MiCA License: Cost, Timeline & Step-by-Step CASP Application Process

MiCA categorizes crypto-assets into three distinct classes — E-Money Tokens (EMTs), Asset-Referenced Tokens (ARTs), and Other Crypto-Assets (utility tokens) — each subject to its own regulatory regime under Titles II–IV. For a detailed breakdown of issuer requirements, capital thresholds, and whitepaper obligations for each class, see Issuing Crypto-Assets Under MiCA below.

MiCA's provisions came into force in stages:

MiCA defines ten categories of crypto-asset services. They are grouped below by capital tier to help you quickly identify your requirements:

Class 1 Services (€50,000 minimum capital)

• Providing advice on crypto-assets — offering personalized recommendations to a client regarding transactions in crypto-assets.
• Reception and transmission of orders — receiving an order from a client and transmitting it to a third party for execution.
• Execution of orders on behalf of clients — concluding agreements to buy or sell crypto-assets on behalf of clients.
• Placing of crypto-assets — marketing newly issued crypto-assets to specified purchasers, on behalf of the issuer or offeror.
• Transfer services for crypto-assets — transferring crypto-assets from one address or account to another on behalf of a person.
• Portfolio management of crypto-assets — managing portfolios on a discretionary, client-by-client basis.

Class 2 Services (€125,000 minimum capital)

• Custody and administration of crypto-assets — safekeeping or controlling clients' crypto-assets or means of access to them (e.g., private keys).
• Exchange of crypto-assets for funds (fiat) — concluding purchase or sale contracts of crypto-assets against fiat currency.
• Exchange of crypto-assets for other crypto-assets — concluding purchase or sale contracts of crypto-assets against other crypto-assets.

Class 3 Services (€150,000 minimum capital)

• Operation of a trading platform for crypto-assets — managing a multilateral system that brings together buying and selling interests in crypto-assets.

MiCA does not apply to every activity involving crypto-assets. The regulation carves out several categories:

• Truly decentralized protocols — where there is no identifiable service provider or intermediary. In practice, regulators scrutinize whether a truly decentralized structure exists — many projects with a foundation, core team, or concentrated governance token voting may still fall within scope.
• Non-fungible tokens (NFTs) — unique and non-fungible crypto-assets. However, if an NFT exhibits fungible characteristics — such as fractionalization, revenue-sharing, or large-scale series issuance — it may fall under MiCA or MiFID II. The classification depends on the specific design.
• Financial instruments under MiFID II — crypto-assets that qualify as transferable securities or derivatives continue to be regulated under existing EU financial services legislation.
• Intra-group services — crypto-asset services provided exclusively within a group of companies, with no third-party clients.
• Central banks and certain public entities — the ECB, EU Member State central banks, and certain public international organizations are excluded.

Exemptions are fact-specific and depend on your exact business structure. If you're unsure whether your project falls within scope, we can help you assess your status.

Especially critical for advisory CASPs and portfolio managers, where the NCA scrutinizes individual competence most closely.

Key rule: at least one senior director must be resident in the EU Member State of authorization. The management body must collectively demonstrate competence in compliance, risk management, IT security, and financial operations. Each member undergoes a fit-and-proper assessment covering good repute, professional experience, and absence of conflicts of interest.

In our experience, fit-and-proper checks take 4–8 weeks per person. NCAs frequently request additional documentation on directors’ professional history — having complete CVs and criminal record certificates ready from the start prevents delays.

Required for all CASPs without exception — this is the area where generic, copy-pasted policies are rejected most often.

Key rule: the compliance function must be independent and report directly to the management body. Your AML/CFT program must include comprehensive KYC procedures, ongoing transaction monitoring, sanctions screening, and SAR filing — all tailored to your specific business model and risk profile. NCAs will reject template policies that do not reflect your actual service type and client base.

CASPs must also conduct regular risk assessments and maintain staff training programs. The MLRO (Money Laundering Reporting Officer) must have direct NCA access and operational independence.

Particularly important for exchanges and trading platforms that handle high transaction volumes and manage private keys.

Key rule: a Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) are mandatory. Beyond that, NCAs expect documented ICT risk management policies, vulnerability assessments, independent penetration testing, encryption standards, and secure key management procedures. Generic security documents will not pass — the framework must reflect your actual technical architecture.

CASPs also fall under the Digital Operational Resilience Act (DORA), the EU’s dedicated ICT risk regulation for financial entities. DORA imposes additional requirements for ICT third-party risk management and periodic resilience testing that go beyond MiCA’s own provisions.

Critical for CASPs providing custody, exchange, or any service where client crypto-assets or fiat funds are held.

Key rule: strict segregation of client assets from company holdings at all times. This means separate wallets and accounts, daily reconciliation, and a prohibition on using client assets for the CASP’s own trading or operations. Client fiat must be placed with a credit institution by the next business day.

Custody arrangements must be documented in detail: key management procedures, client rights in case of insolvency, and the process for returning assets on demand. NCAs treat safeguarding failures as the most serious compliance breach.

Applies to all CASPs — regulators increasingly enforce this area post-authorization through mystery shopping and ad monitoring.

Key rule: all communications must be fair, clear, and not misleading. Before providing any service, CASPs must disclose fees, commissions, spreads, and risk warnings. Marketing materials must be accurate and specific to the services offered — not generic disclaimers.

