027. A CASP authorised in 2026 operates its customer due diligence under the existing framework as transposed nationally, not under AMLR. What changes when that date arrives is covered under EU KYC obligations and the AMLR 2027 framework.

How to Apply for MiCA CASP Authorization

What the Application Package Must Include

The content of a CASP application is set by Article 62 and specified in detail by Commission Delegated Regulation (EU) 2025/305, with standard forms, templates and procedures in Commission Implementing Regulation (EU) 2025/306. Those two instruments — not a generic consultant checklist — are the authoritative source for what a complete file contains.

(Source: Commission Delegated Regulation (EU) 2025/305 — https://eur-lex.europa.eu/eli/reg_del/2025/305/oj/eng; Commission Implementing Regulation (EU) 2025/306 — https://eur-lex.europa.eu/eli/reg_impl/2025/306/oj/eng)

Depending on the services applied for, the information required covers:

  • corporate and legal information about the applicant;
  • the programme of operations, covered separately below;
  • evidence of prudential safeguards;
  • governance arrangements and organisational structure;
  • suitability of the management body;
  • information on qualifying holdings;
  • internal control mechanisms and risk management;
  • the AML/CFT risk framework and related procedures;
  • business continuity arrangements;
  • ICT systems, security arrangements and related documentation;
  • complaints-handling procedures;
  • custody and safeguarding policies where the applicant provides custody;
  • trading-platform operating rules where relevant;
  • exchange and commercial policy where relevant;
  • order execution policy where relevant;
  • advice and portfolio management procedures where relevant;
  • transfer-services procedures where relevant.

The last seven items are service-specific. A firm applying for custody and exchange does not need trading-platform rules; a firm applying for portfolio management does. Building the file around the exact service list, rather than submitting everything defensively, tends to produce a cleaner application.

Business Plan / Programme of Operations

What applicants call the business plan, MiCA calls the programme of operations — and the difference is not cosmetic. This is not a fundraising deck adapted for a regulator. It is a regulatory document with specified content, and under Delegated Regulation (EU) 2025/305 it covers the three years following authorization.

Its contents typically include:

  • the crypto-asset services the applicant intends to provide;
  • the types of crypto-assets involved;
  • the business model and commercial strategy;
  • group structure, where the applicant belongs to a group;
  • the Member States and jurisdictions in which services will be offered;
  • target client types, including whether services reach retail clients;
  • distribution and marketing arrangements;
  • operational resources, systems and staffing;
  • outsourcing arrangements and third-party dependencies;
  • financial forecasts and the assumptions behind them, where required;
  • the operating model for each specific service applied for.

In practical terms, the programme of operations is where regulators test whether the rest of the application is coherent. If the file requests authorization for five services but the programme describes staffing and systems for two, that inconsistency surfaces immediately. If the financial forecasts imply a cost base that would push prudential safeguards above the class minimum under Article 67, the capital evidence needs to match. The strongest applications treat this document as the spine that everything else hangs from, rather than as narrative filler.

Formal Application and Assessment Timeline

MiCA sets statutory review periods, and they are more precise than the multi-month estimates that circulate in commentary.

Under Article 63, the national competent authority acknowledges receipt of the application within 5 working days. It then assesses whether the application is complete within 25 working days, and will request any missing elements. Once the application is complete, the NCA assesses compliance and decides to grant or refuse authorization within 40 working days.

(Source: ESMA Interactive Single Rulebook, MiCA Article 63 — Assessment of the application — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-63-assessment-application)

The additional-information mechanism is also narrower than usually described. It is not accurate that any regulator question stops the clock indefinitely. During the assessment period the NCA may request further information; the first such request may suspend the assessment period until the response is received, for a maximum of 20 working days. Subsequent requests for clarification should not be described as automatically suspending the formal assessment period again.

These are statutory review periods after the relevant procedural conditions are met, not a guaranteed total project timeline from first preparation to authorization. The preparation phase before submission — drafting policies, assembling evidence, appointing key function holders, confirming capital — sits entirely outside these windows and is usually where the real time goes. Quoting a universal end-to-end duration is guesswork; the statutory periods are facts.

