MiCA CASP License Requirements: Capital, Governance, and Application Process

Regulation (EU) 2023/1114 -- the Markets in Crypto-Assets Regulation, or MiCA -- has been fully applicable since 30 December 2024. Every crypto-asset service provider (CASP) operating in the EU must now hold a MiCA authorization. The maximum Article 143(3) transitional period ended on 1 July 2026.

This article covers what the regulation actually requires: the ten service types defined under MiCA, the capital thresholds tied to each, the governance structure your NCA will expect, the application process and timeline, and a comparison of five popular licensing jurisdictions. Everything references the regulation directly -- no paraphrasing of paraphrases.

---

What are the ten crypto-asset services under MiCA?

MiCA Article 3(1)(16) defines ten crypto-asset services. Your authorization application must specify which services you intend to provide, because capital requirements, governance obligations, and operational rules differ by service type.

1. Custody and administration of crypto-assets on behalf of clients
2. Operation of a trading platform for crypto-assets
3. Exchange of crypto-assets for funds (fiat on/off ramp)
4. Exchange of crypto-assets for other crypto-assets
5. Execution of orders for crypto-assets on behalf of clients
6. Placing of crypto-assets (marketing on behalf of an offeror)
7. Reception and transmission of orders for crypto-assets
8. Providing advice on crypto-assets
9. Providing portfolio management on crypto-assets
10. Providing transfer services for crypto-assets on behalf of clients

Most CASPs will apply for authorization covering multiple services. A typical exchange, for example, would need authorization for custody (service 1), operating a trading platform (service 2), exchange for funds (service 3), exchange for other crypto-assets (service 4), and execution of orders (service 5). Your capital requirement is determined by the highest-threshold service in your application.

---

What are the capital requirements by service type?

MiCA Article 67 and Annex IV establish three capital tiers. CASPs must maintain permanent minimum own funds at all times, composed of Common Equity Tier 1 items as defined in Regulation (EU) No 575/2013.

What counts as own funds

Own funds must consist of Common Equity Tier 1 (CET1) instruments as defined in Articles 26-30 of Regulation (EU) No 575/2013 (the Capital Requirements Regulation). In practice, this means:

• Paid-up share capital -- actual equity injected into the company
• Retained earnings -- verified by auditors
• Share premium accounts
• Deductions apply per Article 36 of Regulation 575/2013 (goodwill, deferred tax assets, etc.)

Client funds held in custody, crypto-asset reserves, and subordinated debt do not count toward own funds. These are separate safeguarding requirements under Article 70.

---

What are the MiCA governance requirements?

MiCA Articles 68-69 set out governance obligations. NCAs assess governance during the application process and monitor it on an ongoing basis. This is not a checkbox exercise -- NCAs have rejected applications on governance grounds.

Fit-and-proper test for management

Article 68 requires that members of the management body are of sufficiently good repute and possess appropriate knowledge, skills, and experience to perform their duties. The NCA assesses this individually for each director and senior manager. In practice:

• No criminal convictions related to money laundering, terrorist financing, fraud, or financial crimes
• No regulatory sanctions or disqualifications from previous roles in financial services
• Relevant professional experience -- at least one board member must demonstrate expertise in crypto-assets or financial technology
• Ongoing obligation -- the fit-and-proper assessment is not a one-time check. CASPs must notify the NCA of any changes to the management body and any events that could affect a member's suitability

Money Laundering Reporting Officer (MLRO)

CASPs must appoint a dedicated MLRO responsible for AML/CFT compliance. This is a named individual, not a department or an outsourced function. The MLRO must:

• Have direct access to the management body
• Be authorized to report suspicious transactions to the national Financial Intelligence Unit (FIU)
• Oversee AML/CFT training for all relevant staff
• Conduct ongoing monitoring of business relationships and transactions

Some NCAs -- including CySEC -- require the MLRO to be locally resident. Confirm this with your specific NCA before submitting your application.

Compliance function

Article 68(9) requires CASPs to establish and maintain a permanent and effective compliance function. The compliance function must be independent from the business lines it monitors. For smaller CASPs, the compliance officer and MLRO roles can overlap, but both functions must be formally documented.

Internal audit

CASPs must have an internal audit function that is separate from the compliance function. The internal audit function reviews the adequacy and effectiveness of internal controls, risk management, and governance arrangements. Smaller CASPs may outsource internal audit to a third party, but the management body retains ultimate responsibility.

