The MiCA CASP authorisation readiness checklist

Verified as of 6 October 2026. The capital table, the clock and the grounds for refusal were read that day from the text of MiCA, the two Commission regulations on CASP applications and ESMA’s authorisation briefing and Malta peer review. Statements that carry their own date, including member-state status and the state of the proposal to move CASP supervision to ESMA, speak as at that date. The Commission’s MiCA review consultation closed on 30 September 2026. Confirm anything you rely on against current law, or ask us to.

Work through it in order. The perimeter question decides whether you file at all; the class and the member state decide the rulebook and the regulator; capital, governance, the policy set and the clock decide whether the application survives review.

Confirm you actually need the authorisation

The transitional period closed on 1 July 2026, with no mechanism to extend it. Serving EU clients without authorisation is now the thing regulators told firms to wind down.

Do you provide crypto-asset services to clients in the EU? The obligation applies business-to-business as well as retail, and it applies whether or not your member state finished its national implementing law.
ESMA’s statement of 23 June 2026 told unauthorised providers to stop onboarding EU clients, stop marketing, and either transition to compliance or exit EU markets. Which of those describes you today?
Have you mapped which products and entities actually touch EU clients, so the decision to file, restructure or wind down the EU leg is made deliberately rather than by default?

Pick the class and the services

MiCA authorises services, not companies. The three classes map to service sets; apply for what you do.

Class 1 covers reception and transmission of orders, execution, placing, transfer services, advice and portfolio management. Class 2 adds custody and administration, and exchange of crypto-assets for funds or other crypto-assets. Class 3 adds operating a trading platform.
Are you applying for exactly the services you run, and no more? Over-scoping raises the capital requirement and the compliance build.
Will the service set still be right in eighteen months, or are you filing for today’s product only?

Pick the member state deliberately

One national regulator supervises you at home; the authorisation then passports across 30 EEA countries. The home state is a real decision, not a formality.

Is the state actually open for business? Poland had no implementing law and no designated regulator as of 1 August 2026.
Where are files like yours actually getting through? See the CASP register by member state for the current count by home state, taken from ESMA’s latest register update.
The Commission proposed in December 2025 to move CASP supervision from national regulators to ESMA. The direction of negotiation, per the Parliament rapporteur's June 2026 draft reports, is that only significant CASPs would move to ESMA, and the ECON committee is not scheduled to vote its position until 1 December 2026. It changes nothing about filing today, but the choice of home regulator is a decision with a horizon.

Capital, and the insurance alternative

EUR 50,000, 125,000 or 150,000 by class, or a quarter of prior-year fixed overheads if higher. This is money held, not a fee paid.

Do you meet the minimum for your class: EUR 50,000 for Class 1, EUR 125,000 for Class 2, EUR 150,000 for Class 3?
Have you run the overheads test? The requirement is the higher of the class minimum or one quarter of the prior year’s fixed overheads.
Have you priced the insurance route? Art. 67(4) lets you meet the requirement with own funds, an insurance policy or comparable guarantee, or a combination. It is real, and often overlooked.
The class table, the overheads calculation and the proof the file must carry are set out below.

Governance and fit-and-proper

Art. 68 assesses the people. Management and qualifying shareholders have to stand up to scrutiny, and substance is a continuing condition.

Can every member of management and every qualifying shareholder pass a fit-and-proper review, with clean, documented histories?
Do you have the substance Art. 59(2) requires: a registered office in a member state where you carry out at least part of your services, effective management in the Union, and at least one EU-resident director? Supervisors look for real decision-making, not a letter-box.
Are client-facing staff ready for ESMA’s knowledge-and-competence guidelines, which have applied since 28 July 2026? The stated minimums: 80 hours of professional qualification for staff giving information and 160 hours for staff giving advice, each with appropriate experience, at least 10 and 20 hours respectively of annual professional development, and an annual internal review of the arrangements. National regulators have signed up to apply them, so expect the file, and later the supervisor, to test this.

The programme of operations and the policy set

The regulator authorises a business it can supervise: Art. 62 sets the application content, a programme of operations backed by policies that actually run.

Custody and safeguarding arrangements that match how you actually hold client assets and funds?
Complaints handling, conflicts of interest and outsourcing policies written for your business, not templated?
ICT and operational resilience in DORA territory, and an AML programme a supervisor, an auditor and a bank will all accept?
If custody is in your service set, plan for it to be inspected, not just filed: ESMA opened a common supervisory action on CASPs’ digital operational resilience on 8 July 2026, focused on custody, key and storage management and third-party dependencies, running through H1 2027.

