MiCA Explained: CASP Licensing, Costs and Timeline for Crypto Firms

If you run a crypto exchange, wallet, broker or payments business with European customers, MiCA decides whether you can keep them. The questions are practical: which of your services need a licence, which country to apply in, how long the regulator can take, what it costs in fees and capital, and what happens now that the grace periods are gone. This guide answers each from the text of MiCA itself, ESMA’s register and the national regulators’ own pages, all checked on 14 October 2026. Consultant and press figures are labelled as such.

What is a MiCA licence?

A MiCA licence is the authorisation a company needs to provide crypto-asset services in the EU. Article 59(1) of MiCA says a person “shall not provide crypto-asset services, within the Union” unless it is an authorised CASP, or a bank, investment firm, e-money institution, fund manager or similar financial entity allowed to offer crypto services under Article 60. There is no separate national crypto licence any more: one MiCA authorisation from a national competent authority (NCA) covers all 27 EU member states plus Iceland, Liechtenstein and Norway once passported.

“MiCA licence” and “CASP licence” mean the same thing in practice. MiCA is the regulation; CASP authorisation is the licence it creates for service providers. Stablecoin issuers need different authorisations under other titles of the same regulation (see below).

MiCA at a glance (as of 14 October 2026)

All figures checked 14 October 2026. This is a summary, not legal advice.

Who needs a CASP licence? The ten MiCA services

You need authorisation if you provide any of the ten “crypto-asset services” defined in MiCA Article 3(1)(16), to clients in the EU:

1. Custody and administration of crypto-assets on behalf of clients
2. Operating a trading platform for crypto-assets
3. Exchanging crypto-assets for funds (crypto to fiat)
4. Exchanging crypto-assets for other crypto-assets
5. Executing orders for crypto-assets on behalf of clients
6. Placing of crypto-assets
7. Receiving and transmitting orders for crypto-assets on behalf of clients
8. Providing advice on crypto-assets
9. Providing portfolio management on crypto-assets
10. Providing transfer services for crypto-assets on behalf of clients

Three practical points follow from the text:

• Substance in the EU is required. Article 59(2) says an authorised CASP must have its registered office in a member state where it carries out at least part of its services, its place of effective management in the EU, and at least one director resident in the EU. A letterbox company with management offshore does not qualify.
• Already-regulated firms can notify instead. Banks, investment firms, e-money institutions, UCITS managers, fund managers, market operators and central securities depositories can offer some crypto services under Article 60 by notifying their regulator, without a separate CASP authorisation. The Central Bank of Ireland describes this as a notification made before first offering the services.
• Reverse solicitation is narrow. Article 61 covers only services a client in the EU initiates “at its own exclusive initiative”. It is not a route to market to EU users.

What is the “MiCA qualification” question?

Before you ask whether you need a licence, you have to know whether your token is a MiCA crypto-asset at all. MiCA covers crypto-assets that are not already regulated as financial instruments or deposits. It splits them into three types: e-money tokens (referencing one official currency), asset-referenced tokens (referencing other values or several currencies), and all other crypto-assets, including utility tokens (MiCA recital 18). A token that is really a security falls under MiFID II instead, and a firm dealing in it needs an investment-firm licence, not a CASP licence. ESMA’s MiCA page lists its final reports on crypto-asset qualification, which help draw that line.

How does the MiCA authorisation process work?

Article 62 lists what goes in the application, and Article 63 sets the regulator’s clock. The application has to cover, among other things, your legal form and articles of association, a programme of operations for the services you plan, proof of prudential safeguards, governance arrangements, the fitness and good repute of the management body, the identity of shareholders with qualifying holdings, internal control and AML/CFT procedures, technical documentation of ICT systems and security, and the procedure for segregating client assets (Article 62(2), items (a) to (q) and beyond).

How long does it take to get a MiCA licence?

The legal maximums, from MiCA Article 63:

Add those up and a clean file takes about 65 working days after submission, or 85 with one pause: roughly four months. That is a legal ceiling for a complete file, not a forecast. Regulators’ own pages are more cautious. The Dutch AFM says a CASP application “will take at least five months” even in a best case, with a statutory maximum of about 105 working days. The Central Bank of Ireland adds stages before the formal clock starts: a meeting with a presentation at least ten working days beforehand, then a Key Facts Document review, then the formal application.

Consultant pages ranking for this keyword quote longer ranges: Decta gives 6 months to 2 years overall, and AdamSmith 6 to 12 months end to end. Treat those as vendor estimates. The real variable is how much the regulator asks you to rework before it accepts the file as complete.

