MiCA CASP Authorisation 2026 — Procedure, Capital & Timeline

How the procedure works in practice

Article 63 of MiCA sets the procedural framework for CASP authorisation. The article does not set the core requirements — those live in Articles 59 through 62 (the conditions for authorisation and the content of the application), Articles 66 through 84 (the operating requirements), and the Annexes (capital and document requirements). Article 63 governs the procedure by which an applicant gets from filing to decision.

This guide runs the whole authorisation arc in one place: what goes in the file (Article 62), which class to apply for (Annex IV), how much capital to hold (Article 67), how the clock runs and how long it really takes, the refusal grounds, and what happens at the other end if authorisation is withdrawn (Article 64).

The procedure has six moving parts:

1. Filing. The applicant submits the Article 62 authorisation file to the National Competent Authority of the chosen home state.
2. Completeness assessment. The NCA has 25 working days to assess whether the file is complete under Article 63(3).
3. Statutory clock start. The clock under Article 63(4) starts when the NCA acknowledges the file as complete.
4. Substantive review. The NCA assesses the file against the substantive requirements during the five-month window, with possible information requests under Article 63(5).
5. Cross-NCA and ESMA cooperation. The NCA cooperates with other relevant supervisors under Article 63(6) and notifies ESMA under Article 109.
6. Decision. The NCA issues a grant, refusal with reasons, or conditional grant.

Each step has procedural mechanics that affect the real timeline.

What goes in the application — the Article 62 checklist

There is no mystery about what a MiCA CASP application contains. Article 62 lists it, and ESMA’s authorisation RTS fills in the detail. You can read the whole list before you spend a euro. The file is a defined pack — and what separates a six-month authorisation from a fifteen-month one is not knowing the list, it’s the depth and internal consistency of what you put against each line.

A MiCA CASP application under Article 62 must cover the following — each a real document or set of them, not a checkbox:

• Programme of operations — what services the firm will provide, to whom, how, and over what timeline. This anchors everything else; the NCA reads the rest against it.
• Governance arrangements — board composition, reporting lines, the three-lines-of-defence model, and how decisions get made and overseen.
• Identity and fit-and-proper of the management body and qualifying shareholders — who controls and runs the firm, with evidence they are suitable.
• Internal control mechanisms — risk management, internal audit, compliance monitoring.
• AML/CFT procedures — the written programme: risk assessment, customer due diligence, enhanced due diligence, transaction monitoring, sanctions screening, suspicious-transaction reporting.
• ICT systems and security arrangements — including DORA-aligned ICT-risk management, incident handling, and third-party-risk provisions.
• Custody and segregation policy — for firms holding client crypto-assets, how client assets are safeguarded and kept separate, under Article 75.
• Conflicts-of-interest policy — identifying, preventing, managing, and disclosing conflicts.
• Complaints-handling procedure — how client complaints are received, logged, and resolved.
• Business continuity — how the firm keeps operating, and winds down in an orderly way if it has to.
• Prudential evidence — own funds under Article 67, the higher of the Annex IV class floor or one-quarter of fixed overheads. (How that calculation works is the prudential-capital section below.)

A complete pack runs roughly 150 to 250 pages once drafted properly — but the page count is not the point; the coherence is.

Three roles need real people, not placeholders. The management body must be fit and proper, with the collective experience to run a regulated crypto firm. The compliance officer owns the conduct and ongoing-compliance programme. The MLRO owns AML/CFT and the relationship with the financial intelligence unit. Both the compliance officer and the MLRO need the right qualifications and direct board access; depending on the member state, they may also need local residency or substantive engagement. NCAs scrutinise these appointments; nominee or thinly-engaged function-holders are a recurring reason for follow-up questions.

Three areas generate most of the friction in review. AML depth — generic manuals that do not reflect the firm’s products and customer base draw detailed questions. ICT and DORA — the resilience evidence is heavy, and venture-stage tech operations routinely underbuild it. Governance substance — boards that look thin on financial-services experience, or ownership structures that obscure control, get probed. None of these three stall points is about the document list itself; they are about whether what is in the documents holds up.

