MiCA License: Cost, Timeline & Step-by-Step CASP Application Process

MiCA categorizes crypto-assets into three distinct classes — E-Money Tokens (EMTs), Asset-Referenced Tokens (ARTs), and Other Crypto-Assets (utility tokens) — each subject to its own regulatory regime under Titles II–IV. For a detailed breakdown of issuer requirements, capital thresholds, and whitepaper obligations for each class, see Issuing Crypto-Assets Under MiCA below.

MiCA’s provisions came into force in stages:

MiCA defines ten categories of crypto-asset services. They are grouped below by capital tier to help you quickly identify your requirements:

Class 1 Services (€50,000 minimum capital)

• Providing advice on crypto-assets — offering personalized recommendations to a client regarding transactions in crypto-assets.
• Reception and transmission of orders — receiving an order from a client and transmitting it to a third party for execution.
• Execution of orders on behalf of clients — concluding agreements to buy or sell crypto-assets on behalf of clients.
• Placing of crypto-assets — marketing newly issued crypto-assets to specified purchasers, on behalf of the issuer or offeror.
• Transfer services for crypto-assets — transferring crypto-assets from one address or account to another on behalf of a person.
• Portfolio management of crypto-assets — managing portfolios on a discretionary, client-by-client basis.

Class 2 Services (€125,000 minimum capital)

• Custody and administration of crypto-assets — safekeeping or controlling clients’ crypto-assets or means of access to them (e.g., private keys).
• Exchange of crypto-assets for funds (fiat) — concluding purchase or sale contracts of crypto-assets against fiat currency.
• Exchange of crypto-assets for other crypto-assets — concluding purchase or sale contracts of crypto-assets against other crypto-assets.

Class 3 Services (€150,000 minimum capital)

• Operation of a trading platform for crypto-assets — managing a multilateral system that brings together buying and selling interests in crypto-assets.

MiCA does not apply to every activity involving crypto-assets. The regulation carves out several categories:

• Truly decentralized protocols — where there is no identifiable service provider or intermediary. In practice, regulators scrutinize whether a truly decentralized structure exists — many projects with a foundation, core team, or concentrated governance token voting may still fall within scope.
• Non-fungible tokens (NFTs) — unique and non-fungible crypto-assets. However, if an NFT exhibits fungible characteristics — such as fractionalization, revenue-sharing, or large-scale series issuance — it may fall under MiCA or MiFID II. The classification depends on the specific design.
• Financial instruments under MiFID II — crypto-assets that qualify as transferable securities or derivatives continue to be regulated under existing EU financial services legislation.
• Intra-group services — crypto-asset services provided exclusively within a group of companies, with no third-party clients.
• Central banks and certain public entities — the ECB, EU Member State central banks, and certain public international organizations are excluded.

Exemptions are fact-specific and depend on your exact business structure. If you’re unsure whether your project falls within scope, we can help you assess your status.

The table above shows the absolute floor. On top of it, MiCA requires CASPs to hold own funds equal to at least one quarter (25%) of fixed overhead expenses from the preceding year. Whichever number is higher becomes your actual capital requirement.

Example: Your company runs a crypto exchange (Class 2, €125,000 minimum). Your annual fixed overheads — salaries, rent, IT infrastructure, legal — total €800,000. One quarter of that is €200,000. Because €200,000 > €125,000, your real capital requirement is €200,000.

This is recalculated annually, so growing operational costs mean a growing capital obligation. We help you model realistic first-year budgets so there are no surprises after authorization.

Especially critical for advisory CASPs and portfolio managers, where the NCA scrutinizes individual competence most closely.

Key rule: at least one senior director must be resident in the EU Member State of authorization. The management body must collectively demonstrate competence in compliance, risk management, IT security, and financial operations. Each member undergoes a fit-and-proper assessment covering good repute, professional experience, and absence of conflicts of interest.

In our experience, fit-and-proper checks take 4–8 weeks per person. NCAs frequently request additional documentation on directors’ professional history — having complete CVs and criminal record certificates ready from the start prevents delays.

Required for all CASPs without exception — this is the area where generic, copy-pasted policies are rejected most often.

Key rule: the compliance function must be independent and report directly to the management body. Your AML/CFT program must include comprehensive KYC procedures, ongoing transaction monitoring, sanctions screening, and SAR filing — all tailored to your specific business model and risk profile. NCAs will reject template policies that do not reflect your actual service type and client base.

