A CASP authorisation is not a ‘crypto licence’ in the sense in which the term was used prior to 2024. It is a fully-fledged financial authorisation at the level of an investment firm: paid-up capital, a board of directors subject to professional suitability assessments, a physical presence in the EU, a comprehensive set of policies ranging from AML to operational resilience, and ongoing supervision following authorisation. In return, you receive something that no previous national licence offered: the right to operate in all 27 EU countries under a single authorisation.
We do not start by selling a package, but by asking two questions that an honest adviser is obliged to ask first. Do you even need a licence at all? — because a significant proportion of Web3 projects do not fall within the scope of MiCA, whilst some already licensed financial firms may be able to manage with a notification rather than a new authorisation. And where to apply – because, following the end of the transition period, Estonia is no longer the quickest or cheapest option, and for certain business models, another EU country will grant the same passport more quickly.
If the answer to the first question is ‘yes, you do’, we put the entire project together: the legal entity’s structure in line with the regulation’s requirements, capital and own funds, a set of policies, preparing the board for assessment, and submitting the application and corresponding with the regulator until a decision is reached.
| Topic | Practical guidance |
|---|---|
| Legal framework | Regulation (EU) 2023/1114 (MiCA); in Estonia — the Crypto-Asset Market Act (KrüTS) |
| Regulator in Estonia | Finantsinspektsioon (Financial Supervision Authority) |
| Transition period | Ended on 1 July 2026; previous VASP licences were revoked; there was no automatic conversion |
| Who needs authorisation | Those providing at least one of the 10 services listed in MiCA (CASP) |
| Classes and capital | Class 1 — €50,000; Class 2 — €125,000; Class 3 (trading venue) — €150,000 |
| Own funds requirement | Not less than a quarter of the previous year’s fixed overheads |
| Presence in the EU | Registered office in the country of application, place of effective management within the EU, at least one director who is an EU resident |
| Regulatory timelines | 25 working days for a completeness check + 40 working days for a substantive assessment; the decision is communicated within 5 working days |
| Actual processing time | 6–9 months from application to decision for a well-prepared application; longer if preparation is required |
| Authorisation | Notification procedure via the home regulator; the authorisation is valid in all 27 EU countries |
| For those already licensed | Banks, investment firms, EMIs, asset management companies and a number of others are authorised to provide certain services upon notification within 40 working days, without the need for a separate CASP |
| Related regimes | DORA, the Travel Rule, CARF/DAC8 from 1 January 2026 |
If you have any questions, our managers are always on hand and ready to help! If you’re unsure whether your product falls under MiCA, please submit an enquiry: our specialists will carry out a basic scope assessment free of charge, and if you don’t need a licence, we’ll tell you straight away.
MiCA does not regulate ‘cryptocurrencies in general’, but rather a specific list of 10 services, grouped into three classes according to their level of risk.
The capital requirement is a minimum, not a ceiling: there is also a rule regarding own funds, under which these must not be less than a quarter of the previous year’s fixed overheads. The larger your team and infrastructure, the higher the threshold, and it grows in line with the business.
Who does not need authorisation. Development of protocols and smart contracts, code auditing, infrastructure and nodes, on-chain analytics, non-custodial interfaces where the user always holds the keys, NFT projects with genuinely unique tokens, DAO tools, consultancy and marketing. All of this constitutes standard entrepreneurial activity, for which an Estonian OÜ is sufficient. A detailed breakdown of the scope can be found on the page for crypto and Web3 projects.
This is the most underrated route within MiCA, and you’ll hardly ever come across it on competitors’ websites because it isn’t marketed as a major project.
The Regulation expressly provides that companies already authorised in the EU as credit institutions, MiFID II investment firms, electronic money institutions, UCITS management companies, alternative fund managers, central securities depositories and market operators are entitled to provide certain crypto-services without a separate CASP authorisation — subject to notification to their competent authority, submitted no later than 40 working days before the start of service provision.
