MiCA CASP Authorisation 2026 — Procedure, Capital & Timeline

How the procedure works in practice

Article 63 of MiCA sets the procedural framework for CASP authorisation. The article does not set the core requirements — those live in Articles 59 through 62 (the conditions for authorisation and the content of the application), Articles 66 through 84 (the operating requirements), and the Annexes (capital and document requirements). Article 63 governs the procedure by which an applicant gets from filing to decision.

This guide runs the whole authorisation arc in one place: what goes in the file (Article 62), which class to apply for (Annex IV), how much capital to hold (Article 67), how the clock runs and how long it really takes, the refusal grounds, and what happens at the other end if authorisation is withdrawn (Article 64).

The procedure has six moving parts:

1. Filing and acknowledgement. The applicant submits the Article 62 file to the competent authority of the chosen home state, which acknowledges receipt within five working days (Article 63(1)).
2. Completeness check. The NCA has 25 working days from receipt to check that the Article 62(2) information is all there (Article 63(2)). If it is not, the NCA sets a deadline for the missing items, and may refuse to review a file still incomplete after it (63(3)). It tells the applicant when the file is complete (63(4)).
3. Assessment. From the complete application, the NCA has 40 working days to assess compliance with Title V and adopt a fully reasoned decision (Article 63(9)). One information request, made no later than the 20th working day, suspends that period for up to 20 working days (63(12)).
4. Consultation. Before deciding, the NCA must consult the authorities of another member state where the applicant is linked to an entity they authorised (63(5)), and may consult AML authorities and FIUs (63(6)).
5. Decision and notification. The decision is notified to the applicant within five working days (63(9)); on a grant, ESMA receives the register information within two working days (63(13)).

Each step has procedural mechanics that affect the real timeline.

What goes in the application — the Article 62 checklist

There is no mystery about what a MiCA CASP application contains. Article 62 lists it, and ESMA’s authorisation RTS fills in the detail. You can read the whole list before you spend a euro. The file is a defined pack — and what separates a six-month authorisation from a fifteen-month one is not knowing the list, it’s the depth and internal consistency of what you put against each line.

A MiCA CASP application under Article 62 must cover the following — each a real document or set of them, not a checkbox:

• Programme of operations — what services the firm will provide, to whom, how, and over what timeline. This anchors everything else; the NCA reads the rest against it.
• Governance arrangements — board composition, reporting lines, the three-lines-of-defence model, and how decisions get made and overseen.
• Identity and fit-and-proper of the management body and qualifying shareholders — who controls and runs the firm, with evidence they are suitable.
• Internal control mechanisms — risk management, internal audit, compliance monitoring.
• AML/CFT procedures — the written programme: risk assessment, customer due diligence, enhanced due diligence, transaction monitoring, sanctions screening, suspicious-transaction reporting.
• ICT systems and security arrangements — including DORA-aligned ICT-risk management, incident handling, and third-party-risk provisions.
• Custody and segregation policy — for firms holding client crypto-assets, how client assets are safeguarded and kept separate, under Article 75.
• Conflicts-of-interest policy — identifying, preventing, managing, and disclosing conflicts.
• Complaints-handling procedure — how client complaints are received, logged, and resolved.
• Business continuity — how the firm keeps operating, and winds down in an orderly way if it has to.
• Prudential evidence — own funds under Article 67, the higher of the Annex IV class floor or one-quarter of fixed overheads. (How that calculation works is the prudential-capital section below.)

A complete pack runs roughly 150 to 250 pages once drafted properly — but the page count is not the point; the coherence is.

Three roles need real people, not placeholders. The management body must be fit and proper, with the collective experience to run a regulated crypto firm. The compliance officer owns the conduct and ongoing-compliance programme. The MLRO owns AML/CFT and the relationship with the financial intelligence unit. Both the compliance officer and the MLRO need the right qualifications and direct board access; depending on the member state, they may also need local residency or engagement. NCAs scrutinise these appointments; nominee or thinly-engaged function-holders are a recurring reason for follow-up questions.

Three areas generate most of the friction in review. AML depth — generic manuals that do not reflect the firm’s products and customer base draw detailed questions. ICT and DORA — the resilience evidence is heavy, and venture-stage tech operations routinely underbuild it. Governance substance — boards that look thin on financial-services experience, or ownership structures that obscure control, get probed. None of these three stall points is about the document list itself; they are about whether what is in the documents holds up.

