CASP License

MiCA assigns crypto-asset services to three capital classes in Annex IV. Class 1 includes order execution, placing, transfer services, order reception and transmission, advice and portfolio management, with 50,000 euros in permanent minimum capital. Class 2 adds custody and administration of crypto-assets and exchange for funds or other crypto-assets, with a minimum of 125,000 euros. Class 3 adds operation of a trading platform, with a minimum of 150,000 euros. For providers authorized under Article 63, prudential safeguards must meet the higher of the minimum for the highest required class and one quarter of the preceding year's fixed overheads calculated under Article 67. Safeguards can consist of qualifying own funds, insurance or a comparable guarantee, or a combination; Article 67 does not apply to financial entities operating under Article 60. For new providers, the comparison uses one quarter of projected fixed overheads for the first twelve months.

Beyond the capital figure, MiCA requires a documented governance and risk framework, fit-and-proper assessments of the firm's management, and a working anti-money-laundering and counter-terrorist-financing program before a supervisor grants authorization. The application also has to describe the firm's IT systems, its business continuity plan, its complaints-handling process, and, for a firm offering custody, exactly how it segregates client crypto-assets from its own holdings. A complete application file to BaFin commonly runs past 200 pages before the first round of supervisory feedback, and processing has taken twelve to twenty-four months for firms already through the process. A firm applying today plans for a long lead time and starts preparing the application early.

DZ BANK received BaFin approval for its meinKrypto trading platform at the end of December 2025. Boerse Stuttgart Digital provides custody for the platform. Deutsche Bank has announced a digital-asset custody service for institutional and corporate clients in Europe, covering bitcoin, ether and selected stablecoins. The planned launch is subject to completion of the applicable regulatory process. ESMA maintains a register of crypto-asset service providers with their identities, permitted services and regulatory status, including withdrawn authorizations. For credit institutions, MiCA allows the notification procedure under Article 60 instead of a separate CASP authorization under Article 63. The register and the competent authority, such as BaFin in Germany, provide information for checking a firm's regulatory status.

The longest permitted transitional period under MiCA ended on 1 July 2026; member states could shorten it or choose not to apply it. It covered providers that lawfully supplied crypto services before 30 December 2024 and ended earlier if authorization was granted or refused. Providers now need a CASP authorization or must qualify as a financial entity meeting Article 60 requirements. ESMA has instructed providers without the required authorization or entitlement to wind down their EU business in an orderly way. A traditional bank can use Article 60 if it submits the required complete information to its home supervisor at least 40 working days before its first crypto service. Customers can check a provider's status in the ESMA or BaFin register.

CASP authorization, compliance and custody were among the topics of the Forum für Digitale Vermögenswerte, a German-language forum with Finance Loop as a partner, and Finance Loop partners with OKX, a crypto exchange that operates under a MiCA license in Europe. At the Bybit EU Crypto Evening at TechQuartier, a senior policy director spoke on compliance under MiCAR. The CASP license belongs to the Finance Loop Risk & Compliance track. Related pages: MiCA in Germany, MiCAR and crypto custody.

CASP stands for crypto-asset service provider, the term MiCA uses for an authorized provider of services such as custody, exchange, trading platform operation, advice or portfolio management on crypto-assets. A crypto-native exchange generally needs authorization under Article 63. A traditional bank can provide crypto services under Article 60 by submitting the required complete information to its home supervisor at least 40 working days before its first service, without a separate CASP authorization under Article 63.

Annex IV of MiCA sets 50,000 euros for class 1, including advice, portfolio management and transfer services, 125,000 euros for class 2 with custody or exchange, and 150,000 euros for class 3 with trading platform operation. Article 67 requires prudential safeguards at least equal to the higher of the applicable class minimum and one quarter of the preceding year's fixed overheads. Qualifying own funds, insurance or a comparable guarantee, and combinations are permitted; financial entities operating under Article 60 are exempt from Article 67. For new providers, the comparison uses one quarter of projected fixed overheads for the first twelve months.

A CASP authorization granted by one national supervisor, such as BaFin, permits services in other EU member states without a separate authorization in each country. Under Article 65, the provider notifies its home supervisor of the destination countries, services and intended start date; that supervisor forwards the information to the relevant host supervisors. The provider may start after receiving notice of that forwarding, or at the latest 15 calendar days after submitting the complete information to its home supervisor.