CASP Licence Under MiCA: Requirements and How to Verify One

Last updated: 30 July 2026

"MiCA licensed" appears on a great many crypto websites. A much smaller number of companies hold the thing being described. The gap exists because the underlying authorisation, a CASP licence, is frequently confused with adjacent permissions that are easier to obtain and mean something different.

This guide explains what a CASP licence actually is, which services it covers, what a firm has to demonstrate to get one, how passporting works, and how to verify a claim in a few minutes. Educational only, not legal advice.

What is a CASP licence?

CASP stands for crypto-asset service provider. Under the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, any firm providing crypto-asset services professionally in the EU needs authorisation from a national competent authority in a member state.

The rules for service providers applied from 30 December 2024, following the stablecoin provisions which applied from 30 June 2024. Member states could operate a transitional regime letting existing firms continue while applications were processed, running in some cases until 1 July 2026.

That transitional window is the single biggest source of confusion in this area. A firm operating legitimately under grandfathering was not an authorised CASP; it was a firm permitted to continue while it applied. Marketing produced during that period frequently blurred the two.

Which services need one

MiCA defines a specific list. A licence is granted for the services a firm applies for, not as a blanket permission, which is why "is this firm licensed?" is an incomplete question. The right question is whether it is licensed for the service you are using.

What authorisation requires

The bar is closer to a financial services licence than to a registration, which is precisely the change MiCA introduced.

• Prudential safeguards. A minimum capital requirement that varies by service class, or an equivalent insurance arrangement. Custody and trading platforms sit at the higher tiers.
• Fit and proper management. Named individuals assessed for competence and integrity, plus assessment of qualifying shareholders.
• Client asset segregation. Client crypto-assets held separately from the firm's own, which is the provision most directly aimed at the failures of the previous cycle.
• Governance and conflicts policies. Documented arrangements, complaints handling, and business continuity.
• ICT resilience. Obligations under DORA apply alongside, and competent authorities examine them as part of the application.
• AML framework. Customer due diligence, ongoing transaction monitoring, sanctions screening, and the transfer-of-funds rules that apply the Travel Rule with a zero threshold to crypto transfers.
• Disclosure and marketing rules. Fair, clear and non-misleading communications.

The aggregate cost of this is substantial and largely fixed. It does not scale down for a smaller firm, which is a significant part of why the mid-tier venue population thinned during 2026, as covered in why crypto exchanges are closing.

Passporting across the EEA

The compensating benefit is the single market. A CASP authorised in one member state can notify and provide its authorised services across the EEA without seeking separate authorisation in each country. One licence, twenty-seven-plus markets.

This is why the choice of home member state matters commercially, and why several jurisdictions have positioned themselves as attractive venues for applications. It also means the entity serving you may be authorised somewhere other than where you live, which is normal rather than suspicious, but worth knowing when you go looking for it.

How to verify a CASP licence

There is one authoritative method and it takes about two minutes.

1. Identify the legal entity, not the brand. Groups operate through multiple companies. The one contracting with EEA customers is the one that needs authorisation, and it is usually named in the terms of service rather than on the homepage.
2. Check the ESMA register. The European Securities and Markets Authority maintains public registers of authorised CASPs. If the entity is not listed, it does not hold a CASP authorisation, whatever the marketing says.
3. Cross-check the national competent authority. Authorisation is granted by a member state regulator and recorded in its own register, which is the primary record.
4. Check which services. Confirm the authorisation covers the specific service you are using, not merely that the firm appears.
5. Distinguish licence types. An e-money institution licence, a legacy national VASP registration, and a MiCA CASP authorisation are three different things. Firms routinely cite the first two as evidence of the third.

Our companion guide to verifying MiCA compliance covers the wider framework, including stablecoin issuers.

Does a DeFi protocol need a CASP licence?

MiCA's recitals state that where crypto-asset services are provided in a fully decentralised manner without any intermediary, they fall outside its scope. The operative word is fully, and the analysis turns on facts rather than self-description. An identifiable operator, a controlled fee mechanism, or a service provided on behalf of users can bring an arrangement into scope regardless of how it is labelled.

JewelSwap is non-custodial across MultiversX, Sui and Radix. Users hold their own keys and interact with smart contracts directly; the protocol does not take custody of client assets, does not operate a trading venue on users' behalf, and does not issue an e-money or asset-referenced token. Its liquid staking tokens, JWLSUI, JWLEGLD and JWLXRD, are staking derivatives backed by the underlying staked asset rather than currency-referencing tokens.

On the facts as they stand, that places it outside the CASP categories above. This is an architectural consequence, not a regulatory endorsement, and anyone adding custody, a fiat on-ramp or brokerage on top of a DeFi protocol is squarely in scope.

Frequently asked questions

What is a CASP licence?

Authorisation as a crypto-asset service provider under MiCA, granted by a national competent authority in an EU member state. It permits specified crypto-asset services and can be passported across the EEA without separate authorisation in each country.

When did CASP authorisation become required?

MiCA's rules for crypto-asset service providers applied from 30 December 2024. Member states could run a transitional regime allowing existing firms to continue while their applications were assessed, in some cases until 1 July 2026.

How do I check if a company has a CASP licence?

Identify the legal entity serving EEA customers, then look it up in the ESMA register of authorised CASPs and in its national competent authority's register. Confirm the authorisation covers the specific service you are using, not just that the firm is listed.

What is the difference between a CASP licence and a VASP registration?

A VASP registration was a national AML-focused regime that varied by country. A CASP authorisation under MiCA is a harmonised EU-wide licence with prudential, governance, client-asset and conduct requirements, and it can be passported across the EEA. They are not equivalent.

Can one CASP licence cover all EU countries?

Yes, through passporting. A CASP authorised in one member state can notify and provide its authorised services across the EEA. This is why a firm may be authorised in a country other than the one you live in.

Do DeFi protocols need a CASP licence?

MiCA states that fully decentralised services provided without any intermediary fall outside its scope. In practice an identifiable operator, a controlled fee mechanism, or services provided on behalf of users can bring an arrangement into scope, so the analysis depends on specific facts.

Keep reading

• MiCA-Compliant Crypto Platforms: How to Verify
• DORA Compliance Explained
• What Is the Travel Rule? FATF Rule 16 Explained
• MiCA-Compliant Stablecoins in 2026