The completeness assessment

The completeness check under Article 63(2) is the first real interaction between the applicant and the supervisor. The NCA has 25 working days from receipt to check that the file contains everything listed in Article 62(2), as detailed in the RTS on the content of the application (Commission Delegated Regulation (EU) 2025/305).

The check is about presence, not quality. The NCA confirms that each required item is there; whether the governance, AML framework and prudential structure are adequate is assessed afterwards.

Two outcomes:

Complete. The NCA notifies the applicant that the file is complete (Article 63(4)), and the 40-working-day assessment under Article 63(9) runs from there.

Incomplete. The NCA sets a deadline by which the missing information must be supplied (63(2)). If the file is still incomplete when the deadline passes, the NCA may refuse to review it (63(3)). The decision clock has not started during any of this.

The practical implication: an incomplete filing costs calendar time before the statutory clock even begins, and risks a refusal to review. Checking the file against Article 62(2) and the RTS before submission is the highest-return work in the whole process.

Choosing your CASP class — 1, 2, or 3

The class decision sits at the start of every application and locks in capital, governance depth, and substance for the life of the licence. MiCA Annex IV lists ten crypto-asset services and groups them into three nested tiers — Class 2 includes everything Class 1 covers, and Class 3 includes everything Class 2 covers. A CASP’s class is set by the single highest-risk service it intends to offer, not by the volume mix.

Class 1 — EUR 50,000 minimum capital:

1. Reception and transmission of orders for crypto-assets on behalf of clients
2. Providing advice on crypto-assets
3. Providing portfolio management on crypto-assets
4. Placing of crypto-assets
5. Execution of orders for crypto-assets on behalf of clients
6. Providing transfer services for crypto-assets on behalf of clients

Class 2 — EUR 125,000 minimum capital (adds three services): 7. Custody and administration of crypto-assets on behalf of clients 8. Exchange of crypto-assets for funds 9. Exchange of crypto-assets for other crypto-assets

Class 3 — EUR 150,000 minimum capital (adds one service): 10. Operation of a trading platform for crypto-assets

The economic logic: Class 1 services involve client information and decision-making but no direct custody of client assets; Class 2 brings the firm onto the balance-sheet-risk side by introducing custody and the exchange function; Class 3 adds the systemic risk of running an organised market.

The visible step-up between classes is the capital floor. The less-visible step-up is governance. Moving Class 1 to Class 2 (introducing custody) brings custody operational rules under Title V Chapter 3, segregation of client crypto-assets, client-asset reporting, and heavier DORA expectations. Moving Class 2 to Class 3 (adding a trading platform) brings an operating-rules document, market-abuse monitoring under Title VI, pre- and post-trade transparency, best-execution obligations, and significantly stricter ICT-resilience expectations — trading-platform CASPs are typically treated as systemically more important by national supervisors. The capital differential between Class 2 and Class 3 (EUR 25,000) materially understates the governance differential. Weight governance discipline far above headline capital.

Three questions decide the class:

1. Will the firm hold client crypto-assets at any point? If yes, Class 2 minimum. The custody scope extends to any arrangement where the firm controls the keys, even briefly between order execution and client-side wallet delivery.
2. Will the firm operate any matched-trading or auction venue? If yes, Class 3. This includes orderbook exchanges and RFQ platforms, and any matching infrastructure where multiple buyers and sellers interact through the firm’s system.
3. Will the firm only advise, route, or transfer without custody? If all three are yes, Class 1 may be the right choice — but verify the model is genuinely custody-light and revenue can sustain at a Class 1 footprint.

The vast majority of commercially active CASPs end up at Class 2 because exchange or custody is part of the economic model. Class 1 fits a small set of specialised use cases (pure advisory, order-introduction, portfolio managers using third-party custody, transfer-only providers). Class 3 fits the smaller set whose core business is operating an organised market.

A CASP authorised at one class can later expand to a higher class, but the expansion is a variation of authorisation, not an automatic uplift. The supervisor reviews the firm against the new tier afresh — capital top-up, governance-package update, substance review, and a DORA resilience review scaled to the new operations. Variations are typically faster than fresh authorisations because much of the file is already on supervisory record; plan two to four months, varying by supervisor and complexity. The single most expensive mistake is launching at Class 1 with a hidden custody dependency that surfaces within the first six months. Authorise once at the right tier.

