Crypto-Assets Service Provider (CASP) License

The cost of a CASP license has two components: regulatory costs imposed by the framework itself, and service fees for professional assistance.

Regulatory costs vary by jurisdiction and include NCA application fees (ranging from approximately 1,500 EUR in Lithuania to 10,000 EUR+ in some other member states), mandatory share capital requirements (50,000 EUR to 150,000 EUR depending on class), and ongoing annual supervisory fees. Firms must also budget for local office setup, resident director arrangements, and ongoing AML/CTF compliance infrastructure.

LegalBison’s CASP licensing service covers the full application lifecycle. The firm’s approach is structured around five phases: jurisdictional strategy, operational architecture, regulatory navigation, legal foundation, and licensing execution. Fee structures are tailored to the specific class of services sought and the complexity of the applicant’s business model. For a detailed fee breakdown aligned to your business structure, LegalBison provides scoped assessments rather than generic rate cards. The requirements for a Class 1 advisory firm differ substantially from a Class 3 exchange or custody operation.

The firm’s positioning as a licensed Corporate Service Provider with direct operational presence in key EU jurisdictions, including Poland and Estonia, removes the intermediary layer that inflates cost and timeline with third-party providers.

MiCA sets minimum own funds requirements based on the services the CASP intends to provide. Higher-risk service categories carry higher capital thresholds.

A CASP providing services across multiple categories is subject to the highest applicable threshold. Competent authorities may impose additional capital requirements above these minimums based on the specific risk profile of the business model.

CASP authorisation under MiCA requires a complete application package addressing ten areas. Each must be fully documented before submission.

1. EU legal entity. The applicant must be a legal entity established in an EU member state. Branches of non-EU entities cannot hold a CASP authorisation directly.
2. Minimum own funds. See the capital requirements table above. Capital must be deposited in a corporate bank account in the EU.
3. Fit-and-proper management body. All members of the management body must demonstrate good repute, absence of criminal convictions, adequate knowledge and experience, and sufficient time to carry out their duties. Qualifying shareholders are also subject to assessment.
4. Governance framework. The application must document internal controls, risk management procedures, conflict of interest policies, outsourcing arrangements, and a business continuity plan.
5. AML/KYC programme. A written AML/CFT policy aligned with AMLD6 and the applicable national transposition, covering customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk clients, and risk matrices.
6. Travel Rule compliance. FATF Recommendation 16 obligations as transposed through the Transfer of Funds Regulation (TFR): for transfers of EUR 1,000 or more, transmitting and receiving CASPs must exchange originator and beneficiary data.
7. Transaction monitoring. A deployed transaction monitoring system with documented parameters, alert procedures, and periodic review processes tied to the CASP’s risk matrix.
8. MLRO appointment. A qualified Money Laundering Reporting Officer responsible for the AML programme, suspicious transaction reporting, and regulator liaison.
9. ICT and operational resilience. Documented ICT systems and security arrangements, including DORA compliance obligations that apply to CASPs as financial sector entities.
10. Passporting. Once a CASP authorisation is granted by one member state’s competent authority, the CASP can notify other member states and commence services there without a separate application. Passporting covers all 27 EU member states.

Business Plan for a CASP Licence

Every CASP application requires a detailed programme of operations, which regulators treat as the business plan. It must include: a description of the crypto-asset services to be provided and the business model supporting them; target markets and projected client base; three-year financial projections; IT infrastructure description and security framework; the AML/CFT compliance programme; governance structure and internal controls; and details of outsourcing arrangements with third-party providers. A poorly prepared programme of operations is the single most common reason for application delays.

Who Needs a CASP License

Two categories of businesses face the most immediate CASP licensing obligation.

Existing VASP license holders operating in EU member states under pre-MiCA national frameworks (registrations in Estonia, Lithuania, Poland, the Czech Republic, and Malta, among others) must complete CASP license adaptation before July 1, 2026. After that date, the grandfathering provisions in Article 143(3) of MiCA expire. Firms still operating under legacy VASP registrations will be operating without authorization. The consequences are direct: cease-and-desist orders from the relevant NCA, administrative fines that can reach into the millions under Article 111, and reputational exposure with banking partners and institutional clients.

