TL;DR
- ✓ Germany leads by a wide margin (53 authorised CASPs under BaFin), and ran a fast-track 12-month transition that closed on 30 December 2025
- ✓ The Netherlands (26), France (13), and Norway (13) form the next tier; Malta (12), Cyprus (12), Spain (11), and Ireland (11) sit just below
- ✓ Italy still shows zero authorised CASPs as of 4 May 2026; the OAM-registered VASP cohort is queued behind CONSOB's review backlog
- ✓ Poland has zero authorised CASPs because its national MiCA enabling legislation is still in draft, although one Polish EMT issuer has nonetheless made it onto the register
Why country choice still matters in a passportable regime
Your home NCA owns you
Initial authorisation, ongoing supervision, AML inspections, and any escalation to ESMA all run through the NCA in your country of incorporation. A CASP authorised by BaFin will be supervised by BaFin for its entire life, regardless of where its customers sit. Choose an NCA you can work with, one with sector expertise, predictable processes, and a language your compliance team can operate in.
National enabling legislation matters
MiCA is a regulation (directly applicable), but member states still need national laws to designate the competent authority, set transitional regimes, allocate inspection powers, and (in some cases) lay supplementary capital or governance rules. Most EU countries have these laws in force. A handful, Poland, Bulgaria, Romania, do not, which creates legal uncertainty for CASPs incorporated there.
Transition deadlines diverge
MiCA's headline transition window runs to 1 July 2026. But individual member states had the option to shorten it. Germany cut its national transition to 30 December 2025. France, Spain, Italy, the Netherlands, and most others kept the full 18-month period (1 July 2026). Lithuania moved fastest, closing legacy registrations in mid-2025.
Supervisor sophistication varies
BaFin and the AMF have built dedicated crypto units staffed by people who understand the technology. CONSOB and CySEC are catching up. Some smaller NCAs are still ramping. The depth of supervisory relationship matters when you launch a new product, integrate a new chain, or face an incident, a sophisticated supervisor lets you move faster, an inexperienced one slows you down.
Cross-country snapshot (4 May 2026)
| Country | Regulator | Authorised CASPs | National law | Transition end | Initial capital | Typical timeline |
|---|---|---|---|---|---|---|
| Germany | BaFin | 53 | Yes (KMAG) | 30 Dec 2025 | 150-350k EUR | 6-9 months |
| Netherlands | AFM | 26 | Yes | 1 Jul 2026 | 150-350k EUR | 6-9 months |
| France | AMF / ACPR | 13 | Yes (PACTE + adapt.) | 1 Jul 2026 | 150-350k EUR | 9-12 months |
| Norway (EEA) | Finanstilsynet | 13 | Yes (EEA-adopted) | 30 Dec 2025 | 150-350k EUR | 6-9 months |
| Malta | MFSA | 12 | Yes (VFA + MiCA Act) | 30 Dec 2025 | 150-350k EUR | 6-9 months |
| Cyprus | CySEC | 12 | Yes | 30 Dec 2025 | 150-350k EUR | 6-9 months |
| Spain | CNMV | 11 | Yes (RDL 7/2023 + dev.) | 30 Dec 2025 | 150-350k EUR | 6-9 months |
| Ireland | Central Bank of Ireland | 11 | Yes (S.I. 6/2024) | 30 Dec 2025 | 150-350k EUR | 9-12 months |
| Austria | FMA | 9 | Yes | 30 Dec 2025 | 150-350k EUR | 6-9 months |
| Lithuania | Bank of Lithuania | 6 | Yes (early adopter) | 1 Jun 2025 | 150-350k EUR | 4-6 months |
| Italy | CONSOB + BdI | 0 | Yes (D.Lgs. 129/2024) | 30 Dec 2025 | 150-350k EUR | 9-12 months |
| Poland | KNF | 0 | DRAFT (not in force) | 1 Jul 2026 (de facto) | TBD | uncertain |
Initial-capital ranges follow MiCA Article 67: 150,000 EUR (custody and execution-only services), 125,000 EUR (trading platforms), and 50,000 EUR (advisory and reception/transmission). Most active CASPs end up at the 150,000 EUR minimum because the average authorised CASP holds 3.0 service types simultaneously (MiCA SCAN, May 2026).
