Crypto License in Czech Republic: 2026 MiCA CASP Guide

MiCA Title V governs CASP authorisation, governance, custody segregation, and conflict-of-interest management. Market abuse rules are addressed separately in Title VI. Under MiCA, a Czech-issued licence passports into all other EU Member States and EEA countries via the Article 65 notification procedure, without duplicate national authorisations. See the consolidated text on EUR-Lex and technical standards on the ESMA MiCA hub. See our MiCA licensing guide for the full framework.

Act No. 31/2025 Coll. entered into force in February 2025 and operationalises MiCA domestically. It designates the ČNB as the Article 93 competent authority, sets the administrative procedure for CASP applications, defines supervisory powers, and fixes sanctions for breaches. Full text: Zákony pro lidi.

The ČNB reviews CASP applications, assesses fit-and-proper of management and qualifying shareholders, and runs prudential supervision. Decisions follow the MiCA Article 63 timeline: a 25-working-day completeness check followed by a substantive assessment period of up to 40 working days (extendable in complex cases). AML supervision falls to the FAÚ under Act No. 253/2008 Coll., including Travel Rule enforcement under Regulation (EU) 2023/1113.

Class 1 covers firms whose services do not involve holding client crypto or fiat: execution of orders on behalf of clients, reception and transmission of orders, placing of crypto-assets, transfer services, advice on crypto-assets, and portfolio management. Because no client property is at risk, ČNB applies a lighter operational-risk regime. Typical applicants: advisory boutiques, execution-only brokers, signal providers, and introducing brokers routing flow to a separately licensed venue.

Class 2 adds three services to the Class 1 scope: custody and administration of crypto-assets, exchange of crypto-assets for funds, and exchange of crypto-assets for other crypto-assets. Any firm that holds client crypto or processes fiat-to-crypto conversions needs Class 2 at minimum. ČNB will expect segregated wallets, documented key-management, and a tested BCP. Typical applicants: custodial wallet providers, OTC desks, and fiat gateways into the EU.

Class 3 is mandatory if you operate a trading platform for crypto-assets. The €150,000 capital floor covers the highest tier, but scope is not automatic — the CASP must be separately authorised for each service it intends to provide (e.g., a trading-platform operator that also offers custody must include custody in its application). Expect ČNB to scrutinise market-abuse surveillance, matching-engine resilience, pre- and post-trade transparency, and conflicts-of-interest controls. Typical applicants: centralised crypto exchanges and order-book trading platforms.

Two questions decide it. Will you ever hold client crypto or process fiat-to-crypto or crypto-to-crypto exchange? If no, Class 1 is sufficient — this includes execution-only brokers that route orders without touching client assets. If yes, you need Class 2. Will you run an order book matching third-party buyers and sellers? Then you need Class 3. Stress-test your 18-month roadmap: if you plan to launch a matching engine next year, authorise as Class 3 from the outset rather than reopening the file with ČNB mid-growth.

Note: under MiCA Article 67(1), ongoing own-funds requirements are the higher of (a) the Annex IV class minimum or (b) one quarter of the previous year’s fixed overheads. For established firms, the ¼ overhead floor often exceeds the class minimum — factor this into your capital planning from the start.

The class minimum (see table above) must be evidenced at the time of application — typically via a bank statement showing deposited funds, though MiCA Article 67 also permits an insurance policy or comparable guarantee as an alternative. The bank account does not have to be Czech; ČNB requires proof that the funds are deposited and available (ČNB Position RS2025‑24). On an ongoing basis, you must hold own funds equal to the higher of the class minimum or one quarter of the previous year’s fixed overheads (as calculated under MiCA Article 67(2)), documented in a capital adequacy memorandum.

The ČNB does not accept letterbox structures. Applicants must maintain a genuine physical office in the Czech Republic — virtual offices and mail-forwarding addresses are not accepted — and provide evidence of a real office, typically a signed lease and other supporting documentation. Under MiCA Article 59, at least one executive director must be resident in the EU; ČNB strongly prefers a Czech‑resident director to ensure the place of effective management is genuinely in the Czech Republic, but EU‑resident directors based in another Member State can satisfy the requirement if substance is otherwise demonstrated. The Money Laundering Reporting Officer (MLRO) must be registered with the FAÚ as the designated contact person under §22 of Act 253/2008. Note that all FAÚ communications are conducted in Czech, so the compliance team must include Czech‑language capability.

Every shareholder above 10 percent, every ultimate beneficial owner, and every member of the management body undergoes a fit‑and‑proper assessment per MiCA Article 84 and the Joint EBA/ESMA Suitability Guidelines. Each individual submits a CV, evidence of qualifications, professional references, a personal questionnaire, and a criminal record certificate from each country of recent residence (the exact time window is determined by the ČNB on a case‑by‑case basis). Certificates must be less than 3 months old at submission, apostilled, and translated into Czech by a court‑sworn translator. The ČNB also screens for adverse media, sanctions hits, and prior regulatory refusals across the EU.