Prudential capital and the Article 67 own-funds calculation

Article 67 imposes a continuous own-funds requirement on every authorised CASP. The rule holds two numbers in tension and a tie-breaker:

• Static floor. A permanent minimum tied to the service class under Annex IV: EUR 50,000 (Class 1), EUR 125,000 (Class 2), EUR 150,000 (Class 3).
• Dynamic floor. One quarter of the preceding year’s fixed overheads, calculated as Article 67(3) sets out.
• Tie-breaker. The CASP must hold the higher of the two. The other becomes irrelevant for that year.

For a first-year CASP without a full year of operating expenses, the static floor is the live constraint. By the time of the first audited annual accounts, the dynamic floor typically crosses the static, and from that point the calculation drives the requirement.

What counts as fixed overheads. Article 67(3) starts from total expenses after distribution of profits in the most recent audited annual accounts and deducts four items only: staff bonuses and other remuneration that depend on the year’s net profit; employees’, directors’ and partners’ shares in profits; other fully discretionary appropriations of profits and variable remuneration; and non-recurring expenses from non-ordinary activities. What remains, divided by four, is the dynamic floor. The list is shorter than the investment-firm method under the IFR, so importing that method’s wider deductions understates the requirement. A firm in its first year uses the projected fixed overheads from its application (Article 67(2)).

Worked trajectory. Take a typical Class 2 Lithuanian exchange. Initial capital at authorisation is EUR 125,000 (the Class 2 floor). With Year 1 fixed overheads of EUR 600,000, ongoing capital rises to EUR 150,000 (600,000 / 4, which exceeds the floor). Year 2 at EUR 900,000 fixed overheads gives EUR 225,000. Year 3 at EUR 1.4 million gives EUR 350,000. The firm needs to plan a capital trajectory, not a one-off injection. Founders who capitalise to the floor and assume that is the steady state under-fund the firm.

Composition — CET1, not generic cash. Own funds must be Common Equity Tier 1 as defined in CRR Article 26 — paid-in share capital, share premium, audited retained earnings, and other reserves from retained earnings. Shareholder loans (even subordinated, even interest-free), convertible notes until conversion, off-balance-sheet guarantees, and crypto-asset holdings including stablecoins are all ineligible. The standard CRR deductions apply by reference — goodwill, intangibles, and deferred tax assets that rely on future profitability come off. CASPs that capitalise platform-development costs as intangibles often find their CET1 20-40% lower than their accounting equity. Where the cash sits is not set by Article 67; confirm the home NCA’s expectations, which commonly include evidence from the bank holding it.

Insurance as an alternative form. Article 67(4) lets the prudential safeguard take the form of own funds, an insurance policy covering the territories where services are provided (or a comparable guarantee), or a combination. Under Article 67(5)-(6) the policy must be disclosed on the website, have an initial term of at least one year and at least 90 days’ cancellation notice, come from an authorised third-party insurer, and cover listed risks — among them loss of documents, misleading statements, breaches of legal and conduct duties, conflicts failures, business disruption and, where relevant, gross negligence in safeguarding client assets. MiCA does not require custodians to carry separate custody insurance; under Article 75(8) a custodian is liable for losses attributable to it, capped at the market value of the lost crypto-assets.

Compliance is continuous, not annual: Article 67(1) requires the safeguard “at all times”, and the fixed-overheads figure is reviewed annually. Monitor it monthly and report it to the board, so a rise in overheads is caught before the next accounts make it binding. A persistent shortfall means the firm no longer meets the conditions of its authorisation, which is a withdrawal ground under Article 64(1)(e) if not remedied.

The statutory clock and how long it really takes

Article 63(9) gives the NCA 40 working days from a complete application to assess it and adopt a fully reasoned decision, which it must notify within five working days. That is roughly two calendar months. One information request, made no later than the 20th working day of the assessment, suspends the period until the applicant answers, for no more than 20 working days (Article 63(12)). Further requests are at the NCA’s discretion and do not suspend it.

The statutory figures are not the calendar a founder experiences. Practitioner-reported timelines run six to nine months end-to-end for clean files and longer where the file needs substantial rework. The difference sits almost entirely before the clock starts: preparing a complete file, the 25-working-day completeness check, and the deadline the NCA sets for anything missing. Supervisory pace also varies by member state; the deadlines are EU-wide, the caseloads are not.

Cited expert

In addition, ESMA is actively contributing to MiCA's effective implementation, in close cooperation with the European Banking Authority and National Competent Authorities, including through intense supervisory convergence efforts, information sharing, and guidelines.

