Quick answer: Since 1 July 2026, no national grandfathering regime is left in the EU. A firm providing crypto-asset services to EU clients needs a MiCA authorisation as a crypto-asset service provider (CASP). That means one licence from one national regulator, passported across the EEA, with minimum capital of €50,000, €125,000 or €150,000 depending on services. ESMA has told unauthorised firms to wind down. Further changes are coming in 2027: AML rules on 10 July, DAC8 tax reports, and a proposal to move CASP supervision to ESMA.
Key facts about Crypto Licensing at a glance (as of 13 October 2026)
| Topic | Status |
| Transitional period (Art. 143(3) MiCA) | Ended 1 July 2026 in all member states, no extensions |
| Authorised CASPs on ESMA’s register | About 360–390 depending on counting method (early October 2026) |
| Capital floor | €50,000 / €125,000 / €150,000, or 25% of prior-year fixed overheads if higher |
| Statutory review time | 25 working days for completeness + 40 for assessment, often much longer in practice |
| Passport | Notification route across the EEA once authorised |
| Non-EU firms | No equivalence regime. Only narrow reverse solicitation (Art. 61) |
| Next hard date | 10 July 2027: AMLR applies |
Changes to crypto licensing rules in 2026
The transition ended. MiCA’s Article 59 prohibition on unauthorised services had been in force since December 2024. Article 143(3) only deferred it for firms already operating under national law, and that deferral ran out on 1 July 2026. ESMA confirmed on 17 April 2026 that there would be no extension, and said the rule applies even where a member state has not implemented MiCA.
ESMA moved to enforcement. Its 23 June 2026 statement expects unauthorised CASPs to stop onboarding, stop marketing and wind down in an orderly way, with custody continuing only as long as needed for the exit. It also states that non-EU firms cannot serve EU clients or solicit them, including in B2B arrangements. Clients of unauthorised firms do not get MiCA safeguards, including asset protections.
Many pre-MiCA firms did not convert. More than 1,200 entities held national VASP registrations before MiCA. About 210 CASPs were authorised by May 2026, roughly 17%, according to reporting that cites CCN (Coinpaprika). The register has grown since. One count of ESMA’s file from 30 September 2026 found 359 current authorisations, and a tracker showed 386 on 7 October. Treat any figure as dated, because the register is updated weekly and lags national decisions.
Who needs a MiCA licence, and who doesn’t
- You need an authorisation if you provide any MiCA crypto-asset service (custody, exchange, trading platform, order execution, transfers, advice and others) to clients in the EU on a professional basis. Where the firm is incorporated does not change this. Location of the client does.
- You may use a notification instead if you are already a regulated institution such as a bank or an investment firm. Article 60 gives these firms a shorter route, with the regulator given 20 working days for completeness plus 20 for missing items.
- Non-EU firms have no equivalence route. The only exception is reverse solicitation under Article 61, where the client approaches you entirely on their own initiative. ESMA reads this narrowly, and a disclaimer in your terms does not cure advertising that reached the client first.
- Pure DeFi without an intermediary is outside MiCA’s current perimeter, but that may change (see the 2027 section).
What a CASP authorisation requires
Minimum capital (Annex IV, Art. 67). The floor depends on services:
| Class | Servicios | Minimum |
| 1 | Order execution, reception and transmission, placing, advice, portfolio management, transfers | €50,000 |
| 2 | Custody and administration, exchange for funds or other crypto-assets | €125,000 |
| 3 | Operating a trading platform | €150,000 |
If a quarter of last year’s fixed overheads is higher, that figure applies instead. Some commercial guides group the services differently, so check Annex IV before you budget.
Process and timing. The regulator has 25 working days to confirm completeness and 40 working days to assess. A complete file can clear in roughly 65 working days at a well-run authority, but practitioners report nine to eighteen months end to end for real applications. Plan for the dossier, not the statutory clock: business plan, governance, fit-and-proper checks for management, AML framework, custody and safeguarding arrangements, and the capital itself.