How much does a MiCA licence cost?

Split the budget into three layers: what the regulator charges, what you must hold as capital, and what you spend to become licensable.

Capital requirements by class

Article 67(1) requires prudential safeguards of at least the higher of the Annex IV minimum or one quarter of the previous year’s fixed overheads, reviewed annually. New firms use projected overheads for their first 12 months (Article 67(2)). Annex IV sets three classes:

Source: MiCA Annex IV, read on EUR-Lex 14 October 2026. For a mid-size exchange the overheads test can bite first: EUR 2 million a year of fixed costs means EUR 500,000 of safeguards, well above the class 3 floor.

Official licensing fees: examples from regulators

Checked 14 October 2026. Annual supervisory levies come on top in most countries and were not verified for this article.

The gap between Lithuania and the Netherlands shows why a single “MiCA licence cost” number is misleading. Ranking pages quote ranges such as EUR 5,000 to EUR 25,000 in application fees (Decta), a fixed EUR 19,900 consultancy package (AdamSmith) or EUR 300,000 to EUR 700,000 in first-year costs (ItisPay). None of those is an official figure. The worked minimum for a custody-and-exchange business in Lithuania, using only official numbers, is EUR 2,425 paid to the state plus at least EUR 125,000 held as own funds, before any salary, office, audit or systems cost. The detail for that route is in the Lithuania crypto licence guide.

What drives the real cost

• People in the EU: at least one EU-resident director, plus compliance, AML (MLRO) and risk functions that regulators expect to sit locally.
• Systems: ICT security and DORA readiness, Travel Rule tooling, client asset segregation and record keeping. ESMA has set a JSON schema for order book and record-keeping data (statement of 28 November 2025).
• Capital: held, not spent, but it has to stay above the requirement as losses reduce equity.
• Advisers and rework: the more rounds of questions before the file is “complete”, the higher this line gets.

Passporting: one licence for 30 markets

Under Article 65, a licensed CASP that wants to serve another member state notifies its home regulator of the countries, the services and the start date. The home regulator passes this to the host countries, ESMA and the EBA within 10 working days. You can start in the host country from the date the home regulator confirms it has done so, or at the latest from the 15th calendar day after you submitted the information. The passport covers only the services in your licence, and host countries still apply their own consumer, marketing and tax rules.

This is why the choice of home regulator matters more than the fee. Your home regulator supervises your whole EU business, and its approach to substance and outsourcing shapes your operating model.

Transitional periods: what ended and when

Article 143(3) let firms that served clients under national law before 30 December 2024 continue “until 1 July 2026 or until they are granted or refused an authorisation”, whichever came first. Member states could shorten or skip that period. ESMA’s list of national choices:

Source: ESMA MiCA page, list of grandfathering periods under Article 143(3), checked 14 October 2026. ESMA’s list carries conditions for some states: Bulgaria, Czechia, Denmark and Italy required applications by set dates, and ESMA notes some periods may not have been written into national law when listed. Ireland’s 12 months ended on 29 December 2025 (Central Bank of Ireland).

As of 14 October 2026 every one of these periods has run out. A firm that is not on the register, and is not an Article 60 financial entity, has no legal basis to provide crypto-asset services in the EU. Some member states also offered a simplified procedure under Article 143(6) for firms already authorised nationally on 30 December 2024, but only for applications filed before 1 July 2026.

Which crypto exchanges have a MiCA licence?

ESMA’s interim MiCA register is the official list. Its CASP file, last modified 7 October 2026 and downloaded on 14 October 2026, has 370 entries, 2 of them with a withdrawal date (Decubate B.V. in the Netherlands from 26 March 2026 and Stratos Europe Ltd in Cyprus from 24 April 2026). By home state, Germany leads with 103 active entries, then France (36), the Netherlands (28), Cyprus (24) and Malta (23). Hungary, Poland and Romania have none.

ESMA interim MiCA register, CASPS.csv, file dated 7 October 2026, checked 14 October 2026. ESMA updates the file weekly. Third-party trackers give slightly different totals (CASP Tracker showed 367 on 14 October 2026), and some ranking pages still quote early-2025 counts such as 57. Check the brand’s own entity name against the register, not the brand name alone.

The Binance exit

Binance is the best-known exchange without a MiCA licence. It applied in Greece, and on 16 June 2026 said it understood the Hellenic Capital Market Commission had found its application compliant, while noting a review at ESMA level. It withdrew the Greek application on 24 June 2026 and said it would apply in another member state. By 26 June it had emailed users in France, Italy, Poland and Spain that it could not accept new registrations and would restrict services because it would have no MiCA licence by 1 July, adding that assets “will remain accessible at all times” (CoinDesk, 26 June 2026).

