Passporting reduces separate national approvals but does not remove local product, marketing or consumer-protection rules. Before launch, verify the home-state authority, notified services, country availability and operating terms.
Key takeaways
- A CASP authorisation is service-specific and entity-specific; it is not blanket approval for every company in a group or every token product.
- Passporting improves cross-border distribution, but national registers and the actual service terms still determine what users can access.
- The fastest verification route is to match legal entity, regulator register, service category, countries, and source date before trusting a licence claim.
Does the business need a full CASP authorisation?
A business needs full CASP authorisation when an EU legal entity professionally provides a listed crypto-asset service after MiCA became fully applicable and cannot use the route reserved for eligible regulated institutions.
The assessment starts with the activity, contracting entity and customer journey. Calling a product an exchange, wallet, protocol or software company does not determine whether it performs a regulated service.
MiCA covers ten services: custody, operating a trading platform, exchange for funds, exchange for other crypto-assets, execution, placing, reception and transmission of orders, transfer services, advice and portfolio management. Custody permission does not authorise a trading venue, and CASP status does not automatically cover derivatives classified as financial instruments.
| Operating fact | Likely MiCA route | Evidence required before deciding |
|---|---|---|
| An EU company provides a listed crypto-asset service to clients | Article 59 CASP authorisation | Entity, service map, client flow and target countries |
| A bank, investment firm or another eligible regulated institution adds an equivalent crypto service | Article 60 notification for the services MiCA permits that institution to provide | Existing licence, service equivalence and complete notification |
| A non-EU firm serves an EU client solely at that client’s exclusive initiative | Narrow Article 61 reverse-solicitation analysis | Dated client initiation and no EU solicitation, promotion or agent |
| Software does not hold assets, execute orders, transmit orders or provide advice | Fact-specific out-of-scope analysis | Contracts, technical permissions, revenue flow and control of execution |
Article 60 is not a lighter CASP licence available to every applicant. It applies to eligible credit institutions, investment firms, market operators, electronic-money institutions, depositories and certain fund managers adding services equivalent to their existing permissions.
The AMF and ACPR Article 60 form shows that notification still requires evidence. BaFin’s MiCAR guidance also states that the service cannot begin while the notification remains incomplete.
Reverse solicitation is narrower still. A third-country firm cannot create the exemption with a disclaimer while advertising, using an EU-facing affiliate or promoting services after the client’s request. An intentional EU launch therefore needs an authorisation strategy unless the exact facts support another route.
Building the application and a defensible cost budget
The application must show that the proposed operating model has accountable owners, functioning controls and supporting evidence. Under Annex IV of MiCA, minimum permanent capital is EUR 50,000 for Class 1, EUR 125,000 for Class 2 and EUR 150,000 for Class 3.
Class 2 adds custody and exchange services, while Class 3 adds operation of a trading platform. Article 67 requires the higher of the applicable floor or one quarter of fixed overheads, using projected overheads for a new firm.
Capital is only one budget line. Prudential resources should be separated from application fees, hiring, legal and compliance work, ICT and DORA remediation, audits, insurance, premises and continuing supervision. Only the capital formula is harmonised across the EU.
National charges differ. The AFM publishes EUR 200 per hour with a EUR 100,000 cap, while BaFin bases its charge on time spent. Consultant estimates are commercial quotations, not official licence costs, and need a named provider, scope, assumptions and date.
Article 62 requires operations, governance, ownership, management suitability, prudential resources, AML, ICT security, continuity, outsourcing, conflicts, complaints and client-asset segregation evidence. The service then determines the additional file: custody needs key controls, exchange needs pricing policy, and a platform needs admission and surveillance rules.
The AMF application page separates the entity file, fit-and-proper forms and DORA assessment. The AFM checklist asks applicants to identify exact supporting-document pages. These requirements show what a complete submission means more clearly than a generic policy inventory.
MiCA provides five working days to acknowledge receipt, 25 working days for the completeness check and 40 working days for the substantive decision after completeness. Clarification requests make a simple calendar estimate unreliable.
A credible launch plan tracks the first complete submission, each regulator question, its response owner and every unresolved dependency. The statutory assessment clock should not be advertised as a guaranteed approval date.
Choosing the home-state NCA
Choose the home-state NCA by matching the applicant’s real EU substance, operating model, management location, key controls and primary customer market. Existing licences, Article 60 eligibility, supervisory language and evidence requirements also matter. TheCCPress’s product-by-product regulator map explains why authority follows the activity rather than the brand.
