CASP Operations and Lifecycle 2026 — MiCA Passport, Banking, Wind-Down

Authorisation gets a CASP to the starting line. What follows is an operational lifecycle: making the cross-border passport work, securing banking, keeping the management body fit and proper, structuring outsourcing, holding records, staffing the MLRO and compliance function, running KYC, and eventually winding down. The Article 65 passport is the spine of this pillar because it is where most operators first feel the gap between the clean framework and operational reality, but the same gap recurs across every workstream below. The sections that follow walk the lifecycle in turn.

What 18 months of passport experience reveals

MiCA CASP passport went operational with MiCA application date 30 December 2024. By mid-2026, cross-border passport activity has been established across the EU. The framework works — operators authorised in one member state successfully service customers across the EU without separate host-state authorisations.

But operational realities differ from the clean Article 65 framework. Host-state NCAs maintain engagement. Notification mechanics matter operationally. And the passport works differently for different service types. Operators that planned for theoretical Article 65 framework face operational gaps; operators that planned for actual cross-border operational reality face better outcomes.

The operational pattern through 2025-2026:

Passport works as intended for cross-border online services — operators providing custody and exchange services (and trading-platform services) from single-jurisdiction operational base to customers across the EU. Framework delivers regulatory simplification.

Host-state engagement persists for consumer-protection — host-state NCAs maintain engagement on consumer-protection enforcement and marketing-conduct requirements, along with complaint-handling expectations. Operator infrastructure required for major passport markets.

Language requirements in some markets — host-state language requirements for consumer-facing materials substantial in France, Germany, Italy, Spain, Poland. Operators serving substantial customer base in these markets need local-language infrastructure.

AML cooperation across all passport markets — AML cooperation with host-state FIUs and AML supervisory authorities, together with law-enforcement cooperation across all passport markets. Standard infrastructure across the EU.

Service-type variations material — different MiCA services have different passport-operational reality. Custody passport cleaner than advisory passport. Trading-platform passport more complex than exchange passport.

The notification mechanics — what actually happens

Article 65 notification framework on paper:

• Operator notifies home-state NCA of intent to passport services to host-state(s)
• Home-state NCA validates notification, transmits to host-state NCA(s) within 10 working days
• Host-state servicing can begin on confirmation, or at the latest from the 15th calendar day after submitting the notification (Article 65(4))

In practice through 2025-2026, the mechanics:

Home-state validation engagement — home-state NCA typically engages with operator on notification adequacy. Standard notifications complete within 10 working days; complex notifications (multi-service, multiple host-states) can extend to 4-8 weeks.

Host-state engagement post-notification — host-state NCAs typically engage with passporting operator post-notification. Requests for operator information beyond formal notification and engagement on local customer-protection arrangements, as well as interaction on complaint-handling infrastructure.

Operational preparation expected — host-state NCAs expect operator preparation for local servicing: local customer-protection materials and complaint-handling infrastructure, plus operator knowledge of local consumer-protection framework.

Ongoing engagement — host-state engagement isn’t one-time. Ongoing supervisory engagement on consumer-protection matters and marketing-conduct reviews, complaint-handling oversight included.

The practical implication: passport notification is procedural but operators should plan host-state engagement preparation 8-16 weeks before notification, not reactively after.

What works — passport patterns that operationally succeed

Operational patterns demonstrating passport effectiveness through 2025-2026:

Cross-border online services without local presence — operators providing services entirely through online infrastructure without local presence in host-state. Common pattern for custody, exchange, brokerage services. Framework delivers regulatory simplification — operators face home-state primary supervision and host-state consumer-protection engagement, with unified operations.

Cross-border services with local marketing partnerships — operators providing core services from home-state while partnering with local marketing or business-development partners in host-states. Substantial pattern for operators serving substantial customer base in multiple member states. Operational complexity but framework supports the structure.

Cross-border services with local advisory partnerships — for specialised products (advisory services, portfolio management), operators frequently structure with local advisory partners providing customer engagement while core services delivered from home-state CASP. Article 65 framework supports this structure.

Multi-jurisdictional operations with single CASP authorisation — substantial operators with customer base across multiple member states operating under single home-state CASP authorisation rather than multiple national authorisations. Framework delivers operational simplification compared to pre-MiCA national-licence patchwork.

