CASP License Adaptation: What the End of the MiCA Transition Means in 2026

The EU’s transitional regime for crypto businesses ended on 1 July 2026. Until then, firms registered as virtual asset service providers (VASPs) under national law could keep operating while their MiCA applications were assessed. That bridge is closed. From 1 July, providing crypto-asset services to EU clients without a CASP authorization is a breach of EU law. A pending application does not change that.

If you ran a crypto business on a national VASP license and did not convert, or if you are entering the EU market now, this is your status check: what adaptation meant, where the register stands, what a full CASP authorization requires, and the options open to firms without one.

Free Consultation for Crypto Licensing

What CASP license adaptation means

CASP license adaptation is the process of moving a firm from a national VASP registration to full authorization under MiCA. CASP (crypto-asset service provider) is the authorization category MiCA creates in Title V of Regulation (EU) 2023/1114, covering services such as custody, exchange, order execution, transfer, portfolio management, and operating a trading platform. VASP (virtual asset service provider) was the label national regimes used before MiCA. The VASP-to-CASP transition was the period in which the two systems coexisted.

The legal mechanism was grandfathering under Article 143(3). A firm lawfully providing crypto-asset services before 30 December 2024 could continue after Title V applied, until the earlier of two dates: 1 July 2026, or the grant or refusal of its CASP application. Member states could shorten the window. None could extend it. ESMA publishes the list of national grandfathering periods.

Adaptation took one of two forms:

• A firm already authorized nationally filed a CASP application and kept serving clients while its national competent authority (NCA) assessed the file. States could also run a simplified procedure for firms authorized nationally on 30 December 2024.
• A firm with no prior registration built the full CASP file from zero.

Both routes faced the same authorization standard in Title V. The difference was continuity, and that continuity is gone. The bridge closed on 1 July 2026. A completed CASP authorization is the only route into the EU market now.

CASP is one of four MiCA authorization categories. Token issuers, e-money tokens, and asset-referenced tokens sit in separate regimes. Our MiCA license breakdown lists them all.

The timeline that just closed

MiCA applied in stages, and the transition ran on national clocks:

Included among the full-window states were France, Malta, Luxembourg, Estonia, Spain, Italy, Cyprus, Bulgaria, Czechia, and Denmark. Germany, Ireland, Austria, and Slovakia ran 12 months. The Netherlands, Latvia, Hungary, Slovenia, and Finland ran 6. Sweden ran 9.

Grandfathering was national. It granted no MiCA passport. A firm serving clients in several member states had to respect the window that ended first in each state, and ESMA told firms operating cross-border to prepare accordingly.

Where the EU market stands now

The gap between the old registers and the new one is wide. As of mid-June 2026, the ESMA interim register listed roughly 204-210 firms with a MiCA CASP license against more than 1,200 firms that had held national VASP registrations. Market reporting in June put the share that had not converted at about 83%. The count moves weekly as authorizations land. By late June the register had grown to roughly 244 as decisions landed around the deadline, and to about 325 by 12 August 2026. Any figure dates from the day it was pulled; check the register for the live number.

“Pending” is not a status. ESMA stated in April 2026 that any entity providing crypto-asset services to EU clients after 1 July without authorization breaches EU law and must cease. Its June statement repeats the point: a pending application is not an authorization, and firms without one must implement an orderly wind-down. Only a granted authorization permits service.

Enforcement has teeth. For CASP breaches, administrative fines under Article 111(3) reach at least €5 million or 5% of total annual turnover, whichever is higher; the €15 million or 15% tier applies to market-abuse infringements. NCAs can order firms to cease activity, and ESMA coordinates action against unauthorized cross-border providers.

For authorized firms, the position is good. One authorization passports across the EEA under Article 65 (the 27 EU member states plus Iceland, Liechtenstein, and Norway), with a notification filed with the home regulator, which forwards it to each host state. The register is still growing: Ripple received full CASP authorization from Luxembourg’s CSSF on 6 July 2026, days after the transition ended. Much of the crypto transaction volume has already consolidated on authorized platforms.

