CASP Licence Under MiCA: 2026 Requirements and Register

Last updated: 4 October 2026

A CASP licence is the authorisation a firm needs under the EU's Markets in Crypto-Assets Regulation (MiCA) to provide crypto-asset services such as custody, exchange or a trading platform to clients in the EU and EEA. It is granted by one national regulator, covers only the services listed in it, and can then be passported across all thirty EEA countries. Since the transitional period ended on 1 July 2026, a firm serving EU clients without one is operating unlawfully. You can check any claim in two minutes on the ESMA register.

"MiCA licensed" appears on a great many crypto websites. A much smaller number of companies hold the thing being described. The gap exists because the underlying authorisation, a CASP licence, is frequently confused with adjacent permissions that are easier to obtain and mean something different.

This guide explains what a CASP licence actually is, which services it covers, what a firm has to demonstrate to get one, how passporting works, where things stand now that grandfathering has ended, and how to verify a claim in a few minutes. Educational only, not legal advice.

What is a CASP licence?

CASP stands for crypto-asset service provider. Under the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, any firm providing crypto-asset services professionally in the EU needs authorisation from a national competent authority in a member state. "CASP licence" and "CASP license" are the British and American spellings of the same thing; the regulation itself calls it an authorisation.

The rules for service providers applied from 30 December 2024, following the stablecoin provisions which applied from 30 June 2024. Member states could operate a transitional regime letting existing firms continue while applications were processed, running in some cases until 1 July 2026.

That transitional window is the single biggest source of confusion in this area. A firm operating legitimately under grandfathering was not an authorised CASP; it was a firm permitted to continue while it applied. Marketing produced during that period frequently blurred the two.

Where things stand in October 2026

The grandfathering clause in Article 143(3) of MiCA allowed firms already operating lawfully under national law before 30 December 2024 to continue until 1 July 2026 or until their application was decided, whichever came first. Many member states chose shorter windows; the Netherlands and Poland, for example, closed theirs in June 2025 (Scorechain, checked 4 October 2026). There is no extension mechanism in the regulation, so from 1 July 2026 every firm providing crypto-asset services to EU clients needs a MiCA authorisation and can no longer rely on a national regime (KPMG Cyprus).

The register has grown quickly since the deadline:

• 16 July 2026: ESMA's second post-deadline update brought the interim register to 294 authorised CASP entries (MiCA Crypto Alliance, 23 July 2026).
• 1 October 2026: the independent tracker CASPtracker counted 361 authorised CASPs across thirty EEA markets, led by Germany (96), France (36), the Netherlands (29), Cyprus (25) and Malta (23) (CASPtracker, data verified 1 October 2026).

Germany's lead includes banks, among them cooperative banks, that added crypto services alongside their existing licences, not only crypto-native exchanges. Among the large exchanges, Coinbase is authorised in Luxembourg and Bybit in Austria according to the same tracker. ESMA itself publishes the register as CSV files updated weekly; the version current at the time of writing was last updated on 30 September 2026 (ESMA, checked 4 October 2026). Counts from third-party trackers differ by a few entries depending on the snapshot, so treat the ESMA file as the source of record.

Which services need one

MiCA defines a specific list. A licence is granted for the services a firm applies for, not as a blanket permission, which is why "is this firm licensed?" is an incomplete question. The right question is whether it is licensed for the service you are using.

What authorisation requires

The bar is closer to a financial services licence than to a registration, which is precisely the change MiCA introduced.

• Prudential safeguards. A minimum capital requirement that varies by service class, or an equivalent insurance arrangement. Custody and trading platforms sit at the higher tiers.
• Fit and proper management. Named individuals assessed for competence and integrity, plus assessment of qualifying shareholders.
• Client asset segregation. Client crypto-assets held separately from the firm's own, which is the provision most directly aimed at the failures of the previous cycle.
• Governance and conflicts policies. Documented arrangements, complaints handling, and business continuity.
• ICT resilience. Obligations under DORA apply alongside, and competent authorities examine them as part of the application.
• AML framework. Customer due diligence, ongoing transaction monitoring, sanctions screening, and the transfer-of-funds rules that apply the Travel Rule with a zero threshold to crypto transfers.
• Disclosure and marketing rules. Fair, clear and non-misleading communications.

The minimum capital tiers are EUR 50,000 for Class 1 services (such as advice, order reception and transmission, execution and placing), EUR 125,000 for Class 2 (adding custody and exchange services) and EUR 150,000 for Class 3 (operating a trading platform), as set out in Annex IV of the regulation and summarised by practitioners such as DLK Legal (checked 4 October 2026).

The aggregate cost of this is substantial and largely fixed. It does not scale down for a smaller firm, which is a significant part of why the mid-tier venue population thinned during 2026, as covered in why crypto exchanges are closing. For a full breakdown of what authorisation actually costs, see CASP licence cost in 2026.

