VASP to CASP under MiCA

VASP and CASP have different regulatory roles

The Financial Action Task Force uses VASP as a functional definition for businesses that exchange, transfer or safeguard virtual assets, or provide certain financial services around them. Countries used that framework to bring crypto businesses into customer due diligence, transaction monitoring and suspicious-activity reporting. The VASP label does not, by itself, create a harmonised European operating licence.

CASP is the legal category created by the EU Markets in Crypto-Assets Regulation. MiCA specifies ten regulated services and sets conditions for the company, owners, managers, capital, organisation and customer treatment. Authorisation is granted to a named legal entity for named services. The authorised scope is then published in the ESMA CASP register.

The transition is over

MiCA’s CASP rules applied from 30 December 2024. Article 143 allowed member states to let firms already operating under national law continue temporarily, for no longer than 18 months. Countries chose different windows, but none could run beyond 1 July 2026. ESMA stated in April 2026 that unauthorised providers would need to cease MiCA services when their applicable period ended and arrange an orderly wind-down or client migration.

An old registration proves a historical national status. A CASP application proves only that a firm submitted a file. Current permission requires an authorisation decision or a valid Article 60 notification for an eligible regulated financial entity. The country deadline guide records when each grandfathering window closed.

What can be reused from a VASP file?

A current VASP file can support part of a CASP application. Relevant material can include corporate records, ownership charts, beneficial-owner checks, director biographies, AML risk assessments, KYC procedures, monitoring scenarios and sanctions controls. Each document must be current, internally consistent and matched to the legal entity that is applying.

Reused documents must prove the relevant CASP requirement. A policy for a broker that never held client assets does not prove custody controls. A group-level AML manual does not show who makes decisions inside the applicant. A vendor contract does not prove that management can oversee an outsourced critical function. Start with a controlled document inventory. Record the owner, approval date, legal entity, products covered, supporting records and related MiCA requirement.

The seven-part VASP-to-CASP gap analysis

1. Confirm the applicant’s registered office, effective management and EU-resident director. Show where decisions, staff, records and control functions operate. A registered address or outsourced shell does not prove real operations.
2. Map every product, order flow, wallet movement and customer journey to the ten MiCA services. The requested scope determines the capital class and service-specific policies. The full CASP licence guide explains the services and Article 62 application file.
3. For the normal Article 63 migration route, calculate both sides of Article 67: the Annex IV floor and one quarter of fixed overheads. For a firm without a full operating year, use projected fixed overheads for the first 12 months under Article 67(2). Document the eligible own funds or insurance arrangement and how the firm will monitor the safeguard after approval. Eligible Article 60 financial entities follow their existing sectoral prudential regime because Article 60(10) disapplies Article 67. The cost guide separates this capital from regulator, adviser, staffing and systems costs.
4. Document clear responsibilities, management time commitment, relevant knowledge and experience, conflicts controls, risk ownership and independent challenge. Regulators assess whether the proposed structure can operate. The organisation chart must match the real operating model.
5. Add fair disclosures, fee and pricing information, complaints handling, order and execution controls, safeguarding and segregation. For custody, reconcile the legal record, internal ledger and on-chain or sub-custodian position. Include incident and key-management procedures.
6. Support system architecture, access control, change management, incident response, continuity and recovery with operating evidence. Record critical providers, concentration risk, audit rights, exit plans and the accountable internal owner.
7. Plan how the firm will stop trading, handle open orders and complaints, return or transfer customer assets and records, and approve communications. Define the triggers, responsibilities and funding in the operating plan.

A practical conversion workflow

Define which business activities fall within the application before you use a policy template. Set the intended launch scope, identify the entity that will contract with each customer and trace how money, crypto-assets, orders and data move. Resolve inconsistencies before filing. Regulators will compare the programme of operations with financial projections, staffing, contracts, system diagrams and customer terms.

1. Confirm whether Article 63 application or Article 60 notification is the correct route.
2. Choose a genuine home state and place people and decision-making functions there.
3. Approve the service map, capital class, target markets and three-year operating model.
4. Build a requirements matrix and assign an accountable evidence owner to every item.
5. Test the controls, reconcile the documents and remediate gaps before submission.
6. Manage completeness and assessment questions as evidence requests with version control.
7. After approval, complete passporting notifications and move customers to the authorised entity.

Choose a home state for the real business

Article 65 passporting removes the need for 30 separate CASP licences. The initial home-state choice still determines the authority and local operating requirements. The applicant needs effective management and a credible supervisory relationship in that jurisdiction. Assess the language, regulator portal, local governance expectations, group structure and availability of experienced control staff. Compare the current authorities and register footprint in the MiCA licence by country guide. Spain’s process is covered separately in the CNMV guide.

What customers should verify

A brand may display an old VASP number, a non-EU registration or a group company’s permission. Verify which legal entity contracts with the EEA customer and which services that entity can provide. Match the name in the customer agreement to the ESMA entry. Then check the home state, authorisation date, service codes and any regulator restriction. A claim that a firm is "regulated" or "MiCA compliant" does not replace the official record.

Frequently asked questions

Primary sources include the FATF glossary and VASP definition. The legal requirements come from the consolidated MiCA Regulation (Articles 59–67, 85 and 143, and Annex IV). ESMA also published its statement on the end of MiCA transitional periods and its CASP authorisation briefing. Reviewed 11 August 2026. This page gives general information and does not provide legal, tax or licensing advice.