The completeness assessment

The completeness assessment under Article 63(3) is the first substantive interaction between the applicant and the supervisor. The NCA has 25 working days from receipt to assess whether the file contains all required documents listed in Article 62 and the implementing technical standards.

The completeness assessment is not a thorough review. The NCA checks whether the required documents are present and whether they meet basic format requirements. Substantive evaluation of governance quality and AML framework adequacy, along with prudential structure, happens after completeness is acknowledged.

Two outcomes:

Complete file acknowledgment. The NCA confirms the file is complete. The Article 63(4) five-month clock starts. Substantive review begins.

Incomplete file determination. The NCA identifies missing or non-compliant documents. The applicant has the opportunity to remedy. The 25-working-day window resets on resubmission of the corrected file. The five-month clock does not start until completeness is achieved.

The practical implication: applicants who file incomplete face a real timeline extension even before the substantive clock starts. Files that miss required documents lose six to twelve weeks before thorough review begins. Tight pre-filing review of completeness against Article 62 and the implementing standards is high-impact work.

Choosing your CASP class — 1, 2, or 3

The class decision sits at the start of every application and locks in capital, governance depth, and substance for the life of the licence. MiCA Annex IV lists ten crypto-asset services and groups them into three nested tiers — Class 2 includes everything Class 1 covers, and Class 3 includes everything Class 2 covers. A CASP’s class is set by the single highest-risk service it intends to offer, not by the volume mix.

Class 1 — EUR 50,000 minimum capital:

1. Reception and transmission of orders for crypto-assets on behalf of clients
2. Providing advice on crypto-assets
3. Providing portfolio management on crypto-assets
4. Placing of crypto-assets
5. Execution of orders for crypto-assets on behalf of clients
6. Providing transfer services for crypto-assets on behalf of clients

Class 2 — EUR 125,000 minimum capital (adds three services): 7. Custody and administration of crypto-assets on behalf of clients 8. Exchange of crypto-assets for funds 9. Exchange of crypto-assets for other crypto-assets

Class 3 — EUR 150,000 minimum capital (adds one service): 10. Operation of a trading platform for crypto-assets

The economic logic: Class 1 services involve client information and decision-making but no direct custody of client assets; Class 2 brings the firm onto the balance-sheet-risk side by introducing custody and the exchange function; Class 3 adds the systemic risk of running an organised market.

The visible step-up between classes is the capital floor. The less-visible step-up is governance. Moving Class 1 to Class 2 (introducing custody) brings custody operational rules under Title V Chapter 3, segregation of client crypto-assets, client-asset reporting, and heavier DORA expectations. Moving Class 2 to Class 3 (adding a trading platform) brings an operating-rules document, market-abuse monitoring under Title VI, pre- and post-trade transparency, best-execution obligations, and significantly stricter ICT-resilience expectations — trading-platform CASPs are typically treated as systemically more important by national supervisors. The capital differential between Class 2 and Class 3 (EUR 25,000) materially understates the governance differential. Weight governance discipline far above headline capital.

Three questions decide the class:

1. Will the firm hold client crypto-assets at any point? If yes, Class 2 minimum. The custody scope extends to any arrangement where the firm controls the keys, even briefly between order execution and client-side wallet delivery.
2. Will the firm operate any matched-trading or auction venue? If yes, Class 3. This includes orderbook exchanges and RFQ platforms, and any matching infrastructure where multiple buyers and sellers interact through the firm’s system.
3. Will the firm only advise, route, or transfer without custody? If all three are yes, Class 1 may be the right choice — but verify the model is genuinely custody-light and revenue can sustain at a Class 1 footprint.

The vast majority of commercially active CASPs end up at Class 2 because exchange or custody is part of the economic model. Class 1 fits a small set of specialised use cases (pure advisory, order-introduction, portfolio managers using third-party custody, transfer-only providers). Class 3 fits the smaller set whose core business is operating an organised market.