Germany, BaFin
Who's authorised
Including major exchanges (Boerse Stuttgart Digital, several local exchanges), custodians (Coinbase Custody, BitGo, Tangany), and asset managers. Several legacy KWG-licensed German banks expanded their KMAG authorisation to add MiCA CASP services. The mix is institutional-heavy.
Key features
BaFin requires a German entity (UG or GmbH minimum). Local management substance matters, you need at least two qualified directors resident or actively present in Germany. Capital must be paid up at filing, not promised. Documentation is heavy: 200+ pages of policies, business projections, IT security plan, AML risk assessment, ICAAP-style capital adequacy analysis. Application language is German for the formal filings (English supporting docs accepted).
Timeline
Pre-application meetings with BaFin's crypto unit are encouraged and shorten the formal review. Once filed and complete, the median time to authorisation as of April 2026 is 6-9 months. Incomplete files get bounced quickly, be ready before you submit.
Best for
Institutional custody, regulated exchanges with German bank relationships, asset managers building tokenised funds. The BaFin signature carries weight with corporate clients across Europe.
France, AMF / ACPR
Who's authorised
13 CASPs as of 4 May 2026, with another 30+ in active processing. France also leads on EMTs with 5 issuers (the largest EMT cohort in the EU), including Société Générale-FORGE (the pioneer EURCV stablecoin). The CASP cohort itself includes Coinhouse, Bitstack, and a mix of trading platforms and custodians.
Key features
Existing PSAN-registered firms get a streamlined transition path. Full CASP authorisation requires substantive uplift in governance, conflict-of-interest management, and outsourcing controls. The AMF expects substantive French presence: a qualified senior manager based in France, French-speaking compliance, and a French-anchored board majority. Documentation can be filed in English with French summaries for key sections. Initial capital follows MiCA minima but ACPR scrutinises capital adequacy projections rigorously.
Timeline
9-12 months realistic. Pre-filing dialogue with AMF crypto team is essentially mandatory and shortens the formal phase. Expect detailed Q&A rounds during review.
Best for
Firms targeting French and southern European institutional markets, EMT issuers (France was an early mover with the SocGen-FORGE EURCV), DeFi-adjacent products where the AMF's nuanced positioning helps.
Italy, CONSOB / Banca d'Italia
Who's authorised
Zero CASPs as of 4 May 2026. The OAM-registered VASP backlog is real, including Young Platform, Conio, and several traditional banks expanding into custody, but none have completed the formal MiCA CASP authorisation track. Italian-incorporated firms targeting an immediate launch are increasingly looking at Lithuania or Cyprus authorisation plus passporting back into Italy.
Key features
Italian entity required. CONSOB's review is thorough on governance and consumer-protection aspects (Italy has a strong retail-investor protection tradition). Documentation in Italian for formal filings, English supporting docs accepted. Local presence requirements are flexible compared to Germany, board diversity matters more than residency.
Timeline
9-12 months. CONSOB is still scaling its crypto-supervision capacity; expect longer Q&A cycles than France or Germany. Quality of pre-filing engagement varies.
Best for
Firms with existing Italian retail customer base, fintechs partnering with Italian banks, products requiring strong consumer-protection narrative.
Spain, CNMV
Who's authorised
Eleven CASPs as of 4 May 2026, with a steady processing cadence. Spanish market mix is balanced between exchanges (Bit2Me, Bitnovo) and custodians.
Key features
Spanish entity required. Strong CNMV emphasis on retail customer protection and AML. Documentation in Spanish; English permitted for technical and business annexes. Capital adequacy analysis follows EBA guidelines, CNMV has converged its approach with sister NCAs in the eurozone. Senior management Spanish-language capability is expected.
Timeline
6-9 months for well-prepared applications. CNMV scaled its crypto unit faster than Italian counterparts and now processes files at a steady cadence.
Best for
Firms targeting Iberian retail market, LATAM-facing CASPs (Spain is the natural EU hub for LATAM expansion), payment-adjacent crypto services.
Netherlands, AFM
Who's authorised
26 CASPs as of 4 May 2026, the second-largest cohort in the EU. Includes Bitvavo (the largest Dutch exchange) and a deep bench of institutional custodians. The Netherlands also has 2 EMT issuers, signalling the AFM/DNB combo is comfortable across both CASP and stablecoin tracks.
