A crypto business can have a strong product, active users and reliable technology, yet still face a hard stop when it tries to access the European market. The question, what is a MiCA CASP, goes to the centre of that issue. Under the EU’s Markets in Crypto-Assets Regulation, a Crypto-Asset Service Provider is an authorised business permitted to deliver specified crypto-asset services across the European Economic Area.
For founders, investors and established operators, this is not simply another registration to add to the corporate file. MiCA changes how a crypto business must be structured, governed, funded and operated if it wants to serve EU clients at scale. The right authorisation can create a credible route into multiple markets. The wrong assumption about scope can delay a launch, disrupt banking relationships or expose the business to enforcement risk.
What is a MiCA CASP?
A MiCA CASP is a legal entity authorised by the competent regulator in an EU Member State to provide crypto-asset services. Once authorised, it can generally passport those services into other EEA states without needing to obtain a separate full licence in every country.
MiCA is designed to bring consistency to a market that previously operated through a patchwork of national rules. It applies to many crypto-assets and service providers that were not covered by existing financial-services legislation. Its aim is clear: increase consumer protection, market integrity and operational accountability while allowing legitimate businesses to compete across Europe.
The word “authorised” matters. A company incorporated in an EU jurisdiction is not automatically a CASP. Nor does holding a virtual-asset registration obtained under an earlier national anti-money-laundering regime necessarily provide the permissions required under MiCA. A firm must apply, demonstrate that it meets the relevant conditions and continue meeting them after approval.
Which activities require CASP authorisation?
MiCA regulates a defined range of crypto-asset services. Whether a business needs authorisation depends on what it actually does, not the label it uses in its marketing material. A platform calling itself a technology provider may still be carrying on a regulated service if it controls client assets, executes transactions or operates a trading environment.
Services within the CASP perimeter include:
- custody and administration of crypto-assets on behalf of clients;
- operating a trading platform for crypto-assets;
- exchanging crypto-assets for funds or other crypto-assets;
- executing, receiving or transmitting client orders;
- placing crypto-assets, providing transfer services or offering crypto-asset advice;
- portfolio management of crypto-assets.
A custodial wallet provider, centralised exchange, brokerage, crypto payment business or OTC desk is therefore likely to require close regulatory analysis. The same applies to firms that facilitate trades without taking principal risk, as arranging and executing activity can be regulated in its own right.
The position is less straightforward for decentralised finance, non-custodial software and certain token projects. MiCA is not intended to regulate every piece of open-source code or every genuinely decentralised arrangement. However, a business that retains meaningful control, collects fees, markets an interface or provides client-facing services may not be able to rely on decentralisation as a defence. The facts, governance and customer journey all matter.
A CASP licence is not the same as token compliance
MiCA has separate rules for issuers and offerors of crypto-assets, including obligations around crypto-asset white papers. It also creates more demanding regimes for asset-referenced tokens and e-money tokens, commonly associated with stablecoin models.
That means a business may face more than one MiCA workstream. A trading venue may need CASP authorisation. A group issuing a token may need to assess its white paper and marketing obligations. A stablecoin project may need to consider whether the token falls into an asset-referenced or e-money category and whether additional authorisation is required.
These questions should be addressed early, particularly where the same group develops the token, controls the platform and provides custody or payments functionality. A clean legal separation between entities can sometimes be commercially sensible, but it must reflect real governance, staffing, risk ownership and operational substance. Paper-only structures create problems when regulators test who actually makes decisions and where activity is performed.
What does a MiCA CASP application involve?
The application process is an operational exercise as much as a legal one. Regulators expect a CASP to show that its leadership, controls and resources are appropriate for the services it intends to offer.
The application normally addresses the business plan, programme of operations, group structure, ownership, governance arrangements, internal controls, safeguarding of client crypto-assets and funds, outsourcing, complaints handling, conflicts of interest, security and business continuity. It also examines anti-money-laundering arrangements, although these remain closely connected with wider EU and national AML rules.
Senior management and qualifying shareholders receive particular attention. The firm must demonstrate that directors and key function holders are fit and proper, with sufficient knowledge, experience, time and good repute. Founders should not treat this as a formality. A strong product team may still need experienced compliance, risk, AML, information-security and operational leadership before a regulator is comfortable granting permission.
Capital requirements also vary according to the services provided. MiCA sets minimum own-funds thresholds, generally ranging from EUR 50,000 to EUR 150,000, alongside an alternative calculation linked to fixed overheads where that produces a higher amount. Capital alone is not enough. The regulator will assess whether the proposed financial model is realistic, whether the business can absorb operational shocks and whether client assets are properly protected.
Why jurisdiction and structure still matter
MiCA is an EU regulation, but the authorisation process is supervised by national competent authorities. The legal standard is harmonised, while supervisory expectations, application administration and local practical considerations can differ. Choosing the jurisdiction for a CASP should therefore be a strategic decision, not a race to the lowest headline cost.
Cyprus can be attractive for international crypto businesses because of its established financial-services environment, EU access, professional infrastructure and proximity to major markets. Yet the appropriate jurisdiction depends on the business model, management location, planned services, target clients, funding profile and the group’s broader tax and substance requirements.
For example, a founder may operate a technology company outside the EU, establish an EU operating company for CASP activity and retain intellectual property or group holdings elsewhere. That can be a legitimate expansion model, provided the CASP has genuine local substance and the intra-group arrangements are properly documented. Contracts, data access, customer support, personnel, treasury and decision-making must align with the regulatory narrative.
This is where licensing, corporate structuring, tax planning and payment-rail strategy need to be considered together. An authorisation that looks viable in isolation can become difficult to operate if the entity cannot open appropriate bank accounts, secure compliant liquidity arrangements or evidence control over key outsourced functions.
The commercial value of a MiCA CASP licence
A MiCA authorisation does not guarantee bank accounts, institutional liquidity or customer demand. It does, however, provide a stronger basis for discussing those relationships. Banks, payment partners, institutional clients and investors increasingly want evidence that a crypto operator has a regulated framework, accountable management and documented controls.
The passporting mechanism is equally significant. Instead of designing a separate licensing response for each EEA market, an authorised CASP can use a structured notification process to extend its approved services across borders. This can improve speed to market and reduce duplicated compliance work, although local consumer, tax, marketing and financial-crime considerations still need to be assessed.
Authorisation may also strengthen an eventual acquisition or investment process. Sophisticated buyers do not only examine revenue and user numbers. They investigate licence scope, regulatory correspondence, governance records, outsourcing dependencies, client-asset arrangements and unresolved compliance liabilities. Building the business to meet MiCA standards can protect value well before a transaction is on the table.
Timing, transition rules and common mistakes
MiCA’s CASP rules became applicable during 2024, but transitional arrangements may allow certain existing providers to continue operating for a limited period depending on the Member State and their prior legal status. Those arrangements are not a permanent solution and should not be confused with full MiCA authorisation.
The most common mistake is waiting until a product is ready to launch before assessing regulatory scope. By then, the customer journey, custody model, token flow, terms and group structure may all need to change. Another is submitting policies that look polished but bear little relationship to the firm’s real systems and staffing. Regulators can quickly identify when an outsourcing policy, incident plan or AML procedure has not been operationalised.
A better approach is to map the proposed activity first, decide what entity will perform each function, identify the permissions required and build the governance framework around the actual operating model. The application should tell one coherent story: who owns the business, who runs it, how clients are protected, where risks sit and how the firm will grow without losing control.
For businesses planning European expansion, MiCA should be treated as a commercial design decision rather than a late-stage legal obstacle. A carefully built CASP can give your business a safer foundation for market access, partnerships and long-term value creation.