EU Passporting After MiCA Authorization

Passporting is the commercial reason most firms pursue authorization, and it is also the part most often described as automatic. It is not.

EU passporting does not automatically start simply because a CASP has authorization; Article 65 requires a notification through the home competent authority.

The procedure is short. A CASP intending to provide services in other Member States submits information to its home NCA covering the host Member States concerned, the crypto-asset services it intends to provide there, the intended start date, and any other activities it carries on outside MiCA's scope. The home NCA communicates that information to the host authorities, ESMA and the EBA within 10 working days. The CASP may begin cross-border provision upon receipt of the relevant communication, or at the latest from the 15th calendar day after submitting the information.

(Source: ESMA Interactive Single Rulebook, MiCA Article 65 — Cross-border provision of crypto-asset services — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-65-cross-border-provision-crypto)

Two boundaries apply. Passporting only covers services included in the authorization — a CASP cannot offer a service abroad that its home authorization does not cover, and attempting to do so is not a passporting question but an unauthorized-activity question. And passporting removes the licensing barrier, not every local obligation; host Member State rules that apply generally rather than as authorization requirements continue to apply.

The flip side matters for anyone dealing with a CASP rather than becoming one. Because authorization attaches to a specific legal entity and a specific service list, knowing that a counterparty "has a MiCA licence" is not the same as knowing it is authorised for the service you are relying on. That is why counterparty checks verify the exact authorised CASP and its service scope rather than stopping at the fact of authorization.

MiCA License Adaptation, Extension, and Renewal After July 2026

Three questions come up constantly, often phrased in search language that does not match the legal concepts. They are worth answering directly.

Can an Old VASP Licence Still Be Adapted to MiCA?

"MiCA license adaptation" and "CASP license adaptation" are terms people use for converting an old national VASP regime into MiCA authorization. The direct answer as of late 2026: the EU-wide transition has ended, and no automatic conversion exists.

Article 143(6) allowed Member States to apply a simplified procedure to applications submitted between 30 December 2024 and 1 July 2026, by entities that were already authorised under national law to provide crypto-asset services, where the conditions were met.

(Source: ESMA Interactive Single Rulebook, MiCA Article 143 — Transitional measures — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-143-transitional-measures)

One qualification inside that window is frequently misunderstood, and it stranded firms that assumed otherwise. The simplified procedure was not available simply because a company held an AML/CFT registration. European Commission and ESMA Q&A material clarified that the entity had to have been authorised under national law to provide crypto-asset services; an AML registration alone was not sufficient.

(Source: ESMA Questions and Answers, ref. 2070 — https://www.esma.europa.eu/publications-data/questions-answers/2070)

After 1 July 2026, a legacy provider that did not obtain authorization cannot continue MiCA-regulated services on the strength of its old national status, and a pending application does not extend the transition. An applicant in that position goes through whichever current authorization route applies to it — Article 63, or Article 60 if it is one of the regulated financial entities that qualifies. The full account of how that deadline played out, including wind-down and client migration expectations, sits in what happened when the MiCA transition period ended.

Does a MiCA License Need Renewal?

There is no routine annual MiCA CASP licence renewal, but maintaining authorization requires continuous compliance.

MiCA does not create a standard annual or periodic renewal cycle for Article 63 authorization. What it does create is an ongoing condition: under Article 59, an authorised CASP must meet the conditions for its authorization at all times.

The enforcement mechanism is withdrawal rather than expiry. Article 64 sets out the circumstances in which a competent authority may withdraw authorization, including where the CASP has not used the authorization within 12 months, has expressly renounced it, has not provided crypto-asset services for nine consecutive months, obtained the authorization irregularly, no longer meets the conditions under which it was granted and has not taken remedial action, has seriously failed in its AML/CFT systems, or has seriously breached MiCA.

(Source: ESMA Interactive Single Rulebook, MiCA Article 64 — Withdrawal of the authorisation — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-64-withdrawal-authorisation-crypto)

The absence of a renewal date does not mean the absence of a review. It means the review is continuous and triggered by circumstances rather than by a calendar. Two entries on that list catch dormant entities specifically: an authorization obtained and never used, or a business that stops providing services for nine months, can be withdrawn without any misconduct at all.