Conflicts of interest policy

Article 72 requires CASPs to maintain, operate, and publish a conflicts of interest policy. This must identify conflicts arising from the CASP's activities and set out procedures to prevent, manage, and disclose them. Particular attention is required when the CASP operates a trading platform and also provides execution or custody services.

---

What is the MiCA application process and timeline?

MiCA Articles 62-63 govern the CASP authorization process. You submit your application to the National Competent Authority (NCA) of the EU member state where your registered office is located. There is no option to apply to a different member state's NCA without establishing a legal entity there.

Step 1: Choose your NCA

Your NCA is determined by where you incorporate. Common choices include:

• CySEC (Cyprus Securities and Exchange Commission) -- Cyprus
• BaFin (Federal Financial Supervisory Authority) -- Germany
• AMF (Autorité des marchés financiers) -- France
• AFM (Authority for the Financial Markets) -- Netherlands
• MFSA (Malta Financial Services Authority) -- Malta
• Bank of Lithuania -- Lithuania
• CNMV (Comisión Nacional del Mercado de Valores) -- Spain
• FMA (Finanzmarktaufsicht) -- Austria

Once authorized, your license passports across all 27 EU/EEA member states. You do not need separate authorization in each country -- you notify your home NCA, which informs the host NCA.

Step 2: Prepare your application package

Article 62 specifies the documentation required. The exact forms vary by NCA, but every application must include:

1. Business plan -- services to be provided, target markets, projected volumes, revenue model
2. Governance arrangements -- organizational chart, board composition, reporting lines, fit-and-proper documentation for each director and senior manager
3. Proof of capital -- audited evidence of own funds meeting Article 67 thresholds
4. AML/CFT policies -- customer due diligence procedures, transaction monitoring, MLRO designation, risk assessment
5. Operational resilience -- ICT security policies, business continuity plan, disaster recovery procedures
6. Complaints handling procedure -- documented process for client complaints
7. Outsourcing arrangements -- details and contracts for any outsourced functions (custody, compliance, IT)
8. Conflicts of interest policy -- per Article 72
9. Safeguarding arrangements -- how client funds and crypto-assets are segregated and protected
10. Insurance or comparable guarantee -- where applicable under Article 67(6)

Step 3: Completeness check and assessment

Once submitted, the application follows a statutory timeline defined in Article 63:

• Completeness check: 25 working days. The NCA reviews whether all required documents have been submitted. If anything is missing, the clock stops until you provide it.
• Substantive assessment: 40 business days. The NCA evaluates the quality and adequacy of your application. This can be extended by up to 20 business days for complex applications.
• Decision: within 5 months of receiving a complete application (statutory maximum).

In practice, from initial submission to final authorization, expect 3 to 6 months for a well-prepared application. Poorly prepared applications can take 9 to 12 months due to multiple rounds of NCA questions and resubmissions.

Step 4: ESMA notification

After granting authorization, the NCA notifies ESMA, which maintains the public register of authorized CASPs. Your authorization is valid from the date of the NCA's decision, and passporting rights begin once the notification process is complete.

---

What are the ongoing obligations after authorization?

Authorization is not the end of the process. MiCA imposes continuous obligations that NCAs monitor through regular reporting, inspections, and supervisory engagement.

• Prudential reporting -- annual verification that own funds still meet the higher-of test (Article 67). If your fixed overheads grow, your capital requirement grows with them.
• Client asset safeguarding -- ongoing segregation and protection of client crypto-assets and funds (Article 70). Annual audit of safeguarding arrangements.
• Complaints register -- maintain a register of all client complaints, their resolution, and response times (Article 71).
• Transaction reporting -- NCAs may require periodic reporting on volumes, counterparties, and suspicious activity.
• Material changes notification -- any change to the management body, shareholders with qualifying holdings, or services provided must be notified to the NCA in advance.
• AML/CFT compliance -- ongoing monitoring, periodic risk assessments, and restrictive-measures screening aligned with EBA Guidelines, transfer-of-funds obligations, and your NCA's circulars.
• ICT incident reporting -- major ICT-related incidents must be reported to the NCA per the Digital Operational Resilience Act (DORA), which applies to MiCA-authorized CASPs from January 2025.

