Who needs authorisation
Regulation (EU) 2023/1114 provides that no person may provide crypto-asset services in the Union unless it is authorised as a crypto-asset service provider, or is one of the regulated financial entities that may provide them by notification. A crypto-asset service provider must be a legal person with its registered office in a member state in which it carries out at least part of its services, its place of effective management must be in the Union, and at least one of its directors must be resident in the Union. The authorisation specifies the services the firm may provide, and it entitles the firm to provide them throughout the Union, by establishment or on a cross-border basis, without a physical presence in the host state.
A credit institution, an investment firm, an electronic money institution and certain other authorised financial entities need not apply for a separate authorisation. They may provide crypto-asset services equivalent to their existing authorisation by notifying their home competent authority at least 40 working days before they begin, with the information the Regulation prescribes. An electronic money institution, for instance, may provide custody and transfer services in respect of the e-money tokens it issues on that basis.
The Regulation allowed firms that were providing crypto-asset services lawfully before 30 December 2024 to continue until 1 July 2026 at the latest, or until their application was decided, and it allowed member states to shorten that period. Those transitional arrangements have now run their course, and a firm that serves clients in the EU without authorisation is providing services it may not provide.
The services and the capital they require
The Regulation defines ten crypto-asset services: custody and administration of crypto-assets, the operation of a trading platform, the exchange of crypto-assets for funds and for other crypto-assets, the execution of orders, the placing of crypto-assets, the reception and transmission of orders, advice, portfolio management and transfer services. The application names each service the firm intends to provide, and the capital requirement follows from that choice.
A provider must hold prudential safeguards of at least the higher of a permanent minimum and one quarter of its fixed overheads for the preceding year, which a new firm calculates from the projected overheads in its application. The permanent minimum is set by class. A firm authorised only for execution, placing, transfer services, reception and transmission, advice or portfolio management is in class 1 and must hold EUR 50 000. A firm that also provides custody or exchange services is in class 2 and must hold EUR 125 000. A firm that operates a trading platform is in class 3 and must hold EUR 150 000. The safeguards may consist of own funds, of an insurance policy covering the territories in which the services are provided, or of a combination of the two, and the insurance must meet conditions the Regulation sets out, including a term of at least one year and 90 days' notice of cancellation.
What the application contains
The application is made to the competent authority of the home member state and must contain the information listed in Article 62 of the Regulation, as further specified in the technical standards adopted under it. It begins with the firm's identity, legal form and articles of association, and a programme of operations setting out the services to be provided and where and how they will be marketed. It must prove that the firm meets the prudential requirements, describe its governance arrangements, and show that the members of the management body are of good repute and have the knowledge, skills and experience to manage the firm, both individually and collectively, and the time to do so. The same proof of good repute is required for every shareholder or member with a qualifying holding, direct or indirect. For both groups the proof includes the absence of criminal convictions and of penalties under commercial, insolvency and financial services law, and in relation to money laundering, terrorist financing, fraud and professional liability.
The application then describes the firm's internal control mechanisms and its policies and procedures for identifying, assessing and managing risk, including money laundering and terrorist financing risk, together with its business continuity plan. It includes the technical documentation of the firm's ICT systems and security arrangements, with a description in non-technical language, and the firm must in any case meet the requirements of the Digital Operational Resilience Act. It describes the procedure for segregating clients' crypto-assets and funds and the firm's complaints-handling procedure, and it states the types of crypto-asset to which the services relate.
Further material is required for particular services. A firm applying for custody must describe its custody and administration policy. A firm that will operate a trading platform must describe the platform's operating rules and its procedure and system for detecting market abuse. A firm that will exchange crypto-assets for funds or for other crypto-assets must describe its commercial policy, which must be non-discriminatory, and the methodology by which it prices the crypto-assets it exchanges. A firm that will execute orders must describe its execution policy; a firm that will give advice or manage portfolios must show that the individuals doing so have the necessary knowledge and expertise; and a firm that will provide transfer services must explain how it will provide them.
Two further requirements shape the application even though they are not listed as separate documents. A provider that holds clients' crypto-assets or the means of access to them must have arrangements that safeguard the clients' ownership rights, in particular in its own insolvency, and that prevent it from using client assets for its own account. Clients' funds other than e-money tokens must be placed with a credit institution or a central bank by the end of the business day after they are received, in an account separately identifiable from the firm's own. Payment services connected with the crypto-asset services may be provided only by a firm, or through a third party, authorised under the Payment Services Directive. A provider of custody, trading platform, exchange, execution or placing services must also have a plan for the orderly wind-down of its activities that shows it can wind down without undue economic harm to its clients.
The assessment
The competent authority acknowledges receipt within five working days and has 25 working days to check that the application is complete. If it is not, the authority sets a deadline for the missing information, and it may refuse to review an application that remains incomplete after that deadline. Once the application is complete, the authority has 40 working days to assess whether the firm complies with the Regulation and to adopt a fully reasoned decision granting or refusing authorisation, which it notifies within a further five working days. During the assessment, and no later than its twentieth working day, the authority may request further information in writing; the assessment period is then suspended until the firm answers, for no more than 20 working days. Later requests for clarification do not suspend it.
The authority must refuse authorisation where there are objective and demonstrable grounds that the management body threatens the firm's sound and prudent management, that its members or its qualifying shareholders do not meet the suitability criteria, or that the firm fails or is likely to fail any requirement of Title V of the Regulation. Where the firm is part of a group that includes an entity authorised in another member state, the authority consults that state's authority before deciding. Within two working days of granting authorisation it informs ESMA, which enters the firm in its public register before the firm begins to provide services.
Providing services across the EU
A provider that intends to serve clients in other member states submits to its home authority a list of the states concerned, the services it will provide there, the intended starting date and a list of its other activities. The home authority passes this to the host states, ESMA and the EBA within 10 working days, and the provider may begin in the other states from the date it is told this has been done or, at the latest, from the fifteenth calendar day after it submitted the information. No further authorisation and no physical presence in the host state are required.
How we can help
We prepare CASP applications to the competent authority in any member state, including the programme of operations, the capital calculation, the governance and suitability material, the policies and procedures for each service applied for and the wind-down plan, and we handle the passport notification once the authorisation is granted. See MiCA CASP authorisation, or speak to us. A provider that transfers e-money tokens or holds them for clients should also read our note on authorisation under PSD2, and a firm serving UK clients our page on FCA cryptoasset authorisation.
Source
Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, Articles 3, 59, 60, 62, 63, 65, 67, 68, 70, 74, 109 and 143 and Annex IV, as published on EUR-Lex. Checked 13 October 2026.