A crypto business can be fully registered as a VASP in one European jurisdiction and still be unprepared for MiCA. That is the commercial reality behind the MiCA licence versus VASP registration question. The difference is not a change in terminology. It affects where you can operate, how you market, the capital and governance expected of your business, and whether your compliance framework will support growth rather than hold it back.
For founders building exchanges, custody solutions, brokerages, token platforms or payment-connected crypto products, the decision should be made as part of a wider operating strategy. Authorisation, corporate substance, banking and payment rails, tax planning, intellectual property and the location of key decision-makers all need to work together.
MiCA licence versus VASP registration: the core difference
A VASP registration was generally created under national anti-money laundering rules implementing the EU’s Fifth Anti-Money Laundering Directive. It focused principally on ensuring that virtual-asset businesses carried out customer due diligence, monitored transactions, reported suspicious activity and maintained appropriate AML controls.
The scope and quality of VASP regimes varied materially between Member States. Some jurisdictions applied detailed fitness and propriety reviews, local presence expectations and ongoing supervision. Others offered a lighter registration route. In most cases, however, VASP status did not create a harmonised right to provide services throughout the European Union.
MiCA, the Markets in Crypto-Assets Regulation, changes that model. The term “MiCA licence” is used widely in commercial discussions, although the formal legal concept is authorisation as a Crypto-Asset Service Provider, or CASP. A CASP authorisation is an EU-wide regulatory permission for firms providing in-scope crypto-asset services, subject to notification procedures when entering additional Member States.
That passporting potential is the principal commercial difference. A properly authorised CASP can build a single regulated European base and expand from it. A VASP registration was usually a national AML position, not an EU growth platform.
What MiCA expects that VASP registration may not
MiCA turns crypto regulation from an AML-led registration exercise into a broader conduct, prudential and governance regime. The exact requirements depend on the services provided, but a serious CASP application must show that the business can operate safely at scale.
The regulator will examine the ownership structure and the suitability of shareholders and senior management. It will expect clear governance, internal controls, risk management, complaint-handling arrangements, conflicts-of-interest policies, outsourcing oversight and business continuity planning. The application must accurately explain the operational model rather than present generic policy documents disconnected from the product.
Capital requirements also become more consequential. Depending on the class of crypto-asset services, MiCA sets minimum permanent capital thresholds of €50,000, €125,000 or €150,000, with own-funds requirements that may be higher where fixed overheads demand it. This is not simply capital to place into an account before approval. It is an ongoing prudential obligation that needs to be reflected in forecasts, treasury policy and the group’s cash-flow planning.
Client-asset protection matters just as much. Custody providers need credible arrangements for safeguarding crypto-assets and client rights. Trading platforms, brokers and exchange providers must demonstrate orderly operational controls, transparent information and appropriate management of conflicts. Marketing communications must be fair, clear and not misleading.
MiCA does not replace AML obligations. CASPs remain subject to the EU anti-money laundering framework and the Transfer of Funds Regulation, often called the Travel Rule. In practice, the strongest businesses design MiCA governance, transaction monitoring, sanctions screening, wallet controls, Travel Rule processes and financial-crime escalation as one operating framework rather than as separate compliance projects.
The transition period is not a reason to wait
Existing VASPs may be able to continue operating during a transitional period, but that period is not uniform across the EU. MiCA permits Member States to allow certain providers active before 30 December 2024 to continue until 1 July 2026, or until their authorisation application is approved or refused, whichever comes first. National authorities can apply shorter transition arrangements and may impose their own conditions.
This creates a real planning risk. A founder cannot assume that a historical VASP registration will remain commercially useful until July 2026, nor assume that a pending application provides unrestricted freedom to expand. The applicable national regime, the date and nature of the existing registration, the services actually offered and the firm’s chosen home Member State all matter.
There can be advantages for established providers. In certain jurisdictions, a pre-existing VASP may benefit from a more proportionate authorisation process or from regulatory familiarity with its operations. That is not the same as automatic conversion. Regulators will still assess whether the applicant meets MiCA’s substantive standards.