How the application process works

MiCA sets the statutory clock, and national regulators add their own pre-application expectations on top. The Dutch AFM, one of the busiest authorities, describes three phases: a completeness check of 25 working days, an assessment period of 40 working days, and notification of the decision within 5 working days. It adds that "even in a best-case scenario it will take at least five months" once you count the time applicants need to fix gaps (AFM, checked 4 October 2026).

1. Scope the services. Decide exactly which of the ten services you will provide. Every service you add raises the capital tier and the documentation burden.
2. Choose a home member state. The regulator you file with becomes your lifelong supervisor; the choice is compared in where to get a CASP licence.
3. Build substance first. Local management, a compliance officer and an AML officer, policies, ICT and outsourcing arrangements, and a business plan. Regulators expect these in place, not promised.
4. File and answer questions. The completeness check restarts if documents are missing, which is where most of the real-world delay comes from.
5. Notify passporting. Once authorised, the firm tells its regulator which other member states it will serve, and the passport takes effect after the regulator forwards the notification.

Specialist advisers now also market the purchase of an already-authorised company as a shortcut. A change of control still needs regulatory approval of the new qualifying shareholders, so it shortens the process rather than bypassing it.

CASP onboarding and KYC obligations

An authorised CASP is an obliged entity for anti-money-laundering purposes. In practice that means identifying and verifying every customer before providing services, verifying the beneficial owners of business customers, screening customers against sanctions and politically exposed person (PEP) lists, monitoring transactions on an ongoing basis, and attaching originator and beneficiary information to every crypto transfer under the Travel Rule. Regulators examine these controls during authorisation, not just afterwards.

Most CASPs buy the identity layer rather than building it. Vendors commonly shortlisted for onboarding include iDenfy, Sumsub, Veriff and Onfido. As one example of the scope involved, iDenfy provides identity verification (KYC), business verification (KYB) and AML screening; according to its documentation (checked 4 October 2026) it screens persons and companies against PEP, sanctions and adverse media databases, with optional ongoing monitoring that re-checks each subject daily. On-chain screening of wallet addresses is a separate layer handled by blockchain analytics tools. We compare vendors in the best crypto KYC software, KYB software for crypto and watchlist and PEP screening.

Passporting across the EEA

The compensating benefit is the single market. A CASP authorised in one member state can notify and provide its authorised services across the EEA without seeking separate authorisation in each country. One licence, thirty markets.

This is why the choice of home member state matters commercially, and why several jurisdictions have positioned themselves as attractive venues for applications; we compare them in where to get a CASP licence. It also means the entity serving you may be authorised somewhere other than where you live, which is normal rather than suspicious, but worth knowing when you go looking for it.

Firms outside the EEA cannot passport in at all. Their only route to EU clients without authorisation is reverse solicitation, where the client approaches the firm entirely on their own initiative. ESMA's guidelines on reverse solicitation, published in early 2025, treat this as a narrow exception: a disclaimer or a contract clause does not prove the client came unsolicited, and marketing through paid third parties counts as solicitation.

CASP licence in SVG (St Vincent and the Grenadines)?

There is no such thing as a MiCA CASP licence from St Vincent and the Grenadines. SVG is not an EU or EEA member state, so its regulator cannot grant MiCA authorisation and an SVG-registered firm cannot passport into the EU.

SVG does now have its own regime. The Virtual Asset Business Act was enacted in 2022 and, according to the Financial Services Authority of St Vincent and the Grenadines, became effective on 31 May 2025. Registration is mandatory for SVG-incorporated business companies and LLCs "regardless of where the virtual asset services are being undertaken from". The FSA lists an application fee of EC$4,000, a registration fee and annual renewal of EC$12,000 each, minimum capital of EC$300,000, a statutory deposit of EC$100,000 or 25% of client obligations (whichever is greater), professional indemnity cover, and Travel Rule compliance (FSA SVG, checked 4 October 2026).

The practical consequence: an SVG registration lets a firm operate from SVG, but it does not permit it to market crypto-asset services to EU clients. A platform that serves Europeans on the strength of an SVG registration is relying on reverse solicitation, which is exactly what ESMA's guidelines are designed to police.

How to verify a CASP licence

There is one authoritative method and it takes about two minutes.

1. Identify the legal entity, not the brand. Groups operate through multiple companies. The one contracting with EEA customers is the one that needs authorisation, and it is usually named in the terms of service rather than on the homepage.
2. Check the ESMA register. The European Securities and Markets Authority maintains public registers of authorised CASPs. If the entity is not listed, it does not hold a CASP authorisation, whatever the marketing says.
3. Cross-check the national competent authority. Authorisation is granted by a member state regulator and recorded in its own register, which is the primary record.
4. Check which services. Confirm the authorisation covers the specific service you are using, not merely that the firm appears.
5. Distinguish licence types. An e-money institution licence, a legacy national VASP registration, and a MiCA CASP authorisation are three different things. Firms routinely cite the first two as evidence of the third.