A CASP authorised at one class can later expand to a higher class, but the expansion is a variation of authorisation, not an automatic uplift. The supervisor reviews the firm against the new tier afresh — capital top-up, governance-package update, substance review, and a DORA resilience review scaled to the new operations. Variations are typically faster than fresh authorisations because much of the file is already on supervisory record; plan two to four months, varying by supervisor and complexity. The single most expensive mistake is launching at Class 1 with a hidden custody dependency that surfaces within the first six months. Authorise once at the right tier.

Prudential capital and the Article 67 own-funds calculation

Article 67 imposes a continuous own-funds requirement on every authorised CASP. The rule holds two numbers in tension and a tie-breaker:

• Static floor. A permanent minimum tied to the service class under Annex IV: EUR 50,000 (Class 1), EUR 125,000 (Class 2), EUR 150,000 (Class 3).
• Dynamic floor. One-quarter of the previous year’s fixed overheads, calculated under the methodology in Commission Delegated Regulation (EU) 2025/305.
• Tie-breaker. The CASP must hold the higher of the two. The other becomes irrelevant for that year.

For a first-year CASP without a full year of operating expenses, the static floor is the live constraint. By the time of the first audited annual accounts, the dynamic floor typically crosses the static, and from that point the calculation drives the requirement.

What counts as fixed overheads. The starting point is total expenses from the audited annual accounts. From that, the CASP deducts variable remuneration (performance bonuses, profit-sharing), discretionary commissions tied to revenue, fees and brokerage that vary with transaction volume, depreciation of intangible assets, variable expenses related to investment in subsidiaries, and non-recurring extraordinary items. What remains is the fixed-overheads figure; multiply by 0.25. The methodology mirrors the CRR fixed-overheads requirement for investment firms but adds MiCA-specific items — most notably crypto-asset network fees passed through to clients (deductible) versus internal node-operation costs (not deductible). Applying the investment-firm guidelines verbatim produces small but meaningful misalignments.

Worked trajectory. Take a typical Class 2 Lithuanian exchange. Initial capital at authorisation is EUR 125,000 (the Class 2 floor). With Year 1 fixed overheads of EUR 600,000, ongoing capital rises to EUR 150,000 (600,000 / 4, which exceeds the floor). Year 2 at EUR 900,000 fixed overheads gives EUR 225,000. Year 3 at EUR 1.4 million gives EUR 350,000. The firm needs to plan a capital trajectory, not a one-off injection. Founders who capitalise to the floor and assume that is the steady state under-fund the firm.

Composition — CET1, not generic cash. Own funds must be Common Equity Tier 1 as defined in CRR Article 26 — paid-in share capital, share premium, audited retained earnings, and other reserves from retained earnings. Shareholder loans (even subordinated, even interest-free), convertible notes until conversion, off-balance-sheet guarantees, and crypto-asset holdings including stablecoins are all ineligible. The standard CRR deductions apply by reference — goodwill, intangibles, and deferred tax assets that rely on future profitability come off. CASPs that capitalise platform-development costs as intangibles often find their CET1 20-40% lower than their accounting equity. The capital must be held in fiat at an EEA-licensed credit institution or e-money institution, which provides a confirmation letter to the regulator at authorisation and annually thereafter.

Custody insurance. Class 2 and Class 3 firms holding client assets must maintain liability insurance covering the custody risk they bear, separate from the own-funds floor. Article 67(5) also allows an insurance policy to replace up to 100% of the minimum, but only where it covers the specified operational risks, the insurer holds a credit rating of at least A-, and the policy runs at least 12 months and is uncancellable mid-term other than for non-payment. In 2026 the MiCA-eligible insurance market is thin — a handful of London-market underwriters offer compliant policies at 80-150 bps of the covered amount per year. For most CASPs holding the cash is cheaper than insuring the cash equivalent; placement also runs four to six weeks, so arrange it before filing, not after.

Compliance is continuous, not annual — the CASP must hold the calculated amount at all times. Supervisors expect monthly internal calculation and quarterly board sign-off. When the dynamic floor jumps year-on-year, the higher amount applies from the date the prior-year accounts are finalised; national supervisors generally allow a 30-day grace period for the top-up. Persistent shortfall is a basis for authorisation withdrawal under Article 64.