Passporting. Once authorised, you notify the home regulator of the host states and services you want. The regulator forwards it to the host states, ESMA and the EBA within 10 working days, and you may start on confirmation or at the latest on the 15th calendar day. Firms that traded only under transitional cover could not passport, a point ESMA confirmed.
Choosing a jurisdiction: what the 2026 evidence shows
All 27 member states share one rulebook, but their authorities differ in readiness and timing. Match the jurisdiction to your business, not to a headline price.
| País | What is verifiable as of Oct 2026 |
| Estonia | Finantsinspektsioon has been the sole CASP authority. Its portal opened for applications on 18 March 2026. The old FIU licences, 36 left at the start of 2026, were cancelled on 1 July. Only Lightspark Payments Europe AS had a standalone CASP authorisation by then. |
| Lituania | Bank of Lithuania. The national transition ended earlier, on 30 December 2025. |
| Letonia | Latvijas Banka licensed Hodleris SIA and Bleap SIA on 25 June 2026 and publishes a fixed timeline and fee schedule. |
| Polonia | The president vetoed the national implementing act three times, the last on 11 June 2026. As a result, there is no authority to grant CASP authorisations, and Polish firms have sought licences abroad (Cointelegraph). Check for later legislative news. |
| España | Used the full 18-month transition. It has 15 of the authorisations on ESMA’s register, sixth by count behind Germany, France, the Netherlands, Cyprus and Malta (Hokenfi). |
| Ten member states | Had issued no public CASP authorisation by May–June 2026 (Coinpaprika). |
When comparing, ask these questions:
- Does the authority have a functioning application process and a track record of decisions?
- What local substance does it expect? Some providers report that the Estonian FSA does not accept a virtual office alone. Check this with the regulator, not a vendor.
- Where are your bank, management and key staff? A licence is judged on real operations.
- How will supervision change? See the ESMA proposal below.
Obligations that come with the licence
- Travel Rule. The Transfer of Funds Regulation has applied to crypto since 30 December 2024. CASP-to-CASP transfers must carry originator and beneficiary data, and self-hosted wallet transfers above €1,000 trigger ownership checks.
- DAC8 tax reporting. It applies from 1 January 2026, with 2026 as the first reporting year. Reports go to the tax authority in 2027 on a deadline set by each member state, and authorities exchange data from September 2027. You need residency self-certification from customers, including those onboarded before 2026.
- Ongoing prudential and conduct rules. Own funds, safeguarding, complaints, conflicts, record keeping and operational resilience. Delegating custody to an unauthorised entity is not allowed (Bitcoin Magazine).
What to expect in 2027
10 July 2027: AMLR applies. The EU Anti-Money Laundering Regulation treats CASPs as financial institutions. Article 79 prohibits anonymous crypto-asset accounts and accounts that allow anonymisation, including through anonymity-enhancing coins. AMLA is due to issue related guidelines by that date, and none were published as of early October 2026. The AML Authority is also due to begin selecting up to 40 cross-border groups for direct supervision from 1 July 2027.
ESMA as sole CASP supervisor (proposal). The Commission’s Market Integration and Supervision Package (COM(2025) 943, 4 December 2025) would move authorisation, supervision and enforcement for all CASPs from national authorities to ESMA. Under the proposal it would apply 12 months after entry into force, with ESMA taking over supervision after 24 months. In June 2026 most of the Council favoured limiting this to significant CASPs, while the ECB supports covering all of them. This is a proposal. It does not change today’s requirement to apply to a national authority.
MiCA 2.0. The Commission’s consultation ran from 20 May to 31 August 2026. It covers DeFi, staking, lending and borrowing, NFTs, prediction markets, multi-issuance and third-country stablecoins, the ban on interest on stablecoins, and issuer capital. It notes that no asset-referenced token had been authorised in nearly two years. The consultation commits the Commission to no legislation. If your model touches staking, lending or DeFi, watch the outcome.
DAC8 first filings and exchanges during 2027, as described above.
