MiCA License Routes: CASP Authorization, Article 60, EMT or ART Issuance and Partner Licenses

A crypto-asset service provider (CASP) authorization is the general route: under Article 59 of MiCA, no one may provide crypto-asset services in the Union without it, unless an Article 60 notification applies. The applicant needs its registered office in a member state where it serves clients, its place of effective management in the EU and at least one EU-resident director (Art. 59(2)). It files with its home authority, the national competent authority of the member state of its registered office, and the file follows Delegated Regulation (EU) 2025/305. The authority acknowledges the application within five working days, checks completeness within 25 and decides within 40 working days of a complete file, with one suspension of up to 20 working days for questions (Article 63).

Observed times run longer than the statutory days. The Dutch AFM says "even in a best-case scenario it will take at least five months". The French AMF says review "may take up to four months once the complete file has been submitted", and that original files "are rarely complete".

ESMA's supervisory briefing of 31 January 2025 says "there are no low-risk CASPs". It expects in-country staff and at least one executive board member in the home state, and rules out outsourcing that turns the firm into "a letter-box entity". ESMA's peer review of 10 July 2025 found Malta's authority "partially meeting expectations in the authorisation process", and several of its recommendations went to every national authority. ESMA's statement of 4 December 2025 asked authorities to treat "'last minute' applications for authorisation under MiCA with considerable caution".

Capital is the higher of the Annex IV floor or a quarter of the previous year's fixed overheads (Art. 67): EUR 50,000 for execution, placing, transfers, reception and transmission of orders, advice and portfolio management, EUR 125,000 once custody or exchange is added, and EUR 150,000 with a trading platform. From day one a CASP is in scope of DORA (Article 2(1)(f)) and sends Travel Rule data with every transfer under Regulation (EU) 2023/1113, whose networks and vendors our EU Travel Rule guide compares. On 16 October 2026, ESMA's register flagged 75 active entities as Article 63 authorizations and left the legal basis blank for 178 others, which include both authorized CASPs and banks.

Article 60 lets a firm already licensed under other EU financial law provide crypto-asset services on notice. A credit institution notifies its authority "at least 40 working days before providing those services for the first time" (Art. 60(1)). ESMA's Q&A 2088 confirms that a bank "can provide any crypto-asset services on the basis of an Article 60 notification". It also warns that a bank holding no custody license "may have difficulties to provide the information required", and that national rules transposing the CRD still apply.

The other eligible firms keep to their existing scope (Art. 60(2) to (6)). A central securities depository notifies custody only. An investment firm notifies the services "equivalent to the investment services and activities for which it is specifically authorised under Directive 2014/65/EU". An e-money institution notifies custody and transfers "with regard to the e-money tokens it issues". A UCITS management company notifies advice and portfolio management, an authorized AIFM also reception and transmission of orders, and a market operator a trading platform. Registered AIFMs, the small managers below the AIFMD thresholds, "may not provide crypto-asset services on the basis of a notification under Article 60(5)" (Q&A 2397), and payment institutions are not on the list.

The file holds a program of operations, AML controls, ICT documentation, custody and segregation procedures and, for platforms, operating rules (Art. 60(7)), as detailed in Delegated Regulation (EU) 2025/303. The authority checks completeness within 20 working days and may give the firm up to 20 more to fill gaps, and the firm "shall not begin providing the crypto-asset services as long as the notification is incomplete" (Art. 60(8)); the text gives the authority no approval decision. Services outside the firm's equivalence need a CASP application on top (Q&A 2125). Article 60(3) gives transfers no MiFID equivalent, and a transfer offered inside another service is still the transfer service (Q&A 2071). ESMA's response to the Commission of 30 September 2026 says investment firms "would need to obtain a separate CASP authorisation in order to provide transfer services". None of the authorities whose pages were checked for this guide (AFM, AMF, BaFin, Central Bank of Ireland, CSSF) publishes how long notifications take in practice.

In ESMA's register file of 16 October 2026, 120 active entities carry the Article 60 flag, 98 of them in Germany, most of them banks; other banks, such as KBC Bank and CACEIS Bank, sit among the 178 entities with no legal basis given. Scopes vary: N26 Bank SE notified reception and transmission of orders only (14 May 2025), while BBVA (5 March 2025) and DZ BANK (23 December 2025) notified custody, execution and transfers. Germany kept no deemed notification: a crypto permission under the old banking law lapsed by the end of 31 December 2025 at the latest (KMAG § 50).

An e-money token (EMT) is a crypto-asset that "purports to maintain a stable value by referencing the value of one official currency" (Art. 3(1)(7)), and EMTs "shall be deemed to be electronic money" (Art. 48(2)). Under Article 48, only an issuer "authorised as a credit institution or as an electronic money institution" that has notified and published a white paper may offer one to the public or seek its admission to trading. It tells its authority of the plan at least 40 working days ahead (Art. 48(6)) and notifies the white paper 20 working days before publication, and "Competent authorities shall not require prior approval" (Art. 51(11)).

