MiCA License Support for EU Crypto Businesses

Licensing at a Glance

Topic	What it means for your business
Permission needed	MiCA authorization to operate as a crypto-asset service provider (CASP).
Business location	An EU registered office, with some services provided in that country. Management must be in the EU, with at least one EU-resident director.
Who approves	Your home-country regulator, called the national competent authority.
Services allowed	Only the crypto services covered by your authorization.
Financial safeguards	The higher of €50,000, €125,000 or €150,000, depending on services, and 25% of annual fixed operating expenses. New businesses use first-year projections.
Application review	Under Article 63: up to 25 working days to check completeness, then 40 working days to assess a complete application. Preparation and permitted pauses add time.
Serving other EU countries	Available after completing the required cross-border notification process (“passporting”).
Service price	Gofaizen & Sherle provides a quote based on the agreed scope.

Article 59 also requires activity in the registered-office Member State.

Is This the Right Route for Your Business?

Exchanges, custodians, trading platforms, brokers and investment advisers serving EU crypto clients should assess their authorization needs. Financial instruments, payment services and token issuance require separate classification. Fully decentralised arrangements without an intermediary require careful assessment, not reliance on a “DeFi” (Decentralized Finance) label.

Which Application Route Applies?

The route depends on your planned activities and any financial license your business already holds.

Your Business or Activity	What You Need to Do	Main Limitation
Provide crypto services, such as exchange or custody	Apply to your home-country regulator for CASP authorization under Article 59.	You may provide only the services covered by your authorization.
Add crypto services to an eligible regulated financial business	Submit an Article 60 notification to your home-country regulator.	Available only to specified financial entities, with service limits based on their existing license.
Issue your own tokens	Follow the rules for your token type with the responsible regulator, including separate requirements for asset-referenced tokens (ARTs) and e-money tokens (EMTs).	Issuing tokens does not itself authorize you to provide crypto services to clients.
Offer services involving tokens classified as financial instruments	Follow the MiFID investment-services framework through the relevant national regulator.	Financial instruments fall outside MiCA under Article 2.

Article 60 covers banks, investment firms, central securities depositories, market operators, electronic money institutions (EMIs), UCITS management companies and alternative investment fund managers (AIFMs). A payment institution license alone does not qualify.

Which Activities Are Covered?

MiCA covers ten crypto-asset services:

1. Custody and administration of crypto assets
   Allows to receive and hold client’s crypto assets, but not to transfer them.
2. Operating a trading platform
   Running a system that brings together multiple buyers and sellers to trade crypto assets under the platform’s rules.
3. Exchange for funds
   Buying or selling crypto assets for money, with your business acting as the buyer or seller.
4. Exchange for other crypto assets:
   Trading one crypto asset for another, with your business acting as the counterparty.
5. Order execution
   Allows to execute orders for exchange and purchase of crypto assets with third parties on behalf of the client.
6. Receiving and transmitting orders
   Allows to receive and transfer orders for exchange and purchase of crypto assets with third parties on behalf of the client.
7. Placing of crypto assets (Listing)
   Allows to offer crypto assets issued by the client to third parties.
8. Advice on crypto assets
   Allows to provide information (advice) on transactions with crypto assets.
9. Portfolio management of crypto assets
   Allows to make transaction with crypto assets for investment purposes on behalf of the client.
10. Transfers
    Moving clients’ crypto assets between blockchain addresses or accounts at their request.

Token issuance alone is not a CASP service. Asset-referenced tokens (ARTs), e-money tokens (EMTs), financial instruments under MiFID II and payment services require separate regulatory assessment.

What Does the Service Cost?

Discuss three possible scopes:

Scope	Deliverable	Price and preparation
Regulatory assessment	Route, jurisdiction and readiness findings	Individual quote and schedule
Application support	Documentation, filing and response support	Based on services and identified gaps
Ongoing compliance	Agreed policy updates and regulatory support	Based on recurring obligations

Separate advisory fees from NCA charges, incorporation, capital, staffing, audit, insurance, ICT and banking costs. These require their own budget.

What Should You Prepare?

Provide:

• ownership and UBO details
• management profiles
• entity status
• proposed services
• target markets
• client types
• transaction flows.