Common mistakes
- Relying on a pending application. After 1 July 2026, a pending application does not protect you. Article 143(3) allowed continuation only until authorisation was granted or refused, and in any case not beyond 1 July.
- Treating an old national licence as a passport. A legacy VASP or FIU licence gives no EU-wide rights. In Estonia there was no automatic conversion (Crassula).
- Using reverse solicitation as a business model. It works client by client and does not scale. ESMA also expects authorities to monitor for circumvention.
- Choosing a jurisdiction on speed alone. Poland shows the risk: no implementing act meant nowhere to file.
- Forgetting tax reporting. DAC8 data collection has been running since 1 January 2026.
Frequently asked questions
Is a crypto licence required to serve EU clients in 2026?
Yes. Since 1 July 2026, providing crypto-asset services to EU clients without MiCA authorisation breaches EU law, with the narrow exceptions of already-regulated firms using notification and strictly client-initiated reverse solicitation.
What is a CASP licence?
It is an authorisation under Regulation (EU) 2023/1114 (MiCA), issued by a national competent authority, for providing crypto-asset services. It can be passported across the EEA.
How much capital does a MiCA CASP need?
€50,000, €125,000 or €150,000 depending on the services, or 25% of the previous year’s fixed overheads if higher.
How long does MiCA authorisation take?
The statutory clock is 25 working days for completeness and 40 for assessment. Real timelines are commonly several months to a year or more, depending on file quality and authority workload.
Did Estonia’s old crypto licences survive?
No. The FIU cancelled the remaining virtual currency licences on 1 July 2026, with no automatic conversion. New applications go to Finantsinspektsioon under MiCA and Estonia’s Crypto Markets Act.
Can a non-EU exchange serve European customers?
Only where the customer approaches it at their own exclusive initiative, and only for what they asked. ESMA says non-EU firms cannot solicit EU clients or serve them in B2B arrangements without authorisation.
Will ESMA replace national regulators for CASPs?
It has been proposed but not adopted. The Council has leaned toward ESMA supervising only significant CASPs, and the legislative process is ongoing.
What changes on 10 July 2027?
The AML Regulation (AMLR) applies. CASPs become obliged entities under the same regulation as banks, and anonymous accounts and anonymity-enhancing coins are prohibited.
How Helvetios Can Help with Your European Crypto Business Setup
Obtaining a MiCA CASP authorisation is only one part of establishing a crypto business in Europe. Founders also need to choose a suitable jurisdiction, structure their company, plan for operational substance, and prepare for ongoing accounting, tax and compliance obligations.
Helvetios helps international entrepreneurs plan and establish their European business structures with independent consulting and practical support throughout the setup process.
Depending on your business model and requirements, we can help you:
- Compare European jurisdictions. Understand the practical differences between countries and identify which options may be worth exploring for your business, taking into account regulatory readiness, operational requirements and your long-term plans.
- Plan your company setup. Get guidance on incorporation, corporate structure, local address requirements and the practical steps involved in establishing a presence in your chosen jurisdiction.
- Explore banking and payment solutions. Receive support with bank and fintech account applications, payment service provider options and proof-of-address documentation where required. Availability depends on the provider’s eligibility criteria and approval process.
- Prepare for ongoing business obligations. Explore bookkeeping, accounting, tax reporting and corporate compliance support as your business develops.
- Coordinate the next steps with relevant specialists. Where your project requires regulated legal or licensing advice, we can help you identify the areas that need specialist attention and plan your next steps accordingly.
Planning to launch a crypto business in Europe?
MiCA authorisation requirements depend on the services you intend to provide, while the right jurisdiction depends on more than the headline cost or expected application timeline.
Contact Helvetios to discuss your international expansion plans and explore the corporate, banking and operational arrangements your business may need.
Helvetios — independent consulting and support for entrepreneurs expanding internationally.
Important: Helvetios provides consulting and business setup support. CASP authorisation decisions are made by the competent regulatory authorities. Licensing eligibility, requirements and timelines must be assessed for each individual business.
