CoinFlip’s Italian MiCAR License: What CONSOB’s Approval Signals for CASP Passporting

CoinFlip, the Chicago-based operator of what it describes as the world’s largest network of cryptocurrency kiosks, has been granted a Markets in Crypto-Assets Regulation license by CONSOB, Italy’s securities regulator.

This makes it the country’s first international Crypto-Asset Service Provider authorized under the new regime. The company is setting up its European headquarters in Milan and says the license will let it scale services across the rest of the EU. That last part is the actual story.

I Need CASP Guidance

The Strategic Choice of Italy

MiCA’s CASP framework runs on a passporting model: authorize once with a competent national regulator in one EU or EEA member state, and a firm can offer the same services across the bloc without separate national applications in each country.

Most crypto businesses have already accepted that MiCA authorization is necessary to operate in the EU. The real question is which member state to apply through. CoinFlip chose Italy, and that’s worth noting, because it wasn’t the obvious choice when the CASP regime took effect on December 30, 2024.

Lithuania, Poland, and Malta built early reputations as MiCA entry points, partly on processing speed and partly because their regulators moved quickly to build out CASP review capacity while the framework was still new. Italy has been a quieter presence in that conversation. 

CONSOB approving a US-headquartered kiosk operator, whose business runs on cash-to-crypto conversion rather than exchange trading and carries its own AML profile around cash handling and source-of-funds checks, suggests the regulator now has both the review capacity and the appetite to compete for CASP business rather than simply process domestic applicants.

Operational Substance Requirements

CoinFlip’s decision to headquarter its European operations in Milan, rather than file paperwork remotely, also reflects a MiCA requirement that’s easy to underestimate: CASP applicants generally need a genuine place of effective management within the authorizing member state, not a registered address of convenience. 

Regulators have grown more attentive to this as the framework has matured, and CONSOB’s review would have tested it directly.

Business Model Considerations

The kiosk-based model itself is worth a second look. Cash-to-crypto businesses carry a different AML risk profile than a typical exchange: physical cash handling, walk-up customers, and less reliance on bank rails for onboarding all raise different red flags than a purely digital order book. 

CONSOB approving that model, rather than a more conventional exchange application, says something about the breadth of business models Italy is now willing to authorize, beyond simply being open for CASP business.

The Evolving MiCA Landscape

There’s a broader signal here for firms still deciding where to apply. In the eighteen months following the CASP regime’s December 30, 2024 start date, authorizations went disproportionately to a handful of jurisdictions that built reputations as fast movers.

That concentration created queues at some of the more popular regulators as application volume caught up with review capacity. As more national regulators build out their own processing infrastructure, that early concentration is likely to spread.

CoinFlip’s Italian license is one data point suggesting it already has. For a crypto business choosing between an established CASP hub with a longer queue and a jurisdiction with less of a track record but more available bandwidth, the calculation is shifting in real time.

Core Compliance Standards

None of this changes the underlying compliance work. A CASP application under MiCA still requires the same building blocks regardless of which member state receives it: governance and fit-and-proper documentation for management, an AML/CTF program mapped to the applicant’s actual business model, custody and safeguarding arrangements, and a capital position meeting the framework’s prudential requirements.

What changes by jurisdiction is processing time, the regulator’s familiarity with a given business model, and how much local operational substance is actually expected versus formally required on paper. For founders comparing entry points, that gap between what’s written down and what’s actually expected is usually where the real decision gets made.

Consult Your EU Crypto Licensing