---

Which EU jurisdiction should you apply in?

All MiCA authorizations carry the same legal weight and passport across the EU. But processing times, costs, local requirements, and regulatory culture differ significantly between NCAs. Here is a practical comparison of five popular jurisdictions for CASP licensing.

A few practical notes on jurisdiction selection:

• Cyprus has direct experience with pre-MiCA CASP regulation and a well-documented application process. CySEC's supervisory approach is structured and the compliance talent pool in Limassol is deep. English is widely used in applications.
• Malta was the first EU state to regulate crypto (VFA Act, 2018). The MFSA has institutional knowledge, but application queues can be longer due to high demand.
• Lithuania offers the best combination of speed, cost efficiency, and English-language capability. The Bank of Lithuania processes applications efficiently and compliance staff costs are 30-40% lower than in Amsterdam or Berlin.
• Netherlands has a strong reputational signal and a mature crypto ecosystem, but its transitional period ended in mid-2025, earlier than the EU maximum. New applicants face a thorough process.
• Germany offers the strongest reputational signal in the EU, but BaFin is the slowest processor, requires applications primarily in German, and demands full local establishment.

---

What is the estimated total cost of MiCA authorization?

The minimum capital requirement is not your only cost. Budget for the full picture:

Total first-year cost estimate: EUR 200,000 to EUR 700,000+, depending on service scope, jurisdiction, and whether you build compliance infrastructure in-house or outsource it. The capital requirement is often the smallest line item.

---

Frequently asked questions

How much capital do I need for a MiCA CASP license?

MiCA requires permanent minimum capital of EUR 50,000 for advisory, portfolio management, and execution services; EUR 125,000 for custody and exchange services; and EUR 150,000 for operating a trading platform. The highest applicable tier applies if you offer multiple service types. You must also hold at least one quarter of prior-year fixed overheads if that amount exceeds the minimum threshold (MiCA Article 67, Annex IV).

How long does the MiCA CASP application process take?

Once your NCA confirms the application is complete, the statutory assessment period is 25 working days for completeness review plus up to 40 business days for the substantive assessment, extendable by 20 days. In practice, total processing from first submission to authorization typically takes 3-6 months, depending on jurisdiction and application quality.

Can I passport a MiCA CASP license to other EU countries?

Yes. A MiCA authorization granted by any EU member state NCA allows you to provide crypto-asset services across all 27 EU/EEA member states through passporting. You notify your home NCA, which then informs the host member state NCA. No separate authorization is needed in each country.

What happened to the MiCA grandfathering period for existing CASPs?

The maximum MiCA transitional period ended on 1 July 2026. As of 10 July 2026, an EU CASP without MiCA authorization should not operate business-as-usual: ESMA expects no new EU client onboarding, no new accounts, no marketing or solicitation, and services limited to actions needed for orderly exit, asset transfer, reallocation, or closing positions. CySEC's 27 February 2026 application deadline is now historical.

Which NCA jurisdiction should I choose for my MiCA CASP license?

The choice depends on your business model, operational presence, and language capabilities. Cyprus (CySEC) and Lithuania (Bank of Lithuania) are popular for processing speed and cost efficiency. Malta (MFSA) has deep crypto regulatory experience. The Netherlands (AFM) and Germany (BaFin) offer strong reputational signaling but longer processing times and higher costs. All MiCA licenses passport across the EU regardless of home jurisdiction.

---

Bottom line

Getting a MiCA CASP license is not a form-filling exercise. It is a comprehensive regulatory assessment of your capital adequacy, governance structure, operational resilience, and compliance infrastructure. The capital thresholds (EUR 50K-150K) are the easy part. The governance, AML/CFT, and ICT requirements are where most applications succeed or fail.

Start with the right jurisdiction for your business. Build governance before you apply -- it takes months to recruit a qualified board and MLRO. Budget for the real cost, which is multiples of the minimum capital. And do not rely on grandfathering as a cushion: the maximum transition ended on 1 July 2026, and unauthorized CASPs should now be in orderly exit mode unless and until authorized.

If your CASP handles custody, exchange, or transfer services, your compliance infrastructure needs to include restrictive-measures screening and alignment with EBA guidelines on restrictive measures from day one. These are not post-authorization nice-to-haves -- they are conditions of authorization.