Crypto License in Europe

Last Update: 14.10.2026

Gofaizen & Sherle assesses your planned crypto services, helps you choose a country and prepares application documents so you can address the requirements before filing. In the EU, a crypto-asset service provider (CASP) needs permission for specific services under the Markets in Crypto-Assets Regulation (MiCA). Other European countries have separate regimes.

Service Snapshot

Route

Service-specific authorization or an eligible notification route
Authority

The regulator in your home Member State
Establishment

EU office and management requirements
Scope

Only the services your permission covers
Safeguards

Article 59 safeguards depend on activities and overheads
Review

Separate completeness and assessment periods
Passport

Cross-border EU services require notification
Status

The transition for existing providers ended on July 1, 2026

Is This the Right Fit for Your Business?

European crypto licensing support fits businesses planning exchange, custody or trading platforms for EU clients.
Decentralized finance (DeFi), non-custodial services and mixed payment models need individual classification. Financial instruments and non-EU-only markets require separate regulatory analysis.

Which Regulatory Route Applies?

Applicant	Route and Authority	Access and Limits
Ordinary CASP	Articles 59/63 application to the home national competent authority	Authorized services; EU expansion requires notification
Eligible regulated institution	Article 60 notification to its home authority	Services depend on institution type; complete notification at least 40 working days before starting
Activity in the UK, Switzerland or Gibraltar	Respective national regulator or Swiss self-regulatory organization (SRO)	Local permissions; no MiCA passport

An incomplete Article 60 notification prevents the proposed start.

Regulated Crypto-Asset Services

MiCA service classes set minimum safeguards for Article 59 authorization:

Class 1, €50,000: executing client orders, placing crypto-assets with purchasers, transfers, receiving and transmitting orders, advice and portfolio management
Class 2, €125,000: Class 1 services plus custody (holding and administering client assets) and exchange for money or other crypto-assets
Class 3, €150,000: Class 2 services plus operating a trading platform

Use the highest applicable class. Token issuance, including asset-referenced tokens (ARTs) and electronic money tokens (EMTs), requires separate analysis.

What Gofaizen & Sherle Handles

Gofaizen & Sherle identifies which services need permission and supports EU jurisdiction selection with company setup. We prepare application documents and policies for management, technology, anti-money-laundering and counter-terrorist-financing (AML/CFT), and help answer the regulator’s questions.

You provide accurate records and put the operating arrangements into practice. Local counsel handles agreed local questions. Banking readiness, passporting planning and ongoing support require an agreed scope.

Work Scopes and Costs

Scope	Deliverables and Boundaries
Assessment	Service classification and country assessment; application preparation is separate
Application Support	Documents, policies and regulator communication; approval remains the regulator’s decision

Professional fees depend on agreed work. Official and third-party charges, own funds, staff, technology, office and banking costs are separate budget items.

Your Project Contact

Maksim Gasanbekov

Partner, Head of Sales (Crypto and Blockchain)

+65 3159 3338 maksim@gofaizen-sherle.com

From Assessment to Decision

Step 1 You and Gofaizen & Sherle identify services, markets and how assets move, then select the route.

Step 2 You establish the company and operating presence. Gofaizen & Sherle prepares the agreed documents.

Step 3 You submit the application. The regulator checks whether it is complete. Gofaizen & Sherle helps address missing information and questions.

Step 4 The regulator authorizes specified services or refuses. Launch requires the applicable permission, operational arrangements and any cross-border notification.

What We Need From You

To identify requirements and prepare the application, provide:

Owner and director information, suitability records and sources of funds
Products, client markets, who holds assets and handles payments, and an operating plan
Corporate records, forecasts, governance, risk, business-continuity, technology, AML/CFT, complaints and client-asset protection arrangements

For Article 59 authorization, the registered office must be in a Member State where some services occur. Effective management must be in the EU, with at least one EU-resident director.

For Article 59 authorization, Article 67 safeguards must continuously equal the higher of the class minimum or one quarter of last year’s fixed overheads. New businesses use first-year forecasts. Qualifying own funds, compliant insurance, a comparable guarantee or a combination qualify. These resources support resilience, not regulator payments. Article 60(10) exempts eligible institutions.

Application Timeline

Article 63 allows five working days to acknowledge receipt and 25 to check completeness. Assessment takes 40 working days from a complete application. A qualifying information request made by review day 20 can pause assessment for up to 20 working days. The decision is communicated within five working days.

Preparation, correcting incomplete documents, banking and operational setup take additional time.

EU Regulatory Framework

MiCA, Regulation (EU) 2023/1114, governs market access and client protection.
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, addresses technology resilience.
AML/CFT rules impose separate controls.
Additional permissions depend on activities.