What requires operational work — passport patterns that need preparation

Operational patterns requiring preparation through 2025-2026:

Substantial customer base in single host-state — operators serving substantial customer base in single host-state (Germany, France, Italy, Spain) face host-state operational expectations even without separate authorisation. Local-language infrastructure, local customer-protection materials, complaint-handling infrastructure, host-state regulatory engagement.

Advertising and marketing in host-states — host-state marketing-conduct requirements. Operators with marketing in host-states face engagement on local conduct compliance. Some host-states (notably Spain, France) have heightened marketing-conduct requirements applying to passporting operators.

Trading-platform passport — Article 76 + 82 trading-platform obligations apply across passport markets. Host-state interaction on market-conduct expectations, host-state engagement on consumer-protection arrangements for trading-platform users.

Advisory and portfolio-management services — host-state suitability requirements, host-state customer-protection arrangements for advisory products substantially. Operators frequently structure with local advisory partners to manage host-state expectations.

Service-type variations in passport reality

Different MiCA services have different passport-operational realities:

Custody passport — cleanest passport experience. Custody services largely commodity from passport perspective. Host-state engagement focused on customer-protection arrangements (segregation under Article 75, customer-asset return arrangements). Standard infrastructure across passport markets.

Exchange and execution-of-orders passport — clean for online services. Host-state engagement on best-execution arrangements (Article 80), customer-protection for execution services. Standard infrastructure with customer-protection arrangements.

Trading-platform passport — more complex. Host-state engagement on Article 76 + 82 trading-platform arrangements and market-conduct expectations, alongside customer-protection arrangements for trading-platform users. Operators face host-state engagement on platform-operational arrangements.

Advisory services passport — most complex. Host-state suitability requirements, host-state local-customer arrangements substantial. Many operators structure with local advisory partners managing customer engagement.

Portfolio-management passport — similar to advisory passport in complexity. Host-state engagement on portfolio-management arrangements, customer-protection requirements.

Cross-border supervisory cooperation — Article 95 in practice

Article 95 supervisory-cooperation framework supports passport operations:

Home-state primary supervision — home-state NCA supervision continues regardless of passport scope. Primary supervisory relationship is home-state.

Host-state engagement coordinated through ESMA — coordination through ESMA when host-state engagement requires home-state cooperation or supervisory action.

Joint supervisory actions — cross-border supervisory matters can trigger joint home-state + host-state supervisory action, typically coordinated through ESMA.

Information sharing — ongoing information sharing between home-state and host-state NCAs on supervisory matters affecting passporting operators.

Operator engagement — operators face interaction with both home-state primary supervisor and host-state engagement authorities. Coordination infrastructure required for major operators.

Common operational mistakes and how to avoid them

Through 2025-2026 implementation experience, common operational mistakes include:

Inadequate host-state preparation — operators that prepare for theoretical Article 65 framework face host-state engagement gaps. Operational planning for major passport markets is essential.

Underestimating language requirements — host-state language requirements affect major passport markets. Local-language infrastructure required for substantial customer-base markets.

Inadequate consumer-protection infrastructure — host-state engagement on consumer-protection arrangements. Operators with consumer-protection infrastructure designed for home-state market only face host-state engagement on inadequate arrangements.

Inadequate complaint-handling infrastructure — complaint-handling expectations across passport markets. Infrastructure required including local-language complaint procedures, cross-border complaint coordination.

Underestimating AML cooperation requirements — AML cooperation requirements across passport markets. Infrastructure required including FIU reporting across passport markets, substantive law-enforcement cooperation arrangements.

Banking access — the friction point post-authorisation

A MiCA authorisation answers the supervisory question — is the firm fit, capitalised, and governed to provide crypto-asset services. It does not answer the operational one: which bank holds the operating funds, settles client fiat, and accepts the AML risk of the customer base. Several authorised CASPs in 2025-2026 sat in that gap — licensed by the supervisor, unbanked by every EEA institution they approached, unable to onboard customer fiat flow for months. The friction is structural, not idiosyncratic: EEA banks built their risk frameworks around traditional counterparts, and CASPs sit outside them even when fully licensed.

