The European Union has one crypto license. Since 1 July 2026, when the last national transitional regimes under the Markets in Crypto-Assets Regulation (MiCA) expired, a business that provides crypto-asset services to clients in the EU needs authorization as a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. A national VASP registration no longer allows a firm to keep serving clients. The authorization is granted by the regulator of one member state and passported to the others.
On 26 September 2026, ESMA's interim MiCA register listed 359 crypto-asset service providers, a count that includes banks and investment firms that notified under Article 60. Germany accounted for 95 of them, France for 36, the Netherlands for 29 and Malta for 22.
Is There a Single Crypto License in Europe?
Within the EU, yes. MiCA replaced the national VASP registration regimes with one authorization that every member state applies under the same rules. A firm applies to the competent authority of one member state, its home member state. Once authorized, it can offer the same services in the other member states through a notification procedure, without a second license. The regime also extends to the EEA countries that have incorporated it, such as Norway.
Two large European markets sit outside MiCA. Switzerland supervises crypto businesses through FINMA and self-regulatory organizations, and the UK runs its own regime, with the FCA's crypto authorization gateway open until 28 February 2027. A MiCA authorization gives access to neither.
Which Crypto Services Need CASP Authorization
MiCA defines ten crypto-asset services. Providing any of them to clients in the EU requires authorization:
- custody and administration of crypto-assets on behalf of clients;
- operation of a trading platform for crypto-assets;
- exchange of crypto-assets for funds;
- exchange of crypto-assets for other crypto-assets;
- execution of orders for crypto-assets on behalf of clients;
- placing of crypto-assets;
- reception and transmission of orders for crypto-assets on behalf of clients;
- providing advice on crypto-assets;
- providing portfolio management on crypto-assets;
- providing transfer services for crypto-assets on behalf of clients.
Some regulated firms can skip the separate application. Credit institutions, investment firms, e-money institutions, UCITS management companies, alternative investment fund managers, central securities depositories and market operators may provide crypto-asset services that match their existing permissions by notifying their regulator at least 40 working days before they start (Article 60). The services each type of firm can add this way are limited, so the notification route suits a bank or broker extending its offer, not a crypto-native business.
Capital Requirements by Class
MiCA sorts services into three classes, and the minimum permanent capital follows the highest class a firm applies for.
| Class | Services covered | Minimum capital | Typical profile |
|---|---|---|---|
| 1 | Reception and transmission of orders, advice, execution of orders, placing, transfer services, portfolio management | EUR 50,000 | Brokers, advisers, payment-led crypto services |
| 2 | Class 1 services plus custody and administration, exchange for funds, exchange for other crypto-assets | EUR 125,000 | Custodians, retail exchanges without an order book |
| 3 | Class 2 services plus operating a trading platform | EUR 150,000 | Exchanges running an order book |
The prudential requirement is the higher of that permanent minimum and one quarter of the previous year's fixed overheads, reviewed each year (Article 67). A firm can meet it with own funds, an insurance policy, or a combination of the two. The overheads test takes over once fixed overheads pass four times the minimum: EUR 200,000 a year for Class 1, EUR 600,000 for Class 3.
Substance and Governance the Regulator Expects
Article 59 sets three conditions that decide where a CASP can be authorized. The applicant needs a registered office in the member state where it applies and where it carries out at least part of its services, its place of effective management in the EU, and at least one director resident in the EU. A non-EU group can own the applicant, but decisions have to be taken inside the Union, by people who can explain them to the regulator.
The application itself (Article 62) is a full operating file: a program of operations, the governance arrangements and fit-and-proper evidence for every member of the management body and qualifying shareholder, proof of capital, and a policy set covering AML/CFT, ICT risk and business continuity, conflicts of interest, complaints handling, outsourcing and, for custodians, the custody policy. National regulators add their own expectations on local staffing. In Malta, for example, the MFSA expects at least two directors, one of them an executive director resident in Malta, together with a compliance officer, a money laundering reporting officer and a risk management function.
Two other EU regimes apply to a CASP from day one. The Digital Operational Resilience Act (DORA) governs ICT risk management and incident reporting. The Transfer of Funds Regulation requires originator and beneficiary information to travel with every crypto transfer. A third, the EU Anti-Money Laundering Regulation, will replace national AML rules from 10 July 2027; from 2028 the new AML Authority will directly supervise a selected group of high-risk firms active in at least six member states, CASPs included.