For new market entrants, pursuing a VASP registration merely because it appears quicker can create avoidable duplication. It may require a second governance build, another review of policies, changes to the group structure and a later migration of clients or contracts. A short-term route is only sensible when it supports a clear launch plan and does not compromise the eventual CASP application.
Choosing the right jurisdiction for a CASP strategy
A MiCA authorisation can be passported, but it must be obtained from a Member State where the applicant has real substance. This is why jurisdiction selection should not be based only on headline approval times or incorporation costs.
The right location depends on the regulatory authority’s approach, local talent, availability of directors and compliance staff, banking access, tax position, the group’s technology and outsourcing model, and the markets the business intends to serve. Cyprus, for example, can be attractive for international businesses seeking an EU base, but it is not automatically the right answer for every model.
A trading platform with institutional ambitions may prioritise market infrastructure, senior risk talent and strong relationships with payment providers. A custody business may place more weight on security governance, wallet architecture and asset-segregation controls. A group combining crypto services with gaming, affiliate marketing or payments needs an even closer review of perimeter, merchant flows, brand separation and group-level risk.
The operating entity also needs to match the reality of management. Regulators will challenge structures where all meaningful decisions are made elsewhere, directors lack authority, or essential functions are outsourced without effective oversight. Cross-border structuring remains possible and often commercially valuable, but the EU-authorised company must be more than a paper centre of administration.
Start with the regulated perimeter, not the application form
The first strategic question is not “Where can we register fastest?” It is “What services are we actually providing?” MiCA covers activities such as custody and administration of crypto-assets, operation of a trading platform, exchange of crypto-assets for funds or other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management and transfer services.
A product can cross into regulated territory through its practical operation, even where its branding suggests a purely technology-led business. Holding customer keys, routing orders, arranging liquidity, controlling settlement, operating a marketplace or giving personalised investment recommendations can each change the analysis.
Equally, not every digital-asset activity falls neatly within the same MiCA category. The treatment of asset-referenced tokens, e-money tokens, decentralised arrangements, NFTs and token issuance requires separate analysis. MiCA authorisation for crypto services may also sit alongside requirements under payments, e-money, financial-services, consumer-protection, data-protection or local tax rules.
A defensible regulatory plan maps the customer journey, money flow, crypto-asset flow, contractual chain, technology stack and decision-making process. It then identifies which entity performs each activity and where. That work protects the application, but it also prevents a far more expensive problem: discovering after launch that the commercial model has moved beyond the permission obtained.
Build for approval and for the first year of supervision
Many applications fail to gain momentum because the business treats authorisation as a document-production exercise. Regulators are looking for evidence that policies can be implemented by real people, using real systems, under commercial pressure.
Before filing, management should be able to explain who approves new products, how high-risk customers are assessed, what happens when a blockchain analytics alert is generated, how private-key access is controlled, how complaints are escalated and how an outsourced technology provider is monitored. Financial projections should demonstrate that the business can meet capital obligations without relying on optimistic transaction volumes.
The same preparation strengthens commercial conversations. Banks, payment institutions, liquidity providers, institutional clients and investors increasingly scrutinise regulatory readiness. A credible CASP strategy can shorten due diligence and improve the quality of counterparties available to the business.
For operators moving from a VASP model, the most effective approach is usually a structured gap assessment followed by a prioritised implementation plan. Some controls can be retained and enhanced; others need redesign. Governance, capital planning, local substance and client-asset arrangements are frequent pressure points.
Ivyascent helps founders connect that regulatory work with the wider structure required to launch and scale internationally. The goal is not just to obtain a permission, but to establish an operating platform that can support payment access, investment, new markets and long-term value creation.
The best time to decide between a legacy VASP position and a MiCA authorisation is before your next product release, funding round or market-entry commitment forces the issue. Build the regulated foundation early, and your expansion plan has room to move with confidence.