From VASP to CASP: What Crypto Businesses Must Do Before the 1 July 2026 Deadline?
From VASP to CASP: What Crypto Businesses Must Do Before the 1 July 2026 Deadline
The EU's Markets in Crypto-Assets Regulation ends the era of fragmented national VASP registrations across 27 member states. Every crypto exchange, custodian, order book, and portfolio manager operating in the EU must hold CASP authorisation — or exit the market entirely. This guide covers who is in scope, what authorisation actually requires, and what the July 2026 deadline means for your business in practical terms.
Section 1 — The VASP-to-CASP Transition: What Changed and Why
Until December 2024, a crypto business operating across the EU had to navigate up to 27 different national licensing regimes — each with its own thresholds, registration requirements, and enforcement approaches. MiCA replaces that fragmentation with a single, harmonised framework. The central concept is the Crypto-Asset Service Provider (CASP): a defined category of regulated entity that requires authorisation once and can then passport its services across the entire EU single market.
The shift from VASP to CASP is not merely a renaming exercise. The FATF-based VASP definition — which most EU national regimes implemented — focused primarily on anti-money-laundering registration. MiCA's CASP framework goes substantially further: it requires full prudential authorisation, capital adequacy, fit-and-proper assessments, mandatory policies, and ongoing supervisory oversight. Companies that hold national VASP registrations are not automatically CASPs — they must apply for CASP authorisation under MiCA before the transitional period expires.
Three Things MiCA Actually Changed for Crypto Businesses
Registration → Authorisation
National VASP registration was a light-touch AML compliance measure. CASP authorisation is a full financial services licence — with capital requirements, fit-and-proper assessments, mandatory policies, and ongoing regulatory supervision. The bar is materially higher.
Country-by-Country → EU Passport
Once authorised in a home member state, a CASP can provide services across all EU member states without re-authorisation. Cross-border operation requires only a passporting notification — a significant reduction in regulatory friction for businesses serving EU-wide clients.
Fragmented → Uniform Standards
MiCA imposes harmonised investor protection requirements across the EU: disclosure obligations, conflicts of interest rules, client asset safeguarding, and complaint handling. Regulatory arbitrage — choosing the most lenient jurisdiction — is structurally eliminated.
A crypto business authorised as a CASP in, say, Germany (by BaFin) can passport its services to France, the Netherlands, Spain, or any other EU member state without applying for a separate licence in each country. The process involves notifying the home NCA (BaFin) of the planned cross-border activities, which then communicates with the host member state's NCA. The host NCA has limited grounds to refuse the passport.
This is a significant operational advantage over the pre-MiCA regime, where businesses had to maintain separate national registrations in each market they operated in. The passport applies to all services listed in the CASP's authorisation — a business authorised to provide custody and trading services in Germany can passport both services across the EU. Services not listed in the home member state authorisation are not passported and require expansion of the authorisation or separate steps.
Section 2 — Who Is In Scope: Which Crypto Businesses Need CASP Authorisation
MiCA defines a Crypto-Asset Service Provider (Article 3(1)(16)) as any legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis. The critical question for any crypto business is whether the activities it carries out fall within the 10 regulated crypto-asset services listed in Article 3(1)(16) and Article 60 of MiCA.
CASP authorisation is required per service — not per entity in a binary sense. A business that provides two services (for example, custody and trading platform operation) must be authorised for both. The authorisation covers the specific services listed in the authorisation decision, and the EU passport extends only to those listed services. Expanding into a new service type after authorisation requires an amendment to the authorisation.
The 10 Regulated Crypto-Asset Services Under MiCA
Custody and administration of crypto-assets on behalf of clients
Safekeeping or controlling crypto-assets or the means of access to crypto-assets, including private keys. Covers exchanges, wallet providers, and custodians holding client assets.
Operation of a trading platform for crypto-assets
Running a multilateral system that brings together buyers and sellers of crypto-assets — including centralised exchanges (CEX) matching buy and sell orders for multiple clients.
Exchange of crypto-assets for funds
Buying or selling crypto-assets against fiat currency (EUR, USD, GBP, etc.) using proprietary capital. Covers OTC desks and on/off-ramp services operating with their own capital.
