MiCA crypto-asset service provider authorisation

Fees are national: Malta charges €10,000 to €25,000 to apply. Decisions follow within 40 working days of a complete file; plan for three to five months.

Exchanges, brokers, custodians and trading platforms serving EU clients need MiCA authorisation in one home Member State, and the choice of that state shapes fees, pace and supervision.

Before anything is drafted we advise on whether this is the right authorisation for the business, or whether another route would serve it better.

Transition ended

1 July 2026

Seven steps from choosing a home state to serving the whole EU. MiCA periods are as legislated; preparation times are our planning figures.

1. Choose the class and the home stateFix the services and therefore the class, then choose the Member State where real operations will sit; fees, pace and supervisory focus differ. Time: about 2 weeks.
2. Engage the authority before filingRequest a pre-application meeting where the authority offers one; it surfaces objections before the statutory clock starts. Time: 2 to 4 weeks.
3. Build the applicationProgramme of operations, governance, internal controls, ICT and security under DORA, AML, custody and segregation policy, complaints, conflicts, business continuity and wind-down, in the authority’s format. Time: 8 to 12 weeks.
4. Completeness checkThe authority assesses whether the application is complete and may set a deadline for missing information. Time: 25 working days.
5. AssessmentQuestions must be raised by the 20th working day of the assessment, and the clock stops while you answer, for no more than 20 working days. Time: 40 working days from a complete application.
6. Authorisation and capital in placeThe authority issues a reasoned decision; prudential safeguards and client fund accounts must be ready from day one.
7. Passport across the EUNotify the Member States you will serve; the home authority forwards the notification within 10 working days and services may start on receipt, or at the latest 15 calendar days after submission.

June 2023

MiCA entered into force

30 June 2024

Rules for e-money token and asset-referenced token issuers applied

30 December 2024

Full application, including the CASP regime; the travel rule guidelines under Regulation (EU) 2023/1113 applied

17 January 2025

DORA applied

1 January 2026

DAC8 tax reporting on crypto-asset transactions began

1 July 2026

Last national transitional period ended

10 July 2027

The EU Anti-Money Laundering Regulation applies

The registered office must be in a Member State where at least part of the services are provided, so the home state is where real operations will sit. MiCA sets no EU-level fee; each authority charges its own:

On 10 July 2025 the European Securities and Markets Authority (ESMA) published a peer review of the MFSA’s authorisation of a CASP. It found a good level of resources and engagement, but also that some material issues were not fully resolved when the authorisation was granted and some risk areas were not adequately assessed. ESMA asked every national authority authorising CASPs to pay particular attention to business growth, conflicts of interest, governance and intragroup arrangements, ICT architecture, Web3 and decentralised products, and the promotion of unregulated services.

Those are the areas where applications now attract the most questions in every home state. We address each one in the application itself, which shortens the assessment and keeps the clock running.

Credit institutions, investment firms, e-money institutions and certain other financial entities can provide crypto-asset services under Article 60 by notifying their authority instead of applying for a CASP licence. The notification must be made at least 40 working days before the services start, and the authority checks completeness within 20 working days. In the Netherlands the AFM charges €200 an hour, up to €50,000, to handle such a notification.

Credit institution

Any crypto-asset service

Central securities depository

Custody and administration only

Investment firm

Services equivalent to the investment services it is authorised for

Electronic money institution

Custody and administration, and transfer services, only for the e-money tokens it issues

UCITS management company or AIFM

Services equivalent to portfolio management and the non-core services it is authorised for

Market operator

Operating a crypto-asset trading platform

An EMI that wants to run an exchange therefore needs full CASP authorisation.

Regulator charges, capital and required roles, with Malta as the worked example because its fees are fully legislated. Professional fees are excluded.

Regulator application fee

€10,000 to €25,000 in MaltaUp to €100,000 at €200 an hour with the Dutch AFM; set nationally elsewhere

Initial capital

€50,000, €125,000 or €150,000Or one quarter of projected fixed overheads if higher

Annual supervisory fee

€10,000 to €50,000 in Malta, plus €2,000 per service and 0.05% of volumeMaltese figures, with the 0.05% element capped at €250,000; Ireland charges a €30,000 annual levy

Audit and safeguarding audit

Annual statutory auditClient asset and custody arrangements are reviewed by the authority; auditors’ fees are not set by regulators

Required roles

Management body with an EU-resident directorFit and proper management, a compliance function and an officer responsible for anti-money laundering compliance

Insurance or bond

OptionalAn insurance policy or comparable guarantee may count towards the prudential safeguards

ESMA keeps an interim register of authorised CASPs, which is the authoritative source for who holds a MiCA licence. National figures show how concentrated the market is: Ireland’s levy population for 2025 counts 10 CASPs, each paying a €30,000 levy under the 2026 regulations. The ESMA peer review of July 2025 is the clearest statement of what authorities now test before granting.

