MiCA Authorisation for CASPs: Process, Timeline, ICT
Quick answer. Any firm providing crypto-asset services in the EU needs MiCA authorisation, filed under Article 62 and RTS 2025/305. Authorities check completeness in 25 working days, then decide within 40 of a complete file. Grandfathering ended on 1 July 2026.
Video transcript
Article 9 of RTS 2025/305 sets out the ICT and security evidence a MiCA CASP applicant must file. Supervisors are told to read it closely.
ESMA says there are no low-risk CASPs. Its peer review of Malta found no evidence that ICT and custody risks were adequately assessed.
Article 9 has four points. The ICT risk framework, critical ICT services, incident procedures and a non-technical summary are required. Third-party and past audits are filed if they exist.
ESMA's draft made a third-party audit mandatory. The adopted text says if available. Our reading: plan for it anyway, because supervisors are likely to ask what testing you have done.
An ideal audit covers vulnerability scans, configuration reviews, black, grey and white box pentests, and smart contracts. A contract audit alone answers only the last.
List every critical ICT provider with its contract, mapped to DORA. Our analysis: that includes automation and RPC providers, not only cloud and KYC vendors.
Common gaps: no DORA review before authorisation, unmapped sub-providers, outsourced key management without oversight, and untested pause steps.
Index the pack by RTS article and point. Guardian's Compliance Assessment maps security reports to the application, while legal interpretation stays with your counsel.
Find the gaps before your regulator does. Read the full article, or talk to Guardian.
This article explains MiCA's authorisation process and its technical and security side. It is not legal advice; confirm how the rules apply to you with counsel.
Who Needs MiCA Authorisation
No one may provide crypto-asset services in the EU unless authorised as a CASP under Article 63, or a listed financial entity (Article 59(1)). EUR-Lex
The services are custody, trading platforms, exchange for funds or crypto-assets, execution, placing, order transmission, advice, portfolio management and transfers (Article 3(1)(16)).
A CASP needs a registered office in a member state where it provides some services, effective management in the EU and at least one EU-resident director (Article 59(2)).
Banks, investment firms, e-money institutions, central securities depositories, market operators, UCITS managers and AIF managers notify instead, within their existing licences, at least 40 working days ahead (Article 60).
Non-EU firms cannot serve EU clients except at the client's own exclusive initiative (Article 61). ESMA says this applies business to business too. European Securities and Markets Authority (ESMA)
Token issuers follow other routes. Asset-referenced token issuers apply under Article 18; e-money token issuers must be credit or e-money institutions (Article 48).
What the Application File Contains
You apply to the competent authority of your home member state (Article 62(1)), on the standard form in Implementing Regulation (EU) 2025/306. EUR-Lex
Article 62(2) lists the contents, points (a) to (s). RTS 2025/305 specifies each one, article by article. EUR-Lex
| What to file | Art 62(2) | RTS 2025/305 |
|---|---|---|
| Name, LEI, website, legal form, articles of association | (a) to (c) | Art 1 |
| Programme of operations: services, crypto-asset types, where and how marketed | (d), (s) | Art 2 |
| Prudential safeguards: the higher of Annex IV capital (EUR 50,000 to 150,000 by service class) or a quarter of fixed overheads | (e) | Art 3 |
| Governance, internal controls and business continuity plan | (f), (i) | Arts 4, 5 |
| AML/CFT controls and risk assessment | (i) | Art 6 |
| Management body repute, knowledge, skills and time | (g) | Art 7 |
| Qualifying shareholders and their repute | (h) | Art 8 |
| ICT systems and security arrangements, plus a non-technical description | (j) | Art 9 |
| Segregation of clients' crypto-assets and funds | (k) | Art 10 |
| Complaints handling | (l) | Art 11 |
| Service-specific policies: custody, platform rules, exchange pricing, execution, advice, transfers | (m) to (r) | Arts 12 to 17 |
How Long Authorisation Takes
Article 63 sets the clocks, in working days. EUR-Lex
| Step | Deadline | Article |
|---|---|---|
| Acknowledge receipt | 5 working days after receipt | 63(1) |
| Check completeness | 25 working days after receipt | 63(2) |
| Fill gaps | By a deadline the authority sets; if still incomplete, it may refuse to review | 63(2), (3) |
| Request more information | By day 20 of the assessment; pauses it up to 20 working days | 63(12) |
| Decide | 40 working days from a complete application | 63(9) |
| Notify the applicant | 5 working days after the decision | 63(9) |
Our arithmetic: the clocks add up to about 90 working days, plus your time filling gaps. Updated information restarts the 40-day clock (Implementing Regulation 2025/306 Article 4(2)). EUR-Lex
Refusal is mandatory on objective, demonstrable grounds. These include an unfit management body or shareholders, or failing, or being likely to fail, any Title V requirement (Article 63(10)).