Exchange of crypto-assets for other crypto-assets
Buying or selling one crypto-asset in exchange for another using proprietary capital. Distinct from trading platform operation — this is principal trading rather than marketplace operation.
Execution of orders for crypto-assets on behalf of clients
Acting to conclude agreements to buy or sell crypto-assets on behalf of clients. Execution-only brokers and agency models executing client trades fall within this category.
Placing of crypto-assets
Marketing crypto-assets on behalf of an issuer or offeror to potential buyers, without a firm commitment to acquire the unsold portion. Covers ICO/ITO facilitators and token sale agents.
Reception and transmission of orders on behalf of clients
Receiving orders from clients and transmitting them to a third party for execution. Introducing brokers, referral platforms, and B2B order routing businesses are typically within scope.
Providing advice on crypto-assets
Providing personalised recommendations to clients on one or more crypto-assets. The "personalised" element distinguishes regulated advice from general market commentary or research.
Portfolio management of crypto-assets
Managing portfolios of crypto-assets in accordance with client mandates on a discretionary client-by-client basis. Crypto asset managers and robo-advisers exercising discretion are within scope.
Providing transfer services for crypto-assets on behalf of clients
Providing services of transferring crypto-assets from one distributed ledger address or account to another on behalf of a client. Payment-focused crypto transfer apps and crypto payroll services are within scope.
Scope at a Glance — Common Business Models
The following covers how the 10 services map to the most common EU crypto business models and what services they typically trigger:
Key Exemptions — Who Does Not Need CASP Authorisation
MiCA Article 4 sets out the entities and activities that fall outside the CASP framework. These exemptions are narrowly construed and cannot be relied upon without careful analysis of the actual business model.
Investment firms already authorised under MiFID II to provide investment services may provide equivalent crypto-asset services under MiCA without CASP authorisation — they must notify their NCA of the intention to provide crypto-asset services. This is a notification, not an application, and is subject to conditions set by the NCA.
Credit institutions authorised under the CRD may provide crypto-asset services under MiCA subject only to a prior notification to their NCA at least 40 working days before providing the service. No separate CASP authorisation is required — but the notification must include required disclosures and the services must be within the bank's existing authorisation scope.
Where a crypto-asset service is provided in a fully decentralised manner without any intermediary, MiCA does not apply. This exemption is narrow in practice: if there is any identifiable legal entity operating a front end, smart contract deployer, fee collector, or governance token holder exercising control, regulators are likely to view there as an identifiable person providing the service.
Crypto-assets that are unique and not fungible with other crypto-assets are excluded from MiCA (Article 4(1)(f)). However, NFT collections with large volumes of identical or similar tokens may be reclassified as fungible — a fractionalized or large-edition NFT series faces the same analysis as other crypto-assets. ESMA has published guidance on the boundary between NFTs and fungible crypto-assets.
Creating crypto-assets through mining or validation — including staking as a technical consensus mechanism — does not constitute a crypto-asset service under MiCA. However, providing staking-as-a-service on behalf of clients (i.e., where a third party delegates their staking to you) may fall within the transfer or custody service definitions depending on the structure.
Section 3 — CASP Authorisation Requirements: What You Need to Prepare
CASP authorisation under MiCA (Articles 62–76) is a full financial services licensing process, not a registration exercise. An application to the national competent authority requires capital adequacy evidence, a comprehensive governance framework, mandatory policies covering AML, cybersecurity, conflicts of interest, and client asset protection, plus a fit-and-proper assessment of all directors. The preparation timeline for a well-organised applicant typically runs four to six months before submission.
Authorisation decisions must be made within 25 working days of a complete application. However, the NCA can request additional information during that period, which suspends the clock. In practice, applicants should budget for six to nine months from initial submission to authorisation decision in most member states — making an application target of Q3–Q4 2025 necessary for businesses that want operational certainty before 1 July 2026.
Capital Requirements — Three Authorisation Classes
Article 67 of MiCA sets minimum own funds requirements based on the services a CASP provides. Where a CASP provides services from multiple classes, the highest applicable threshold applies. As an alternative to minimum own funds, MiCA permits professional indemnity insurance (PII) covering equivalent risk — subject to NCA acceptance.