The five-month clock and how long it really takes

Article 63(4) sets the supervisor’s decision window at five months from completeness acknowledgment. The clock is a statutory deadline — the supervisor must issue a decision within five months unless the clock is paused under Article 63(5).

The clock is not the real timeline. Two factors stretch the practical window:

Information requests under Article 63(5). The supervisor can suspend the clock during information requests. Suspension runs from the date of the information request to the date of fully-complete response. Most CASP files receive two to four information requests during review. Cumulative suspension commonly adds two to four months to the real timeline.

Cross-NCA consultation under Article 63(6). Where the applicant has a related authorisation in another member state (a credit institution or investment firm parent, or a prior CASP authorisation), the home NCA must consult the related NCA. Consultation can run in parallel with substantive review or can extend the timeline depending on the home NCA’s process.

The practical real timeline for clean files runs six to nine months. Files with substance gaps run ten to fifteen months. Files with serious deficiencies (insufficient capital, inadequate governance, AML gaps) face either refusal or extended remediation engagement that can stretch fifteen months or longer.

There is one more reason the calendar runs longer than the statutory numbers suggest: the clock starts only once the file is complete, and getting there is its own phase. A file that arrives thin triggers a cycle: the NCA identifies gaps and the applicant fills them, then the NCA re-checks, and each cycle is weeks. The pre-completeness phase is where most calendar time goes and it is not captured in the statutory figures at all. The single biggest determinant of timeline is therefore file quality at filing; the fastest applications are not the ones filed earliest, but the ones filed complete. Supervisory pace also varies by jurisdiction — the clock is EU-wide, the experience is not, because national competent authorities move at different real-world speeds depending on their CASP caseload and capacity.

Cited expert

In addition, [ESMA](/glossary/esma/) is actively contributing to MiCA's effective implementation, in close cooperation with the European Banking Authority and National Competent Authorities, including through intense supervisory convergence efforts, information sharing, and guidelines.

For planning, a sensible model is: two to four months of preparation to build a genuinely complete, well-evidenced file; weeks in the completeness phase if the file is strong, longer if it is thin; the roughly five-month statutory assessment once complete, paused by information requests; and notification within five working days of the decision. The honest headline for a founder is to plan for the better part of a year from “we decide to do this” to “we hold the licence” — with the preparation phase being the part you most control. The CASP cost calculator helps size the budget around that runway.

Information requests in practice

Information requests are the most procedurally important feature in operation. The requests reshape the file and surface supervisor concerns; they also produce the bulk of the timeline variance.

Typical request profile:

First request. Two to four weeks after completeness acknowledgment. Covers governance framework details, capital adequacy calculations, AML risk assessment, and senior personnel substance. Response window two to four weeks.

Second request. Six to ten weeks after first response. Drills into the supervisor’s principal concerns from the first round. Often covers ICT and DORA framework, outsourcing arrangements, conflicts of interest, and business model specifics.

Third request. Often more focused. Addresses remaining concerns or surfaces issues from cross-NCA consultation. Response window typically two to four weeks.

Fourth request (if needed). Targeted remediation requests on specific issues. Sometimes a fourth round signals the file is heading toward refusal unless the underlying concern is addressed.

Each round of requests pauses the clock. Each response resumes it. Operators that respond promptly with comprehensive answers minimise pause-time. Operators that respond slowly or with partial answers extend the real timeline.

The principle is procedural but the substance matters. Information requests are the supervisor’s main mechanism for working through file weaknesses. Treating requests as primarily administrative misreads the supervisor’s purpose.

Cross-NCA cooperation under Article 63(6)

Article 63(6) requires cooperation with NCAs of related authorisations. The cooperation framework operates in three main scenarios:

Credit institution parent or affiliate. If the CASP applicant is a subsidiary or affiliate of an EU credit institution, the home NCA consults the credit institution’s home supervisor. The consultation typically focuses on group-structure governance and capital flows, alongside risk-management integration.