Every CASP must maintain a formal complaints handling procedure: free submission for clients, defined response timeframes set by the NCA, escalation paths, and record-keeping. NCAs review complaint logs during supervisory visits.

This is capital you must maintain at all times, not a one-time fee. Your minimum depends on your service tier: €50,000 (Class 1), €125,000 (Class 2), or €150,000 (Class 3). The 25% overhead rule may push your actual requirement higher.

The full documentation package — policies, procedures, business plan, and NCA application materials — typically costs €15,000 to €60,000 depending on the scope and complexity of your services. Our approach uses pre-built, regulator-tested frameworks, which keeps legal costs toward the lower end of this range for most clients.

After authorization, annual compliance costs typically range from €80,000 to €200,000. MLRO salary and office rent are your largest recurring items — plan for these to scale with headcount as your operations grow.

All figures are estimates based on typical market conditions across EU jurisdictions. Actual costs vary depending on the specific country, scope of services, and complexity of your business model.

The single most effective way to accelerate the timeline is to ensure your application package is complete and high-quality before formal submission. Incomplete applications trigger additional completeness check cycles, each adding 2–4 weeks. Working with advisors who have direct experience with your chosen NCA can reduce the overall timeline by 2–3 months compared to a self-guided approach.

Substance refers to the level of real operational presence the NCA expects in the country:

• Moderate — registered office, at least one local director, basic local staff. Lean setups are generally accepted.
• Moderate–High — local director with industry experience, dedicated compliance officer on-site, physical office expected.
• High — multiple local employees, senior management resident in-country, fully operational office, independent compliance and risk functions.
• Very high — full C-suite presence, extensive local headcount, audited operational processes, and deep regulatory engagement expected from day one.

Banking indicates how easy it is for a newly licensed CASP to open a corporate bank account in the jurisdiction:

• Excellent — multiple banks actively service crypto-licensed companies; account opening typically takes 2–4 weeks.
• Good — several banking options available; some banks may require additional due diligence, 4–8 weeks typical.
• Moderate — limited bank appetite for crypto clients; expect longer timelines (2–3 months) and possible rejections before finding a partner bank.

• Constitutional documents and ownership structure, including full UBO (Ultimate Beneficial Owner) disclosure up to the natural person level
• Detailed business plan covering services offered, target markets, three-year financial projections, key risks, and mitigation strategies
• AML/CFT policy and sanctions compliance framework, tailored to your specific business model and risk profile
• KYC and customer onboarding procedures, including customer due diligence (CDD) and enhanced due diligence (EDD) protocols
• Custody and safekeeping policy (if providing custody and administration of crypto-assets on behalf of clients)
• Market abuse prevention policy, covering insider dealing, unlawful disclosure, and market manipulation as defined under MiCA Title VI
• Conflicts of interest policy, documenting identification, prevention, management, and disclosure of conflicts
• Complaints handling procedure with defined timelines, escalation paths, and record-keeping requirements
• Pricing and fee schedule with full client disclosures
• Outsourcing policy and third-party risk assessment, covering all critical functions delegated to external providers
• ICT risk management framework, aligned with MiCA requirements and relevant DORA standards
• Information security policy and penetration test results
• Business continuity and disaster recovery plan (BCP/DRP), including recovery time objectives and testing evidence
• Data protection and GDPR compliance documentation
• Whitepaper (if issuing tokens under MiCA Title II or Title III) — see our policies and procedures development services
• Key personnel CVs and fit-and-proper declarations for all members of the management body
• Financial statements and capital adequacy calculations, demonstrating compliance with Annex IV own funds requirements

MiCA categorizes crypto-assets into three distinct classes, each subject to its own regulatory requirements:

Note: Algorithmic stablecoins without actual reserves may fall outside the ART definition, limiting their ability to be publicly offered in the EU. Always verify classification against the full MiCA text and EBA/ESMA guidance.

ART issuers (stablecoin projects under Title III) face a minimum own-funds floor of €350,000 — more than double the highest CASP tier. This capital must be maintained at all times and is separate from any CASP capital obligations. If your business involves both CASP services and stablecoin issuance, both sets of requirements apply in parallel.

EMT issuers must be authorized as a credit institution or electronic money institution under Directive 2009/110/EC. This means meeting the EMI/bank capital requirements, which are substantially higher than the ART floor. For more details, see our EMI license page.

Utility token issuers do not face a specific capital requirement under MiCA, but must comply with whitepaper publication, marketing, and right-of-withdrawal obligations.

Every crypto-asset issuer offering tokens to the public or seeking admission to a trading platform must publish a crypto-asset whitepaper. The whitepaper must include a detailed description of the project, the rights and obligations attached to the crypto-asset, the underlying technology, and the risks involved.

• ARTs (Title III): Whitepaper must be approved by the NCA before publication. The issuer cannot begin the public offering until approval is granted.
• Utility tokens (Title II): Whitepaper must be notified to the NCA at least 20 working days before publication. No prior approval is required, but the NCA may intervene post-notification.
• EMTs (Title IV): Whitepaper requirements similar to ARTs, with additional disclosures specific to e-money characteristics.

For details on whitepaper content requirements, see MiCA Articles 6, 17, and 51.