Two MiCA provisions drive the banking workstream. Under the client-asset safeguarding rule (MiCA Article 70), client funds (fiat received pending a crypto purchase, or fiat held against a pending withdrawal) must be deposited at an EEA-authorised credit institution or central bank, segregated from the CASP’s own assets, identified separately in accounting, and not used for the CASP’s own account. The rule does not prescribe which institution — only that the chain ends at one. Class 3 firms running a trading platform pick up additional operational expectations under the custody and operations rulebook (Article 75). Beyond MiCA itself, the EBA Opinion on the interplay between PSD2 and MiCA (June 2025) sets the supervisory expectation for hybrid arrangements (fiat on/off ramps, customer top-up flows, withdrawal routing) that sit at the PSD2-MiCA boundary.

The banking patterns operating successfully in 2026 fall into four shapes:

• Direct EEA bank relationship. The cleanest pattern, hardest to obtain — typically a specialist or challenger bank rather than a domestic universal bank, with material lead time for onboarding (months, not weeks).
• EMI partnership. An electronic money institution holds operating funds and runs the fiat rail, itself safeguarding funds at a credit institution. The practical default for retail-facing Class 2 firms.
• Banking-as-a-service partner. A BaaS provider holds the regulated authorisation and provides accounts, rails, and (sometimes) safeguarding-grade infrastructure as a service; the CASP integrates by API.
• Multi-bank redundancy. Mature CASPs hold at least two operating relationships, typically across jurisdictions. After de-banking events hit several authorised CASPs in 2025-2026, redundancy became a planning default rather than an exception — and for Class 3 platforms with institutional flow, effectively a requirement.

CASPs that also issue ARTs (Title III) or EMTs (Title IV) run a second banking workstream entirely. EMT reserve assets must sit in credit-institution deposits, central-bank reserves, or secure low-risk assets; ART reserves must be invested in highly liquid instruments under specific composition, custody, and segregation rules reviewed at authorisation. A hybrid CASP-issuer therefore runs three parallel workstreams (operational, client-fund safeguarding, and reserve-asset) and should plan all three from the start. National supervisors treat the banking arrangement as a credibility signal at authorisation: a documented operating relationship and a documented safeguarding arrangement demonstrate seriousness, and filing without addressing banking is a real deficiency in supervisory practice.

Management body fit and proper — who can run a CASP

A MiCA application is not only a test of the firm; it is a test of the people. Before a national competent authority authorises a CASP, it has to be satisfied the firm will be run soundly — a function of who sits on the management body and who stands behind the firm’s significant shareholdings. Two groups fall in scope: the management body (directors and senior managers, assessed individually and collectively) and qualifying holders (the natural persons behind significant shareholdings or other control). A founder who is both controlling shareholder and CEO is assessed in both capacities.

Suitability for the management body breaks into four assessment areas:

• Good repute. No record indicating the contrary — relevant criminal history and prior regulatory findings, plus financial-integrity issues such as insolvency or disqualification. Good repute is evidenced through criminal-record certificates and disclosure declarations, not asserted.
• Knowledge, skills, and experience. Individually as appropriate and collectively as a body, adequate to understand the firm’s activities including its main risks — custody and key-management risk, market-abuse risk on a venue, ICT and operational-resilience risk, and crypto-specific AML typologies.
• Honesty, integrity, and independence of mind. Sufficient independence to assess and challenge management-body decisions. A board that cannot challenge a dominant founder is a governance weakness supervisors look for.
• Time commitment. Each member must be able to commit sufficient time. A director on many unrelated boards, or a CEO plainly running other businesses full-time, raises a time-commitment concern — the supervisor expects the arithmetic to add up.

Beyond the individual, the board as a whole must hold adequate knowledge, skills, and experience. A board can be collectively suitable even if no single member covers everything, provided the mix covers the firm’s activities and risks — which makes board composition a design decision at application stage, not an afterthought. Applicants concentrate on directors and frequently under-prepare the qualifying-shareholder assessment: the ownership chain must be transparent to the natural persons at the top, and those persons are assessed for good repute and integrity. Source-of-funds evidence is often required. An opaque structure or a controller who cannot evidence source of funds can stall an application even where the management body is strong. The single most useful principle is to disclose proactively — a disclosed, explained, resolved matter is almost always survivable; the same issue undisclosed and then discovered becomes a credibility problem.