The application file must include a complete, internally consistent policy suite tailored to the services requested — generic templates are routinely identified and challenged during the substantive assessment. Mandatory documents include:

• Programme of Operations — 3‑year business plan with financial projections, client segments, and volumes
• Business Continuity Plan (BCP) and Disaster Recovery Plan with RTO and RPO targets
• Capital adequacy memorandum — prudential safeguards calculation under MiCA Article 67
• AML/CFT manual, KYC procedures, and KYT (transaction monitoring) rules calibrated to crypto typologies
• Custody and safeguarding policy with client‑asset segregation and key‑management procedures
• Travel Rule policy compliant with the EU Transfer of Funds Regulation
• ICT and cybersecurity policy aligned with DORA
• Outsourcing policy with a register of critical providers
• Conflicts of interest, complaints handling, and marketing communications policies

The entire CASP application is filed with the ČNB as the sole competent authority under §9 of Act 31/2025 and MiCA Article 93. There is no separate parallel submission to the FAÚ; however, the ČNB may consult the FAÚ internally during the assessment process under MiCA Article 63(7). Separately, once authorised, the MLRO must register with the FAÚ as the designated contact person under §22 of Act 253/2008. See the Financial Analytical Office website for current AML reporting guidance.

Czech CASPs must comply with Regulation (EU) 2023/1113 — the EU Travel Rule for crypto transfers — with no de minimis threshold. Every outgoing and incoming transfer must carry verified originator and beneficiary information, and your monitoring system must screen counterparties against sanctions lists in real time.

• Travel Rule data — collect and transmit full originator and beneficiary information for all crypto transfers, including self-hosted wallet verification.
• Transaction monitoring — run continuous monitoring with risk-based scenarios calibrated to Czech FAU typologies.
• STR filing — file suspicious transaction reports to the FAU without delay.

DORA (Regulation EU 2022/2554) applies directly to CASPs as classified financial entities, imposing comprehensive operational resilience requirements alongside MiCA. Under DORA Article 6, you must review your ICT risk management framework at least annually, and the ČNB conducts ongoing supervisory monitoring and periodic inspections across the full technology stack.

• ICT risk framework — maintain a documented framework covering identification, protection, detection, response, and recovery.
• Business continuity testing — test BCP and disaster recovery plans at least annually, including hot-wallet failover scenarios.
• Incident reporting — report major ICT-related incidents to the ČNB within DORA timelines and maintain a register of third-party ICT providers.

Under MiCA Article 75, CASPs custodying client crypto-assets must segregate them from proprietary holdings and ensure clients retain full ownership rights even in insolvency. The ČNB treats safeguarding breaches as a top enforcement priority.

• Segregated wallets — hold client crypto-assets in segregated wallets, with cryptographic and accounting separation from house funds.
• Position register — update the register of positions without undue delay and provide clients a statement of position at least quarterly and on request.
• Custody policy — document custody arrangements, key management, and sub-custodian due diligence in a board-approved policy.

Licensed CASPs submit periodic prudential, conduct, and AML reports to the ČNB. Czech accounting law also triggers a statutory audit once your firm crosses defined thresholds, so finance teams should monitor growth carefully.

• Periodic reports — submit prudential, conduct, and AML reports to the ČNB through the SDAT system, plus annual financial statements under Czech accounting law.
• Statutory audit — commission an audit when the firm exceeds two of three size criteria in two consecutive periods: turnover ≥ CZK 240m, assets ≥ CZK 120m, or ≥50 full-time employees (new thresholds effective 1 January 2026).
• AML risk refresh — refresh AML risk assessments annually and whenever products, jurisdictions, or delivery channels change materially.

Czech-resident CASPs pay corporate income tax at a flat rate of 21 % on worldwide profits, calculated as the difference between taxable revenues and deductible expenses in accordance with Czech accounting standards. Trading fees, custody charges, staking commissions, and any other revenue streams derived from MiCA-authorised services all fall within the corporate tax base. Deductible costs include staff salaries, office rent, technology infrastructure, AML/CFT compliance tooling, audit fees, and the annual ČNB supervisory levy. Losses may be carried forward for up to five tax years and offset against future profits, which is useful during the capital-intensive launch phase. CASPs structured as an s.r.o. (the standard Czech limited-liability company) file an annual corporate tax return by the first day of the fourth month following the fiscal year-end — or the first day of the seventh month if the return is prepared by a registered tax adviser — and make quarterly or half-yearly advance payments once their prior-year liability exceeds CZK 150,000. Transfer-pricing rules apply to intercompany transactions with related parties abroad, so groups that route liquidity or technology fees through a Czech CASP entity need arm’s-length documentation from the outset.

