CASP Authorisation Procedure 2026 — MiCA Practitioner Guide

How the procedure works in practice

The MiCA framework sets the procedural framework for CASP authorisation. The article does not set core requirements — those live in Articles 59 through 62 (the conditions for authorisation), Articles 66 through 84 (the operating requirements), and the various Annexes (capital and document requirements). The MiCA framework governs the procedure by which an applicant gets from filing to decision.

The procedure has six moving parts:

1. Filing. The applicant submits the authorisation file to the National Competent Authority of the chosen home state.
2. Completeness assessment. The NCA has 25 working days to assess whether the file is complete under Article 63(3).
3. Statutory clock start. The clock under Article 63(4) starts when the NCA acknowledges the file as complete.
4. Substantive review. The NCA assesses the file against the substantive requirements during the five-month window, with possible information requests under Article 63(5).
5. Cross-NCA and ESMA cooperation. The NCA cooperates with other relevant supervisors under Article 63(6) and notifies ESMA under Article 109.
6. Decision. The NCA issues a grant, refusal with reasons, or conditional grant.

Each step has procedural mechanics that affect the real timeline.

The completeness assessment

The completeness assessment under Article 63(3) is the first substantive interaction between the applicant and the supervisor. The NCA has 25 working days from receipt to assess whether the file contains all required documents listed in Article 62 and the implementing technical standards.

The completeness assessment is not a thorough review. The NCA checks whether the required documents are present and whether they meet basic format requirements. Substantive evaluation of governance quality, AML framework adequacy, and prudential structure happens after completeness is acknowledged.

Two outcomes:

Complete file acknowledgment. The NCA confirms the file is complete. The Article 63(4) five-month clock starts. Substantive review begins.

Incomplete file determination. The NCA identifies missing or non-compliant documents. The applicant has the opportunity to remedy. The 25-working-day window resets on resubmission of the corrected file. The five-month clock does not start until completeness is achieved.

The practical implication: applicants who file incomplete face a real timeline extension even before the substantive clock starts. Files that miss required documents lose six to twelve weeks before thorough review begins. Tight pre-filing review of completeness against Article 62 and the implementing standards is high-impact work.

The five-month clock

Article 63(4) sets the supervisor’s decision window at five months from completeness acknowledgment. The clock is a statutory deadline — the supervisor must issue a decision within five months unless the clock is paused under Article 63(5).

The clock is not the real timeline. Two factors stretch the practical window:

Information requests under Article 63(5). The supervisor can suspend the clock during information requests. Suspension runs from the date of the information request to the date of fully-complete response. Most CASP files receive two to four information requests during review. Cumulative suspension commonly adds two to four months to the real timeline.

Cross-NCA consultation under Article 63(6). Where the applicant has a related authorisation in another member state (credit institution parent, investment firm parent, prior CASP authorisation), the home NCA must consult the related NCA. Consultation can run in parallel with substantive review or can extend the timeline depending on the home NCA’s process.

The practical real timeline for clean files runs six to nine months. Files with substance gaps run ten to fifteen months. Files with serious deficiencies (insufficient capital, inadequate governance, AML gaps) face either refusal or extended remediation engagement that can stretch fifteen months or longer.

Information requests in practice

Information requests are the most procedurally important feature in operation. The requests reshape the file, surface supervisor concerns, and produce the bulk of the timeline variance.

Typical request profile:

First request. Two to four weeks after completeness acknowledgment. Covers governance framework details, capital adequacy calculations, AML risk assessment, and senior personnel substance. Response window two to four weeks.

Second request. Six to ten weeks after first response. Drills into the supervisor’s principal concerns from the first round. Often covers ICT and DORA framework, outsourcing arrangements, conflicts of interest, and business model specifics.

Third request. Often more focused. Addresses remaining concerns or surfaces issues from cross-NCA consultation. Response window typically two to four weeks.

Fourth request (if needed). Targeted remediation requests on specific issues. Sometimes a fourth round signals the file is heading toward refusal unless the underlying concern is addressed.

Each round of requests pauses the clock. Each response resumes it. Operators that respond promptly with comprehensive answers minimise pause-time. Operators that respond slowly or with partial answers extend the real timeline.

The principle is procedural but the substance matters. Information requests are the supervisor’s main mechanism for working through file weaknesses. Treating requests as primarily administrative misreads the supervisor’s purpose.

Cross-NCA cooperation under Article 63(6)

Article 63(6) requires cooperation with NCAs of related authorisations. The cooperation framework operates in three main scenarios:

Credit institution parent or affiliate. If the CASP applicant is a subsidiary or affiliate of an EU credit institution, the home NCA consults the credit institution’s home supervisor. The consultation typically focuses on group-structure governance, capital flows, and risk-management integration.