Governance and Fit-and-Proper Requirements
Article 68 requires that a CASP's management body includes at least two independent directors who meet fit-and-proper requirements. The NCA assesses the knowledge, skills, experience, good repute, and conflicts of interest of all proposed management body members as part of the authorisation assessment.
Minimum two independent directors
The management body must include at least two independent executive directors at all times. A sole director structure is not compliant. The independence requirement means directors must be genuinely independent from significant shareholders — a founder who is also the sole director will need to appoint an additional qualifying director.
Fit-and-proper assessment
All management body members must demonstrate: relevant knowledge and experience (typically financial services, technology, or legal background); good repute (no criminal convictions, regulatory sanctions, or adverse financial history); and absence of conflicts of interest that would compromise independent judgement.
Remuneration policy
MiCA requires a documented remuneration policy that is gender-neutral and promotes sound risk management. The policy must be assessed and approved by the management body annually. Variable remuneration must not create incentives to take risks exceeding the CASP's risk profile, with particular attention to sales-linked bonus structures.
Place of effective management
At least one of the qualifying directors must be resident in the EU. NCAs in some member states interpret this as requiring effective management to be located in the home member state — a shell company with all management conducted from outside the EU will not meet the standard. Substance requirements are assessed during the authorisation process.
Mandatory Policies and Procedures
The authorisation application must include comprehensive documented policies covering the following areas. Each policy must be tailored to the CASP's specific business model — generic templates are unlikely to satisfy NCA reviewers.
Section 3 — Business Models That Work Well on Open LLMs
The commercial success of the Gemma, Llama 3, and Mistral licence families for software businesses is not theoretical — there are well-established archetypes of products that fit cleanly within the licence boundaries while generating defensible revenue. The pattern that runs through every commercially viable open-LLM business model is the same: the model is infrastructure, and the product is built on top. The revenue is derived from what the product does, not from access to the model itself.
The models best suited for commercial products without licence complications are Apache-2.0 licensed models — specifically Mistral 7B and its derivatives — because Apache-2.0 places no commercial restrictions on use, redistribution, or monetization. For products that need higher capability and can work within their licence restrictions, Llama 3 and Gemma are viable for most SaaS and vertical application use cases below the specific restriction thresholds. The key is matching the business model archetype to the model licence's actual constraints.
What Each Model Is Suited For Commercially
Four Business Model Archetypes That Work
Vertical SaaS with AI-powered workflow
Fine-tuned specialist model as a product
AI-augmented internal tooling sold externally
Consumer or SMB applications with embedded AI
Why Apache-2.0 Models Are the Default Choice for Maximum Commercial Freedom
What Apache-2.0 permits that custom licences restrict
Where Apache-2.0 models may require trade-offs
Section 4 — The 1 July 2026 Deadline: Timeline and Transitional Provisions
MiCA's transitional provisions under Article 143 allowed crypto businesses already operating in an EU member state under national law to continue during a grandfathering period without holding full CASP authorisation. That grandfathering period expires on 1 July 2026. After that date, there is no further transition — a business providing crypto-asset services in the EU without CASP authorisation will be operating unlawfully.
The transitional period does not apply automatically and uniformly. Individual member states chose whether to implement it, and some set shorter national transitional deadlines. A business cannot assume it can operate until 1 July 2026 in every EU market without verifying the transitional arrangements in each member state where it provides services.
MiCA Implementation Timeline
Regulation (EU) 2023/1114 entered into force 20 days after publication on 29 June 2023. The 18-month preparation period for Title V (CASP provisions) began. ESMA and EBA began developing the regulatory technical standards (RTS) required under MiCA — over 50 mandates covering authorisation templates, conduct requirements, and prudential standards.
The asset-referenced token (ART) and e-money token (EMT) issuance provisions became fully applicable. Issuers of stablecoins and other crypto-assets were required to comply with MiCA's issuance and disclosure rules from this date.
The CASP authorisation framework became fully applicable. NCAs began accepting CASP authorisation applications from this date. Businesses already providing crypto-asset services under national law became subject to transitional provisions under Article 143. The 18-month transitional period began.