Investment firm parent or affiliate. Similar consultation framework where the CASP applicant has an EU investment firm parent or affiliate. Focus areas include MiFID II / MiCA boundary issues and conduct framework integration, plus operational risk management.

Prior CASP authorisation in another member state. Where the applicant or beneficial owners have prior CASP authorisation in another member state, the home NCA consults. Particularly relevant where the operator has passport activity or a group corporate structure spanning multiple member states, or where beneficial owners appear in adjacent CASP files.

Cooperation under Article 63(6) is mandatory where applicable. Skipping consultation produces procedural defect that can support appeal of a refusal decision. From the applicant’s perspective the cooperation is operationally invisible (the supervisors handle the interaction), but it affects the practical timeline.

ESMA notification under Article 109

Article 109 requires the home NCA to notify ESMA of authorisation decisions. ESMA maintains a register of authorised CASPs that produces EU-wide visibility.

The ESMA register has three operational consequences:

Passport visibility. Other NCAs see the authorisation in the ESMA register. Passport notifications to those NCAs under Article 65 carry the supervisor signal that the home NCA has authorised. The register reduces friction in passport notifications.

Cross-NCA enforcement coordination. ESMA’s role in supervisor cooperation produces visibility of enforcement actions, significant CASP designations under Article 85, and supervisor concerns across the EU. The register feeds that coordination.

Public credibility. The ESMA register is public. Counterparties and customers, banks among them, can verify CASP authorisation status. The register produces real reputational signal for authorised CASPs and a real obstacle for unauthorised operators claiming compliance.

The notification step looks administrative but produces material EU-wide effects.

Refusal grounds under Article 63(7)

Article 63(7) lists the grounds for authorisation refusal. The article is not exhaustive (serious non-compliance with Article 59 through 62 conditions or implementing technical standards can also support refusal), but the listed grounds capture the most common refusal scenarios.

The principal refusal grounds:

Fit-and-proper failures. Management body or qualifying shareholders fail the suitability assessment. Criminal record, regulatory enforcement history, insufficient track record, or governance concerns can support refusal.

Inadequate governance arrangements. Governance framework, board composition, internal controls, or risk-management framework do not meet MiCA’s substantive requirements.

Prudential and capital gaps. Own funds below the applicable Article 67 minimum, or a capital structure that does not meet the article’s quality requirements. A capital plan that does not support the business model counts too.

AML deficiencies. AML framework does not meet AMLD6 (or post-2027 AMLR) standards. Customer due-diligence procedures inadequate. MLRO substance insufficient. FIU reporting framework not operational.

ICT and operational resilience gaps. DORA framework not in place. ICT third-party risk management inadequate. ICT incident reporting infrastructure not operational.

Conflicts of interest framework deficiencies. COI framework under Article 72 not adequate. Particularly relevant where the applicant operates multiple service lines that produce intrinsic conflicts.

Group-structure concerns. Group corporate structure prevents effective supervision. Beneficial ownership opaque. Cross-border governance inadequate.

Refusal must be by written decision with reasons. The reasons document the supervisor’s principal concerns and form the basis for any appeal.

Appeal rights

Appeal of a refusal decision operates under national procedural law of the home NCA’s member state. The procedural mechanics vary across member states but the basic shape is consistent.

First-level appeal. Typically to a national administrative tribunal or specialised financial-services appellate body. Time window for filing typically 30-60 days from the refusal decision.

Second-level appeal. To national administrative courts. Time window typically 30-90 days from first-level decision.

EU-level recourse. Article 263 TFEU recourse to the EU Court of Justice is not available against NCA decisions directly — NCAs are member-state bodies, not EU institutions. Indirect challenge through preliminary references from national courts under Article 267 TFEU is theoretically available but rare in practice.

The practical reality: appeal is available but is a slow, expensive process. Operators that disagree with a refusal more commonly remediate the underlying concerns and refile rather than appeal. Refile produces a faster route to authorisation than appeal in most scenarios.

