Crypto-Assets Service Provider (CASP) License

How Much Does a CASP License Cost

The cost of a CASP license has two components: regulatory costs imposed by the framework itself, and service fees for professional assistance.

Regulatory costs vary by jurisdiction and include NCA application fees (ranging from approximately 1,500 EUR in Lithuania to 10,000 EUR+ in some other member states), mandatory share capital requirements (50,000 EUR to 150,000 EUR depending on class), and ongoing annual supervisory fees. Firms must also budget for local office setup, resident director arrangements, and ongoing AML/CTF compliance infrastructure.

LegalBison’s CASP licensing service covers the full application lifecycle. The firm’s approach is structured around five phases: jurisdictional strategy, operational architecture, regulatory navigation, legal foundation, and licensing execution. Fee structures are tailored to the specific class of services sought and the complexity of the applicant’s business model. For a detailed fee breakdown aligned to your business structure, LegalBison provides scoped assessments rather than generic rate cards. The requirements for a Class 1 advisory firm differ substantially from a Class 3 exchange or custody operation.

The firm’s positioning as a licensed Corporate Service Provider with direct operational presence in key EU jurisdictions, including Poland and Estonia, removes the intermediary layer that inflates cost and timeline with third-party providers.

What Are the Requirements to Apply for a CASP License

MiCA Article 62 and the surrounding provisions set out a comprehensive application framework. Meeting these requirements demands early preparation and cross-functional coordination across legal, compliance, technical, and operational teams.

Core application requirements include:

• Legal entity: The applicant must be a legal entity incorporated in an EU member state. Branches of third-country firms cannot hold a CASP license; a dedicated EU entity is required;
• Share capital and financial resources: Minimum permanent own funds of 50,000 EUR, 125,000 EUR, or 150,000 EUR depending on service class, plus additional prudential requirements proportionate to the firm’s activity volumes;
• Physical substance: A registered office and real operational presence in the Home Member State. “Letterbox” entities, meaning companies incorporated in one jurisdiction while actually managed from another, are explicitly prohibited under MiCA. At least one senior executive must be resident in the EU;
• Governance and management: A management body with appropriate collective competence in crypto-asset markets, risk management, and regulatory compliance. Each senior manager must pass a fit-and-proper assessment by the NCA;
• AML/CTF compliance program: A fully documented AML/CTF framework aligned with FATF standards. This includes transaction monitoring, customer due diligence procedures, a nominated MLRO, and a risk assessment specific to the firm’s activity profile;
• Asset segregation: Client crypto assets and fiat must be legally and technically segregated from firm assets. Custody arrangements must be documented at the level of individual client wallets or omnibus structures with per-client reconciliation;
• IT and cybersecurity policy: Documented security frameworks covering key management, wallet infrastructure, incident response, and business continuity. These are assessed against DORA (Digital Operational Resilience Act) requirements that apply concurrently with MiCA;
• Complaints handling and conflicts policy: Formal written procedures, including escalation paths and resolution timelines;
• White paper (for token-related services): Where services involve issuance or offer of crypto assets, a compliant crypto-asset white paper under MiCA Title II or III may be required in addition to the service authorization.

LegalBison structures the path through these requirements for crypto firms seeking MiCA-compliant CASP licensing for entry into the European market. The firm’s approach converts the application checklist into a managed workstream, coordinating document production, entity setup, compliance program design, and NCA correspondence under a single engagement model.

Who Needs a CASP License

Two categories of businesses face the most immediate CASP licensing obligation.

Existing VASP license holders operating in EU member states under pre-MiCA national frameworks (registrations in Estonia, Lithuania, Poland, the Czech Republic, and Malta, among others) must complete CASP license adaptation before July 1, 2026. After that date, the grandfathering provisions in Article 143(3) of MiCA expire. Firms still operating under legacy VASP registrations will be operating without authorization. The consequences are direct: cease-and-desist orders from the relevant NCA, administrative fines that can reach into the millions under Article 111, and reputational exposure with banking partners and institutional clients.

NCAs are already receiving high volumes of CASP applications. The firms that filed early have entered review queues ahead of those that wait. By mid-2025, several NCAs publicly acknowledged backlogs. Firms that have not yet begun their CASP license adaptation process face a compounding problem: even if they file before July 1, 2026, the NCA may not complete review in time to grant authorization before the deadline passes.

New businesses building crypto services with European market ambitions have an equally clear imperative. MiCA creates the most investor-ready, bank-friendly regulatory framework for crypto in any major market. A CASP authorization signals institutional-grade compliance to banking partners, payment processors, and institutional investors: the counterparties most crypto businesses struggle to secure without credible regulation behind them.

Key Differences Between a CASP and VASP License

The VASP framework, as implemented across EU member states under FATF Recommendation 15 and the EU’s Fifth and Sixth AMLD, was a registration or notification regime focused primarily on AML/CTF identity controls. It was not a full authorization framework. A VASP registration told the regulator who you were. It did not confirm you had the governance, capital, technology, or compliance infrastructure to operate safely.

A CASP license under MiCA is a full prudential authorization. It confirms all of the above. Capital requirements, governance standards, asset segregation, technology resilience, conflict of interest rules, and ongoing supervisory reporting are built into the authorization itself. The CASP license is what a VASP registration was not: a genuine financial-services-grade operating license with passporting rights across the entire EU single market.

What Types of Crypto Business Activities Are Allowed Under a CASP License

Any business providing crypto-asset services to clients in the EU on a professional basis requires CASP authorization. The scope of permitted activities maps to the three classes defined above, but in practice covers the following business types operating in the EU.

• Centralised Exchanges (CEX): Spot and derivatives trading platforms matching buyer and seller orders. Class 3 authorization required for operating the trading platform itself; Class 2 covers execution of orders where the firm matches orders externally rather than running its own order book;
• Brokerages and OTC Desks: Firms exchanging crypto assets for fiat or other crypto assets (including OTC desk operations) require Class 2 authorization. Execution of orders on behalf of clients is a Class 1 activity, as is advice on specific crypto-asset positions;
• Custodial Wallets and Custody Providers: Any firm holding private keys on behalf of clients requires at minimum Class 2 authorization, as custody and administration of crypto assets on behalf of clients is a Class 2 service under Annex IV. This includes exchange wallets, institutional custody solutions, and hot/cold storage services offered to third parties;
• Crypto Payment Processors and Gateways: Firms processing crypto payments on behalf of merchants or providing fiat-crypto conversion in payment flows require at minimum Class 2 authorization, and in many cases Class 1 advisory authorization depending on how the service is structured;
• Issuance-Related Services (ICOs, IEOs, Launchpads): Firms placing crypto assets on behalf of issuers, managing token sale processes, or providing subscription-related services around new issuances need Class 1 authorization: placing of crypto assets is defined as a Class 1 activity under Annex IV. Additional services such as custody of proceeds or exchange functions would trigger Class 2;
• Crypto P2P Platforms: Platforms that match buyers and sellers directly without running a centralized order book operate in a nuanced zone. Where the platform itself executes matching and settlement, Class 3 authorization applies. Where users transact directly with no platform intermediation in the trade, the activity analysis becomes more fact-specific;
• GameFi and Play-to-Earn Platforms: projects and play-to-earn platforms that issue, distribute, or enable trading of in-game tokens as crypto assets fall within MiCA’s scope where those tokens meet the definition of crypto assets under the regulation;
• Portfolio Management Services: Firms managing discretionary crypto portfolios on behalf of clients require Class 1 authorization.