CASPs must also conduct regular risk assessments and maintain staff training programs. The MLRO (Money Laundering Reporting Officer) must have direct NCA access and operational independence.

Particularly important for exchanges and trading platforms that handle high transaction volumes and manage private keys.

Key rule: a Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) are mandatory. Beyond that, NCAs expect documented ICT risk management policies, vulnerability assessments, independent penetration testing, encryption standards, and secure key management procedures. Generic security documents will not pass — the framework must reflect your actual technical architecture.

CASPs also fall under the Digital Operational Resilience Act (DORA), the EU’s dedicated ICT risk regulation for financial entities. DORA imposes additional requirements for ICT third-party risk management and periodic resilience testing that go beyond MiCA’s own provisions.

Critical for CASPs providing custody, exchange, or any service where client crypto-assets or fiat funds are held.

Key rule: strict segregation of client assets from company holdings at all times. This means separate wallets and accounts, daily reconciliation, and a prohibition on using client assets for the CASP’s own trading or operations. Client fiat must be placed with a credit institution by the next business day.

Custody arrangements must be documented in detail: key management procedures, client rights in case of insolvency, and the process for returning assets on demand. NCAs treat safeguarding failures as the most serious compliance breach.

Applies to all CASPs — regulators increasingly enforce this area post-authorization through mystery shopping and ad monitoring.

Key rule: all communications must be fair, clear, and not misleading. Before providing any service, CASPs must disclose fees, commissions, spreads, and risk warnings. Marketing materials must be accurate and specific to the services offered — not generic disclaimers.

Every CASP must maintain a formal complaints handling procedure: free submission for clients, defined response timeframes set by the NCA, escalation paths, and record-keeping. NCAs review complaint logs during supervisory visits.

This is capital you must maintain at all times, not a one-time fee. Your minimum depends on your service tier: €50,000 (Class 1), €125,000 (Class 2), or €150,000 (Class 3). The 25% overhead rule may push your actual requirement higher.

The full documentation package — policies, procedures, business plan, and NCA application materials — typically costs €15,000 to €60,000 depending on the scope and complexity of your services. Our approach uses pre-built, regulator-tested frameworks, which keeps legal costs toward the lower end of this range for most clients.

After authorization, annual compliance costs typically range from €80,000 to €200,000. MLRO salary and office rent are your largest recurring items — plan for these to scale with headcount as your operations grow.

All figures are estimates based on typical market conditions across EU jurisdictions. Actual costs vary depending on the specific country, scope of services, and complexity of your business model.

The single most effective way to accelerate the timeline is to ensure your application package is complete and high-quality before formal submission. Incomplete applications trigger additional completeness check cycles, each adding 2–4 weeks. Working with advisors who have direct experience with your chosen NCA can reduce the overall timeline by 2–3 months compared to a self-guided approach.

Substance refers to the level of real operational presence the NCA expects in the country:

• Moderate — registered office, at least one local director, basic local staff. Lean setups are generally accepted.
• Moderate–High — local director with industry experience, dedicated compliance officer on-site, physical office expected.
• High — multiple local employees, senior management resident in-country, fully operational office, independent compliance and risk functions.
• Very high — full C-suite presence, extensive local headcount, audited operational processes, and deep regulatory engagement expected from day one.

Banking indicates how easy it is for a newly licensed CASP to open a corporate bank account in the jurisdiction:

• Excellent — multiple banks actively service crypto-licensed companies; account opening typically takes 2–4 weeks.
• Good — several banking options available; some banks may require additional due diligence, 4–8 weeks typical.
• Moderate — limited bank appetite for crypto clients; expect longer timelines (2–3 months) and possible rejections before finding a partner bank.

Germany offers the largest domestic market in the EU and excellent banking access through BaFin supervision. With 45 licensed CASPs — by far the most in the EU — Germany has attracted heavyweights such as Bitpanda, Trade Republic, N26, Commerzbank, and Bullish Europe. However, BaFin is notoriously thorough, timelines can exceed 12 months, and all communications must be in German.

France offers excellent banking access and a mature financial ecosystem. The AMF is a respected regulator, and France’s shorter transitional period signals its commitment to rapid MiCA adoption. With 12 licensed CASPs, France has attracted major players including Circle (the issuer of USDC and EURC) and Société Générale Forge. Best suited for larger companies with the resources to maintain significant local presence.