Investment firm parent or affiliate. Similar consultation framework where the CASP applicant has an EU investment firm parent or affiliate. Focus areas include MiFID II / MiCA boundary issues, conduct framework integration, and operational risk management.

Prior CASP authorisation in another member state. Where the applicant or beneficial owners have prior CASP authorisation in another member state, the home NCA consults. Particularly relevant for operators with passport activity, group corporate structure across multiple member states, or beneficial-owner history in adjacent CASP files.

Cooperation under Article 63(6) is mandatory where applicable. Skipping consultation produces procedural defect that can support appeal of a refusal decision. From the applicant’s perspective the cooperation is operationally invisible — the supervisors handle the interaction — but it affects the practical timeline.

ESMA notification under Article 109

Article 109 requires the home NCA to notify ESMA of authorisation decisions. ESMA maintains a register of authorised CASPs that produces EU-wide visibility.

The ESMA register has three operational consequences:

Passport visibility. Other NCAs see the authorisation in the ESMA register. Passport notifications to those NCAs under Article 65 carry the supervisor signal that the home NCA has authorised. The register reduces friction in passport notifications.

Cross-NCA enforcement coordination. ESMA’s role in supervisor cooperation produces visibility of enforcement actions, significant CASP designations under Article 85, and supervisor concerns across the EU. The register feeds that coordination.

Public credibility. The ESMA register is public. Counterparties, banks, and customers can verify CASP authorisation status. The register produces real reputational signal for authorised CASPs and a real obstacle for unauthorised operators claiming compliance.

The notification step looks administrative but produces material EU-wide effects.

Refusal grounds under Article 63(7)

Article 63(7) lists the grounds for authorisation refusal. The article is not exhaustive — serious non-compliance with Article 59 through 62 conditions or implementing technical standards can also support refusal — but the listed grounds capture the most common refusal scenarios.

The principal refusal grounds:

Fit-and-proper failures. Management body or qualifying shareholders fail the suitability assessment. Criminal record, regulatory enforcement history, insufficient track record, or governance concerns can support refusal.

Inadequate governance arrangements. Governance framework, board composition, internal controls, or risk-management framework do not meet MiCA’s substantive requirements.

Prudential and capital gaps. Own funds below the applicable Article 67 minimum, capital structure that does not meet the article’s quality requirements, or capital plan that does not support the business model.

AML deficiencies. AML framework does not meet AMLD6 (or post-2027 AMLR) standards. Customer due-diligence procedures inadequate. MLRO substance insufficient. FIU reporting framework not operational.

ICT and operational resilience gaps. DORA framework not in place. ICT third-party risk management inadequate. ICT incident reporting infrastructure not operational.

Conflicts of interest framework deficiencies. COI framework under Article 72 not adequate. Particularly relevant where the applicant operates multiple service lines that produce intrinsic conflicts.

Group-structure concerns. Group corporate structure prevents effective supervision. Beneficial ownership opaque. Cross-border governance inadequate.

Refusal must be by written decision with reasons. The reasons document the supervisor’s principal concerns and form the basis for any appeal.

Appeal rights

Appeal of a refusal decision operates under national procedural law of the home NCA’s member state. The procedural mechanics vary across member states but the basic shape is consistent.

First-level appeal. Typically to a national administrative tribunal or specialised financial-services appellate body. Time window for filing typically 30-60 days from the refusal decision.

Second-level appeal. To national administrative courts. Time window typically 30-90 days from first-level decision.

EU-level recourse. Article 263 TFEU recourse to the EU Court of Justice is not available against NCA decisions directly — NCAs are member-state bodies, not EU institutions. Indirect challenge through preliminary references from national courts under Article 267 TFEU is theoretically available but rare in practice.

The practical reality: appeal is available but is a slow, expensive process. Operators that disagree with a refusal more commonly remediate the underlying concerns and refile rather than appeal. Refile produces a faster route to authorisation than appeal in most scenarios.

Practical takeaways

The procedure looks administratively tidy but produces real-timeline complexity. Operators that understand the procedural mechanics — completeness window before clock start, information requests as the primary supervisor mechanism, cross-NCA consultation, ESMA notification — produce shorter real timelines and cleaner supervisor relationships.

Three principles for operators working through the procedure:

Front-load the completeness work. Pre-file completeness review against Article 62 and implementing standards. Lost completeness assessment time is unrecoverable.

Respond to information requests promptly and comprehensively. Each pause-time delay adds directly to real timeline. Slow or partial responses compound across multiple rounds.

Engage with the supervisor before filing. Pre-engagement surfaces concerns before the file lands and signals substance expectations. The pre-engagement workstream typically pays back several times over.

The five-month statutory clock is not a target. The real target is a clean file, a responsive process, and a tight supervisor dialogue that lands authorisation in six to nine months.

For corrections, updates, or counsel referrals on the authorisation procedure, email [email protected].