What Is a CASP Licence Under MiCA? A Plain-English Guide

For crypto businesses planning to operate in Europe, understanding licensing requirements is an important part of entering the market. One of the first questions they encounter is: What is a CASP licence, and why does it matter under MiCA?

A CASP licence is commonly used to describe regulatory authorisation that allows a Crypto-Asset Service Provider to offer specified crypto-asset services under the European Union's Markets in Crypto-Assets Regulation (MiCA).

The framework applies to activities such as cryptocurrency exchanges, custody services, trading platforms, and certain crypto-asset advisory services.

For businesses based outside the EU, including Australia and the United States, understanding MiCA authorisation is also important when considering European operations.

This guide explains what a CASP licence means, what activities it covers, who issues it, and how businesses can understand their regulatory responsibilities. For a broader overview of the regulatory framework and ongoing obligations, see MiCA Compliance for CASPs: The Complete 2026 Guide.

What Is a CASP Licence Under MiCA?

A CASP licence refers to authorisation granted under the EU's regulatory framework for crypto-asset service providers.

MiCA, formally known as Regulation (EU) 2023/1114, establishes common requirements for specified crypto-asset activities across the European Union.

Before MiCA, crypto businesses operated under different national regulatory arrangements. This created differences in how providers were registered, supervised, and permitted to operate across Member States.

MiCA introduces a more consistent framework for crypto-asset services, including requirements relating to authorisation, governance, customer protection, and operational conduct.

What Does CASP Stand For?

Under the Markets in Crypto-Assets Regulation (MiCA), a Crypto-Asset Service Provider (CASP) is an entity that professionally provides one or more regulated crypto-asset services to clients and is authorised to provide those services under the regulation.

Examples of CASPs may include businesses that:

1. Operate crypto-asset trading platforms: Facilitate the buying and selling of crypto-assets.
2. Provide custody services: Safeguard clients’ crypto-assets or the means of accessing them.
3. Execute transactions: Carry out crypto-asset transactions on behalf of clients.

However, not every blockchain-related business qualifies as a CASP. For example, developing blockchain software does not automatically make a company a regulated service provider.

CASP classification depends on the activities a business performs, the services it offers to clients, and the applicable MiCA definitions. Businesses should assess their actual operations to determine whether CASP authorisation is required.

Is a CASP Licence the Same as MiCA Authorisation?

In everyday industry discussions, the terms CASP licence and MiCA authorisation are often used interchangeably.

Technically, MiCA refers to authorisation rather than creating a separate legal instrument formally named a CASP licence.

Under Article 59, businesses generally need an appropriate regulatory basis before providing covered crypto-asset services within the EU.

There are two important routes:

• CASP authorisation: An eligible business receives authorisation under Article 63 following assessment by the relevant national competent authority.
• Article 60 notification: Certain existing regulated financial institutions may provide specified crypto-asset services through notification arrangements, subject to the applicable requirements.

These routes are not interchangeable for every business.

Understanding which arrangement applies is an important first step when assessing whether a crypto company can lawfully provide services under MiCA.

What Does a CASP Licence Allow a Crypto Business to Do?

A CASP licence allows an authorised business to provide the crypto-asset services covered by its authorisation, subject to MiCA's applicable requirements.

It does not automatically grant permission to conduct every cryptocurrency-related activity.

MiCA identifies ten categories of regulated crypto-asset services, including exchange, custody, trading, advice, portfolio management, and transfer activities.

Crypto-Asset Services Covered by MiCA

The following examples illustrate how CASP authorisation may relate to different business operations.

These are simplified illustrations. The precise classification depends on MiCA's legal definitions and how the business actually operates.

Other regulated categories include placing crypto-assets.

A company offering several services may need authorisation covering each relevant activity. Permission to provide custody services, for example, does not automatically authorise the operation of a trading platform.

Businesses should therefore identify their activities carefully rather than assuming that one licence covers their entire operating model.

What a CASP Licence Does Not Automatically Permit

CASP authorisation has defined limits.

It does not automatically:

• Authorise every crypto-asset service or financial activity.
• Replace other applicable EU financial services laws.
• Guarantee that a cryptocurrency or platform is risk-free.
• Exempt the provider from anti-money laundering requirements.
• Permit activities beyond the scope of its approved authorisation.

Some crypto-related activities may also fall under other regulatory frameworks, depending on the assets and services involved.

A CASP licence is therefore best understood as regulatory permission for specific activities, not a general endorsement of every product offered by a crypto business.

Who Issues a CASP Licence Under MiCA?

CASP authorisation is granted by the appropriate regulatory authority in an EU Member State, rather than through a single EU-wide licensing office.

Although MiCA establishes a common framework, national regulators remain responsible for assessing authorisation applications.

The Role of National Competent Authorities

A national competent authority (NCA) is the regulator responsible for supervising relevant financial activities within its jurisdiction.