The license underneath is national. An e-money institution needs initial capital "of not less than EUR 350 000" (Directive 2009/110/EC, Article 4), and its authority decides within three months of a complete application (PSD2 Article 12, applied to e-money institutions through the E-Money Directive); a bank needs at least EUR 5 million (CRD Article 12). Holders "have a claim against the issuers", tokens are redeemed "at any time and at par value", and redemption "shall not be subject to a fee" (Art. 49). Article 50 bars interest and "any remuneration or any other benefit related to the length of time" a holder keeps the token. An e-money institution keeps "at least 30 % of the funds received" in separate accounts at credit institutions (Art. 54).

ESMA's EMT register file of 16 October 2026 lists 25 issuers: 20 e-money institutions, among them Circle Internet Financial Europe and Société Générale-FORGE, four credit institutions (Oddo BHF, CACEIS Bank, Banking Circle and Bison Bank) and one entry without a type. The EBA counted 45 notified EMTs on 14 October 2026, when it classified USDC as the first significant EMT, under joint EBA and national supervision from 12 November 2026. Our euro stablecoins guide sets seven euro tokens side by side and weighs issuing a firm's own token against distributing one.

An asset-referenced token (ART) is "a type of crypto-asset that is not an electronic money token and that purports to maintain a stable value by referencing another value or right or a combination thereof, including one or more official currencies" (Art. 3(1)(6)). Under Article 16, only a legal person "established in the Union" and authorized under Article 21, or "a credit institution that complies with Article 17", may offer one to the public. The authority checks completeness within 25 working days and drafts a decision within 60; the EBA, ESMA and the ECB give opinions within 20, and the final decision follows within 25 (Arts. 20, 21). The application follows Delegated Regulation (EU) 2025/1125.

A bank instead has its white paper approved and notifies "at least 90 working days before issuing", with a legal opinion that the token is neither excluded from MiCA nor an EMT; a negative ECB opinion on payment-system, monetary-policy or monetary-sovereignty grounds stops the offer (Art. 17). Own funds are the highest of "EUR 350 000", "2 % of the average amount of the reserve of assets" or a quarter of the previous year's fixed overheads (Art. 35), the reserve is segregated (Art. 36), and Article 40 bars interest.

ESMA's ART register file held only a header row on 16 October 2026, unchanged since 14 February 2025. BaFin's 2025 annual report says it refused authorization for the first ART applied for in Germany, under the transitional rule of Article 143(4), and prohibited its further distribution. MiCA names no banned design: Recital 41 applies the ART and EMT titles "irrespective of how the issuer intends to design the crypto-asset", so-called algorithmic stablecoins included, and sends algorithmic tokens that reference no assets to Title II. In our reading, a token with no backing cannot meet the ART or EMT reserve rules.

A white paper is MiCA's disclosure document for a token: who offers it, the project, the rights the token carries, its technology and its risks (Art. 6). Article 4 lets "a legal person" offer a crypto-asset that is neither an EMT nor an ART to the public once it has drawn up, notified and published a white paper and follows MiCA's content, notification, publication and marketing rules (Arts. 6 to 9); seeking admission to trading works the same way (Art. 5). The authority receives the white paper "at least 20 working days before the date of publication", with an explanation of why the token is not excluded, not an EMT and not an ART, and authorities "shall not require prior approval" (Art. 8). Its machine-readable classification data follow Delegated Regulation (EU) 2025/421.

No white paper is needed for offers "to fewer than 150 natural or legal persons per Member State", offers worth no more than "EUR 1 000 000" over 12 months, or offers only to qualified investors (Art. 4(2)). Title II does not apply at all to free tokens, mining or validation rewards, utility tokens for an existing good or service, or tokens usable only in a limited network (Art. 4(3)), though those exemptions fall away once the offeror announces it will seek admission to trading (Art. 4(4)). Retail buyers who buy from the offeror, or from a CASP placing the token for it, can withdraw within 14 days until the token is admitted to trading (Art. 13), and liability for the content sits with the offeror and its management body (Art. 15).

ESMA's white-paper register file held 1,049 rows on 16 October 2026 (rows, not unique tokens), 398 of them notified in Ireland. 279 rows name a CASP, led by Kraken entities with 157, consistent with platforms drafting white papers for the tokens they list (Art. 5(2), (3)). For tokens admitted to trading before 30 December 2024, platforms need compliant white papers "by 31 December 2027" (Art. 143(2)(b)).

A partner route keeps the regulated service with an authorized CASP. In the disclosed-counterparty model, the CASP contracts with the client directly: bunq states that "Crypto trading is provided by Payward Europe Solutions Limited t/a Kraken", and bunq itself does not appear in ESMA's register. Embedded crypto-as-a-service puts the provider's service inside the firm's app: in June 2026 BitGo announced that Bielik.io would offer deposits, trading and custody "through BitGo Europe's infrastructure". Bitpanda sells both an "Our license" and a "Bring-your-own license" model. This page covers which route the law leaves open; our crypto-as-a-service for banks guide compares the providers.