Around 1 October 2026 Cointelegraph, citing the Financial Times, reported that ESMA and regulators in France, Germany and Greece were examining Binance’s use of reverse solicitation to keep serving some EU customers. Binance says it complies with applicable rules. The full record is in the Binance safety review.

Stablecoins under MiCA

A CASP licence does not let you issue a stablecoin. Issuers of asset-referenced tokens (Title III) and e-money tokens (Title IV) need their own authorisation, and those rules have applied since 30 June 2024. ESMA’s register keeps separate files for them. What matters for CASPs is what they may list and transfer: EMT rules also interact with payment law. The Central Bank of Ireland says that under an EBA no-action letter, CASPs transacting EMTs needed a payment institution licence under PSD2, or a partnership with a payment service provider, by 2 March 2026, with “no discretion” to extend. The issuer side, and how the EU compares with the US GENIUS Act, is in the stablecoin regulation guide.

MiCA and the AML rules: TFR and AMLR

MiCA does not replace anti-money-laundering law. Two other EU regulations sit beside it:

• Transfer of Funds Regulation (EU) 2023/1113, applying from 30 December 2024, the same day as MiCA’s CASP rules. Under Article 14 the originator’s CASP must send the originator’s name, distributed ledger address and account number with every crypto transfer: there is no minimum amount. For transfers above EUR 1,000 to or from a self-hosted address, the CASP should verify that the client owns or controls that address (TFR recitals).
• Anti-Money Laundering Regulation (EU) 2024/1624, the single EU AML rulebook, which applies from 10 July 2027 (10 July 2029 for two categories of obliged entity). Until then, national laws implementing the AML directives govern your customer due diligence and reporting.

In practice a MiCA application is also an AML review: Ireland, for example, asks non-VASP applicants for an AML/CFT and financial sanctions pre-authorisation questionnaire. The tooling side (Travel Rule providers, screening, monitoring) is covered in the crypto compliance guide.

EU crypto regulation beyond MiCA

For a European crypto firm, “EU crypto regulation” now means a stack: MiCA for authorisation and conduct, the TFR for the Travel Rule, national AML law until the AMLR applies in July 2027, DORA for ICT resilience, and PSD2 where e-money tokens move like payments. Tax stays national.

Step by step: getting authorised

1. Map your services against the ten in Article 3(1)(16) and pick your class. Custody or exchange means class 2; a trading platform means class 3.
2. Check the Article 60 route if your group already holds a bank, investment firm or e-money licence.
3. Choose a home regulator for its supervisory approach and substance expectations, not only its fee.
4. Build EU substance: registered office, effective management in the EU, an EU-resident director, and local compliance and AML leads.
5. Fund own funds above the higher of the Annex IV floor or a quarter of projected fixed overheads.
6. Prepare the Article 62 file, including ICT documentation, client asset segregation, and AML/CFT and Travel Rule procedures.
7. Engage before filing. Several regulators, including the Central Bank of Ireland and the AFM, offer pre-application meetings or pre-scans.
8. Submit, answer questions, decide. Expect the 25 plus 40 working-day clock to stop for requests.
9. Notify passports under Article 65 for each country you will serve.

Red flags when buying MiCA licensing help

• “Ready-made MiCA licence for sale”. An authorisation is granted to a specific entity after the regulator has assessed its shareholders and management body (Article 62(2)). Buying a company buys its problems, not a clean licence.
• Guaranteed timelines in weeks. The statutory clock alone is up to 65 working days after a complete file, and the AFM says at least five months in practice.
• A single capital figure. MiCA has three classes and an overheads test.
• Old VASP registrations sold as licences. Every grandfathering period has ended; a national VASP registration alone gives no right to serve EU clients.
• Undated register counts. The ESMA file changes weekly; ask for the file date.

What this means for you

If you serve EU clients today without being on ESMA’s register or holding an Article 60 permission, you are operating without a legal basis in every member state, because the last grandfathering period ended on 1 July 2026. If you are planning to enter, the numbers that matter are the class capital or a quarter of your fixed costs, a regulator review of at least four to five months on a complete file, and an operating model with real people in the EU.

The official fee is rarely the biggest line, whether it is EUR 2,425 in Lithuania or up to EUR 100,000 in hourly charges in the Netherlands. Compare EU and non-EU routes in the VASP licence guide, and find compliance providers in the KYC/AML & Compliance section, assessed under the site’s methodology. Month-to-month regulatory changes are tracked in the regulation roundup.