The MiCA CASP authorisation readiness checklist
One authorisation, granted by one national regulator, reaches 30 EEA countries. That is the prize, and the file that wins it is largely built before anything is submitted. This is the readiness list we run with founders planning an EU market entry. Weighing the EU against Dubai first? Read MiCA vs VARA.
Work through it in order. The perimeter question decides whether you file at all; the class and the member state decide the rulebook and the regulator; capital, governance, the policy set and the clock decide whether the application survives review.
Confirm you actually need the authorisation
The transitional period closed on 1 July 2026, with no mechanism to extend it. Serving EU clients without authorisation is now the thing regulators told firms to wind down.
- Do you provide crypto-asset services to clients in the EU? The obligation applies business-to-business as well as retail, and it applies whether or not your member state finished its national implementing law.
- ESMA’s statement of 23 June 2026 told unauthorised providers to stop onboarding EU clients, stop marketing, and either transition to compliance or exit EU markets. Which of those describes you today?
- Have you mapped which products and entities actually touch EU clients, so the decision to file, restructure or wind down the EU leg is made deliberately rather than by default?
Pick the class and the services
MiCA authorises services, not companies. The three classes map to service sets; apply for what you do.
- Class 1 covers reception and transmission of orders, execution, placing, transfer services, advice and portfolio management. Class 2 adds custody and administration, and exchange of crypto-assets for funds or other crypto-assets. Class 3 adds operating a trading platform.
- Are you applying for exactly the services you run, and no more? Over-scoping raises the capital requirement and the compliance build.
- Will the service set still be right in eighteen months, or are you filing for today’s product only?
Pick the member state deliberately
One national regulator supervises you at home; the authorisation then passports across 30 EEA countries. The home state is a real decision, not a formality.
- Is the state actually open for business? Poland had no implementing law and no designated regulator as of mid-July 2026, and four member states, Poland, Hungary, Greece and Romania, each had zero authorised CASPs.
- Where are files like yours actually getting through? About 290 CASPs were authorised across the EEA as of mid-July 2026, and the spread by home state is very uneven: Germany led with the most, several states barely feature.
- The Commission proposed in December 2025 to move CASP supervision from national regulators to ESMA; as of mid-July 2026 the negotiations were targeted to conclude by end-2026. It changes nothing about filing today, but the choice of home regulator is a decision with a horizon.
Capital, and the insurance alternative
EUR 50,000, 125,000 or 150,000 by class, or a quarter of prior-year fixed overheads if higher. This is money held, not a fee paid.
- Do you meet the minimum for your class: EUR 50,000 for Class 1, EUR 125,000 for Class 2, EUR 150,000 for Class 3?
- Have you run the overheads test? The requirement is the higher of the class minimum or one quarter of the prior year’s fixed overheads.
- Have you priced the insurance route? Art. 67(4) lets you meet the requirement with own funds, an insurance policy or comparable guarantee, or a combination. It is real, and often overlooked.
Governance and fit-and-proper
Art. 68 assesses the people. Management and qualifying shareholders have to stand up to scrutiny, and substance is a continuing condition.
- Can every member of management and every qualifying shareholder pass a fit-and-proper review, with clean, documented histories?
- Do you have the substance Art. 59(2) requires: a registered office in a member state where you carry out at least part of your services, effective management in the Union, and at least one EU-resident director? Supervisors look for real decision-making, not a letter-box.
- Are client-facing staff ready for ESMA’s knowledge-and-competence expectations for those giving advice or information on crypto-assets, which apply from 28 July 2026?
The programme of operations and the policy set
The regulator authorises a business it can supervise: Art. 62 sets the application content, a programme of operations backed by policies that actually run.
- Custody and safeguarding arrangements that match how you actually hold client assets and funds?
- Complaints handling, conflicts of interest and outsourcing policies written for your business, not templated?
- ICT and operational resilience in DORA territory, and an AML programme a supervisor, an auditor and a bank will all accept?
The clock and the sequence
The statutory clock is short; getting the file complete is what takes time. Run the slow workstreams in parallel.
- Under Art. 63(9) the regulator has 40 working days to assess a complete file, after the completeness check. Real timelines are set by how complete you file and how well you answer the regulator’s information request, not by regulator slowness.
- Are banking and audit relationships being built in parallel with the drafting, rather than after the grant? They are usually the slow path.
- If you missed the transitional deadline, re-entry is a live path, not a dead end: an orderly wind-down of the EU leg followed by a clean filing beats operating in breach.
If the business is a stablecoin or a yield product, read Arts 40 and 50 before anything on this list. Both ban interest on asset-referenced and e-money tokens, both extend the ban to service providers handling those tokens, and both define interest widely enough to catch net compensation or discounts with equivalent effect, whoever pays it. A product paying yield on a stablecoin to EU users has a structural problem, not a marketing one. We mapped how this plays out in stablecoin yield across jurisdictions.
A CASP authorisation is a supervised relationship, not a registration you buy. The regulator, the auditor and the bank are all checking the same thing: whether this is a genuine, governed business with real decision-making in the EU. So make the decisions in order, perimeter, services, member state, and build the substance and the file before the clock starts. The filing itself is the work of EU-qualified local counsel; the jurisdiction choice, the group structure and the sequencing are decisions the founder has to get right first. That is the work this checklist front-loads.
Planning an EU market entry?
Infinilex quarterbacks the cross-border side: discovery, jurisdiction choice, group structuring and project management, with EU-qualified local counsel handling the regulator-facing filing. Send us what you do and who your users are, and we will map the class, the member state and the sequence.
Want this as a PDF in your inbox?
Email us and we will send the current version, and the updated one each time the law moves. Or print the page: it is built for paper.
This checklist is general information for founders, not legal or regulatory advice for your specific project. MiCA, its implementing measures and national practice change; confirm every point against current law before relying on it. Infinilex is a consultancy working with EU-qualified local counsel, not EU counsel itself. The right class, member state and sequence depend on your activity, your users and your wider structure. Have your setup reviewed before you file.
Prepared by Infinilex Consultancy · infinilex.io · Verified as of 18 July 2026. Printed copies date; check infinilex.io/resources/ for the current version.