The VAT position of crypto-asset services in the Czech Republic follows the landmark CJEU Case C-264/14 Hedqvist ruling, which held that the exchange of fiat currency for Bitcoin (and by extension other crypto assets) constitutes a supply of services exempt from VAT under Article 135(1)(e) of the VAT Directive. The Czech tax authority (Finanční správa) has adopted this interpretation: pure crypto-to-fiat and crypto-to-crypto exchange transactions are VAT-exempt without the right to deduct input VAT on related costs. Custody fees, advisory services, and portfolio-management charges, however, are standard taxable supplies subject to the 21 % Czech VAT rate because they do not qualify as transactions in currency, bank notes, or coins used as legal tender. CASPs that provide a mix of exempt exchange services and taxable ancillary services must apply a pro-rata input-VAT deduction method, splitting deductible VAT between the two streams based on revenue proportions. Getting this apportionment wrong is one of the most common post-authorisation compliance failures — the Czech tax authority has been issuing sector-specific guidance since late 2025, and Fintech Simple recommends engaging a Czech VAT specialist before the first filing period closes.

Every Czech CASP with local employees — and MiCA substance rules virtually guarantee you will have at least a director and an MLRO on the Czech payroll — must withhold and remit personal income tax at the flat 15 % rate (or 23 % on annual income exceeding CZK 1,935,552, roughly €78,000) plus mandatory social-security and health-insurance contributions that together add approximately 33.8 % on top of the gross salary for the employer and 11 % for the employee. For senior hires such as compliance officers or CTOs recruited from abroad, the Czech Republic offers a favourable “key employee” regime under the Employee Card or Blue Card framework, but the payroll obligations remain the same once the individual is Czech tax-resident. Stock-option or token-based compensation plans — common in the crypto sector — trigger a taxable benefit at the point of exercise or vesting, valued at fair market price on that date, and both income tax and social contributions apply. CASPs should factor these costs into their financial projections submitted to the ČNB, because the regulator reviews projected operating budgets during authorisation and expects them to reflect realistic Czech payroll levels, not offshore contractor rates. Fintech Simple’s Prague team typically models a three-year payroll forecast as part of the application dossier to pre-empt RFI queries on staffing costs.

1. Insufficient own funds or capital documentation. Applicants deposit the minimum €50k–€150k but fail to prove the funds are unencumbered, or submit bank statements that are outdated by the time the ČNB reviews them. How to avoid: obtain a fresh bank confirmation letter dated within 5 business days of filing, and ensure the capital account is free of pledges, liens, or pending outflows.
2. No genuine local substance. A virtual office address and a non-resident director on paper will not pass. The ČNB verifies that the Czech entity has real decision-making capacity — a physical office, at least one EU-resident director, and a locally reachable MLRO. How to avoid: secure a staffed office in Prague or Brno before filing, appoint an EU-resident statutory director, and designate an MLRO who can demonstrate Czech AML/CFT knowledge.
3. Weak or generic AML/CFT policies. Recycled compliance templates that reference FATF guidelines without mapping them to Czech Act No. 253/2008 Coll. and MiCA’s specific requirements are flagged immediately. How to avoid: draft a bespoke AML programme that references Czech legislation, names the FAÚ as the FIU, defines CDD thresholds in line with local rules, and includes a Travel Rule procedure under Regulation (EU) 2023/1113.
4. Fit-and-proper failures among shareholders or directors. Criminal-record gaps, undisclosed beneficial owners, or directors with adverse regulatory history trigger RFI rounds that can stall an application for months. How to avoid: run pre-filing due diligence on every UBO, shareholder, and board member; disclose all regulatory sanctions proactively; and prepare CVs that demonstrate relevant financial-services experience per Joint EBA/ESMA Guidelines.
5. Incomplete ICT and operational-resilience documentation. MiCA and DORA require applicants to demonstrate IT governance, incident-response procedures, and business-continuity planning. Many first-time filers omit these entirely. How to avoid: include an ICT governance framework, a penetration-testing schedule, a disaster-recovery plan, and an outsourcing register for any critical IT functions before submission.
6. Mismatch between requested CASP class and actual business model. Applying for Class 1 while the whitepaper or pitch deck describes exchange, custody, and transfer services tells the ČNB the applicant does not understand the regime. How to avoid: map every planned crypto-asset service to MiCA Annex IV, confirm the correct class (1, 2, or 3), and ensure capital, policies, and staffing all align with that class from day one.