CASP
What is CASP?
Crypto-asset service provider (CASP) is a legal person or undertaking whose business is providing one or more crypto-asset services to clients on a professional basis, and that holds authorization to do so under the EU's Markets in Crypto-Assets Regulation (). In practice, a CASP is the regulated entity that holds, exchanges, or transfers crypto-assets on behalf of others in the EU.
MiCA (Regulation (EU) 2023/1114) introduced the CASP license as a single EU-wide authorization. A firm authorized in one Member State can passport its services to clients across the other EU countries without a separate local license. For businesses that hold, send or receive such as USDC and EURC, a CASP is typically the regulated entity that safekeeps the tokens, handles on-chain transfers and exchanges them for fiat currency. CASP isn't the same as VASP (virtual asset service provider), the broader term used in FATF standards; CASP is the specific category defined and licensed under EU law.
Key requirements
MiCA sets out both entry conditions and ongoing obligations. The main ones are:
- Authorization: a CASP must be authorized by the national competent authority in its home Member State before serving EU clients (MiCA Article 59).
- Prudential capital: own funds must equal the higher of a fixed minimum or one quarter of the previous year's fixed overheads. The fixed minimum is EUR 50,000, EUR 125,000, or EUR 150,000, depending on which services the CASP provides (Article 67 and Annex IV).
- Safekeeping of client assets: CASPs that provide custody must hold client crypto-assets separately from their own, both on the distributed ledger and legally, so creditors have no claim on them in insolvency (Article 75).
- AML and CFT controls: CASPs are obliged entities under EU rules and must run checks, transaction monitoring, and procedures.
- Travel rule: under the Transfer of Funds Regulation (EU) 2023/1113, originator and beneficiary information has to accompany crypto-asset transfers between providers.
- Governance and conduct: fit-and-proper management, conflict-of-interest policies, complaint handling, and clear disclosures to clients.
Who it applies to
The CASP regime covers any business offering one of the ten crypto-asset services listed in MiCA to clients in the EU:
- Custody and administration of crypto-assets on behalf of clients
- Operating a trading platform for crypto-assets
- Exchanging crypto-assets for funds
- Exchanging crypto-assets for other crypto-assets
- Executing orders on behalf of clients
- Placing crypto-assets
- Receiving and transmitting orders on behalf of clients
- Providing advice on crypto-assets
- Providing portfolio management on crypto-assets
- Providing transfer services on behalf of clients
A business that sends or receives stablecoins in its own name, for example to pay contractors or suppliers, isn't typically providing these services to clients. Whether a specific business model needs authorization depends on the exact activity and is assessed case by case. Businesses that use stablecoins rely on a CASP (or another authorized entity) to hold, transfer and exchange those funds, which makes the provider's authorization status part of a business's own on its payment partners. Credit institutions and certain other already-regulated financial firms can provide crypto-asset services through a notification procedure rather than a full CASP application.
How it works in practice
- Application: the firm applies to its home-state competent authority with a business plan, governance and ownership details (including ), capital evidence, and policies for custody, AML, ICT security, and complaints.
- Authorization and passporting: once authorized, the CASP can notify its regulator of the other Member States where it plans to operate and serve clients there under the same license.
- Client onboarding: each client goes through KYC (individuals) or checks (companies) before the CASP holds or moves assets for them.
- Transaction handling: when a client sends or receives stablecoins, the CASP processes the USDC or EURC transfer on-chain, applies sanctions and travel-rule checks, and either holds the tokens in segregated custody or exchanges them for fiat for to the client's bank account.
- Ongoing supervision: the CASP reports to its regulator, maintains its capital floor, and updates policies as MiCA technical standards change.
MiCA's transitional period ended on 1 July 2026. Since then, firms that only operated under earlier national crypto registrations can't keep serving EU clients without full CASP authorization, and a pending application doesn't count. Several Member States closed their transitional windows earlier, some as early as 30 June 2025.
Penalties for non-compliance
MiCA requires each Member State to give its competent authority a set of administrative sanctions for CASP breaches. These include:
- Fines: for legal persons that breach the CASP provisions, maximum fines of at least EUR 5 million or 5% of total annual turnover, under Article 111.
- License action: suspension or withdrawal of CASP authorization, which removes the right to serve EU clients and ends passporting.
- Management bans: temporary bans on individuals responsible for the breach from holding management roles at CASPs.
- Public statements: regulators can publish the name of the firm and the nature of the infringement.
Operating without authorization is itself a breach. For businesses, a provider losing its license can interrupt access to stablecoin services and delay until funds are moved to another authorized provider.