CASP authorisation, step by step

Before you start

This is the order most teams actually work in. None of it is legal advice, and the file itself is jurisdiction-specific, but the sequence is consistent across member states. The slow part is almost never the regulator’s clock; it is getting the application to the point where it survives the completeness check.

Step 1 - Confirm you are in scope, and for which services

Are you providing any of the ten regulated services to clients in the EU on a professional basis? See the scope self-assessment.
List the exact services you need authorised, because each one adds procedures and sets your capital class.
Separate issuing a token (white paper, ART/EMT rules) from providing services on one (CASP). They are different doors.

Step 2 - Choose your home member state

Pick where your business, board, and advisers actually are; the licence passports across all 27 states under Article 65 regardless.
Weigh regulator speed, posture, cost, and substance expectations. See the jurisdiction comparison.
Check the transitional deadline for any state where you already operate.

Step 3 - Decide your route: Article 60 or Article 62

Already an EU credit institution, investment firm, e-money institution, or other listed entity? You may use the lighter Article 60 notification.
Everyone else takes the full Article 62 authorisation route.
Both still require governance, custody, AML, complaints, and conflicts evidence.

Step 4 - Stand up real substance

Incorporate an EU entity with its registered office and effective management in the home state (Article 59(2)).
Appoint a fit-and-proper management body with genuine crypto knowledge and at least one EU-resident director (Article 68).
Staff key functions (compliance, risk, AML) in the EU rather than fully outsourcing them. A letterbox entity is a standard ground for refusal.

Step 5 - Meet the prudential safeguard

Hold the higher of your class minimum (€50,000 / €125,000 / €150,000) or one quarter of fixed overheads (Article 67).
Choose own funds, a qualifying insurance policy, a comparable guarantee, or a mix. See own funds vs insurance.
Budget the full cost, not just the capital. See cost and timeline.

Step 6 - Build the operating framework

Custody and client-asset segregation (Article 75), AML/CFT and the Travel Rule, complaints (Article 71), conflicts (Article 72), outsourcing (Article 73), and a wind-down plan (Article 74).
Build ICT and operational-resilience evidence to the DORA standard, which applies to CASPs in parallel with MiCA.
Service-specific procedures for each of the ten activities you are requesting.

Step 7 - Assemble and submit the Article 62 file

Roughly 40 distinct documents. Use the application evidence pack as a cross-walk.
Engage the regulator before filing where pre-application meetings are offered; it shortens the back-and-forth.
Make the file internally consistent. Inconsistency is the most common reason a file fails the completeness check.

Step 8 - Work the two clocks, then get on the register

The competent authority has 25 working days for the completeness check and 40 working days to decide once the file is complete (Article 63).
Requests for information pause the decision clock, so expect the real timeline to exceed the headline days.
On authorisation you appear on the ESMA register, and you can then notify other member states to passport under Article 65.