ESMA also publishes a separate file of non-compliant entities providing crypto-asset services without authorisation, alongside the CASP list. It is worth checking both: absence from the authorised list is a warning sign, presence on the non-compliant list is a conclusion. Because the register updates weekly, a firm authorised in the last few days may not yet appear; in that case the national regulator's own register is the faster source.

Our companion guide to verifying MiCA compliance covers the wider framework, including stablecoin issuers.

Does a DeFi protocol need a CASP licence?

MiCA's recitals state that where crypto-asset services are provided in a fully decentralised manner without any intermediary, they fall outside its scope. The operative word is fully, and the analysis turns on facts rather than self-description. An identifiable operator, a controlled fee mechanism, or a service provided on behalf of users can bring an arrangement into scope regardless of how it is labelled.

JewelSwap is non-custodial across MultiversX, Sui and Radix. Users hold their own keys and interact with smart contracts directly; the protocol does not take custody of client assets, does not operate a trading venue on users' behalf, and does not issue an e-money or asset-referenced token. Its liquid staking tokens, JWLSUI, JWLEGLD and JWLXRD, are staking derivatives backed by the underlying staked asset rather than currency-referencing tokens.

On the facts as they stand, that places it outside the CASP categories above. This is an architectural consequence, not a regulatory endorsement, and anyone adding custody, a fiat on-ramp or brokerage on top of a DeFi protocol is squarely in scope.

Frequently asked questions

What is a CASP licence?

Authorisation as a crypto-asset service provider under MiCA, granted by a national competent authority in an EU member state. It permits specified crypto-asset services and can be passported across the EEA without separate authorisation in each country.

When did CASP authorisation become required?

MiCA's rules for crypto-asset service providers applied from 30 December 2024. Member states could run a transitional regime allowing existing firms to continue while their applications were assessed, in some cases until 1 July 2026. That period has now ended, so since 1 July 2026 every firm serving EU clients needs a MiCA authorisation.

How many CASPs are authorised under MiCA?

ESMA's interim register held 294 authorised CASP entries after its 16 July 2026 update, and the independent CASPtracker counted 361 as of 1 October 2026, with Germany, France and the Netherlands hosting the most. The ESMA register is updated weekly and is the source of record.

How do I check if a company has a CASP licence?

Identify the legal entity serving EEA customers, then look it up in the ESMA register of authorised CASPs and in its national competent authority's register. Confirm the authorisation covers the specific service you are using, not just that the firm is listed.

What is the difference between a CASP licence and a VASP registration?

A VASP registration was a national AML-focused regime that varied by country. A CASP authorisation under MiCA is a harmonised EU-wide licence with prudential, governance, client-asset and conduct requirements, and it can be passported across the EEA. They are not equivalent.

Can one CASP licence cover all EU countries?

Yes, through passporting. A CASP authorised in one member state can notify and provide its authorised services across the EEA. This is why a firm may be authorised in a country other than the one you live in.

Can I get a CASP licence in SVG (St Vincent and the Grenadines)?

No. MiCA CASP authorisation is only granted by regulators in EU and EEA states. SVG has its own Virtual Asset Business Act, effective from 31 May 2025 according to its Financial Services Authority, but registration there does not allow a firm to passport into or market to the EU.

How long does it take to get a CASP licence?

The statutory steps are a 25-working-day completeness check and a 40-working-day assessment. The Dutch AFM says that even in a best-case scenario an application takes at least five months, and longer if the file needs changes.

How much does a CASP licence cost?

The application fee is the smallest component. Minimum capital runs from EUR 50,000 to EUR 150,000 depending on service class, and the resident staffing a regulator expects before you file typically costs EUR 300,000 to EUR 600,000 a year. Full breakdown in CASP licence cost in 2026.

Do DeFi protocols need a CASP licence?

MiCA states that fully decentralised services provided without any intermediary fall outside its scope. In practice an identifiable operator, a controlled fee mechanism, or services provided on behalf of users can bring an arrangement into scope, so the analysis depends on specific facts.

Keep reading

• CASP Licence Cost in 2026: Fees, Capital and Timelines
• Where to Get a CASP Licence: Jurisdictions Compared
• MiCA and DORA: How the Two Regimes Overlap
• MiCA-Compliant Crypto Platforms: How to Verify
• DORA Compliance Explained
• What Is the Travel Rule? FATF Rule 16 Explained
• MiCA-Compliant Stablecoins in 2026
• Crypto AML Compliance Guide for Exchanges and VASPs
• JewelSwap crypto glossary
• DAC8 Explained: EU Crypto Tax Reporting from 2026
• The Top Blockchains for Europe Under MiCA (2026)