How to Add New Crypto Services to an Existing Authorization

This is the legal concept that sits behind much of the "adaptation" search traffic, and it is distinct from the transition question above.

Under Article 59(8), a CASP that intends to provide crypto-asset services not covered by its authorization must request an extension of authorization from its home competent authority, complementing and updating the Article 62 information. The extension request goes through the Article 63 assessment process.

Adding a new crypto-asset service requires an extension of the CASP's authorization rather than simply starting the new service under the existing licence. A CASP authorised for custody and administration cannot begin operating a trading platform because both activities involve crypto — they are separate named services, and the second one is not in its authorization. The same applies to a Class 1 adviser that decides to start holding client assets: new service, extension request, and a higher capital class attached to it.

For a business planning product expansion, this is worth building into the roadmap rather than discovering later. The extension is an assessment process with its own timeline, and the prudential class may shift with it.

How AMLBot Supports CASP Compliance

Authorization is a regulatory process; what follows it is an operational one. A CASP that has satisfied its NCA on paper still has to run customer onboarding, screening and monitoring every day, and produce evidence of how it did so.

The onboarding layer is where most applications make commitments that later need systems behind them. Automated KYC and KYB verification handles identity verification for individual clients and the corporate side for business customers — entity verification, ownership structure and beneficial owner identification — with sanctions and PEP screening running inside the same flow rather than as a separate manual step. For a CASP whose programme of operations describes retail onboarding across several Member States, that is the difference between a described process and a working one.

On the transaction side, crypto transaction monitoring provides the ongoing screening of on-chain activity that sits behind the AML framework described in the application, with results written back into the customer record rather than into a separate log. That linkage matters more than any individual check: an alert without customer context is noise, and a customer file that never sees on-chain behaviour has blind spots.

Two limits worth stating. No platform determines which authorization route or service scope applies to your business — that is legal analysis, and it belongs with advisers who can read your specific model against Articles 59 and 60. And no vendor assumes your regulatory responsibility; the CASP remains accountable to its NCA regardless of who runs the verification step. What good tooling does is make the required work consistent, fast and evidenced.

If you are assembling an application and want the AML and KYC sections to describe systems that actually exist, or you have been authorised and are now operationalizing what the file promised, that is a sensible point to map the controls against your real service list rather than against a template. A wider view of the technology stack an EU crypto business needs is covered in the EU crypto AML platform guide.

MiCA Is Now the Operating Framework, Not a Transition Plan

As of late 2026, MiCA is no longer a planning exercise with a deadline attached. CASP authorization is the operating framework for regulated crypto-asset services in the European Union, and the questions that matter are structural rather than chronological.

For a business approaching the regime now, seven questions do most of the work. Which of the ten crypto-asset services does the business actually provide? Which authorization route applies — the ordinary Article 63 procedure, or the Article 60 notification framework for certain already-regulated financial entities? Which prudential class follows from that service list, and does the fixed-overheads calculation under Article 67 push the requirement above the Annex IV minimum? Are the governance and EU substance conditions in Article 59 met, including registered office, effective management and an EU-resident director? Is the application complete, with a three-year programme of operations that is consistent with the rest of the file? How will passporting be notified under Article 65 once authorization is granted? And how will the authorization be maintained, or extended, as the business changes? None of those are answered by a date. They are answered by the service list, which is where any MiCA project should start and what everything else follows from.

FAQ

What Is a MiCA License?

"MiCA license" is the common market term for authorization as a Crypto-Asset Service Provider under Regulation (EU) 2023/1114. The regulation itself uses the word authorization rather than licence. It is granted by a national competent authority, covers specified crypto-asset services, and applies to a particular legal entity rather than to a group or a brand.

Who Needs a CASP License Under MiCA?

Businesses professionally providing one or more of the ten MiCA-defined crypto-asset services in the EU generally need the relevant authorization. However, Article 60 provides a separate notification route for certain already-regulated financial entities, including specified credit institutions, investment firms and electronic money institutions, where the conditions are met.

Can a Crypto Business Still Rely on a National VASP Licence After July 2026?