The critical window for applicants. Businesses should aim to submit CASP applications by Q3–Q4 2025 at the latest to allow sufficient time for the NCA review process (25 working days for a complete application, plus request-for-information pauses) before 1 July 2026. Applications submitted too close to the deadline risk being incomplete or undecided by the transition end date.
All transitional grandfathering ends. Any business providing crypto-asset services in the EU without CASP authorisation after this date is operating unlawfully, regardless of its prior national VASP registration status. There is no further extension mechanism in MiCA. Businesses that have submitted an application but have not yet received an authorisation decision will be in an uncertain position — see the note on pending applications below.
How the Transitional Provisions (Article 143) Work
Member State Transitional Periods — Key Variations
The following reflects the position across selected member states. Businesses should obtain current legal advice on the transitional position in each relevant jurisdiction, as national implementing measures can change.
Germany (BaFin)
Germany implemented the full 18-month transitional period. Existing VASPs registered with BaFin before 30 December 2024 may continue under national law until 1 July 2026 while their CASP application is processed. BaFin began accepting applications from December 2024.
Full 18-month transitionFrance (AMF)
France implemented the transitional period for PSAN-registered entities (the French national VASP regime). Existing PSANs may continue operating until 1 July 2026, subject to ongoing compliance with French AML requirements during the transitional period. The AMF began the CASP authorisation process from December 2024.
Full 18-month transitionNetherlands (DNB / AFM)
The Netherlands applied a shorter transitional period — Dutch-registered VASPs had a reduced window compared to the full MiCA 18 months. Businesses operating in the Netherlands should verify the exact end date of the Dutch transitional period with DNB or their legal advisers, as the position may differ from the EU-wide 1 July 2026 deadline.
Shorter national periodIreland (CBI)
Ireland implemented the transitional provisions. The Central Bank of Ireland began accepting CASP authorisation applications in late 2024. Existing VASP-registered entities in Ireland may rely on the transitional provisions until 1 July 2026, subject to ongoing compliance with the CBI's VASP requirements and AML/CFT obligations.
Full 18-month transitionLithuania (LB)
Lithuania was a popular VASP registration hub under the previous AML-only regime. Lithuanian-registered VASPs must apply for CASP authorisation under MiCA — the Bank of Lithuania accepts applications and applies the Article 143 transitional provisions. Given the volume of VASPs registered in Lithuania, early application is advisable to avoid application processing backlogs.
Check with LB for timingPoland (KNF)
Poland has implemented MiCA through the KNF (Polish Financial Supervision Authority). Polish-registered VASPs are subject to the transitional provisions and may continue until 1 July 2026, subject to KNF requirements. Poland's existing national crypto regulation was relatively light-touch — CASP authorisation represents a substantially higher compliance burden for Polish operators.
Full 18-month transitionSection 5 — Consequences of Missing the Deadline and Your Action Plan
Operating as a crypto-asset service provider in the EU after 1 July 2026 without CASP authorisation is not a grey area. It is an unlawful activity in every EU member state, subject to criminal and administrative enforcement. The consequences extend beyond regulatory fines — loss of EU market access, forced wind-down of operations, and reputational damage are material business risks that cannot be managed retrospectively.
The window to act is narrowing. With authorisation timelines of six to nine months from application submission, businesses that have not yet begun their CASP application process need to start immediately. Every month of delay reduces the available buffer before the hard deadline.
What Happens If You Miss the Deadline
Unlawful operation — immediate exposure
Providing any of the 10 CASP services in the EU after 1 July 2026 without authorisation constitutes a violation of Regulation (EU) 2023/1114 in every member state. There is no grace period, no further extension, and no transitional mechanism after that date. The violation is immediate from the first day of operation post-deadline.
Loss of EU market access
Without CASP authorisation, the EU passport does not exist. A business operating without authorisation cannot lawfully serve EU-resident clients for the covered services, regardless of where the business is incorporated. Regulators in multiple member states may issue simultaneous prohibition orders against an unauthorised provider operating cross-border.
Administrative fines — up to 12.5% of annual turnover
MiCA Article 111 grants national competent authorities the power to impose administrative fines of up to €5 million (or 12.5% of annual turnover, whichever is higher) for the most serious infringements, including providing services without authorisation. These are per-infringement maxima — sustained unlicensed operation creates compounding exposure.