The clock and the sequence

The statutory clock is short; getting the file complete is what takes time. Run the slow workstreams in parallel.

Under Art. 63(9) the regulator has 40 working days to assess a complete file, after the completeness check. Real timelines are set by how complete you file and how well you answer the regulator’s information request, not by regulator slowness.
Are banking and audit relationships being built in parallel with the drafting, rather than after the grant? They are usually the slow path.
If you missed the transitional deadline, re-entry is a live path, not a dead end: an orderly wind-down of the EU leg followed by a clean filing beats operating in breach.
Freeze the file before it goes in. Updated information sent during the assessment restarts the 40 working days. The grounds for refusal and the usual causes of delay are set out below.

If the business is a stablecoin or a yield product, read Arts 40 and 50 before anything on this list. Both ban interest on asset-referenced and e-money tokens, both extend the ban to service providers handling those tokens, and both define interest widely enough to catch net compensation or discounts with equivalent effect, whoever pays it. A product paying yield on a stablecoin to EU users has a structural problem, not a marketing one. We mapped how this plays out in stablecoin yield across jurisdictions.

The one principle under all seven

A CASP authorisation is a supervised relationship, not a registration you buy. The regulator, the auditor and the bank are all checking the same thing: whether this is a genuine, governed business with real decision-making in the EU. So make the decisions in order, perimeter, services, member state, and build the substance and the file before the clock starts. The filing itself is the work of EU-qualified local counsel; the jurisdiction choice, the group structure and the sequencing are decisions the founder has to get right first. That is the work this checklist front-loads.

MiCA own funds by class: Class 1, Class 2 and Class 3

Article 67(1) sets the prudential safeguard at the higher of two numbers: the permanent minimum capital for your class in Annex IV, or one quarter of the previous year’s fixed overheads, reviewed annually. The class follows the services you are authorised for: one Class 2 service makes you Class 2.

Table 1 · Minimum capital by CASP class, from Annex IV and Article 67 of Regulation (EU) 2023/1114, read 6 October 2026
Class	Services that put you in the class	Permanent minimum capital
Class 1	Execution of orders on behalf of clients; placing of crypto-assets; transfer services for crypto-assets on behalf of clients; reception and transmission of orders; advice on crypto-assets; portfolio management on crypto-assets.	EUR 50,000
Class 2	Any Class 1 service, plus custody and administration of crypto-assets on behalf of clients, exchange of crypto-assets for funds, or exchange of crypto-assets for other crypto-assets.	EUR 125,000
Class 3	Any Class 2 service, plus operation of a trading platform for crypto-assets.	EUR 150,000

The overheads test. Fixed overheads are total expenses after distribution of profits in the latest audited annual accounts, or accounts validated by the national supervisor where none are audited, less profit-linked bonuses, staff, director and partner profit shares, fully discretionary variable pay and non-recurring expenses (Article 67(3)). A firm that has not been in business for a year uses the projected fixed overheads for its first 12 months, as submitted with the application (Article 67(2)).
The form it takes. Common Equity Tier 1 own funds, an insurance policy covering the EU territories where you provide services or a comparable guarantee, or a combination (Article 67(4)). A policy must be disclosed on your website, have an initial term of at least one year and a cancellation notice period of at least 90 days, and come from an authorised third-party insurer (Article 67(5)). It must cover the risks listed in Article 67(6).
What the file must prove. Delegated Regulation (EU) 2025/305, Article 3, asks for the amount and how it was calculated; a forecast of the safeguard for the first three business years, with stress scenarios and the expected clients, order volumes and assets under custody behind it; and the proof itself. For a company being incorporated, that is a statement from a credit institution that the funds are deposited. For insurance, it is a copy of the subscribed policy or the signed insurance agreement.

For cost and the choice of member state, see the MiCA authorisation service. For who has been authorised where, see the CASP register by member state.

Why CASP applications get rejected or delayed

Refusal is a short list in the text. Delay is a longer one, and most of it is in the applicant’s control.

The grounds for refusal in MiCA

The management body. It threatens effective, sound and prudent management, business continuity, the interests of clients or market integrity, or exposes the firm to a serious risk of money laundering or terrorist financing (Article 63(10)(a)).
Board members. They lack the good repute, knowledge, skills and experience, individually and collectively, or the time that Article 68(1) requires (Article 63(10)(b)).
Qualifying shareholders. Direct or indirect holders of qualifying holdings lack sufficiently good repute under Article 68(2) (Article 63(10)(c)).
Any other requirement. The applicant fails, or is likely to fail, any requirement of Title V, the CASP rules (Article 63(10)(d)). This is the ground that reaches substance, the policy set, custody, ICT and capital.
Close links. Close links to other persons prevent effective supervision, either directly or because third-country law governing those persons, or difficulty enforcing it, gets in the way (Article 63(7) and (8)).
An incomplete file. The authority sets a deadline for missing information and may refuse to review a file still incomplete when it passes (Article 63(2) and (3)).