For planning, a sensible model is: two to four months to build a genuinely complete, well-evidenced file; up to five weeks for the completeness check if the file is strong, longer if it is thin; about two months for the assessment, plus up to four weeks if the one suspending request is used; then notification within five working days. The honest headline is to plan for the better part of a year from “we decide to do this” to “we hold the licence” — with the preparation phase being the part you most control. The CASP cost calculator helps size the budget around that runway.

Information requests in practice

Article 63(12) shapes how questions work. The NCA may request further information during the assessment, but only a request made no later than the 20th working day suspends the clock, and only for up to 20 working days. Anything asked after that runs inside the 40 days. Supervisors therefore tend to put their main questions in that first request: governance and management-body suitability, the capital calculation, the AML risk assessment, the ICT and DORA arrangements, outsourcing, conflicts and the business model.

Two consequences follow. A slow or partial answer does not extend the assessment beyond the 20-working-day suspension; it leaves the supervisor deciding on an incomplete record, which is how refusals happen. And because there is effectively one round, the time to resolve open points is before filing, through pre-application engagement where the NCA offers it.

Consulting other authorities — Article 63(5) and (6)

Article 63(5) makes consultation mandatory in defined cases. Before granting or refusing, the NCA must consult the competent authorities of another member state where the applicant is a subsidiary of, a subsidiary of the parent of, or controlled by the same persons as a credit institution, central securities depository, investment firm, market operator, UCITS management company, AIF manager, payment institution, insurance undertaking, e-money institution or occupational pension institution authorised there.

Article 63(6) adds discretionary consultation with AML authorities and financial intelligence units, to check that the applicant has not been investigated for money laundering or terrorist financing, together with checks on establishments or third parties in high-risk third countries.

From the applicant’s side this runs between supervisors, but it runs inside the 40-working-day assessment, so a group with regulated affiliates elsewhere should expect those authorities to be asked and should have its group structure documented accordingly.

ESMA notification — Article 63(13)

Within two working days of granting authorisation, the NCA communicates to ESMA the information listed in Article 109(5), and it also informs ESMA of refusals. ESMA publishes authorised CASPs in its register under Article 109 by the date the CASP starts providing services.

The register has three practical effects. Passporting: host authorities can see the authorisation and its scope when the CASP notifies under Article 65. Coordination: withdrawals are recorded there too (Article 64(3)). Public verification: banks, counterparties and clients check the register, so the services recorded there are the services the firm can show it is authorised for.

Refusal grounds — Article 63(7), (8) and (10)

Article 63(10) obliges the NCA to refuse authorisation where there are objective and demonstrable grounds that:

The management body is a threat. It poses a threat to the effective, sound and prudent management and business continuity of the applicant, to the adequate consideration of clients’ interests and market integrity, or exposes the applicant to a serious risk of money laundering or terrorist financing.

Members of the management body fail Article 68(1). Sufficiently good repute, knowledge, skills and experience, and enough time committed.

Qualifying shareholders fail Article 68(2). Shareholders or members with qualifying holdings, direct or indirect, lack sufficiently good repute.

The applicant fails Title V. It does not, or is likely not to, meet any of the requirements of Title V — capital, governance, conduct, safeguarding, ICT and the rest.

Separately, close links with other persons must not prevent effective supervision (Article 63(7)), and authorisation must be refused where a third country’s law or its enforcement prevents it (63(8)). The decision must be fully reasoned, and the reasons are the basis for any appeal.

Appeal rights

Appeal of a refusal decision operates under national procedural law of the home NCA’s member state. The procedural mechanics vary across member states but the basic shape is consistent.

First-level appeal. Typically to a national administrative tribunal or specialised financial-services appellate body. Time window for filing typically 30-60 days from the refusal decision.

Second-level appeal. To national administrative courts. Time window typically 30-90 days from first-level decision.

EU-level recourse. Article 263 TFEU recourse to the EU Court of Justice is not available against NCA decisions directly — NCAs are member-state bodies, not EU institutions. Indirect challenge through preliminary references from national courts under Article 267 TFEU is theoretically available but rare in practice.

The practical reality: appeal is available but is a slow, expensive process. Operators that disagree with a refusal more commonly remediate the underlying concerns and refile rather than appeal. Refile produces a faster route to authorisation than appeal in most scenarios.