Outsourcing under Article 73 — and the DORA overlay

MiCA Article 73 permits a CASP to use third parties for operational functions, provided the arrangement does not impair the quality of internal control or the supervisor’s ability to monitor compliance. The Article enumerates four conditions: the arrangement must be in writing; the CASP must retain the expertise and resources to evaluate and supervise the outsourced function; the arrangement must not delegate senior-management responsibilities; and the CASP must take steps to avoid undue additional operational risk. The text is short, but the interpretive surface is large, and national supervisors have diverged on the operational reading.

In 2026 supervisory practice, the routinely outsourceable functions are the execution layer: ICT and cloud infrastructure (subject to DORA documentation), custody-tech (Fireblocks, Copper, Anchorage), exchange-tech, KYC verification (Sumsub, Onfido, Veriff), AML transaction monitoring and chain analytics (Chainalysis, Elliptic, TRM Labs), sanctions screening (World-Check, ComplyAdvantage), customer support, accounting, and back-office reconciliation. What cannot be outsourced is the decision and oversight layer: senior-management decision-making, risk-management oversight, compliance oversight, the MLRO function (with narrow exceptions, see below), and internal-audit oversight (the audit can be performed externally, but engaging, reviewing, and escalating findings stays in-house). The boundary test in every case is whether the CASP retains the authority to direct the function and the capability to evaluate its output — a KYC provider the CASP cannot meaningfully evaluate is over-outsourced even if the contract is technically Article-73-compliant.

The MLRO function is the most-debated edge case. Cyprus accepts MLRO outsourcing for small firms (typically below EUR 5M revenue and EUR 25M custody) with documented escalation paths to a CySEC-registered AML services firm; Lithuania accepts narrow outsourcing of support functions but requires a resident in-house MLRO; Estonia, Malta, and Ireland expect an in-house function with no outsourcing; and the Czech Republic formally permits outsourcing but ČNB practice has narrowed acceptability since 2024. For a multi-jurisdiction firm passporting from a permissive home to a strict host, the realistic answer is to plan to the strictest jurisdiction — in-house MLRO from day one.

For any ICT outsourcing, DORA Articles 28-30 layer additional requirements on top of Article 73. Article 28 requires a register of all ICT third-party providers, with categorisation and criticality classification, plus contract summaries available to the supervisor. Article 29 requires a documented ICT third-party risk-management framework covering selection, monitoring, concentration risk, and per-provider exit planning. Article 30 governs the designation of critical ICT third-party providers (CTPPs) — providers serving multiple regulated firms whose failure could create systemic risk, subject to EU-level oversight by a Lead Overseer; major cloud providers (AWS, Microsoft Azure, Google Cloud) are expected to be designated. The most common 2026 supervisory deficiency in ICT-outsourcing reviews is an incomplete register — many CASPs cover cloud and custody-tech but omit KYC vendors and AML tooling (and chain analytics). A clean file pairs a board-approved outsourcing policy with a live register, per-provider risk assessments, per-provider exit plans with specific triggers, and a quarterly oversight cadence. The principle: decision and oversight live in-house; the work itself can sit anywhere DORA and Article 73 permit. Two patterns to avoid — importing FCA, MAS, or VARA outsourcing structures directly (the EU framework is heavier on senior-management substance retention) and treating exit triggers as boilerplate (supervisors expect specific triggers and a defined exit timeline, not generic “material breach” language).

Record-keeping under Article 68

MiCA Article 68 is short on the page but expansive in operational implication. It requires CASPs to keep records of all services provided, transactions executed, orders received, and communications with clients and third parties for a minimum of five years, extendable to seven on competent-authority request. Failure carries administrative sanctions up to EUR 5M or 10% of annual turnover under Article 111.

Each element unpacks into infrastructure. Services provided means trade records for exchange, deposit/withdrawal and balance-state records for custody, order books for execution, and decision records for advice and portfolio management. Transactions executed means full transaction-level granularity (customer, counterparty, asset, amount, price, timestamp, venue, fees), not just summaries. Orders received means time-stamped order books including unfilled, cancelled, and modified orders. And communications with clients (the obligation operators most underestimate) covers email, live chat, support tickets, recorded calls, and structured messaging, plus communications with third parties about specific client matters.

