Learn
A crypto-asset service provider under MiCA needs an authorisation that names each service it provides, a registered office in the Member State where it provides at least part of them, and prudential safeguards equal to the higher of an Annex IV floor of EUR 50 000, EUR 125 000 or EUR 150 000 and one quarter of last year's fixed overheads. On top of that sit the Title V duties that bind every CASP, in Articles 66 to 74: conduct, governance, safekeeping of client assets and funds, complaints, conflicts of interest, outsourcing and, for some services, a wind-down plan. Articles 75 to 82 then add rules for each service you are authorised for. All of it has applied since 30 December 2024 under Regulation (EU) 2023/1114.
The transitional period is over. Article 143(3) let firms that provided services lawfully before 30 December 2024 continue until 1 July 2026, or until their authorisation was granted or refused if that came sooner, and Member States could shorten it. Any firm providing crypto-asset services in the Union today needs either a CASP authorisation or an Article 60 notification. What that costs is covered in our guide to what MiCA compliance costs.
| Requirement | What it means in practice | Where it says so |
|---|---|---|
| Authorisation | Authorised as a CASP, or a regulated financial entity that has notified under Article 60. | Art. 59(1) |
| Presence | Registered office where you provide part of your services, effective management in the Union, at least one director resident in the Union. | Art. 59(2) |
| Capital | The higher of the Annex IV floor for your class and a quarter of prior year fixed overheads. | Art. 67, Annex IV |
| Governance | Fit and proper management and qualifying holders, policies, continuity, AML risk assessment, records. | Art. 68 |
| Client assets | Protect ownership rights, and place client funds with a credit institution or central bank by the next business day. | Art. 70 |
| Conduct | Act honestly, fairly and professionally; fair, clear and not misleading information; risk warnings. | Art. 66 |
| Service rules | Extra duties for custody, trading platforms, exchange, execution, placing, orders, advice, portfolio management and transfers. | Arts. 75 to 82 |
Who needs a CASP authorisation?
Anyone providing one of the ten crypto-asset services defined in Article 3(1)(16) within the Union: custody and administration on behalf of clients, operating a trading platform, exchange for funds, exchange for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management, and transfer services. Article 59(1) allows two routes. Either you are a legal person or other undertaking authorised under Article 63, or you are a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager allowed to provide services under Article 60.
The Article 60 route is a notification, not an authorisation, and each entity type has its own scope: an electronic money institution, for example, may only provide custody and transfer services for the e-money tokens it issues. The notification goes to the home competent authority at least 40 working days before the services start. Your authorisation, whichever route, specifies the services you may provide, and adding one later means applying for an extension under Article 59(8).
What goes into the application, and how long does it take?
Article 62(2) lists 19 items, from (a) to (s). The ones that take the longest to produce are the programme of operations, proof of the prudential safeguards, the governance arrangements, fit and proper evidence for management and qualifying holders, the internal control, AML and business continuity description, the technical documentation of the ICT systems and security arrangements with a non-technical description, the procedure for segregating client crypto-assets and funds, and the complaints procedure. Service specific items follow: a custody policy, trading platform operating rules and market abuse detection, a non-discriminatory commercial policy and pricing methodology for exchange, an execution policy, proof of adviser competence, and how transfers will be provided.
The regulator's clock is set in Article 63. It acknowledges receipt within five working days and checks completeness within 25 working days, setting a deadline for anything missing. Once the application is complete, it has 40 working days to adopt a reasoned decision, and notifies you within five working days of it. It may request further information up to the 20th working day of that assessment, which suspends the clock for up to 20 working days. Refusal grounds are in Article 63(10), including a management body that threatens sound and prudent management or exposes the firm to serious money laundering risk.
Passporting is a notification too. Under Article 65, you tell your home authority where you intend to provide services and which ones; it passes that on within 10 working days, and you may start from the date it tells you it has done so, or at the latest from the 15th calendar day after you submitted. No physical presence in the host Member State is required.
How much capital does a CASP need?
Article 67(1) requires prudential safeguards at all times equal to the higher of two amounts. The first is the permanent minimum capital in Annex IV, set by class.
| Class | Services that put you in it | Annex IV minimum |
|---|---|---|
| Class 1 | Execution of orders, placing, transfer services, reception and transmission of orders, advice, portfolio management. | EUR 50 000 |
| Class 2 | Any class 1 service plus custody and administration, exchange for funds, or exchange for other crypto-assets. | EUR 125 000 |
| Class 3 | Any class 2 service plus operating a trading platform. | EUR 150 000 |
The second is one quarter of the fixed overheads of the preceding year, reviewed annually. A firm in its first year uses the projected overheads it submitted with its application. The safeguards can be held as Common Equity Tier 1 own funds, as an insurance policy or comparable guarantee, or a combination. An insurance policy must be disclosed on your website, run for an initial term of at least one year and carry a cancellation notice period of at least 90 days.
What governance does MiCA require?
Article 68 sets the standard. Members of the management body must be of sufficiently good repute, have the knowledge, skills and experience to do the job individually and collectively, commit sufficient time, and have no convictions for money laundering, terrorist financing or other offences affecting their repute. Shareholders with qualifying holdings must meet the same repute test. The firm needs effective policies and procedures, competent personnel, and a management body that periodically reviews whether those arrangements work.
Operational resilience is written in by reference. Article 68(7) requires resilient and secure ICT systems as required by Regulation (EU) 2022/2554, DORA, and a business continuity policy that includes the ICT business continuity and response and recovery plans under Articles 11 and 12 of DORA. CASPs are in DORA's own scope under its Article 2(1)(f). Article 68(9) requires records of all services, activities, orders and transactions, provided to clients on request and kept for five years, or up to seven where the competent authority asks before the five years run out.