How Long MiCA Authorization Takes
MiCA fixes the regulator's side of the timetable in Article 63:
| Step | Statutory deadline |
|---|---|
| Acknowledgment of receipt | Within 5 working days |
| Completeness check | Within 25 working days of receipt |
| Request for missing information after the file is declared complete | Assessment suspended for up to 20 working days |
| Decision to grant or refuse | Within 40 working days of a complete application |
| Notification of the decision | Within 5 working days of the decision |
On paper that adds up to three to four months. The 40-day clock only starts running once the regulator declares the file complete, though, and everything before that date sits with the applicant: incorporating the entity, appointing EU-resident management, opening a bank account for the capital, writing the policy set and answering the regulator's questions. For an authorization in Malta, Equilex plans from six months end to end. Most of that time goes into preparation.
Where Firms Are Getting Authorized
The register shows where listed CASPs are based, as of 26 September 2026:
| Home member state | CASPs in the register |
|---|---|
| Germany | 95 |
| France | 36 |
| Netherlands | 29 |
| Malta | 22 |
| All EU/EEA home states | 359 |
Germany's lead reflects banks and cooperative lenders that added crypto services through the Article 60 notification alongside crypto-native firms, so a high count does not mean a regulator is the fastest route for a start-up exchange. The register has also grown quickly since the transitional deadline: on 26 June 2026 it listed 243 entries. ESMA maintains a separate list of entities reported for providing crypto-asset services without authorization, which held 169 names on 26 September 2026.
Four factors decide the home member state: the regulator's experience with your business model, where you can hire resident directors and a compliance team, the language the authority works in, and the cost of local substance each year.
What May Change: ESMA as the Single Supervisor
On 4 December 2025 the European Commission proposed moving authorization, supervision and enforcement for all CASPs from national regulators to ESMA, as part of its market integration and supervision package. The ECB supported the transfer in its September 2026 response to the Commission's review of MiCA. The proposal is still being negotiated between the Council and the European Parliament, and it would include a transitional regime for firms already authorized and for applications in progress.
None of this changes what a firm files today. Applications go to a national regulator, and the choice of home member state still decides who reviews the file and how long the review takes.
Who Should Not Apply for Its Own CASP Authorization
An authorization of its own is the right answer for a business that serves EU clients at scale and wants to control its regulatory status. Three profiles are better served by another route.
A business whose clients are mostly outside the EU. MiCA brings EU capital, substance, DORA and reporting costs without giving the business any market access it needs. Several non-EU registrations cost less to run and take less time, though Dubai, Singapore and Hong Kong are not among them, and our comparison of the best countries for a crypto license sets out the options. Groups that need both can combine the two, as described in MiCA secondary licensing.
A bank, e-money institution or fintech that wants to offer crypto to its existing customers. A bank or investment firm can use the Article 60 notification; an e-money institution can use it only for custody and transfers of the e-money tokens it issues itself. A firm without that option can work with an authorized partner: Equilex's CASP as a Service connects a business to a partner's MiCA authorization for custody, trading and transfers; launch takes about a month.
A firm that operated under a national registration and missed the transition. There is no grace period left, and continuing to serve EU clients while an application is pending is unauthorized activity. The options for that position are covered in MiCA grandfathering is over.
For businesses that need their own EU authorization, Equilex prepares and files CASP applications in Malta and advises on the choice of home member state. To compare EU and non-EU routes side by side, see our crypto licensing options.
FAQ
Can a non-EU company get a MiCA license?
Yes, through an EU subsidiary. The applicant must have its registered office in the member state where it applies, its place of effective management in the EU and at least one EU-resident director. The parent company can remain outside the EU, and its owners and controllers are assessed as qualifying shareholders.
How much capital does a crypto license in Europe require?
EUR 50,000 for Class 1 services, EUR 125,000 for Class 2 and EUR 150,000 for Class 3, or one quarter of the previous year's fixed overheads if that is higher. Capital is only one part of the budget: local directors, compliance staff, audit, ICT controls under DORA and the application work itself usually cost more over the first year.
Is a national VASP registration still valid in 2026?
No. The transitional periods that let firms registered under national regimes keep operating ended on 1 July 2026 at the latest. A firm that provides crypto-asset services in the EU without MiCA authorization is operating illegally, and national regulators report such firms to ESMA's non-compliant list.
Can a firm outside the EU serve EU clients without authorization?
Only under reverse solicitation (Article 61), where the client approaches the firm exclusively on its own initiative. The exemption does not allow the firm to market new crypto-assets or services to that client, and ESMA's guidelines treat it narrowly. It cannot support a business model built on EU clients.
How long does it take to get a MiCA license?
The regulator has 25 working days to check completeness and 40 working days to decide on a complete file, with a possible suspension of up to 20 working days for further questions. In practice the total depends on preparation. For Malta, Equilex plans from six months from the start of work to authorization.