The operational lever is the format requirement: records must be kept in a format that lets the competent authority retrieve and process them without delay. That rules out bulk archive storage without indexing and records dispersed across operational systems with no unified retrieval, along with records locked in proprietary vendor formats. The infrastructure that passes the retrievability test is consolidated, indexed, queryable, and exportable — most CASPs build it through a data-warehouse layer that ingests from operational systems, at a typical build cost of EUR 200-500k for a mid-tier operator. The communications-retention obligation is the broadest gap: corporate email systems often expire records after 1-2 years and customer-service platforms default to shorter retention, while consumer-grade mobile messaging (Telegram, Signal, WhatsApp) has no enterprise archiving — several CASPs in 2025-2026 received NCA findings for failing to retain client-facing mobile-messaging communications. Records can be stored anywhere geographically but must remain accessible to the EU NCA without delay (a typical expectation of 24-72 hours for routine requests), so EU-resident storage is the lowest-friction path, with non-EU storage requiring a documented transfer mechanism such as the EU-US Data Privacy Framework or Standard Contractual Clauses. Article 68 also overlaps with (but is distinct from) AMLR/AMLA record-keeping (typically five years from end of relationship), Article 75 custody record-keeping, and Travel Rule (TFR) records; most CASPs build a unified retention architecture with metadata flags routing each record type to the right obligation.

The MLRO role, substance, and the wider compliance function

The crypto compliance officer role under MiCA runs broader than pre-MiCA VASP compliance positions. It combines MLRO duties (customer-due-diligence oversight, suspicious-activity reporting to the national FIU, AML-programme management, sanctions-screening oversight) with broader compliance leadership across conduct, prudential, ICT/DORA resilience, customer-asset protection, and market abuse, plus senior-management responsibility with direct board reporting and personal accountability. It is a recognised senior management function under MiCA Article 68 and national equivalents (for example the UK FCA’s SMF-16 and SMF-17). The combined role typically requires a senior-tier hire at EUR 120,000-200,000 base for a mid-tier CASP, rising to EUR 200,000-400,000 at premier tier. Role splits scale with the operator: small CASPs combine MLRO and Head of Compliance, sometimes with DPO; mid-tier firms split MLRO from Head of Compliance; substantial firms run a full senior-management split. The role carries material personal liability (civil regulatory penalties, loss of personal authorisation, and in extreme cases criminal liability), so operators should expect a compliance officer to push back on commercial pressure to relax controls.

The MLRO function is also the AML side of MiCA’s substance test, and national regulators have diverged sharply on what “adequate seniority, independence, and resources” means in 2026. The expectations cluster into three groups. The strict jurisdictions are Estonia (FSA), Malta (MFSA), and Ireland (CBI). They expect a local-resident MLRO and a defined FTE allocation, together with prior CASP-relevant experience; Malta requires functional separation of the MLRO and Compliance Officer for above-threshold Class 3 firms, and Ireland applies banking-grade governance expectations across all classes. The middle jurisdictions are Lithuania (Bank of Lithuania) and the Czech Republic (ČNB / FAÚ). They expect local residency and an FTE expectation scaled by licence class, as well as local-language capability for FIU correspondence. The lighter jurisdiction, Cyprus (CySEC), expects residency plus an AML qualification (CAMS, ICA International Diploma, or equivalent) with more flexibility on FTE and role-combination. Three principles for any file: plan to the strictest applicable jurisdiction (a Cyprus-to-Estonia passport should satisfy the FSA, not CySEC); match MLRO experience to the firm’s risk profile (Class 3 custody firms need high-volume transaction-monitoring and self-hosted-wallet CDD experience); and document the MLRO appointment with the same rigour as senior management, including source-of-funds evidence where the MLRO holds significant equity.

KYC operations

Crypto KYC operates at the intersection of MiCA, AMLR (Regulation (EU) 2024/1624), FATF guidance, and national AML frameworks. The compliance build runs EUR 200-500k in the first year and EUR 100-300k per year ongoing for a mid-tier CASP, and it has six operational components: customer identification, identity verification, beneficial-ownership verification, PEP and sanctions screening, customer risk assessment, and ongoing monitoring.