Withdrawal of authorisation under Article 64

Authorisation is not permanent. Article 64 governs the withdrawal process — the supervisory tool of last resort when an authorised CASP fails to maintain compliance. Where Article 63 establishes the grant, Article 64 ends a CASP’s regulatory life, and it addresses three primary scenarios:

Failure to commence services within 12 months — operators that obtain authorisation but fail to launch within 12 months face automatic withdrawal grounds. The provision exists to prevent “shelf authorisations” — entities holding authorisation as a placeholder without genuine operational intent.

Serious or repeated breaches of MiCA obligations — escalation from less-serious supervisory measures. A single material breach (major AML failure, customer-asset misappropriation) or a pattern of repeated lesser breaches both qualify.

No longer meeting authorisation conditions — where the underlying basis no longer holds: substantial changes in beneficial ownership without proper Article 83 notification, key-person departures leaving inadequate management, or capital reduction below the Article 67 floor.

Withdrawal is not summary. The procedural framework incorporates standard EU administrative-law protections — written notice identifying the grounds and supporting evidence, a real opportunity to be heard, a reasoned decision addressing the operator’s response, and a right of appeal under member-state administrative law (the same shape as the refusal appeal above). NCAs do withdraw notices where a thorough response identifies grounds-flaws or remediation paths.

The real operational concern is customer protection. The framework requires a mandatory wind-down plan approved by the NCA, return of segregated customer crypto-assets (which sit outside the operator’s insolvency estate under Article 75 segregation), ongoing-services continuity for pending orders and withdrawals, NCA monitoring throughout, and managed successor-operator transitions subject to GDPR. Operators without genuine business-continuity infrastructure face operational chaos under wind-down pressure — segregated custody addresses and customer-data infrastructure for transition, plus contracts with potential successor operators. That infrastructure should exist before any withdrawal scenario, not be built reactively.

For passport-active operators the cross-border ramifications are substantial. Passport rights derive from home-state authorisation under Article 65, so withdrawal terminates passport access automatically across every member state where the operator was passporting. The home-state NCA must notify host-state NCAs and ESMA; the public ESMA register reflects the withdrawal, with durable reputational consequences for the operator, affiliated entities, and key persons (who may face individual fit-and-proper implications for future financial-services roles). Counterparty contracts with banking partners and payment processors, as well as technology vendors, typically carry provisions triggered by authorisation loss.

Withdrawal is distinct from Article 109 administrative sanctions. Article 109 covers penalty actions — fines up to the higher of EUR 5 million, 3% of turnover, or twice the gain or avoided loss, plus individual bans, public statements, and supervisory measures. Withdrawal is the loss of authorisation entirely. Both can apply for the same conduct; serious breaches often trigger Article 109 sanctions on the individuals plus Article 64 withdrawal of the operating entity. The combined consequences can be career-ending for affected individuals and terminal for the entity. Real compliance investment is the only meaningful protection — documentation that survives supervisory scrutiny and capital-maintenance monitoring with early-warning thresholds above the regulatory minimum, backed by a key-person succession plan.

Practical takeaways

The procedure looks administratively tidy but produces real-timeline complexity. Operators that understand the procedural mechanics produce shorter real timelines and cleaner supervisor relationships — the completeness window before clock start, information requests as the primary supervisor mechanism, cross-NCA consultation, and ESMA notification.

Three principles for operators working through the procedure:

Front-load the completeness work. Pre-file completeness review against Article 62 and implementing standards. Lost completeness assessment time is unrecoverable.

Respond to information requests promptly and comprehensively. Each pause-time delay adds directly to real timeline. Slow or partial responses compound across multiple rounds.

Engage with the supervisor before filing. Pre-engagement surfaces concerns before the file lands and signals substance expectations. The pre-engagement workstream typically pays back several times over.

The five-month statutory clock is not a target. The real target is a clean file and a responsive process, held together by a tight supervisor dialogue that lands authorisation in six to nine months.

For corrections, updates, or counsel referrals on the authorisation procedure, email [email protected].