Cyprus has long been a popular jurisdiction for financial services companies. CySEC accepts English, and the country offers moderate substance requirements and a favorable tax environment. With 8 licensed CASPs under MiCA — including eToro, Revolut, and Trading 212 — Cyprus is proving a popular choice for consumer-facing platforms. A strong choice for companies already familiar with the CySEC regulatory approach.

Austria provides a solid financial infrastructure and good banking access through the FMA. With 7 licensed CASPs, Austria has attracted notable names including Bitpanda, Bybit EU, and KuCoin EU. Particularly well-suited for companies targeting the DACH region (Germany, Austria, Switzerland).

Spain is building its crypto regulatory infrastructure through the CNMV. The country offers moderate substance requirements and connections to Latin America that offer unique strategic advantages.

Luxembourg is the jurisdiction of choice for institutional-grade crypto operations. The CSSF is a highly respected regulator with unmatched banking infrastructure. However, timelines are long and costs are at the upper end of the range.

Lithuania remains the most popular jurisdiction for crypto startups and mid-size companies seeking a MiCA license. The Bank of Lithuania accepts English-language submissions, offers competitive processing times of 3 to 5 months, and the country provides a cost-effective operating environment with a well-established fintech ecosystem. With only 3 licensed CASPs so far under MiCA, Lithuania is still in the early stages of its transition — the country was dominant under the previous VASP regime, and most existing operators are now converting to full MiCA authorization. Learn more about crypto licensing in Lithuania.

Estonia is known for its digital-first governance and was one of the earliest EU countries to establish a crypto licensing framework. Under MiCA, Estonia has not adopted grandfathering provisions, meaning all providers must apply for full CASP authorization. The FSA enforces strict substance requirements, but the jurisdiction’s reputation for digital innovation continues to attract serious crypto businesses. Learn more about crypto licensing in Estonia.

Poland is an increasingly attractive option for MiCA licensing, offering a cost-effective environment and a growing crypto ecosystem. The KNF has been actively preparing for MiCA implementation, and Poland’s large domestic market adds appeal for companies seeking a Central European presence. As of February 2026, no CASPs have been licensed under MiCA in Poland yet — the KNF is still ramping up its authorization process, which may present an opportunity for early movers. Learn more about crypto licensing in Poland.

The Czech Republic offers a straightforward licensing process, reasonable costs, and a central EU location. The Czech National Bank has demonstrated a pragmatic approach to crypto regulation, and Prague has emerged as a significant European tech hub. Like Poland, the Czech Republic has 0 licensed CASPs under MiCA so far — the CNB is still finalizing its authorization procedures. Learn more about crypto licensing in Czech Republic.

• Constitutional documents and ownership structure, including full UBO (Ultimate Beneficial Owner) disclosure up to the natural person level
• Detailed business plan covering services offered, target markets, three-year financial projections, key risks, and mitigation strategies
• AML/CFT policy and sanctions compliance framework, tailored to your specific business model and risk profile
• KYC and customer onboarding procedures, including customer due diligence (CDD) and enhanced due diligence (EDD) protocols
• Custody and safekeeping policy (if providing custody and administration of crypto-assets on behalf of clients)
• Market abuse prevention policy, covering insider dealing, unlawful disclosure, and market manipulation as defined under MiCA Title VI
• Conflicts of interest policy, documenting identification, prevention, management, and disclosure of conflicts
• Complaints handling procedure with defined timelines, escalation paths, and record-keeping requirements
• Pricing and fee schedule with full client disclosures
• Outsourcing policy and third-party risk assessment, covering all critical functions delegated to external providers
• ICT risk management framework, aligned with MiCA requirements and relevant DORA standards
• Information security policy and penetration test results
• Business continuity and disaster recovery plan (BCP/DRP), including recovery time objectives and testing evidence
• Data protection and GDPR compliance documentation
• Whitepaper (if issuing tokens under MiCA Title II or Title III) — see our policies and procedures development services
• Key personnel CVs and fit-and-proper declarations for all members of the management body
• Financial statements and capital adequacy calculations, demonstrating compliance with Annex IV own funds requirements

The number one reason for rejection. Virtual offices, nominee directors with no real involvement, absence of local staff — NCAs flag these immediately. We have seen applications returned within weeks because the registered office was a shared coworking address with no dedicated space, and the sole director visited the country once a quarter. Your entity must demonstrate genuine, day-to-day operational presence in the Member State.