For CASP authorisation, the competent authority assesses whether an applicant meets applicable MiCA requirements.

This includes reviewing the proposed business activities, governance arrangements, financial safeguards, management suitability, and operational controls.

For example, a business seeking authorisation in Germany would engage with the relevant German regulatory authority, while a business established in another EU Member State would follow that jurisdiction's applicable authorisation process.

The shared regulatory framework promotes consistency, but the assessment still takes place through the responsible national authority.

What Does ESMA Do?

The European Securities and Markets Authority (ESMA) supports consistent supervision and implementation of MiCA across the EU.

Its responsibilities include contributing to supervisory convergence, developing regulatory and technical guidance, and maintaining central information about regulated crypto-asset market participants.

ESMA also publishes registers that help businesses and consumers review regulatory information.

However, ESMA does not ordinarily issue individual CASP authorisations. That responsibility lies with the relevant national competent authority.

This distinction matters when businesses are preparing applications or checking whether a provider is properly authorised.

What Are the Basic Requirements for CASP Authorisation?

CASP authorisation involves more than registering a company or submitting a business description.

Regulators need to assess whether the applicant has the organisational arrangements, financial resources, and control systems necessary for its proposed services.

The exact requirements depend partly on the activities for which authorisation is requested.

Business Structure, Governance, and Financial Safeguards

Under MiCA, businesses seeking Article 63 CASP authorisation generally need to demonstrate appropriate arrangements in several areas:

1. EU establishment: The provider must satisfy applicable registered office, effective management, and management residency requirements.
2. Governance: Management must have suitable knowledge, experience, and reputation.
3. Risk management: The organisation needs appropriate systems to identify, assess, and manage relevant risks.
4. Financial safeguards: Prudential requirements apply according to the services provided.
5. Client protection: Relevant safeguards must address the handling of customer crypto-assets and funds.

For example, a business offering custody services must consider how customers' assets will be protected and managed.

A business operating a trading platform has additional responsibilities connected with its platform rules and operations.

These differences make the scope of proposed services especially important.

Operational and Compliance Responsibilities

Authorisation is not simply a one-time approval.

CASPs must continue meeting applicable regulatory requirements while providing their services.

These responsibilities may include maintaining appropriate records, managing conflicts of interest, handling customer complaints, and operating suitable information technology and security arrangements.

Applicable anti-money laundering and counter-terrorist financing obligations must also be considered.

MiCA Articles 62 and 63 establish requirements relating to applications and their assessment, while other provisions address continuing operational obligations.

Businesses can use ESMA's MiCA single rulebook to examine the relevant provisions and associated technical requirements.

The central point is that authorisation depends on the business demonstrating its ability to operate within the regulatory framework, not merely stating that it intends to comply.

Can an Australian Crypto Business Obtain a CASP Licence?

Yes, an Australian-owned crypto business may be able to establish an eligible EU entity and seek CASP authorisation, provided the applicant meets the relevant requirements.

However, Australian registration or licensing does not automatically provide MiCA authorisation.

A company must assess its proposed European activities and determine the appropriate regulatory route.

How MiCA Applies to Non-EU Businesses

MiCA primarily regulates covered crypto-asset activities within the EU. Businesses in Australia or the US considering European expansion should assess whether their activities involve providing regulated crypto-asset services to EU customers.

Key considerations include:

• EU establishment requirements: Under Article 59, CASPs authorised under Article 63 must satisfy MiCA's establishment conditions, including having a registered office in a Member State where they carry out at least part of their services and effective management within the EU.
• Overseas operations: Maintaining an overseas headquarters and serving European customers remotely does not automatically satisfy these requirements.
• Reverse solicitation: MiCA contains a limited provision for services initiated exclusively by a customer. This should not be treated as a general exemption for overseas businesses actively marketing services to EU customers.
• Market entry planning: Businesses should assess their proposed services, EU operating structure and applicable authorisation requirements before entering European markets.

Example: An Australian cryptocurrency exchange planning to serve customers in France and Germany should evaluate its proposed services, establish an appropriate EU operating structure and determine the relevant authorisation requirements before launching.

CASP Authorisation vs Australian VASP Registration

Australia regulates virtual asset activities through its own legal framework.

AUSTRAC's virtual asset service provider requirements address domestic registration and anti-money laundering obligations for covered providers.

Depending on the products and activities involved, Australian financial services requirements administered by ASIC may also apply.

These obligations differ from MiCA authorisation.

Depending on the products and activities involved, Australian financial services requirements administered by ASIC may also apply.

These obligations differ from MiCA authorisation.

Businesses operating in both markets may therefore have separate regulatory responsibilities.

Meeting Australian requirements does not remove the need to assess MiCA, and EU authorisation does not replace Australian obligations.

Can a CASP Licence Be Used Across the EU?