What slows a file down

Gaps against the standards. The application is made on the form in Implementing Regulation (EU) 2025/306 and has to carry the detail Delegated Regulation (EU) 2025/305 specifies, including a programme of operations for the three years after authorisation that names the marketing means you will use. A gap holds the file in the 25-working-day completeness stage, and the 40 working days do not start.
Changes after filing. Updated information sent while the file is under assessment restarts the 40 working days from its receipt (Implementing Regulation (EU) 2025/306, Article 4(2)). Freeze the structure, the people and the service set before you file.
The information request. One written request, made no later than the 20th working day of the assessment, suspends the clock for up to 20 working days. Further requests are at the authority’s discretion and do not suspend it (Article 63(12)).
Consultation. Where the applicant is a subsidiary of, or under common control with, a bank, investment firm, payment or e-money institution, insurer or other listed financial firm authorised in another member state, the authority must consult that state’s regulator before deciding (Article 63(5)). It may also consult anti-money-laundering authorities and financial intelligence units (Article 63(6)).
Elevated scrutiny. ESMA’s supervisory briefing of 31 January 2025 tells authorities that no CASP is low-risk, and to look harder at firms with more than 1,000,000 yearly active EU users or a EUR 3 billion balance sheet, more than 200,000 yearly active users outside the home member state, complex group structures, many services combined, ART or EMT issuance combined with CASP services, outsourcing of key functions or outsourcing outside the EU, and a supervisory history, including operating without registration elsewhere.

What ESMA has told authorities to test

Local decision-making. The EU entity must be able to decide its EU policy on its own. The burden of proof is on the applicant, and the authority should be convinced that decision-making does not lie elsewhere. At least one executive board member should be resident in the member state of authorisation, with an allowance for member states of under one million inhabitants. The chief executive should as a rule work full time for the CASP; other executive board members should give it at least half their time.
Outsourcing. No letter-box entities. A set-up with more functions outside the EU than inside it is critically assessed. Responsibility for anti-money-laundering compliance stays with the CASP. Custody can be outsourced only to a CASP authorised under Article 59; the briefing’s exception for firms in the transitional period ended with that period on 1 July 2026. Where outsourcing raises concerns about the authority’s ability to supervise, the briefing says the application should be rejected.
The people. Every executive board member needs at least a good understanding of how crypto-assets and the services offered work. Ongoing criminal proceedings, inside or outside the EU, count even before any conviction.
The business plan. Realistic three-year projections with intermediate points the authority can test against reality, built from current activity where there is any, and a pessimistic scenario in which revenues fall well below plan.

ESMA has also shown what happens when an authority moves too fast. Its fast-track peer review of the Malta Financial Services Authority, published on 10 July 2025, rated the authorisation process for one CASP as partially meeting expectations and found that several material issues remained unresolved when authorisation was granted. It then asked every national authority still authorising CASPs to pay particular attention to business growth, conflicts of interest, governance and intragroup arrangements, ICT architecture including the ability to block malicious transactions, exposure to Web3 and decentralised products and the promotion of unregulated services, and user interfaces and risk warnings. Expect those questions in your own file.

Frequently asked questions

How long does MiCA CASP authorisation take?

MiCA sets the steps, not an overall deadline. Under Article 63 the national authority acknowledges receipt within 5 working days, has 25 working days to check that the file is complete, has 40 working days from a complete file to grant or refuse, and notifies its decision within 5 working days of making it. It may make one information request, no later than the 20th working day of that assessment, which suspends the clock for up to 20 working days. The part with no limit is the time a file takes to become complete: the authority sets a deadline for missing information and may refuse to review a file that is still incomplete when it passes. Under Implementing Regulation (EU) 2025/306, updated information sent during the assessment restarts the 40 working days. Real timelines are set by how complete the file is when it goes in.

What capital do I need for MiCA CASP authorisation: Class 1, Class 2 or Class 3?

The higher of the class minimum in Annex IV and one quarter of the previous year's fixed overheads, reviewed annually (Article 67(1)). Class 1 is EUR 50,000: execution of orders, placing, transfer services, reception and transmission of orders, advice and portfolio management. Class 2 is EUR 125,000: any Class 1 service plus custody and administration, exchange of crypto-assets for funds, or exchange of crypto-assets for other crypto-assets. Class 3 is EUR 150,000: any Class 2 service plus operating a trading platform. A firm that has not been in business for a year uses the projected fixed overheads for its first 12 months, as submitted with the application (Article 67(2)). The amount is held as a prudential safeguard, not paid as a fee.