Public disclosure and reputational damage
NCAs are required under MiCA to publish enforcement decisions on their websites, including the identity of the infringing entity and the nature of the violation. Being publicly named as an unlicensed crypto operator has material consequences for customer trust, banking relationships, and future authorisation prospects across the EU.
Criminal liability in some member states
Beyond MiCA administrative sanctions, several EU member states — including France, Germany, and Lithuania — impose criminal liability on directors and officers of entities providing financial services without authorisation. Personal exposure for management is a distinct risk from the corporate administrative fine exposure.
Forced client asset wind-down
When a prohibition order is issued, an unauthorised CASP must return client assets and cease services — potentially under an NCA-supervised wind-down. An unplanned forced wind-down is operationally costly and commercially damaging, including the reputational impact of informing clients that services must cease due to regulatory non-compliance.
Your 8-Step CASP Authorisation Action Plan
Map your services against the 10 CASP categories
Conduct a structured assessment of every activity your business performs against the 10 regulated crypto-asset services in Article 3(1)(16) MiCA. Include current and planned services — a service you intend to launch before 1 July 2026 must be included in the initial authorisation application. Identify the applicable authorisation class (1, 2, or 3) and the capital threshold.
Identify your home member state and national competent authority
Your home member state is the EU member state in which your registered office is located (for legal persons). If you are not yet incorporated in the EU, you must establish a legal entity in an EU member state before applying for CASP authorisation — third-country businesses cannot hold a MiCA CASP authorisation directly. Choose your home member state taking into account the NCA's processing capacity, experience with crypto businesses, and your commercial plans.
Verify your transitional period position in each operating member state
Confirm whether you qualify for transitional provisions in each EU market where you currently provide services. Verify the national transitional deadline — not all member states use the full 1 July 2026 date. Confirm that your existing activities fall within the scope of the transitional provisions (continuation of pre-December 2024 services, not expansion). Document your transitional position.
Prepare governance — appoint qualifying directors
Ensure your management body includes at least two independent directors who meet the fit-and-proper requirements under Article 68. If your current structure has a sole director or directors who do not meet the independence requirement, begin the recruitment or restructuring process now — finding and onboarding qualifying directors takes time, and the NCA will scrutinise the fit-and-proper assessment carefully.
Draft and implement required policies
Commission the preparation of all mandatory policies: AML/CFT (including Travel Rule / TFR compliance), conflicts of interest, client complaint handling, business continuity, cybersecurity (DORA-aligned), outsourcing, market abuse prevention, and orderly wind-down. Policies must be tailored to your specific business model — NCAs routinely reject applications that contain generic or template policies that do not reflect the actual operations of the applicant.
Meet and evidence capital requirements
Organise and document the minimum own funds required for your authorisation class. If using professional indemnity insurance as an alternative, obtain a qualifying policy from an insurer acceptable to your NCA and verify coverage limits meet the MiCA thresholds. Prepare financial statements and projections demonstrating that capital requirements will be maintained on an ongoing basis, not just at the point of application.
Prepare and submit the authorisation application
Compile the complete application package using the ESMA standardised application templates. The application must include: corporate documents, business plan, financial projections, policy documentation, management body CVs and fit-and-proper evidence, programme of operations, and AML/CFT framework evidence. Submit no later than Q4 2025 to allow time for NCA review and any request-for-information rounds before July 2026.
Manage the NCA review process and respond to information requests
Following submission, the NCA has 25 working days to determine whether the application is complete, then 25 working days to make a decision on a complete application. Information requests pause the clock — respond promptly and completely. Use the review period to finalise operational readiness: systems, controls, and staffing should all be in place before authorisation is granted, not after.
Need support with your CASP authorisation application?
CASP authorisation under MiCA is a structured legal and regulatory process. The application package, policy framework, governance restructuring, and NCA engagement each carry material risks if not handled correctly. Our crypto licensing team assists crypto businesses across the EU with CASP authorisation strategy, application preparation, and the regulatory engagement required to achieve authorisation before the July 2026 deadline.
Explore Crypto Licensing Services →
