CASP License

CASP Licensing Process

Obtaining a CASP license in accordance with MiCA requirements consists of several stages. In general, the procedure looks like this (although individual details may differ depending on the country).

Preparation of documents (stage 1)

The first step is to prepare a full package of documents required for submitting an application. It includes:

• business plan;
• operational program;
• risk management and compliance policies;
• AML/CFT procedures (anti-money laundering and countering the financing of terrorism);
• description of IT infrastructure and cybersecurity measures;
• information about the company’s management and its owners.

All statements specified in the application must be confirmed by relevant internal documents, policies, or procedures.

In practice, this stage almost always involves several rounds of finalizing documents — after discussions with the team, lawyers, or consultants.

Before submission, it is worth checking once again that all documents meet MiCA requirements. For example, the risk management policy must cover all risks defined by the regulation, and the description of IT systems must contain information about data encryption, access control, backup, and other measures expected by the regulator.

Choosing a jurisdiction for licensing (stage 2)

In parallel with the preparation of documents, it is necessary to decide in which EU country to submit the application.

Although MiCA establishes uniform rules for the entire European Union, national regulators may have their own procedural requirements or use different document formats.

For example:

• in one country they may require a separate Fit & Proper questionnaire for each director;
• in another, this information is already included in the main application;
• somewhere it is necessary to submit documents in the official language, while other regulators accept English.

When choosing a jurisdiction, it is worth considering:

• compliance of the country with your business model;
• expected timeframes for reviewing the application;
• the amount of state fees;
• the cost of subsequent supervision;
• features of corporate and tax legislation;
• language requirements for documents.

Many crypto companies choose jurisdictions such as Lithuania, Estonia, and other countries that actively develop the fintech sector and have experience working with CASP applications. At the same time, the optimal choice always depends on the specific business.

Submission of the application (stage 3)

After completing the preparation of documents, the company submits an official application to the National Competent Authority (NCA) of the chosen country.

Usually, an electronic portal or a special procedure defined by the local regulator is used for this.

Together with the application, all prepared documents are submitted and official forms with general information about the company are filled out.

The regulator, as a rule, requests the following information.

Company information

It includes:

• full name;
• organizational and legal form (for example, LLC or PLC);
• legal address;
• contact details.

List of services

It is necessary to clearly describe exactly which crypto-asset services the company plans to provide:

• exchange of crypto-assets;
• custodial storage;
• consulting services;
• other types of activity.

It is this list that determines the type of license and the MiCA requirements that will apply to the company.

AML/CFT program

It is necessary to describe the system for countering money laundering and the financing of terrorism, in particular:

• client identification procedures (KYC);
• monitoring of operations;
• detection of suspicious activity;
• the procedure for submitting notifications to competent authorities.

Business continuity and information security

The company must explain how it will ensure:

• uninterrupted operation of services;
• emergency response;
• backup copying;
• protection of information and IT systems.

Risk management and internal control

The application must contain a description of how the company:

• identifies risks;
• assesses them;
• minimizes possible consequences;
• organizes internal control, audit, and compliance.

Information About Management and Owners

It is necessary to provide information about directors, managers, and shareholders, as well as, if necessary:

• resumes (CV);
• certificates of no criminal record;
• declarations regarding financial status;
• other documents confirming their professional suitability and flawless business reputation.

In most countries, it is also required to pay a state fee for reviewing the application. Its amount depends on the specific jurisdiction.

After receiving the documents, the regulator confirms their receipt and notifies if any materials are missing already at the initial stage.

Verification and assessment of documents (stage 4)

At this stage, the regulator analyzes all submitted information in detail and checks its compliance with MiCA requirements.

In particular, the following aspects are assessed.

Compliance of internal policies

The regulator checks whether the company’s policies comply with European requirements.

For example:

• whether the AML/CFT policy fully covers the requirements of EU legislation;
• whether cybersecurity and information protection measures are described in sufficient detail.

Financial capacity

The following is checked:

• availability of minimum authorized capital;
• confirmation of the origin of funds;
• realism of financial forecasts.

In some cases, it is necessary to provide confirmation of the availability of funds in a bank account.

Verification of management and owners

Directors, managers, and owners undergo a Fit & Proper assessment.

The regulator may check:

• presence of criminal records;
• facts of bankruptcy;
• previous sanctions or violations;
• professional experience;
• business reputation;
• the ability to effectively manage a crypto-financial company.

Organizational readiness

It is assessed whether the company has sufficient resources to conduct the declared activity.

For example, if the applicant plans to launch a large crypto exchange, but only two people work on the staff, this will almost certainly cause additional questions.

The presence of qualified specialists in compliance, risk management, and information security is also checked.

Completeness of documents

If any documents are missing or certain information requires clarification, the regulator sends a request for additional information.

For most applicants, this is a normal part of the process. It is not uncommon for several rounds of correspondence with questions and answers to take place between the company and the regulator.

Prompt and full responses help avoid delays and speed up the review of the application.

Review periods

MiCA establishes clear timeframes for reviewing applications.

Within 25 working days after submission, the regulator checks the completeness of the documents and notifies if anything is missing.

After the package of documents is recognized as complete, the decision to issue or refuse to issue a license must be made within three months.

However, in practice, the process often takes longer. Additional requests, a complex business structure, or a significant workload on the regulator can increase the review period to six months or more.

Therefore, the successful passage of this stage largely depends on the quality of document preparation, timely responses to the regulator’s requests, and careful compliance with all procedural requirements.

Obtaining a license and providing services (stage 5)

If the regulator is convinced that the company meets all requirements, it officially issues the CASP license. After that, the company acquires the status of an authorized provider of services related to crypto-assets.

Usually, after obtaining the license, the company is entered into the open register of licensed CASPs, and an official document (a license or a decision on its granting) is also issued.

The status of a licensed CASP gives the right to immediately start or continue to provide those crypto-services that were specified in the application. Moreover, it is possible to work throughout the territory of the European Union.

This is possible thanks to the passporting mechanism provided for by MiCA. If a company has obtained a license in one EU member state, it can provide services in other countries of the Union without issuing separate licenses. Usually, it is enough to notify the local regulator of the intention to operate in its market — additional approval is not required.

Precisely the possibility of passporting is one of the main advantages of the CASP regime, because it opens access to the entire European market within a single regulatory system.

At the same time, after obtaining the license, the regulator may establish certain additional conditions. For example, to grant a license with separate restrictions or recommendations or to appoint a repeated audit in a year. However, in most cases, the company can fully scale the business, launch new products, and promote its services throughout the EU, if it acts within the limits of the obtained permission and complies with the requirements of the legislation.

Terms of Obtaining a License. The law provides that the consideration of the application and the making of a decision should last approximately 3–4 months. In practice, however, the process may take more time. Companies should target a general timeframe of about 6–9 months from the moment of submitting documents to obtaining the license, taking into account the preparation stage and possible delays during consideration. At the same time, those who obtain a license at an early stage of MiCA implementation gain a competitive advantage in the new regulated market.