Key features
Dutch entity required. AFM is one of the more sophisticated supervisors, direct, technical, and quick to engage. Documentation in English fully accepted (Netherlands is consistently the most English-friendly NCA in continental Europe). Strong governance expectations: independent NEDs, formal risk committee, robust outsourcing oversight.
Timeline
6-9 months. AFM runs structured pre-filing meetings that genuinely shorten the formal review.
Best for
English-operating teams, institutional CASPs targeting BeNeLux and DACH markets, firms valuing supervisor sophistication and dialogue quality.
Lithuania, Bank of Lithuania
Who's authorised
Mix of institutional players (Foxpay, Citadele crypto arm) and lean fintechs. Lithuania's status as a regional EMI hub creates natural overlap with CASP licensing, with 2 EMT issuers already on the register.
Key features
Lithuanian UAB entity required. BoL is highly responsive and runs structured pre-filing dialogues. Documentation in English fully accepted. Substance requirements are real: at least one resident director, local senior compliance officer, real meeting cadence in Vilnius. Capital must be paid up. BoL's review is fast but thorough, they will return incomplete files within days.
Timeline
4-6 months for well-prepared applications. The fastest authorisation path in continental Europe.
Best for
Fintechs already operating in Lithuania (often with EMI alongside CASP), CEE-facing CASPs, lean teams wanting fast time-to-market with credible NCA branding.
Poland, KNF (the missing piece)
What this means in practice
Polish-registered VASPs cannot apply for CASP authorisation in Poland because there is no statutory basis to do so. The European Securities and Markets Authority (ESMA) and the European Commission have publicly noted the situation. KNF has issued informal guidance that legacy VASP registrations remain valid until enabling legislation passes, but this is supervisory tolerance, not legal certainty.
Workarounds Polish CASPs are using
Three patterns dominate: (1) incorporate a CASP entity in Lithuania or Cyprus and passport services back into Poland; (2) park applications in draft form pending the Polish law; (3) for crypto firms with EMI ambitions, apply for an EMI license under the existing PSD2 framework and prepare to add CASP authorisation later. The PSD3/PSR streamlined CASP-to-PSP path (covered in our PSD3 article) is also unavailable in Poland for the same reason.
Poland-specific risks
Polish CASPs that wait for KNF authorisation risk crossing the 1 July 2026 transition without a license, at which point ESMA's tolerance ends. The pragmatic move for Polish-headquartered crypto firms with European ambitions is to authorise elsewhere first (Lithuania is the natural choice given language proximity and BoL responsiveness), then re-domicile back when KNF's regime opens.
Important nuance:
Status as of late April 2026. The Polish enabling legislation has cleared committee stage and is expected to enter force in mid-to-late 2026. Verify with KNF or counsel before acting.
Malta, Cyprus, Ireland
Malta, MFSA
Malta was the original "Blockchain Island" with the 2018 VFA Act. 12 CASPs authorised plus 2 EMT issuers as of 4 May 2026, putting Malta among the top 5 jurisdictions by CASP count. Most VFA-licensed firms transitioned smoothly. The MFSA built capacity early; processing is steady at 6-9 months. Best for funds-adjacent CASPs and European fintech entities valuing English-language operations and an EU passport.
Cyprus, CySEC
12 CASPs authorised as of 4 May 2026, on par with Malta. CySEC handles a mix of CASPs and existing CIF/AIFM-passported firms expanding into crypto. Strong on retail-distribution structures, less developed on infrastructure-heavy custodial models. Timeline 6-9 months. Useful for firms with broader investment-services strategy.
Ireland, Central Bank of Ireland
11 CASPs authorised as of 4 May 2026, more than the article's earlier estimates suggested. Includes major US players (Coinbase, Gemini) using Ireland as their EU hub, plus institutional custodians. Timeline 9-12 months and the bar is high. Best for institutional CASPs with strong compliance cultures already in place; not the right home for early-stage builders.