Regulators can tell within minutes whether your IT security documentation reflects your actual architecture or was downloaded from the internet. One common pattern we see: applicants submit a penetration test report from an unrelated system, or list security controls that do not match their cloud infrastructure. NCAs expect company-specific ICT risk policies, independent pen test results for your systems, and alignment with DORA — not a renamed template.

NCAs can immediately identify AML frameworks copied from other jurisdictions or generic templates — the wrong FIU name, references to legislation that does not apply, or risk assessments that describe a business model different from yours. One applicant we helped rescue had submitted a policy referencing Estonian AML law while applying in Lithuania. Your risk assessment must address the specific risks of your service type, and your transaction monitoring rules must be calibrated to your expected volumes and client profile.

Overlap between control functions is a red flag regulators catch quickly. If your compliance officer also serves as CFO, or your risk function reports to the same person who runs the business line, the NCA will push back. The management body must also collectively demonstrate competence across all proposed services — a team of software engineers with no financial services background will not pass the fit-and-proper assessment.

NCAs scrutinize three-year projections specifically for MiCA-related details: how own-funds requirements scale as transaction volumes grow, whether the 25% overhead rule is modeled correctly, and whether revenue projections per crypto-asset service type are defensible. Overly optimistic forecasts, capital buffers that barely meet the minimum, and the absence of stress testing are consistent triggers for additional Q&A rounds — or outright rejection.

Incomplete UBO disclosures, outdated CVs, unsigned policies, or forms with blank fields signal a lack of professionalism and restart the completeness clock. We have seen applications delayed by two months because a single director’s criminal record certificate was from the wrong country. Every document must be complete, current, and properly executed before submission.

Our team has successfully completed over 500 CASP and VASP license approvals across EU jurisdictions. This is not theoretical expertise — it is built on years of real applications, real regulator interactions, and real approvals.

We have developed a comprehensive ecosystem of legal templates and procedures specifically aligned with MiCA requirements. Instead of building from scratch, we adapt our proven frameworks to your business model, reducing preparation time by up to 50%.

We have worked directly with NCAs including the Bank of Lithuania, KNF (Poland), CNB (Czech Republic), FSA (Estonia), and others. We understand how each regulator operates, what they prioritize, and how to structure your application for the fastest possible approval.

From initial jurisdiction analysis through company incorporation, documentation preparation, application filing, regulator Q&A management, and post-approval compliance — we handle the entire process with a single point of contact.

We provide clear, upfront pricing with no hidden fees. We deliver a detailed quote within 48 hours of your initial consultation.

Our team consists of dedicated EU regulatory lawyers who work in-house, ensuring faster turnaround, better quality control, and consistent expertise across every stage of your project.

MiCA categorizes crypto-assets into three distinct classes, each subject to its own regulatory requirements:

Note: Algorithmic stablecoins without actual reserves may fall outside the ART definition, limiting their ability to be publicly offered in the EU. Always verify classification against the full MiCA text and EBA/ESMA guidance.

ART issuers (stablecoin projects under Title III) face a minimum own-funds floor of €350,000 — more than double the highest CASP tier. This capital must be maintained at all times and is separate from any CASP capital obligations. If your business involves both CASP services and stablecoin issuance, both sets of requirements apply in parallel.

EMT issuers must be authorized as a credit institution or electronic money institution under Directive 2009/110/EC. This means meeting the EMI/bank capital requirements, which are substantially higher than the ART floor. For more details, see our EMI license page.

Utility token issuers do not face a specific capital requirement under MiCA, but must comply with whitepaper publication, marketing, and right-of-withdrawal obligations.

Every crypto-asset issuer offering tokens to the public or seeking admission to a trading platform must publish a crypto-asset whitepaper. The whitepaper must include a detailed description of the project, the rights and obligations attached to the crypto-asset, the underlying technology, and the risks involved.

• ARTs (Title III): Whitepaper must be approved by the NCA before publication. The issuer cannot begin the public offering until approval is granted.
• Utility tokens (Title II): Whitepaper must be notified to the NCA at least 20 working days before publication. No prior approval is required, but the NCA may intervene post-notification.
• EMTs (Title IV): Whitepaper requirements similar to ARTs, with additional disclosures specific to e-money characteristics.

For details on whitepaper content requirements, see MiCA Articles 6, 17, and 51.