What conduct and client asset rules apply to every CASP?
Conduct, Article 66
Act honestly, fairly and professionally in the best interests of clients. Information, including marketing, must be fair, clear and not misleading. Warn clients of the risks. Publish your pricing, costs and fees prominently on your website, together with information on the principal adverse climate and environmental impacts of the consensus mechanism of each crypto-asset you provide services for. Trading platforms, exchange, advice and portfolio management must link clients to the relevant white papers.
Safekeeping, Article 70
If you hold client crypto-assets or the means of access to them, you must protect clients' ownership rights, especially on insolvency, and never use them for your own account. Client funds other than e-money tokens must be placed with a credit institution or a central bank by the end of the business day following receipt, in an account separately identifiable from your own. Paragraphs 2 and 3 do not apply to CASPs that are themselves electronic money, payment or credit institutions.
Complaints, conflicts and outsourcing, Articles 71 to 73
Complaints must be free to file, handled promptly and fairly, recorded, and answered within a reasonable period, with a published procedure and a template. Conflicts of interest must be identified, prevented, managed and disclosed on your website. Outsourcing does not delegate responsibility: you remain fully responsible for your Title V obligations, and the provider must cooperate with your competent authority, including on-site access.
What extra rules apply to specific services?
Each service brings its own article, and only the ones on your authorisation apply.
| Service | Selected duties | Article |
|---|---|---|
| Custody and administration | Client agreement, register of positions, a statement at least every three months, segregation on the ledger, liability for losses attributable to you capped at market value at the time of loss. | Art. 75 |
| Trading platform | Clear operating rules for admission and participation; no dealing on own account on your own platform. | Art. 76 |
| Exchange | A non-discriminatory commercial policy; a firm price or a published method for determining it. | Art. 77 |
| Execution of orders | An execution policy aimed at the best possible result for clients. | Art. 78 |
| Advice and portfolio management | A suitability assessment of knowledge, experience, objectives and ability to bear losses. | Art. 81 |
| Transfer services | An agreement with clients setting out duties and responsibilities. | Art. 82 |
Firms providing custody, a trading platform, exchange, execution or placing, the services in Articles 75 to 79, must also keep an orderly wind-down plan under Article 74. And a CASP with at least 15 million active users in the Union, averaged over the previous calendar year, is significant under Article 85 and must notify its competent authority within two months of reaching that number.
What the other results get wrong
The capital classes are where published guides slip most. One licensing guide we read, updated on 28 May 2026, puts EUR 125 000 against operating a trading platform and EUR 150 000 against custody or exchange. Annex IV does the reverse: custody and exchange are class 2 at EUR 125 000, and adding a trading platform makes you class 3 at EUR 150 000. The same guide does not describe the fixed overheads test at all, which for a firm with a real payroll is usually the number that binds.
The second slip is the timeline. The 25 and 40 working day periods are the regulator's clock for a single complete application. The 25 days end with a deadline for missing information, not a decision, and a request for more information during the assessment stops the 40 day clock for up to 20 working days. Plan on the application being complete before you count.
The third is treating MiCA and DORA as separate programmes. Article 68 imports DORA directly for ICT systems and continuity, so the ICT half of your MiCA governance file is the same evidence your DORA programme should already hold.
Where does your firm stand?
Fill this in against your authorisation, or the one you are applying for. A blank cell is the next piece of work.
| Question | Your answer | Why it matters |
|---|---|---|
| Which of the ten services do you provide, and which Annex IV class does that put you in? | Sets the capital floor and the service articles that apply. | |
| What were last year's fixed overheads, and is a quarter of them above your class floor? | Article 67 takes the higher of the two. | |
| Which Member State is home, and is one director resident in the Union? | Article 59(2). | |
| Where do client funds sit by the end of the next business day? | Article 70(3), unless you are an e-money, payment or credit institution. | |
| Is your ICT continuity plan the same document for MiCA and DORA? | Article 68(7) requires the DORA plans. | |
| Can you produce five years of records of every order and transaction? | Article 68(9). | |
| If you provide custody, exchange, execution, placing or a platform, where is the wind-down plan? | Article 74. |
For the exposure if any of this slips, our guide to MiCA fines and penalties sets out the Article 111 tiers. The free compliance check gives you a baseline, and the MiCA framework page shows how authorisation scope, prudential safeguards, safekeeping, conduct and reporting are held as controls, with ICT resilience shared with your DORA programme.
Frequently asked questions
Can we still operate under the MiCA transitional period?
No. Article 143(3) ended the transitional regime on 1 July 2026 at the latest, and Member States could end it earlier. Providing crypto-asset services now requires an authorisation or an Article 60 notification.
How long does MiCA authorisation take?
The regulator has 25 working days to check completeness and 40 working days from a complete application to decide, with a possible suspension of up to 20 working days for further information. The time to prepare a complete application is not in the Regulation.
Do banks need a separate CASP licence?
No. Under Article 60, a credit institution may provide crypto-asset services after notifying its competent authority at least 40 working days in advance.
Can the capital be held as insurance?
Yes, in whole or part. Article 67(4) allows own funds, an insurance policy or comparable guarantee, or a combination, and Article 67(5) sets the policy's minimum terms.
Does a MiCA authorisation work across the EU?
Yes. Article 59(7) lets an authorised CASP provide services throughout the Union, and Article 65 sets the notification that switches it on for each Member State.
Primary sources
Everything above is taken from Articles 3, 59, 60, 62, 63, 65 to 82, 85, 143 and 149 and Annex IV of Regulation (EU) 2023/1114, and Article 2 of Regulation (EU) 2022/2554. Level 2 measures under MiCA add detail to several of these articles, and the Official Journal text is authentic. Confirm the current consolidated text and your competent authority's guidance before relying on a specific provision.