In a second model, the brand owner runs the front end, technology or first-line support as the CASP's outsourced provider under Article 73, where the CASP "shall remain fully responsible" and outsourcing must not "alter the relationship between the crypto-asset service providers and their clients". In our reading, whether such a front end is the CASP's outsourced function or a reception-and-transmission service of the brand's own turns on who receives the order (Q&A 2653), and the closest question (Q&A 2746) has no published answer. Where the brand is itself the client's provider and the supplier works behind it, the brand needs an authorization or a notification of its own.

A Commission answer published by ESMA (Q&A 2143) says "a CASP cannot designate agents in order to provide crypto-asset services on behalf of the CASP concerned. If a CASP appoints an agent, the agent needs to be a CASP itself." Q&A 2653 tells supervisors to look at "the order fulfilment flow" rather than contract labels, so an app that takes orders and forwards them provides reception and transmission (Art. 3(1)(23)), and a firm authorized or notified for that service may not be paid for routing orders to a particular provider (Art. 80(2)). Q&A 2882 of 18 June 2026 says a bare reference to a CASP, equally accessible to all potential investors, is no recommendation, while recommending a crypto service to a person may be advice, depending on the circumstances. Q&A 2746, which asks whether an unregulated holding may contract with and invoice clients while a group CASP performs the service, had no answer on 19 October 2026. Where a given referral or white-label model falls is for counsel.

Some banks pair a partner with a notification for the one service they perform: N26 Bank SE notified reception and transmission of orders only (register date 14 May 2025), and 56 German cooperative banks notified execution of orders alone for the cooperative network's offer with DZ BANK, two of them with start dates in late October and November 2026. In our reading, a licensed partner usually counts as a financial service under DORA rather than an ICT provider, while the custody software and Travel Rule tools around the integration do count; our DORA third-party risk guide applies that test type by type.

The EBA's no-action letter of 10 June 2025 told national authorities to treat transfers of e-money tokens on behalf of clients, and custody of EMTs, as PSD2 payment services, and a custodial wallet that sends to and receives from third parties as a payment account. Exchange of crypto-assets for funds or for other crypto-assets is not a payment service. Its opinion of 12 February 2026 said the transition "ends on 2 March 2026". From then, the opinion says, a CASP needs a payment institution or e-money license, or a partnership with a payment service provider, for example as its agent. A firm with a pending application may serve existing clients only, and authorities should require the rest "to offboard clients of EMT services that qualify as a payment service under PSD2". The Central Bank of Ireland added: "There is no discretion for the Central Bank to extend this deadline."

MiCA already allows the split: CASPs may provide payment services "themselves, or through a third party" authorized under PSD2 (Art. 70(4)). A payment institution needs initial capital of EUR 125,000 for payment services 1 to 5, or EUR 20,000 for money remittance alone, and an e-money institution EUR 350,000; the authority decides within three months of a complete application (PSD2 Articles 7 and 12; E-Money Directive Article 4). The EBA reported in February 2026 that "more than 100 CASPs have approached" national authorities "informally or have submitted an application", and had published no outcome figures by 19 October 2026.

PSD3 and the Payment Services Regulation were not adopted on 19 October 2026: that day the Parliament's Legislative Observatory showed them awaiting the Council's first-reading position, with 14 December 2026 as an indicative plenary date. The agreed PSR text would add a MiCA Article 60(4a) letting a payment institution notify EMT services equivalent to its payment services, and the EBA's response to the Commission of 24 September 2026 says the package does "not remove the double authorisation requirement".

Some activities sit outside MiCA's service list altogether. "Hardware or software providers of non-custodial wallets should not fall within the scope" (Recital 83). Where services "are provided in a fully decentralised manner without any intermediary, they should not fall within the scope" (Recital 22). MiCA still applies when only part of an activity is decentralized, and ESMA's response to the Commission of 30 September 2026 says legal uncertainty has "increased the risk of 'decentralisation washing'" and asks for a narrow legal definition of DeFi. Crypto-assets "that are unique and not fungible with other crypto-assets" are excluded (Art. 2(3)), though Recital 11 treats fractions and "a large series or collection" as signs of fungibility, and services provided only within a group are excluded too (Art. 2(2)(a)).

Staking is not one of the ten services. The Commission's answer in Q&A 2067 says "staking as such is not subject to specific requirements or licensing" when holders stake for themselves, while staking offered to clients is "ancillary to custody services" and needs a custody authorization, with staking losses "deemed as attributable to the CASP". Q&A 2607 adds that "MiCA does not allow the staking of clients' crypto-assets by CASPs for their own account, even in cases where the client has explicitly provided consent". Validation rewards also fall outside Title II's white-paper duty (Art. 4(3)).

MiCA "should not address the lending and borrowing of crypto-assets, including e-money tokens" (Recital 94). ESMA's Q&A 2883 of 18 June 2026 lets CASPs offer lending on conditions: using a client's assets "requires prior express and specific consent", revenues "should accrue to the client" apart from a fair and proportionate fee, and "Safeguarding arrangements under MiCA will also not apply to assets used in lending programmes". Some arrangements "could meet the definition of an alternative investment fund". A CASP offering unregulated services beside regulated ones follows ESMA's statement of 11 July 2025, which warns that a regulated status can create a "'halo effect'" over them.