One important feature of MiCA authorisation is the ability to provide authorised crypto-asset services across EU Member States through the regulatory framework commonly known as passporting.

Rather than seeking an entirely separate CASP authorisation in every Member State, an authorised provider can use the cross-border arrangements established by MiCA.

However, the provider must follow the applicable notification process.

Under Article 65, a CASP intending to provide services in additional Member States must submit information to its home competent authority, including the destination countries, proposed services, and intended starting date.

The authority then communicates the relevant information to the appropriate bodies.

For example, a CASP authorised in France may be able to expand its authorised services into Spain using these arrangements.

The authorisation does not automatically permit services outside its approved scope.

Businesses should also distinguish EU passporting from any separate requirements arising under other regulatory frameworks.

How Can You Check Whether a CASP Is Authorised?

A company describing itself as MiCA-compliant is not necessarily authorised to provide every crypto-asset service.

Checking its regulatory status is an important step for businesses, customers, and potential commercial partners.

ESMA provides a central source of information about entities operating within the MiCA framework.

To verify a provider:

1. Visit ESMA's MiCA register. Locate the information covering crypto-asset service providers.
2. Search for the provider's legal entity. Use its registered legal name rather than relying only on a trading brand.
3. Check the authorisation information. Review the relevant authority and available regulatory details.
4. Confirm the services covered. A provider may be authorised for some activities but not others.
5. Cross-check with the national regulator. Where clarification is needed, consult the relevant competent authority's official records.

It is also worth confirming that the company operating a website is the same legal entity identified in the register.

A familiar brand name, regulatory claim, or professional-looking website should not replace official verification.

Why CASP Authorisation Matters for Crypto Businesses

CASP authorisation provides a regulatory foundation for businesses offering covered crypto-asset services in the EU.

It establishes expectations around governance, financial safeguards, operational conduct, and accountability.

For management teams, this means understanding not only which services require authorisation but also how continuing obligations affect everyday decisions.

By October 2026, MiCA's general transitional period for qualifying existing providers has ended. Businesses should assess their current authorisation status rather than assuming earlier national arrangements continue to permit EU operations.

Developing internal regulatory knowledge can help organisations understand these responsibilities.

Global Compliance's MiCA Compliance for Crypto-Asset Service Providers (CASPs) course offers a relevant learning opportunity for professionals seeking to strengthen their understanding of the framework and its practical compliance implications.

Training can support better awareness and decision-making, although it does not replace regulatory authorisation or specialist legal advice.

Conclusion: Understanding CASP Authorisation Under MiCA

A CASP licence is more than a document permitting a crypto business to operate. It represents authorisation to provide specified regulated services within the EU under MiCA, together with the responsibility to meet applicable regulatory requirements.

For crypto exchanges, custody providers, and other service businesses, understanding the scope of authorisation is an important starting point.

Businesses based outside Europe, including Australia and the United States, should also consider how MiCA applies to their proposed EU activities.

The practical next step is to identify the services being provided, assess the relevant regulatory route, and verify requirements using official sources.

Frequently Asked Questions

Is a CASP Licence the Same as MiCA Authorisation?

The terms are commonly used interchangeably, but MiCA formally refers to authorisation. An Article 63 CASP authorisation permits specified regulated crypto-asset services, subject to applicable requirements. Certain existing financial institutions may instead qualify to provide particular services through Article 60 notification arrangements.

Who Issues a CASP Licence in the EU?

CASP authorisations are granted by the relevant national competent authorities in EU Member States. These regulators assess applications against MiCA requirements. ESMA supports supervisory consistency and maintains EU-level regulatory information, but it is not the ordinary authority issuing individual CASP authorisations.

Can an Australian Company Apply for CASP Authorisation?

An Australian-owned business may seek authorisation through an eligible EU-established entity if it meets the applicable requirements. MiCA includes conditions concerning registered office, effective management, and management residency. Existing Australian regulatory registrations do not automatically provide authorisation to conduct regulated crypto-asset services within the EU.

How Do I Check if a CASP Licence Is Valid?

Consult ESMA's register of crypto-asset service providers and confirm the provider's legal name, authorisation information, and permitted services. Where necessary, verify those details against records maintained by the relevant national competent authority. Be careful not to assume that a platform's brand name matches its authorised legal entity.

Can a CASP Licence Be Used Across the EU?

Yes. MiCA allows authorised CASPs to provide services across EU Member States through its cross-border arrangements. Providers must comply with the applicable notification requirements and remain within their authorised service scope. Authorisation does not automatically cover additional services for which the provider has not been approved.

What Is the Difference Between a CASP and a VASP?

CASP means Crypto-Asset Service Provider and is defined within the EU's MiCA regulatory framework. VASP means Virtual Asset Service Provider, a term commonly used in international anti-money laundering standards and some national regulatory systems. The two concepts overlap, but their definitions, obligations, and authorisation arrangements are not necessarily identical.