European Union · MiCA

At a glance

Choose the route your business actually needs.

MiCA CASP authorisation is granted by the competent authority of the home member state, not by ESMA. Passporting follows the applicable notification process; financial instruments and other excluded products require a separate analysis.

• Choose a home member state based on real management, staff and operational substance—not just incorporation cost.
• Map every CASP service: custody, exchange, trading platform, execution, placing, advice, portfolio management or transfer services can require different permissions.
• Distinguish crypto-assets covered by MiCA from financial instruments. Tokenised securities remain subject to the relevant financial-services framework.
• Asset-referenced tokens and e-money tokens have issuer-specific rules; a CASP authorisation does not authorise token issuance.
• EU passporting is a notification-based process for authorised services, not automatic permission for every product or non-EU market.
• The maximum MiCA grandfathering period ended on 1 July 2026; national deadlines could be earlier. A pending application does not extend the right to operate beyond the applicable deadline.

Permissions & perimeter

Distinct activities. Distinct requirements.

Application evidence

Prepare a coherent submission—not just forms.

The exact checklist depends on the authority, permission and applicant. These workstreams establish a practical preparation baseline; authority-specific forms and evidence take precedence.

1. 01Business plan and activity map: products, customer types, revenue, execution flow and target countries.
2. 02Ownership and control chart, source of funds, beneficial-owner evidence and fit-and-proper files for management.
3. 03Financial projections, capital and liquidity plan, staffing, local presence and outsourcing arrangements.
4. 04AML/CFT risk assessment, customer due diligence, sanctions screening, monitoring and reporting procedures.
5. 05Governance, compliance monitoring, complaints, cybersecurity, business continuity and incident-response policies.
6. 06MiCA service-by-service policies, custody or trading procedures, wind-down plan and DORA ICT risk documentation where applicable.

Assessment to launch

A structured path through the application.

1. 01Classify tokens and services; identify MiCA, payments or investment-services overlaps.
2. 02Select the home member state, competent authority and substantive operating model.
3. 03Prepare CASP governance, safeguards, prudential and technology documentation.
4. 04Respond to the home authority's completeness and substantive assessment.
5. 05After authorisation, complete applicable cross-border notifications and ongoing compliance.

Capital, fees and timing vary by permission and applicant. Incorporation, initial approval or a pending application does not by itself permit regulated operations. Approval remains the regulator's decision.

Beyond the licence

Compliance and risk must work in practice.

Build a permissions register, regulatory calendar and control-testing programme. Assign owners for financial-crime controls, client assets, outsourcing, cyber incidents, complaints and board reporting. Reassess permissions before adding products, jurisdictions or distribution channels.

General advisory guidance, not a legal opinion or a guarantee of eligibility. Confirm current rules and local legal requirements for the proposed business before taking action.