What a real adaptation requires

Grandfathering deferred nothing permanently. The requirements it suspended now apply in full. The authorization is granted on the file, and the file must cover:

• The entity must have a registered office in an EU member state and file a program of operations covering its services, structure, and controls.
• Directors and qualifying shareholders must pass a fit-and-proper assessment by the NCA.
• Governance must cover internal controls, risk management, complaint handling, and conflicts-of-interest management.
• Client crypto-assets and funds must be segregated from the firm’s own assets, with custody arrangements that meet MiCA’s rules.
• AML/CFT obligations come from the EU anti-money-laundering package and the transfers-of-funds regulation (EU) 2023/1113 (the Travel Rule), which applies to crypto-asset transfers where a provider is involved on either side, including transfers to and from self-hosted wallets.
• ICT systems and operational resilience follow DORA, Regulation (EU) 2022/2554, which applies to CASPs.
• Client-facing staff who give information or advice on crypto-assets must meet the knowledge and competence standards in ESMA’s guidelines of 28 January 2026, applicable from 28 July 2026.
• Core services, notably custody, cannot be delegated to entities that are not authorized CASPs; ESMA restated this in June 2026.
• The home NCA receives ongoing prudential and conduct reporting.

Minimum capital depends on the service mix, in the three classes ESMA applies to Article 67(1) and Annex IV:

Ongoing own funds must stay at least at the higher of the initial capital figure or 25% of fixed overheads. Firms that combine crypto services with e-money or payments need an EMI authorization on top; see our breakdown of crypto banking license structures for the full stack.

This is a build, not a submission. NCAs assess the business model, the systems, and the people, and they ask questions on an incomplete file.

I Need a Crypto Market Entry Advice

Jurisdiction strategy: where the conversions happened

Authorization counts cluster where the VASP base sat and where regulators moved fast. The ESMA register, tracked on 12 August 2026, lists about 325 authorized CASPs across 26 EU/EEA jurisdictions:

Germany alone holds more than one in five authorizations, and most of its summer growth came from cooperative banks adding execution services.

Do not treat these as rankings. They are snapshots of one moment, and the register updates weekly.

Some states coupled a long window with a hard application date. Cyprus ran the full 18 months but required existing firms to file by 27 February 2026; firms that did not apply had to prepare wind-down plans (CySEC). Check the rules of your chosen state rather than assuming the transition protected you.

One warning. Some providers market “CASP licenses” in Panama, SVG, and Seychelles. Those are local VASP-style licenses under those states’ own laws, not MiCA authorizations. They grant no EU passport and do not substitute for EU market access.

Missed the deadline? Your 4 options

Your options reduce to four, and none of them is “keep operating”.

1. Wind down in an orderly way

ESMA’s June statement sets the expectations: stop onboarding new EU clients, stop marketing, limit activity to closing out positions, keep AML/CFT controls running, and give clients a clear timeline. Custody may continue only as long as the wind-down requires.

2. Migrate clients to an authorized CASP

The receiving firm runs its own onboarding and AML/CFT checks. Migrated clients do not skip KYC. Client consent applies where required. Choose the receiving firm before you announce the move.

3. Buy an authorized CASP

A change of control requires NCA approval before it takes effect. The license may carry conditions, the buyer inherits the compliance record, and the register is short, so suitable targets are scarce. Assess the license scope first.

4. Reverse solicitation is not a strategy

Third-country firms may serve an EU client only when the client takes the initiative. ESMA reads solicitation broadly: marketing, events, and affiliate arrangements cross the line. The exception cannot rebuild the client base the transition took.

Budget and timeline reality

The budget extends beyond the license. The compliance program, safeguarding arrangements, DORA work, reporting, and staff training are ongoing costs.

Where to start

First, check your position in the ESMA register. If your entity is not listed as authorized, decide between wind-down, migration, acquisition, and a new application before you talk to clients or regulators.

For founders rebuilding EU market access, LegalBison runs the path as one project: jurisdiction strategy, company formation and licensing, the authorization file, compliance program, and banking facilitation through a single point of contact. We recommend on the business model, not on where we have offices, and we set out pricing and timelines before engagement.

Schedule a free consultation to map your route into the MiCA regime.

Speak to LegalBison Crypto Licensing Experts