Current Authorization Status

Check	Meaning
EU-wide rule	MiCA’s maximum transition period ended on July 1, 2026. Old virtual asset service provider (VASP) registration is insufficient; eligible institutions retain the Article 60 route.
National implementation	Confirm the competent authority and submission procedure in the selected country, including Poland, before filing.
Project-specific status	Check the provider’s authorized services in the ESMA MiCA Register and any applicable Article 60 status.

Home Member State Requirements

Local company law, application language, forms, fees, management evidence, operating presence and reporting requirements affect preparation. A shared EU framework does not make national procedures identical.

Ongoing Compliance

The CASP must maintain applicable financial safeguards, protect client assets and apply AML/CFT and transfer-information controls. Management must address technology risks, incidents, resilience testing and outsourcing. Complaints, conflicts, records, reporting and notifications of relevant changes remain ongoing obligations.

Operating Outside Your Permission

Unauthorized activities and failures in governance, financial safeguards, AML or technology controls create regulatory risk. Expansion must remain within permitted services.

Banking and Payment Readiness

Banks and payment providers assess owners, funding, transaction flows and client countries. Authorization does not guarantee an account.

Under Article 70, a CASP holding client funds other than EMTs must protect clients’ ownership rights. Funds must reach an account identifiable separately from the CASP’s own accounts at a credit institution or central bank by the end of the working day after receipt. Paragraphs 2 and 3 exempt CASPs that are credit, payment or electronic money institutions. This exemption does not cover paragraph 1’s crypto-asset protections.

Payment services require the CASP or its third-party provider to hold the applicable authorization under the Payment Services Directive (PSD2).

Compare European Jurisdictions

In the eight EU countries below, MiCA requires authorization or eligible Article 60 notification. Article 59 applicants must meet the EU establishment requirements. Non-EU establishment requirements need separate assessment. Bank onboarding is individual everywhere; tax consequences require country-specific analysis.

Country	Authority and Route	Key Consideration
Lithuania	Bank of Lithuania, MiCA	Old VASP registration is insufficient
Estonia	Finantsinspektsioon, MiCA	Estonian application; identify intended English documents separately
Poland	MiCA; confirm the competent authority before filing	Verify the current submission procedure before committing to setup
Czech Republic	CNB, MiCA	Former trade authorization is insufficient
Germany	BaFin and Bundesbank, MiCA	Eligible Article 60 notices go to both
France	AMF, MiCA	Old DASP status provides no automatic passport
Netherlands	AFM, MiCA	Management and supervisory-board suitability are assessed
Spain	CNMV, MiCA	ART/EMT issuer supervision is separate
United Kingdom	Financial Conduct Authority (FCA), current Money Laundering Regulations and future Financial Services and Markets Act regimes	A future application gives no present permission
Switzerland	Swiss Financial Market Supervisory Authority (FINMA) or relevant SRO, activity-specific route	Self-regulatory membership is not prudential authorization
Gibraltar	Gibraltar Financial Services Commission (GFSC), distributed ledger technology (DLT) permission	Covers holding or transferring others’ value; no EU passport

Official Sources

Last reviewed 14.10.2026

Frequently Asked Questions

Is there one license for all of Europe?

No. EU permissions cover specified services, with cross-border notification. Separate regimes apply outside the EU.

Are MiCA and CASP the same thing?

No. MiCA is the regulation; a CASP is a crypto-asset service provider.

Does a non-custodial business need authorization?

It may. Actual services and control over assets determine obligations; the label alone does not establish an exemption.

Can a company operate without an EU-resident director?

The Article 59 authorization route requires at least one. Office and management conditions also apply.

Is the capital threshold the license fee?

No. Article 59 safeguards are financial protection, not fees. Higher overheads can increase them; new businesses use forecasts.

Does the review period equal the launch date?

No. Review starts with a complete application and may pause. Operational preparation also affects launch.

Which country is best for my business?

Compare your services, management location, application language and local requirements. There is no universally best jurisdiction.

When can cross-border services start?

The home authority transmits the notification within ten working days. Covered EU services may start once transmission is notified or, at the latest, from the fifteenth calendar day after submission.

Does authorization guarantee a bank account?

No. Providers make separate onboarding decisions, and payment-service permissions remain separate.

Can an old VASP registration still be used?

It cannot replace the applicable MiCA route after the transition ended on July 1, 2026.

Can any VASP use Article 60?

No. Eligibility and services depend on institution type. Complete notification is required at least 40 working days before starting.

Does MiCA cover the UK, Switzerland and Gibraltar?

No. Their local regimes apply. UK in-scope businesses still need current money-laundering registration. The new regime is expected to start October 25, 2027; applying does not replace current duties.