CASP MiCA license processing time, regulation, and market trends in 2026

At the moment of this article being published, 330 CASP licenses have been issued across the European Union under the MiCA regulatory framework. The number is derived from the latest updates tracked via the European Securities and Markets Authority (ESMA) public register. 

In the near future, the number of MiCA-authorised enterprises is expected to increase significantly as all emerging companies intending to provide regulated crypto-asset services in the EU must obtain the required authorization before launching operations. 

The most critical update in the MiCA guidelines this year has been the end of the transitional period on 1 July 2026. However, this was the expiry of the maximum transitional period under Article 143(3), rather than an amendment to MiCA itself. This date marked the moment when all providers that were relying on national transitional arrangements could no longer continue on that basis. 

One of the major advantages provided by the new MiCA framework is the passporting rights, which allow an authorised CASP to provide the services across the EU. This way, once licensed in one of the EU member states, the platform may provide those services in other EU member states after completing notification without having to apply for additional licenses. 

This principle unlocks significant opportunities for businesses’ quick growth across the area. Meanwhile, MiCA’s strong emphasis on operational security ensures that the licensed entities contribute to the market’s integrity and stability. Unlike the former, fragmented crypto regulations across the EU, the current MiCA framework is taking a huge step forward in establishing clear, robust, effective, and unified standards applicable to CASPs across the entire area. 

While the compliance standards for all European CASPs are established by MiCA, it is the national regulators that process each particular application and communicate with the operators. In most cases, the national central banks oversee the applicants’ financial compliance and the fulfilment of the core requirements. 

MiCA’s standards for operational security mandate licensed operators to submit their reports and notifications to the local authorities at various levels of frequency. Namely, there are three major categories of reporting that differ in their purpose and urgency:

• Quarterly and semi-annual reports are required for monitoring the transactions and financial activities of the licensed entity. These also include the basic volume reporting, user account counts, and cross-border activity statistics;
• Annual reporting applies to the internal controls, compliance monitoring, external financial audits, and ICT risk reports, depending on the applicable requirements;
• Occasional, event-related reporting associated with cybersecurity incidents, suspicious transactions, operational changes, and financial breaches.

Besides the obvious benefit of CASP licensing, which is the legal right to provide crypto services in the EU, the MiCA authorisation provides several other advantages. Namely, once licensed, your venture can perform crypto operations not only in your business setup jurisdiction but also in all EU member states under the same licensing, subject to the passporting notification procedure. This policy is particularly useful when it comes to expanding your business reach quickly and without spending extra. 

Also, the CASP license serves as a trusted seal of your ongoing compliance and demonstrates your commitment to responsible financial conduct in the market. Since MiCA and related EU rules for cybersecurity, data protection, and local presence are known as incredibly robust, they ensure that only fully compliant and verified entities enter the market. 

No, the CASP license issued under the EU’s Markets in Crypto-Assets (MiCA) regulation is not automatically recognized outside the European Union, except where MiCA applies through EEA arrangements (namely in Norway, Iceland, and Liechtenstein). In order to legally operate in any of the non-EU countries, operators must adhere to the local crypto rules and regulations. However, holding the CASP license acts as a certain trust indicator as it confirms the company’s basic AML and data protection compliance. This, in turn, can significantly simplify the verification process in the non-EU jurisdiction where you plan to provide your services. 

While the CASP authorisation can become easily overwhelming if navigated alone, there are several ways to make it as smooth and efficient as possible:

• Make sure to contact a team of experienced legal consultants before starting the application process. They will help you build a clear, tailored authorisation strategy and assist you with each step of the procedure, including the document preparation, communication with the authorities, establishing local presence in the target jurisdiction, and beyond. 
• Prepare the complete and accurate documentation featuring probable information about your business model and management. Most of the delays occur specifically during the document preparation phase, as even minor errors are taken with caution and must be corrected before sending the documents for the second revision. 
• Ensure that the financial details you provide to the regulator are both accurate and provable. This includes the financial records, source of funds, and other relevant records. Compliance with the applicable share capital requirements falls into the same category of importance, too. 
• Establish proper local presence in the jurisdiction where you plan to anchor your business. Under MiCA, the CASP must have its registered office in a Member State where it carries out at least part of its crypto-asset services, its place of effective management in the EU, and at least one director resident in the EU. Keep in mind that MiCA requires the applicants to also provide detailed documentation about each key hire, along with the confirmation of their expertise in the field of their work. If your application misses any of the relevant information in this regard, the risks of licensing delays are quite significant. 

Yes, MiCA and DORA have set strict cybersecurity requirements for operators seeking to proceed with CASP authorisation. Namely, the applicant companies must implement formal information and communication technology (ICT) security policies, data governance frameworks, and mandatory internal controls. The local regulators’ priority here is to protect the clients’ cryptographic keys, digital assets, and sensitive user data from possible breaches or information losses. Other security measures, such as the platforms’ testing, regular system audits, and infrastructure monitoring, also aim to guarantee sufficient security of operations in the long term. 

Yes, both startups and established companies seeking to reach EU clients and to provide regulated crypto-asset services in the EU can and must obtain the CASP licence upon having their company officially registered in their target jurisdiction. Once the legal entity is incorporated, the applicable capital requirements are met, the mandatory local presence is established, and operational security measures are applied, the business is eligible to apply for the CASP authorisation.  

When it comes to calculating your ongoing license expenses, it’s important to note that the exact price list is unique to each company and varies depending on the scope of permitted activities, the complexity of the business model, and other major factors. Yet, certain costs commonly apply to all CASPs who have already received their license and seek to maintain it in the years to come. Those include the annual supervisory fees, where charged by the relevant authority, physical office maintenance, compliance fees, regular audits and reporting, local substance costs, and other expenses. 

The Crypto-Asset Service Provider (CASP) license is the cornerstone of the Markets in Crypto-Assets Regulation (MiCA), establishing a single rulebook across all 27 EU member states. It replaces fragmented national registrations, provides EU-wide passporting rights, builds institutional trust, and sets strict operational and security standards required to legally operate. This way, the European market is currently undergoing a fundamental shift towards improved regulatory clarity and precision in operational standards for CASPs in all member states. Businesses that seek to serve clients in any of the EU countries no longer need to rely on the inconsistent operational rules of each particular jurisdiction. Instead, they are provided with a transparent, clearly defined framework of standards to adhere to, knowing that the same rules apply in all other EU destinations.