France may fit French operations or a legacy DASP footprint, while Germany suits applicants prepared for BaFin engagement, German-language supervision and detailed DORA evidence. The Netherlands offers an explicit AFM checklist and hourly charge. Malta may fit genuine local substance or VFA history under the MFSA authorisation process.
Treat these options as a jurisdiction matrix, not a ranking. Verify each NCA’s fees, pre-application steps, submission language, management-presence rules, reporting channel and register process. Price the same operating model everywhere because quotes excluding DORA remediation, travel, local staff, audit, insurance or post-authorisation reporting are not comparable with all-in proposals.
Passporting and transition risk
Passporting lets an authorised CASP provide approved services across borders without obtaining another CASP licence in each host state. It is a notification attached to the home-state authorisation, not a new licence or proof that every product is live.
The passporting sequence has four practical checks:
- Notification scope: The CASP identifies the target member states, authorised services, intended start date and activities outside MiCA.
- Authority communication: Article 65 gives the home authority 10 working days to notify host-state contact points, ESMA and EBA.
- Permitted start: The CASP may begin after communication is confirmed, or no later than the 15th calendar day after submitting the information.
- Commercial readiness: Fiat rails, token availability, language, marketing controls, customer support and terms must still be tested in each country.
The notification timetable does not prove that a complete customer journey is live. A comparison should show both the passport record and the services actually available in the country being reviewed.
Transition language now needs historical labeling. ESMA’s June 2026 statement on the end of MiCA transitional periods says the final national periods ended on 1 July 2026. An August 2026 comparison should not present an old national registration as current MiCA authorisation.
Transition rules are already changing user behaviour. In a discussion of MiCA-driven venue migration, EU users examined a Bitpanda offer of 5% in BTC for qualifying transfers from affected third-party venues. Private-wallet and compliant-exchange transfers did not qualify, showing that the receiving venue’s rules determined which users, assets and routes received the incentive.
The promotion does not prove that one venue is safer or that a passport covers every service. Users should still verify the sending venue, receiving entity, eligible asset, country, transfer conditions and withdrawal route. The EBA’s MiCA supervisory role also confirms that CASP and issuer status are separate; distributing another entity’s token does not make a platform its issuer or give both the same authorisation.
How to Verify a CASP Licence and EU Passport
A CASP licence is verified only when the legal entity, authorised service, passport country and live product terms match. The brand name or an undated licence badge cannot complete this check.
- Legal entity: Match the company in the customer agreement with the name, address and status in the competent authority’s register.
- Service scope: Confirm whether the permission covers custody, exchange, execution, transfers, advice or operation of a trading platform.
- EU passport: Verify the host country and notified service instead of assuming that one authorisation activates every product across the EEA.
- Customer journey: Compare onboarding, fiat rails, token access, custody terms and complaints information for the country being assessed.
- Evidence date: Record when the register and product terms were checked because authorisations, passports and service availability can change.
Entity substitution credits one subsidiary’s permission to every company using the group brand. Scope substitution treats custody, brokerage, exchange and trading-platform operation as the same authorised service. Date substitution presents an old national registration or screenshot as current MiCA evidence.
An authorisation must also be separated from an investor-alert listing, which answers a different question. Any mismatch should be reported as an evidence gap rather than filled with inference.
Conclusion
MiCA CASP licensing should follow the service scope, legal entity, capital requirement and real EU operating model. Article 60 is limited to eligible regulated institutions, while passporting extends only the services attached to the home-state authorisation and notification.
Authorisation confirms a regulatory perimeter, not liquidity, execution quality, low fees, solvency or uninterrupted withdrawals. A defensible launch therefore ends with a dated register check, verified passport scope, live country terms and separate testing of custody, costs, support and market-abuse controls.
Frequently asked questions
What does MiCA CASP licensing actually cover?
It covers the authorised entity and the crypto-asset services listed by the competent authority. It does not automatically cover every group company, every token, or every product such as crypto derivatives, lending, or staking.
How much capital does a MiCA CASP need?
The minimum is EUR 50,000 for Class 1, EUR 125,000 for Class 2 and EUR 150,000 for Class 3. The actual prudential safeguard is the higher of that minimum or one quarter of the preceding year’s fixed overheads, which means a larger operator may need more than the table minimum.
Is a passported CASP available throughout the EU?
Passporting supports cross-border provision, but availability still depends on the notified service, product restrictions, onboarding terms, and the firm’s actual launch decisions. Verify the contracting entity and live country terms rather than inferring availability from an EU-wide marketing claim.
Which claim needs the most frequent refresh?
Current register status, transition deadlines, country availability, supported tokens, and product permissions can change quickly. Recheck those fields immediately before publication or a commercial decision.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