Include custody arrangements, technology providers, financial projections, expected volumes, banking needs and existing compliance controls.

How Long Does Authorization Take?

Preparation depends on evidence and operational gaps. Article 63 sets separate regulatory stages:

Stage	Statutory period
Receipt acknowledgement	Within 5 working days of receipt
Completeness check	Within 25 working days of receipt
Assessment and decision	Within 40 working days of receiving a complete application
Information-request suspension	Up to 20 working days under Article 63(12)
Decision notification	Within 5 working days of the decision

These periods are not an end-to-end project estimate. Under Article 65, cross-border services can start upon notification of authority-to-authority communication or, at latest, 15 calendar days after submitting the required information.

How Does the MiCA Framework Apply?

Markets in Crypto-Assets Regulation (EU) 2023/1114 (also called MiCAR) separates service-provider authorization under Title V from other-token offerings under Title II, asset-referenced tokens (ARTs) under Title III and e-money tokens (EMTs) under Title IV.

Under Annex IV, minimum amounts are €50,000 for execution, placing, transfers, order reception/transmission, advice and portfolio management, €125,000 when custody or exchange is included, and €150,000 for trading platforms. Article 67 requires the higher of that amount and one quarter of fixed overheads. New businesses use projected overheads.

What Is the Current Regulatory Status?

Status	Position and source
Confirmed	Full application began on 30 December 2024. Maximum CASP grandfathering ended on 1 July 2026 under Article 143.
Under review	The Commission’s 2026 consultation remains open until 30 September. It does not itself amend current obligations.

Check the authorised entity and permissions in the ESMA register.

What Changes Between EU Countries?

MiCA sets common EU authorization rules, but each country has its own regulator, application procedures and taxes.

Area	What to Check in Your Chosen EU Country	Where to Check
Application	Which regulator handles your application, which portal to use, accepted languages and applicable fees.	National regulator’s application guidance and fee schedule.
Management and local operations	What evidence the regulator expects about your managers, staff, office and how the business operates.	National regulator’s MiCA guidance.
Anti-money laundering	Which authority supervises your business and which local procedures and reporting requirements apply.	National AML supervisor’s guidance.
Company and taxes	Company registration, employment rules and tax obligations. These are separate from MiCA authorization.	Company registry, employment authority and tax authority.
Serving other EU countries	How to submit the required passport notification to your home regulator under Article 65.	Home regulator’s cross-border notification instructions.

Gofaizen & Sherle checks these requirements before recommending an EU country for your business.

What Continues After Approval?

Management remains responsible for ongoing governance, client-asset protection, complaints, conflicts, outsourcing, records and reporting. Safeguards must remain adequate, with annual overhead review. Material changes require applicable notifications.

AML/CFT controls include transfer-information handling under the TFR Travel Rule. The Digital Operational Resilience Act (DORA) adds ICT risk management, resilience testing, incident reporting and third-party oversight. Gofaizen & Sherle can support policy updates, while operational responsibility remains with the business.

What Are the Consequences of Non-Compliance?

Unauthorised activity and other breaches can lead to public statements, cessation orders, fines, management restrictions or authorization withdrawal, depending on the infringement and applicable national law under Article 111.

Does Authorization Secure Banking Access?

No. Banks, EMIs and payment providers make independent onboarding decisions. Under Article 70, relevant client funds must be placed with a credit institution or central bank and separately identifiable. A commercial payment account does not automatically satisfy safeguarding requirements.

Which Taxes and Reporting Rules Apply?

Corporate tax, VAT, payroll and withholding depend on national law and the activities involved. MiCA provides no uniform tax rate. Under DAC8, in-scope providers collect reportable transaction data from 1 January 2026. This is a reporting framework, not a tax exemption.

Which Alternatives Should You Assess?

Business need	Route to assess	Boundary
Payments or e-money	Payment institution (PI) or EMI permission	Not general crypto authorization
Tokenised securities	MiFID and, where relevant, DLT Pilot Regime	Instrument and infrastructure eligibility matter
Issuance only	Relevant token-issuer regime	Separate service activities need assessment
Non-EU operations	Local licensing	No substitute for permission to actively target EU clients