No. The EU-wide MiCA transitional period ended on 1 July 2026. ESMA confirmed that after that date, any entity providing crypto-asset services to EU clients without MiCA authorization is in breach of EU law and must cease offering those services. A pending application does not extend the transition or provide a basis for continuing.

What Does "MiCA License Adaptation" Mean?

It is a search term rather than a legal procedure. People use it for converting an old national VASP regime into MiCA authorization. The Article 143 transitional window, including the simplified application procedure, closed on 1 July 2026. No automatic conversion from national registration to MiCA authorization exists after that date.

Could an AML-Registered VASP Use the Simplified MiCA Authorization Procedure?

Not on the strength of an AML registration alone. The Article 143(6) simplified procedure was available to entities that had been authorised under national law to provide crypto-asset services. ESMA Q&A material clarified that an AML/CFT registration by itself was not sufficient to qualify, which caught a number of firms that assumed otherwise.

Does a MiCA License Need to Be Renewed?

There is no standard annual or periodic renewal cycle for Article 63 CASP authorization. However, a CASP must continuously meet the conditions of its authorization. Article 64 allows competent authorities to withdraw authorization in defined circumstances, including prolonged non-use, serious AML system failures, or failure to maintain the conditions without remediation.

How Can a CASP Add Another Crypto Service to Its Licence?

By requesting an extension of authorization from its home national competent authority under Article 59(8), complementing and updating the Article 62 information. The extension is assessed through the Article 63 process. A new service cannot simply be started under the existing authorization, and the prudential class may change as a result.

What Are the MiCA CASP Capital Requirements?

Class 1 is €50,000, Class 2 is €125,000 and Class 3 is €150,000, with the classes cumulative by service. However, Article 67 requires prudential safeguards equal to at least the higher of the applicable minimum or one quarter of the preceding year's fixed overheads, so a growing business often needs more than the Annex IV figure.

What Should a MiCA CASP Business Plan Include?

The correct term is the programme of operations. Under Commission Delegated Regulation (EU) 2025/305 it covers the three years following authorization and includes the services to be provided, types of crypto-assets, business model, group structure, target markets and clients, distribution arrangements, operational resources, outsourcing, and financial information where required.

How Long Does a MiCA CASP Application Take?

MiCA sets statutory periods: receipt acknowledged within 5 working days, completeness assessed within 25 working days, and compliance assessed within 40 working days after the application is complete. The first request for additional information may suspend the assessment for up to 20 working days. These are review periods, not a guaranteed end-to-end project duration.

How Does MiCA Passporting Work?

Under Article 65, a CASP notifies its home competent authority of the host Member States, the services concerned, the intended start date and any non-MiCA activities. The home authority forwards that to host authorities, ESMA and the EBA within 10 working days. Cross-border provision may begin on receipt of the communication, or at the latest from the 15th calendar day after submission.

Is a MiCA CASP License Valid for Every Crypto Service?

No. Authorization specifies which of the ten crypto-asset services the CASP may provide, and passporting covers only those services. Providing a service outside the authorized scope requires an extension of authorization first, whether the service is offered domestically or in another Member State.

Do Stablecoin Issuers Get the Same MiCA CASP License?

Not necessarily. Issuance of asset-referenced tokens and e-money tokens sits in separate MiCA and e-money issuer frameworks rather than in the CASP authorization regime. A business that both issues a token and provides crypto-asset services may need to address both frameworks, but they are distinct authorization questions.

Does the EU Crypto Travel Rule Only Apply Above €1,000?

No. There is no general €1,000 de minimis threshold for relevant CASP-to-CASP crypto transfers under the Transfer of Funds Regulation. The €1,000 figure relates to certain transfers involving self-hosted addresses, where the CASP must assess whether the address is owned or controlled by its customer.

Does MiCA Authorization Cover AML Compliance Too?

No. MiCA governs authorization, prudential requirements and conduct. An authorised CASP is separately subject to the applicable AML/CFT framework as an obliged entity, to the Transfer of Funds Regulation for transfer traceability, and to DORA where applicable. AMLR is in force as legislation but generally applies from 10 July 2027.

Sign up for more like this.

Enter your email
Subscribe