Can insurance replace own funds for MiCA capital?

Yes, in whole or in part. Article 67(4) allows Common Equity Tier 1 own funds, an insurance policy covering the EU territories where you provide services or a comparable guarantee, or a combination. Article 67(5) requires the policy to be disclosed on your website, to have an initial term of at least one year and a cancellation notice period of at least 90 days, and to come from an authorised third-party insurer. Article 67(6) lists the risks it must cover, from loss of documents and misleading statements to business disruption, system failures and, where relevant, gross negligence in safeguarding client assets. The application must include a copy of the subscribed policy or a signed insurance agreement containing all of those elements (Delegated Regulation (EU) 2025/305, Article 3).

Why do CASP applications get rejected under MiCA?

Article 63(10) obliges the authority to refuse where there are objective and demonstrable grounds that the management body threatens the firm's sound and prudent management or exposes it to a serious risk of money laundering or terrorist financing; that board members fail the repute, knowledge, skills, experience and time tests in Article 68(1); that shareholders with qualifying holdings lack sufficiently good repute under Article 68(2); or that the firm fails, or is likely to fail, any requirement of Title V, the CASP rules. Article 63(8) adds refusal where third-country law governing a person with close links to the applicant, or difficulty enforcing it, prevents effective supervision. ESMA's supervisory briefing of 31 January 2025 adds a practical test: where outsourcing reaches a level that raises concerns about the authority's ability to supervise, the application should be rejected.

Why are CASP applications delayed?

Mostly because the file is not complete or not convincing. The common causes in the text and in ESMA's guidance are: items missing from the Article 62 list or from the detail Delegated Regulation (EU) 2025/305 requires, which hold the file in the completeness stage; changes made after filing, which restart the 40 working days; consultation with another member state's regulator where the applicant is in a group with a bank, investment firm, payment or e-money institution or other listed financial firm authorised there; and elevated scrutiny, which ESMA's briefing applies to large firms, complex groups, firms combining many services, ART or EMT issuers that also provide CASP services, outsourcing of key functions or outsourcing outside the EU, and people or firms with a supervisory history, including operating without registration elsewhere.

Who files a CASP application, and what does Infinilex do?

The applicant files with the competent authority of its home member state (Article 62(1)), and EU-qualified local counsel handles the regulator-facing filing. Infinilex quarterbacks, EU local counsel files: we run discovery, the class and member-state choice, the group structure and the sequence, and coordinate the workstreams around the file. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. Email is answered within one working day.

Primary texts, each read on 6 October 2026: Regulation (EU) 2023/1114 (MiCA), OJ L 150, 9 June 2023, Articles 62, 63, 67 and 68 and Annex IV; Commission Delegated Regulation (EU) 2025/305 of 31 October 2024 on the information in a CASP application, published 31 March 2025; Commission Implementing Regulation (EU) 2025/306 of 31 October 2024 on the application form and procedure, published 31 March 2025; ESMA, Supervisory Briefing on the Authorisation of CASPs under MiCA, ESMA75-453128700-1263, 31 January 2025; ESMA, Fast-track peer review on a CASP authorisation and supervision in Malta, ESMA42-2004696504-8164, 10 July 2025; European Commission, Targeted consultation on the review of MiCA, closed 30 September 2026.

Next step

Planning an EU market entry?

Infinilex quarterbacks the cross-border side: discovery, jurisdiction choice, group structuring and project management, with EU-qualified local counsel handling the regulator-facing filing. Send us what you do and who your users are, and we will map the class, the member state and the sequence.

Book a 30-minute call The MiCA authorisation service The MiCA readiness self-assessment Not ready for a call? Email two lines

Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.

The PDF

Want this as a PDF in your inbox?

Email us and we will send the current version, and the updated one each time the law moves. Or print the page: it is built for paper.

Email me the PDF

This checklist is general information for founders, not legal or regulatory advice for your specific project. MiCA, its implementing measures and national practice change; confirm every point against current law before relying on it. Infinilex is a consultancy working with EU-qualified local counsel, not EU counsel itself. The right class, member state and sequence depend on your activity, your users and your wider structure. Have your setup reviewed before you file.

Prepared by Infinilex Consultancy · infinilex.io · Verified as of 6 October 2026. Printed copies date; check infinilex.io/resources/ for the current version.