Identity verification must run through reliable independent sources, not customer self-attestation — the operational standard is document authentication (security-feature validation, MRZ extraction, tamper detection) plus a biometric face match with liveness detection, plus proof-of-address documentation within three months. Corporate customers require beneficial-ownership transparency at the 25%+ ownership/control threshold, with registry verification where available (UK Persons of Significant Control register, EU UBO registers) and careful identification of the ultimate natural person behind layered structures. PEP and sanctions screening runs continuously: foreign, domestic, and international-organisation PEPs plus their family and close associates, screened against the EU consolidated list, UN, US OFAC, UK, and national lists at onboarding and then daily, with an alert-handling workflow for false-positive disposition and confirmed-match escalation. Enhanced due diligence applies to higher-risk customers (high-risk jurisdictions, PEPs, high transaction values, complex ownership, and product-risk factors such as privacy coins or mixer activity) and requires source-of-funds information and senior-management approval, alongside tighter ongoing monitoring. KYC is not a one-time onboarding exercise: transaction monitoring, periodic CDD refresh, behavioural analytics, and suspicious-activity reporting to the national FIU all run for the life of the relationship. Records are retained five years from the end of the relationship under AMLR, extendable on supervisor request. Note that the pre-MiCA exemptions for low-value transactions have been removed — KYC applies to all CASP onboarding regardless of transaction value.

Wind-down planning under Article 74

Article 74 requires a plan that supports an orderly wind-down of the CASP’s activities under national law, including the continuity or recovery of any critical activities, and it must show the CASP can wind down without causing undue economic harm to its clients. The obligation applies to CASPs providing the services in Articles 75 to 79: custody and administration, operating a trading platform, exchanging crypto-assets for funds or other crypto-assets, executing orders, and placing. A CASP that only advises, receives and transmits orders, manages portfolios or provides transfer services is not caught by Article 74, though its NCA may still ask how it would exit.

A plan has to work in three situations: a board decision to stop, a supervisor-driven exit (withdrawal of authorisation under Article 64), and insolvency, where the aim is to protect client assets. Customer notification is the most resource-intensive part: several channels, the languages of the customer base, notification in waves, clear instructions and enough support capacity for the surge in contacts. Asset return is the legal core. Client crypto-assets stay segregated under Article 75 throughout and go back either to wallets the customer designates, with address verification and an audit trail, or to another authorised CASP with the customer’s consent; fiat balances return through the banking arrangements, which can tighten once a wind-down is public. Every return needs a record that will stand up to the supervisor and to later disputes.

ICT exit is the most under-planned piece. DORA Article 28 already requires exit strategies for ICT third-party providers, so a CASP with working exit plans for its cloud, custody technology, KYC and analytics providers has most of what the wind-down needs. The last steps are regulatory: withdrawal of authorisation under Article 64, the ESMA register update, keeping AML records for the period national AML law sets, tax closure and dissolution under national law. A plan that nobody has reviewed since it was written tends to fail when it is used, so review it when the business changes and involve the people who would have to carry it out.

MiCA does not give CASPs a recovery-and-resolution regime of the banking kind. Recovery plans (Article 46) and redemption plans (Article 47) apply to issuers of asset-referenced tokens, and the colleges in Article 119 exist for issuers of significant asset-referenced and e-money tokens. For a CASP, the Article 74 plan, client-asset segregation and national insolvency law are the framework. Earlier versions of this page described an Article 84 recovery and resolution regime for every CASP; Article 84 concerns the assessment of proposed acquisitions, and that regime does not exist.

The framework’s strategic implication

For operators planning EU strategy under MiCA, CASP passport framework has strategic implications:

Home-state selection matters substantively — different home-state NCAs have different supervisory cultures, processing capacities, and operational engagement styles. Home-state selection affects ongoing operational experience for the entire passport network.

Passport scope planning — operational planning required for major passport markets. Not all passport markets equal in operational requirements.

Local-language infrastructure investment — infrastructure investment for major passport markets pays operational dividends through host-state engagement.

Cross-border operational coordination — operational infrastructure managing home-state + multiple host-state supervisory engagements. Operational overhead is real but framework delivers compared to pre-MiCA national-licence patchwork.

Long-term strategic flexibility — passport framework supports strategic flexibility: operators can adjust passport scope and add or remove host-state servicing, restructuring operational arrangements without changing home-state authorisation foundation.

For operators using or planning CASP passport, the framework works — but operational reality requires engagement with host-state expectations beyond the clean theoretical Article 65 framework.