Imagine running a successful crypto exchange in Berlin, only to realize you need a completely new license to serve customers in Paris. Before 2024, this was the frustrating reality for many European crypto firms. They navigated a patchwork of 27 different national rules, burning cash on duplicate compliance teams and legal fees. Then came MiCA, or the Markets in Crypto-Assets Regulation. This isn't just another bureaucratic hurdle; it’s the first comprehensive framework designed to unify the $1.2 trillion European crypto market. If you’re planning to launch or expand a crypto business in the EU, understanding how to get your CASP (Crypto-Asset Service Provider) license is no longer optional-it’s the key to unlocking the entire single market.
What Exactly Is a CASP License?
Under MiCA, if you provide one or more crypto services professionally, you are likely a CASP. This definition is broad. It covers everything from holding customer keys (custody) to letting them swap Bitcoin for Euros (exchange). The core idea is simple: if you touch client assets or facilitate trades, you need authorization. You can’t just operate as a tech company anymore; you are treated like a financial institution.
The most attractive feature for any entrepreneur here is "passporting." Once you get approved by one National Competent Authority (NCA)-say, the AMF in France-you can legally offer your services across all 27 EU member states without applying for separate licenses in each country. This mechanism alone cuts compliance costs by an estimated 40-60%, according to KPMG analysis. For a startup, that’s the difference between surviving and drowning in legal fees.
Who Needs This License?
You might be wondering if your specific business model falls under this umbrella. Generally, if you do any of the following, you need a CASP license:
- Custody and Administration: Storing crypto on behalf of clients, including managing private keys.
- Trading Platforms: Operating an exchange where users buy and sell crypto.
- Exchange Services: Converting crypto to fiat currency (like EUR or USD) or vice versa.
- Execution of Orders: Placing trades for clients based on their instructions.
- Advice: Giving personalized recommendations on crypto investments.
Decentralized Finance (DeFi) protocols often escape this net because they lack a central legal entity. However, if you have a team behind the scenes making decisions and handling user funds, regulators are increasingly looking to classify you as a CASP. The University of Zurich noted in early 2025 that 68% of DeFi protocols avoid the EU market specifically to dodge these requirements, but that window may be closing as enforcement tightens.
Capital Requirements: How Much Money Do You Need?
Regulators want to ensure you have enough skin in the game. Your minimum capital depends on what services you offer. Here’s the breakdown specified in Article 52 of MiCA:
| Service Type | Minimum Capital (EUR) | Why This Amount? |
|---|---|---|
| Custody & Administration | €125,000 | Lower risk since you don't trade with client funds. |
| Exchange Services | €150,000 | Higher liquidity needs to handle daily swaps. |
| Operating Trading Platform | €730,000 | Significant operational risk and infrastructure costs. |
These aren't just numbers on paper. You must prove these funds are available and segregated from your operating expenses. If you plan to offer multiple services, you generally need the highest applicable amount, not the sum of all. But beware: if you serve over 15 million average annual users, you become a "significant CASP" (sCASP), triggering stricter oversight and potentially higher buffers.
The Application Process: What to Expect
Getting the license takes time. Don’t expect overnight approval. On average, firms spend 9-12 months preparing for full compliance before even submitting their application, according to Deloitte. Once submitted, processing times vary wildly by jurisdiction. Germany’s BaFin is known for efficiency, often clearing applications in six months. In contrast, smaller jurisdictions like Estonia have seen delays stretch to 11 months due to resource constraints.
Your application packet needs to be bulletproof. Key components include:
- Detailed Business Plan: Not just a vision statement. Regulators want realistic revenue projections and risk models.
- Governance Structure: Who is responsible? You need at least one director resident in the EU member state where you apply.
- AML/CFT Procedures: Compliance with the 6th Anti-Money Laundering Directive is non-negotiable.
- Technical Standards: Proof that your IT systems meet NIS2 Directive security standards.
- Environmental Impact Report: Yes, really. You must quantify energy consumption metrics using EU Blockchain Observatory methodologies.
One major pitfall? Underestimating documentation quality. A KPMG survey rated Germany’s guidance documents 4.5/5 for clarity, while Malta’s MFSA scored 2.8/5 for inconsistency. Choosing the right jurisdiction matters as much as the paperwork itself.
Passporting vs. Local Branches
Once you have your license, how do you actually use it? You have two options. First, cross-border services: you stay headquartered in your home country and serve clients elsewhere digitally. Second, establishing branches: you set up physical offices in other countries. Most startups prefer the first option initially to save costs.
Consider Bitstamp’s experience. After securing authorization from the Czech National Bank in February 2025, they expanded to 15 additional EU markets within three weeks without further regulatory hurdles. That’s the power of passporting. Compare that to Kraken, which used France’s AMF authorization to scale across the EU in 30 days. These examples show that once the initial barrier is crossed, expansion becomes rapid.
Ongoing Compliance and Risks
Getting the license is just the start. Ongoing obligations are heavy. You face mandatory quarterly stress tests if you’re a significant CASP. Real-time transaction monitoring systems are now required, costing an average of €1.2 million to implement properly. Plus, you must publish risk warnings for every asset listed, which has annoyed some users-41% of negative reviews on Trustpilot cite these warnings as excessive.
There’s also the threat of regulatory arbitrage. Some firms, frustrated by EU strictness, are eyeing lighter-touch regimes like the UAE’s VARA. A Baker McKenzie study found 23 firms abandoned MiCA pursuits for Dubai. However, for institutional players, MiCA remains the gold standard. J.P. Morgan reported that 78% of traditional finance institutions view MiCA compliance as a prerequisite for entering the crypto market, compared to only 32% for US entry.
Frequently Asked Questions
Can a non-EU company get a CASP license?
Yes, but you must establish a registered office within the EU. You cannot operate solely from outside the bloc. Additionally, you need at least one director who is a resident of the EU member state where you seek authorization. This requirement forces foreign firms to localize their management structure significantly.
How long does the CASP licensing process take?
Preparation typically takes 9-12 months. Processing times by National Competent Authorities vary from 6 months (e.g., Germany's BaFin) to over 11 months (e.g., Estonia). Factors include the complexity of your business model and the regulator's current workload. Always budget extra time for back-and-forth queries during review.
Do I need a license if I only hold my own crypto?
No. MiCA regulates service providers acting on behalf of clients. If you are an individual investor or a corporate treasury holding its own assets, you are not considered a CASP. The regulation targets professional provision of services like custody, trading, or advice to third parties.
What happens if I fail to comply after getting licensed?
NCAs have powers to suspend or revoke licenses. Common triggers include failure to maintain minimum capital, inadequate AML controls, or misleading disclosures. Severe breaches can lead to fines and public bans from operating in the EU single market. Reputation damage is often worse than the financial penalty.
Are stablecoins covered under CASP licensing?
Stablecoin issuers fall under a separate part of MiCA regarding Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs). While related, issuing a stablecoin requires different authorizations than providing trading or custody services. However, many CASPs also issue tokens, so dual compliance is common.
Next Steps for Applicants
If you’re serious about entering the EU market, start by mapping your services against the MiCA definitions. Hire local legal counsel early-they know which NCAs are currently efficient. Budget for high-quality technical audits and environmental reporting tools. And remember, the transitional period ends July 1, 2026. Firms still operating under old national rules will need to switch quickly. Don’t wait until the last minute; the pipeline is already crowded with 217 active applications as of August 2025.