After authorisation. The authority withdraws an authorisation not used within 12 months, or where the CASP has provided no crypto-asset services for nine consecutive months (article 64). Anyone deciding to acquire a qualifying holding, or to increase it to 20%, 30% or 50%, notifies the authority in writing, which assesses the acquisition within 60 working days of acknowledging receipt (article 83). Under DAC8, from 1 January 2026 reporting providers collect information on their users’ transactions and report it to their tax authority the following year.

MiCA allowed Member States to let firms already operating under national regimes continue for a transitional period, up to 1 July 2026 at the latest. That period has now ended everywhere; some states ended it sooner, Lithuania on 1 January 2026. A provider without MiCA authorisation or a valid notification must have wound down its EU business, and national authorities are enforcing.

Member states set their own periods: six months in the Netherlands, Finland, Latvia, Hungary, Slovenia and Poland; nine months in Sweden; 12 months in Germany, Ireland, Greece, Austria, Lithuania and Slovakia; up to 18 months elsewhere. ESMA’s statement of 17 April 2026 says any entity providing crypto-asset services to EU clients without MiCA authorisation after 1 July 2026 is in breach of EU law and must cease.

Wind-down plans should move clients’ assets to an authorised CASP or a self-hosted wallet, with prior notice to clients. Firms outside the EU may not solicit EU clients, including business clients, except under the narrow reverse solicitation exception, and custody may not be delegated to entities that are not authorised CASPs.

• Custody. A custodian keeps a register of positions in each client’s name, gives clients a summary of its custody policy electronically on request, and is liable for the loss of crypto-assets or means of access from an incident attributable to it, up to their market value at the time of loss. It may delegate custody only to CASPs authorised under MiCA, and tells clients when it does (article 75).
• Travel rule. Originator and beneficiary information travels with crypto-asset transfers. Where a transfer of more than €1,000 involves a self-hosted address, the CASP assesses whether the address is owned or controlled by its customer.
• Anti-money laundering. The EU Anti-Money Laundering Regulation applies from 10 July 2027.
• Stablecoins. Only credit institutions and EMIs that have notified a white paper may offer e-money tokens (article 48). A CASP that only lists or transfers tokens issued by others needs no issuer authorisation.
• Payment services. Some services with e-money tokens are also payment services under PSD2. The EBA’s transition for CASPs to obtain PSD2 authorisation ended on 2 March 2026, and its Opinion of 12 February 2026 advises authorities to require firms that do not meet its conditions to stop those services.

A CASP needs client fund accounts with a credit institution, kept separate from its own funds, and operating accounts in the markets it serves. We open these alongside the application, ready for client funds to be placed by the end of the next business day. See banking and payment processing.

1. Scoping. We confirm the class, the services and the home Member State, comparing fees, timelines and supervisory approach across the national authorities, since MiCA sets no EU-level fee.
2. Application pack. The programme of operations, governance, internal controls, ICT and security, AML, the segregation and custody policy, complaints, conflicts and business continuity, in the form the chosen authority prescribes to clear the 25-working-day completeness check.
3. Banking. The client funds accounts with a credit institution, kept separate from your own funds, and the operating accounts, opened alongside the application and ready for client funds to be placed by the end of the next business day.
4. Regulator engagement. We answer questions within any suspension of up to 20 working days, through the 40-working-day assessment to the decision, and prepare the passport notifications for the other Member States alongside.

You will need a management team that runs the business from the EU, with at least one director living in the EU.

We prepare MiCA CASP authorisation applications, file them with the home-state authority and manage each one to approval, from our offices in London and New York.

Authorisation is the first stage. We can also arrange what the regulator expects to be in place alongside it: the local directors and compliance officer, bank accounts, payment processing and the first year of compliance.

Crypto licence consultants