If your business still doesn’t hold a CASP authorization, the situation changed materially three weeks ago: the EU-wide transitional period under MiCA (the Markets in Crypto-Assets Regulation) legally ended on July 1, 2026. Any entity providing crypto-asset services to EU clients without a granted authorization is now operating in breach of EU law — not approaching a deadline, but past it.
Here’s what that actually means, and what’s still true for businesses working through authorization.
What MiCA and the CASP License Actually Require
MiCA is the EU’s harmonized framework for crypto-asset regulation, fully applicable since December 30, 2024. At its center is the Crypto-Asset Service Provider (CASP) authorization — the single license required to legally provide crypto-related services anywhere in the EU. A CASP license replaces the patchwork of national registrations (France’s PSAN, Germany’s BaFin crypto custody registration, Malta’s VFA license, and similar national regimes) with one authorization recognized across all 27 member states.
Article 143 allowed member states to grant existing providers up to 18 months of transitional operating cover while they pursued full authorization. That clock started December 30, 2024, and the EU-wide outer limit was July 1, 2026 — the date that has now passed. Several member states, including the Netherlands, Finland, Latvia, Hungary, and Slovenia, actually closed their transition windows even earlier, in mid-2025.
What Changed on July 1, 2026
As of this writing, roughly 204 CASPs hold full MiCA authorization across the EU — including major exchanges like Kraken, Coinbase, Binance, OKX, Crypto.com, and Bitstamp. Authorization has clustered heavily in a handful of jurisdictions: Germany and the Netherlands account for a large share, with France and Malta also hosting a meaningful cluster of licensed firms.
For any firm that was relying on transitional cover and doesn’t yet hold authorization, ESMA’s April 2026 guidance is direct: unauthorized entities must have an operational, executable wind-down plan in place, and continuing to serve EU clients without authorization now carries real regulatory exposure — fines of up to 12.5% of annual turnover, license revocation, and potential personal liability for company executives. A pending application is explicitly not the same as authorization; only a granted license under Article 63 permits continued service.
Which Services Actually Require Authorization
MiCA’s definition of crypto-asset services is broad. It covers custody and administration of crypto-assets, operating a trading platform, exchange services (crypto-to-fiat and crypto-to-crypto), executing orders, placement of crypto-assets, providing transfer services, receiving and transmitting orders, portfolio management, and crypto-asset advisory services. A firm needs authorization for each specific service it provides — though authorization for a higher-tier service (like operating a trading platform) automatically covers lower-tier services as well.
Capital Requirements by Class
This is the part most guides skip entirely, and it’s where a company’s real cost exposure sits:
| CASP Class | Typical Services | Minimum Own-Funds Requirement |
|---|---|---|
| Class 1 | Advice, order reception/transmission, portfolio management | €50,000 |
| Class 2 | Exchange services, custody, placement | €125,000 |
| Class 3 | Operating a trading platform | €150,000 |
Critically, this capital must be in qualifying own funds — paid-up share capital, share premium, or retained earnings. Crypto-assets sitting on a company’s balance sheet don’t count toward this requirement, regardless of their market value.
Realistic total first-year cost for a credible Class 2 or Class 3 CASP, including legal, compliance infrastructure, and the capital requirement itself, runs roughly €350,000 to €900,000 depending on jurisdiction — Malta tends to run leaner, while Germany, France, and Ireland run two to three times that figure.
The Authorization Process and Timeline
The statutory review clock is 25 working days for a completeness check, plus 40 working days for a decision, extendable by a further 20 working days if regulators need more information — roughly three to four months on paper. Real-world timelines during 2025 and into 2026 frequently ran longer, particularly for applications requiring back-and-forth on governance documentation or AML/CTF procedures.
Applicants must demonstrate a sound business model, robust internal controls, adequate cybersecurity measures, and the minimum capital for their service class, along with detailed documentation covering ownership structure, governance, AML/CTF procedures, and risk management. Applications go to the national competent authority in the member state where the firm is established, with ESMA and the European Banking Authority coordinating supervisory standards across the bloc.
Personal Experience: Where Applications Actually Stall
The most common reason applications get delayed isn’t the capital requirement — firms that reach the application stage have usually already solved that. It’s incomplete or inconsistent AML/CTF documentation, and governance structures that look fine on paper but don’t hold up when a regulator asks who’s actually accountable for a specific control. Firms that treat the “fit and proper” management assessment as a formality, rather than preparing detailed, consistent documentation on every named individual upfront, are the ones who end up in extended back-and-forth cycles that push a three-month process into six or more.
Why the Single License Still Matters
Once authorized, a CASP can passport its services to any EU member state without separate national licensing — a genuine simplification for firms scaling across borders, and the core benefit a crypto license under MiCA provides over the old fragmented system. For platforms operating in adjacent, less-regulated corners of the crypto economy — like the crypto gambling infrastructure space — this same authorization question is becoming increasingly relevant as regulators expand scrutiny of crypto-adjacent financial products more broadly.
FAQ
Is the MiCA transitional period still in effect?
No — it ended EU-wide on July 1, 2026. Any provider without granted authorization is now operating unlawfully if serving EU clients.
How much capital do I need for a CASP license?
It depends on your service class: €50,000 for Class 1 services, €125,000 for Class 2, and €150,000 for Class 3 (trading platforms), and it must be qualifying own funds, not crypto holdings.
How long does CASP authorization take?
The statutory clock is roughly 65 working days (about three months), extendable by 20 more, though real-world timelines have often run longer depending on documentation quality.
Can I still apply for a CASP license if I missed the July 1 deadline?
Yes — authorization remains available going forward, but you cannot legally serve EU clients while the application is pending. A pending application is not the same as authorization.
Does a CASP license from one EU country work in all EU countries?
Yes — this is the core benefit of MiCA. Authorization in one member state grants passporting rights to provide services across the entire EU.
What happens if a company operates without CASP authorization now?
Potential penalties include fines of up to 12.5% of annual turnover, license revocation, and personal liability exposure for executives, under enforcement action from national regulators coordinated by ESMA.
Takeaway
If your business doesn’t currently hold CASP authorization and serves EU clients, the operative question is no longer “when is the deadline” — it’s already passed. The immediate priority is confirming your authorization status against ESMA’s public register and, if unauthorized, putting a wind-down plan in place while pursuing authorization in parallel.
