What changed when MiCA replaced national VASP regimes?
MiCA replaced the fragmented national VASP and crypto-registration regimes with one EU-wide authorisation: the CASP licence. Before MiCA, each member state ran its own registration — Estonia, Lithuania, Poland and others each had a local process, and a registration in one country carried no weight in another. Regulation (EU) 2023/1114 ended that. Firms that provide crypto-asset services now operate under a single rulebook and a single licence type instead of a stack of national registrations.
The practical effect is a step up in standard. National VASP registration was, in many states, a light-touch AML gateway. CASP authorisation is a full prudential and conduct regime — capital, governance, operational resilience and client-asset protection all in scope. So this isn’t a rebadge of the old registration; it’s a different bar.
When did the CASP rules start to apply?
MiCA’s crypto-asset service provider rules apply from 30 December 2024, after an earlier phase that covered stablecoins. The regulation came into force in stages: the rules for asset-referenced tokens and e-money tokens landed on 30 June 2024, and the CASP obligations in Title V followed on 30 December 2024. From that point, providing crypto-asset services in the EU requires either a CASP authorisation or the benefit of a transitional arrangement.
That staggered start matters for planning. A firm reading only the headline “MiCA applies” date can misjudge when its own obligations actually bite.
How do the transitional and grandfathering windows work?
A transitional window let existing providers keep trading for a limited time while they moved onto a MiCA licence. MiCA allowed each member state to grant firms that were already registered or operating lawfully under national law a grandfathering period before full CASP authorisation became mandatory. The regulation caps how long that window can run, and member states could adopt the full length or a shorter one.
Two things are easy to miss here. First, the window is national. The outer EU deadline is 1 July 2026, but several states moved earlier: Germany and Ireland closed theirs on 31 December 2025, and the Netherlands, Poland, Latvia, Hungary and Slovenia opted for just six months. Poland is the extreme case — its enabling law was vetoed twice, so the KNF cannot grant CASP authorisations at all, and firms passport in from Lithuania or Estonia instead. Second, grandfathering is not renewal. It buys time; it does not hand you a licence, and if you do not file or get granted in time, the cover simply expires. The scale of the squeeze is real: across the EU, under 18% of previously registered VASPs had obtained MiCA authorisation by mid-2026.
What must existing providers actually do?
Existing providers have to treat CASP authorisation as a fresh application, not a conversion. The work is the same package a new entrant files. In practice that means:
- Map the gap. Compare your current national-registration footprint against MiCA’s full requirements — capital tier, AML/CFT function, governance, and DORA-driven ICT resilience. The delta is usually large, because national VASP rules asked for less.
- Fix capital and own funds. MiCA’s prudential tiers are keyed to the services you provide, so confirm which tier applies and top up own funds if needed.
- Rebuild the compliance file. A named compliance officer, customer due diligence, transaction monitoring, and Travel Rule data handling under the Transfer of Funds Regulation all have to be evidenced, not just described.
- Prepare governance and resilience documentation. Fit-and-proper checks on key people, conflict-of-interest controls, incident reporting and third-party ICT oversight all sit in the submission.
Then file with the national competent authority in your home state, and expect follow-up questions before a decision.
Why is leaving the transition late a real risk?
Leaving the MiCA transition late risks a forced pause in trading and a weaker application. When a national window closes, operating without CASP authorisation is unlawful in that member state, so a provider that has not secured — or at least filed — a licence may have to stop offering services. That is a commercial hit, not a paperwork one.
Late filing hurts quality too. Rushed applications carry gaps, gaps draw regulator questions, and questions push the decision further out. Firms that started early could stage the capital raise, the hiring and the systems work, and they went into the assessment with a complete file. The ones that waited are still answering questions after the deadline has passed.