NCAs are already receiving high volumes of CASP applications. The firms that filed early have entered review queues ahead of those that wait. By mid-2025, several NCAs publicly acknowledged backlogs. Firms that have not yet begun their CASP license adaptation process face a compounding problem: even if they file before July 1, 2026, the NCA may not complete review in time to grant authorization before the deadline passes.

New businesses building crypto services with European market ambitions have an equally clear imperative. MiCA creates the most investor-ready, bank-friendly regulatory framework for crypto in any major market. A CASP authorization signals institutional-grade compliance to banking partners, payment processors, and institutional investors: the counterparties most crypto businesses struggle to secure without credible regulation behind them.

Key Differences Between a CASP and VASP License

The VASP framework, as implemented across EU member states under FATF Recommendation 15 and the EU’s Fifth and Sixth AMLD, was a registration or notification regime focused primarily on AML/CTF identity controls. It was not a full authorization framework. A VASP registration told the regulator who you were. It did not confirm you had the governance, capital, technology, or compliance infrastructure to operate safely.

A CASP license under MiCA is a full prudential authorization. It confirms all of the above. Capital requirements, governance standards, asset segregation, technology resilience, conflict of interest rules, and ongoing supervisory reporting are built into the authorization itself. The CASP license is what a VASP registration was not: a genuine financial-services-grade operating license with passporting rights across the entire EU single market.

What Types of Crypto Business Activities Are Allowed Under a CASP License

Any business providing crypto-asset services to clients in the EU on a professional basis requires CASP authorization. The scope of permitted activities maps to the three classes defined above, but in practice covers the following business types operating in the EU.

• Centralised Exchanges (CEX): Spot and derivatives trading platforms matching buyer and seller orders. Class 3 authorization required for operating the trading platform itself; Class 2 covers execution of orders where the firm matches orders externally rather than running its own order book;
• Brokerages and OTC Desks: Firms exchanging crypto assets for fiat or other crypto assets (including OTC desk operations) require Class 2 authorization. Execution of orders on behalf of clients is a Class 1 activity, as is advice on specific crypto-asset positions;
• Custodial Wallets and Custody Providers: Any firm holding private keys on behalf of clients requires at minimum Class 2 authorization, as custody and administration of crypto assets on behalf of clients is a Class 2 service under Annex IV. This includes exchange wallets, institutional custody solutions, and hot/cold storage services offered to third parties;
• Crypto Payment Processors and Gateways: Firms processing crypto payments on behalf of merchants or providing fiat-crypto conversion in payment flows require at minimum Class 2 authorization, and in many cases Class 1 advisory authorization depending on how the service is structured;
• Issuance-Related Services (ICOs, IEOs, Launchpads): Firms placing crypto assets on behalf of issuers, managing token sale processes, or providing subscription-related services around new issuances need Class 1 authorization: placing of crypto assets is defined as a Class 1 activity under Annex IV. Additional services such as custody of proceeds or exchange functions would trigger Class 2;
• Crypto P2P Platforms: Platforms that match buyers and sellers directly without running a centralized order book operate in a nuanced zone. Where the platform itself executes matching and settlement, Class 3 authorization applies. Where users transact directly with no platform intermediation in the trade, the activity analysis becomes more fact-specific;
• GameFi and Play-to-Earn Platforms: projects and play-to-earn platforms that issue, distribute, or enable trading of in-game tokens as crypto assets fall within MiCA’s scope where those tokens meet the definition of crypto assets under the regulation;
• Portfolio Management Services: Firms managing discretionary crypto portfolios on behalf of clients require Class 1 authorization.

The optimal CASP jurisdiction depends on business model, substance capacity, and timeline. The options below represent the most commonly pursued routes. LegalBison maintains an active practice in each of these member states.