Practical implications for three typical scenarios:
The regulations set strict deadlines: the regulator has 25 working days to check that the application is complete and 40 working days to assess its substance from the moment the application is deemed complete; the decision is communicated within five working days. On paper, this amounts to around three months. In practice, a realistic timeframe from submission to a decision is 6–9 months, and significantly longer when preparation is taken into account. The difference arises in three areas:
If you have not met the deadline by the end of the transition period and continue to serve EU clients without authorisation, an orderly winding down of your European operations followed by a fresh application is almost always better than continuing to operate in breach of the rules. Any breach will come to light at the very first audit of the counterparty and will block the path to authorisation for a long time.
A licence is not a standalone product, but rather an overarching layer for an operational company. If the corporate foundation is not properly established — vague descriptions of activities, lack of record-keeping, a random registered office address — these issues come to light during the application assessment stage and can cause months of delay.
The Regulation sets a minimum level of physical presence, and it is not possible to circumvent this by setting up a ‘letterbox company’:
| Section | What is included |
|---|---|
| Corporate | Incorporation documents, ownership structure, information on beneficial owners, organisational chart |
| Financial | Proof of paid-up capital, calculation of own funds, business plan with a model and stress tests covering 3–5 years |
| Management | Information on board members and key personnel, suitability questionnaires, allocation of responsibilities |
| Compliance | AML/CFT, sanctions screening, the Travel Rule, transaction monitoring, reporting of suspicious transactions |
| Operational | Description of services and fund flows, protection of client assets, retention policy, outsourcing, business continuity |
| Technology | ICT risks and cyber resilience in accordance with DORA requirements, testing, incident management |
| Client | Contracts, risk disclosure, fees, complaints handling procedures |
A CASP licence is valid throughout the EU, so the country of application determines not the market, but the cost and speed of entry. Following the end of the transition period, the Estonian market has changed radically: old licences have been revoked, and only a handful of companies have received their own authorisations from the Financial Supervision Authority. The regulator, with many years’ experience in supervising banks and investment firms, applies the same standard to the crypto sector — this is a plus for reputation but a minus for speed.
What to compare when choosing a country in which to apply: the regulator’s practices and workload, the availability of a preliminary stage for discussing the application, the language of the documentation, requirements for local staff and office space, the cost of maintaining the entity, the availability of banking services and auditors, as well as where your team is actually based — because the place of effective management must be a real location. We carry out this comparison during the scope audit and advise you on where your project will proceed more quickly.
There are four layers to consider, and the first is the smallest:
It is precisely this fourth layer that is usually underestimated: the annual operating costs of a licensed entity generally exceed the cost of the application itself. The own funds rule links the prudential threshold to your ongoing expenses, so as your team grows, the capital requirement automatically increases. You need to plan your budget for a year’s operation, not just for the set of documents. We quote the government fee based on the regulator’s current price list as at the date the estimate is prepared — figures vary across open sources.
Authorisation marks the start of the supervisory relationship. Next come: regular financial and regulatory reporting, external audits, compliance with own funds requirements, updating policies in line with changes to ESMA and EBA regulations and guidelines, notifying the regulator of material changes, and supervisory inspections. Separate related regimes apply: operational resilience under DORA, the Travel Rule for crypto-asset transfers, and obligations to collect and transmit user data under CARF/DAC8, which came into force on 1 January 2026.
Non-compliance leads to corrective orders, fines, restrictions on operations and the revocation of authorisation. For a licensed company, the loss of authorisation does not mean a pause, but the end of business in the EU — which is why compliance is embedded in the operational model rather than imposed from above.
A separate authorisation in each country is not required. The company notifies its home regulator of its intention to provide services in other Member States; the regulator then forwards this information to the host authorities, after which the company may operate in those markets. The procedure is a notification process, but not a mere formality: the range of services and business model must comply with the authorisation granted, whilst marketing and client documentation must adhere to the host countries’ rules regarding language and disclosure of information.
Tell us about your product (interface, keys, tools, command, licences in the EU) — within 24 hours, we’ll determine the regulatory category and scope, calculate the timelines and budget, and select the jurisdiction with the shortest time to market.
Order