Withdrawal of authorisation under Article 64

Authorisation is not permanent. Article 64 governs the withdrawal process — the supervisory tool of last resort when an authorised CASP fails to maintain compliance. Where Article 63 establishes the grant, Article 64 ends it. Article 64(1) lists seven situations in which the NCA must withdraw authorisation, and 64(2) two in which it may. The ones that matter most in practice:

Authorisation unused or dormant — not used within 12 months of the grant (64(1)(a)), or no crypto-asset services for nine consecutive months (64(1)(c)). Both are mandatory grounds; they stop authorisations being held as placeholders.

Serious infringements and AML failures — serious infringement of MiCA, including client-protection and market-integrity rules (64(1)(g)); failing to have effective AML/CFT systems (64(1)(f)); obtaining the authorisation by false statements or other irregular means (64(1)(d)).

No longer meeting authorisation conditions — where the basis no longer holds and the CASP has not taken the remedial action the NCA requested within its deadline (64(1)(e)): changes in ownership without an Article 83 notification, departures that leave inadequate management, or capital below the Article 67 requirement. The NCA may also limit a withdrawal to a particular service (64(4)).

Withdrawal is not summary. The procedural framework incorporates standard EU administrative-law protections — written notice identifying the grounds and supporting evidence, a real opportunity to be heard, a reasoned decision addressing the operator’s response, and a right of appeal under member-state administrative law (the same shape as the refusal appeal above). NCAs do withdraw notices where a thorough response identifies grounds-flaws or remediation paths.

The real operational concern is customer protection. CASPs must keep procedures for the timely and orderly transfer of clients’ crypto-assets and funds to another CASP if authorisation is withdrawn (Article 64(8)), and those providing custody, trading-platform, exchange, execution or placing services must have an orderly wind-down plan (Article 74). The essentials are return of segregated customer crypto-assets (which sit outside the operator’s insolvency estate under Article 75 segregation), ongoing-services continuity for pending orders and withdrawals, NCA monitoring throughout, and managed successor-operator transitions subject to GDPR. Operators without genuine business-continuity infrastructure face operational chaos under wind-down pressure — segregated custody addresses and customer-data infrastructure for transition, plus contracts with potential successor operators. That infrastructure should exist before any withdrawal scenario, not be built reactively.

For passport-active operators the cross-border ramifications are substantial. Passport rights derive from home-state authorisation under Article 65, so withdrawal terminates passport access automatically across every member state where the operator was passporting. The home-state NCA must notify host-state NCAs and ESMA; the public ESMA register reflects the withdrawal, with durable reputational consequences for the operator, affiliated entities, and key persons (who may face individual fit-and-proper implications for future financial-services roles). Counterparty contracts with banking partners and payment processors, as well as technology vendors, typically carry provisions triggered by authorisation loss.

Withdrawal is distinct from administrative penalties under Article 111. For a legal person, Article 111 requires maximum fines of at least EUR 5 million or 5% of annual turnover, or at least twice the profit gained or loss avoided, alongside public statements and orders to stop the conduct; for individuals the maximum fine must be at least EUR 700,000. Withdrawal is the loss of authorisation entirely. Both can apply for the same conduct; serious breaches can bring Article 111 penalties on the individuals and Article 64 withdrawal for the operating entity. The combined consequences can be career-ending for affected individuals and terminal for the entity. Real compliance investment is the only meaningful protection — documentation that survives supervisory scrutiny and capital-maintenance monitoring with early-warning thresholds above the regulatory minimum, backed by a key-person succession plan.

Practical takeaways

The procedure looks administratively tidy, and its deadlines are short. Operators that understand the mechanics — the completeness check before the clock starts, the single suspending information request, mandatory consultation where the group has regulated affiliates, and ESMA notification — get to a decision faster.

Three principles for operators working through the procedure:

Front-load the completeness work. Pre-file completeness review against Article 62 and implementing standards. Lost completeness assessment time is unrecoverable.

Answer the first information request completely. It is the only one that suspends the clock, for at most 20 working days; what is left unanswered goes into the decision.

Engage with the supervisor before filing. Pre-engagement surfaces concerns before the file lands and signals substance expectations. The pre-engagement workstream typically pays back several times over.

The statutory deadlines are short; the calendar is long because files arrive incomplete. The real target is a file that is complete on day one and a first-round answer that leaves nothing open.

For corrections, updates, or counsel referrals on the authorisation procedure, email [email protected].