Don't overlook: Norway and Austria
Norway, Finanstilsynet (EEA)
Norway runs MiCA via the EEA agreement and currently has 13 authorised CASPs, tied with France for third place in the EU/EEA. Finanstilsynet processes applications quickly (6-9 months) and the supervisor is direct, English-friendly, and pragmatic. Norwegian CASP authorisation passports into all 27 EU member states under the same passporting mechanics as native EU authorisations. Worth considering for Nordic-focused operations or as an alternative to Lithuania for English-operating teams.
Austria, FMA
Austria is the under-the-radar outperformer with 9 authorised CASPs, ahead of Lithuania, Luxembourg, and several other better-known hubs. FMA combines Germanic regulatory rigour with a more pragmatic processing tempo than BaFin. German-language documentation is required for formal filings. Best for firms with strong DACH presence that want a regulator that engages substantively without BaFin's heavy documentation overhead.
Passporting mechanics
Freedom of services (no establishment)
The CASP notifies its home NCA of intent to provide cross-border services. The home NCA forwards the notification to the host member state's NCA. The CASP can begin services after a 15-business-day notification period (no host approval required). This is the lighter-touch route, suitable for online-only services.
Freedom of establishment (branch)
If the CASP wants to open a branch, agency, or tied-agent presence in another member state, the notification process is heavier, host NCA review, possible objection, more documentation. Used by larger CASPs setting up local sales presence.
Practical reality
Most authorised CASPs passport into all 26 other member states via freedom-of-services within months of initial authorisation. The notification is administratively trivial relative to initial authorisation. The harder question, addressed below, is which jurisdiction to authorise in first.
Decision framework: where should you authorise?
- ✓ Market priority: where will your largest customer base sit? Authorise there to keep supervisor close to customer behaviour
- ✓ Speed to market: Lithuania (4-6 months) > Spain/Germany/Netherlands (6-9 months) > France/Italy/Ireland (9-12 months)
- ✓ Supervisor sophistication: BaFin, AMF, AFM lead; CNMV catching up fast; CySEC, MFSA solid for fund-adjacent businesses; CONSOB still scaling crypto capacity
- ✓ Language and substance: Germany and France require substantive local-language capability; Netherlands and Lithuania accept English fully
- ✓ Adjacent licences needed: if you also need EMI (most issuer-side businesses do), align jurisdictions, Lithuania, Netherlands, and Ireland are strong dual-licensed homes
- ✓ Tax and corporate structure: speak to corporate counsel, CASP NCA choice and group tax structure interact
Default recommendation for new CASPs without strong existing geographic anchors: Lithuania for speed and EMI alignment, Netherlands for English-language sophistication, Spain for southern European retail, Germany for institutional credibility. Avoid Poland for now unless you already operate there and can wait for enabling legislation.
Closing commentary
If you're planning your CASP authorisation strategy and want a second opinion on jurisdiction choice, regulatory dialogue, or application sequencing, that's exactly the work Binar does day-to-day. We've supported CASP authorisation projects across Germany, France, Lithuania, Spain, and Poland.
Sources
- ✓ MiCA SCAN, State of the Market Report dated 4 May 2026 (micascan.eu/2025), the primary source for the country-level CASP and EMT counts in this article
- ✓ ESMA, Public register of authorised crypto-asset service providers (live)
- ✓ Regulation (EU) 2023/1114 (MiCA), Articles 59-67, 64-65
- ✓ BaFin, Authorised CASPs and KMAG transition guidance (April 2026)
- ✓ AMF / ACPR, MiCA implementation page and CASP register (April 2026)
- ✓ CONSOB, Comunicazioni MiCA and authorised intermediaries register
- ✓ CNMV, Registro de proveedores de servicios sobre criptoactivos
- ✓ AFM, MiCA implementation page and authorised CASPs
- ✓ Bank of Lithuania, Crypto-asset service providers register
- ✓ MFSA, MiCA implementation page; CySEC and CBI public registers
- ✓ Finanstilsynet (Norway), authorised CASP register
- ✓ FMA (Austria), authorised CASP register
- ✓ ESMA, Statement on Polish MiCA implementation status (October 2025)
Country counts as of 4 May 2026 per MiCA SCAN. Authorised counts are point-in-time and updated continuously by NCAs and ESMA. This article does not constitute legal advice; verify with counsel before acting on any specific application.