An authorisation unused for 12 months is withdrawn (Article 64(1)(a)). Fees by country are in our MiCA licence cost guide.
Transitional Period: Status in November 2026
Article 143(3) let CASPs operating under national law before 30 December 2024 continue until 1 July 2026, or until granted or refused authorisation, if sooner. EUR-Lex
Member states could shorten it. ESMA's list shows periods from 6 months, as in the Netherlands, to 18 months, as in France. European Securities and Markets Authority (ESMA)
As of November 2026, every grandfathering period has ended. ESMA says a firm serving EU clients without MiCA authorisation after 1 July 2026 is in breach of EU law and must stop. European Securities and Markets Authority (ESMA)
Its 23 June 2026 statement says unauthorised CASPs must stop onboarding EU clients and limit services to helping clients exit. Custody may continue only as long as an orderly exit strictly needs. European Securities and Markets Authority (ESMA)
The simplified procedure in Article 143(6) covered applications filed by 1 July 2026. Anyone applying now follows Articles 62 and 63 in full.
Passporting Across the EU
An authorisation covers the whole EU, through a branch or cross-border services, with no physical presence needed in host states (Article 59(7)). EUR-Lex
To passport, give your home authority the member states, services, start date and any activities outside MiCA (Article 65(1)).
It forwards them to host states, ESMA and EBA within 10 working days. You may start once told, or at the latest on the 15th calendar day after filing (Article 65(2) to (4)).
To add services later, ask your home authority to extend your authorisation, updating the Article 62 information. Article 63 then applies (Article 59(8)).
The ESMA Interim Register
ESMA lists each authorised CASP in its interim MiCA register by the start date of its services (Article 63(13)). EUR-Lex
ESMA publishes the register as CSV files, updated weekly. Our count of the CASP file dated 11 November 2026: 407 entries, authorisations and Article 60 notifications together. European Securities and Markets Authority (ESMA), ESMA CASP register file
ESMA tells clients to check the register before they invest or transfer funds. European Securities and Markets Authority (ESMA)
The ICT File Under Article 62(2)(j)
MiCA Article 62(2)(j) requires technical documentation of ICT systems and security arrangements, plus a non-technical description. RTS 2025/305 Article 9, in force since 20 April 2025, sets its content. Council of the European Union / European Commission, Národná banka Slovenska
ESMA tells supervisors there are no low-risk CASPs, so no application should get a cursory review.
Its July 2025 peer review of Malta found no evidence that ICT infrastructure and custody risks were adequately assessed.
For ongoing controls after licensing, use our MiCA compliance checklist for security.
What Article 9 Asks For
Article 9 has four points. Points (a) and (d) are firm requirements. Point (b) applies if a third-party audit is available, and point (c) covers past audits, if any. Council of the European Union / European Commission, Autorité des marchés financiers (AMF)
Point (a) also covers the ICT and human resources you deploy to comply with DORA.
ESMA's March 2024 draft made a third-party audit mandatory. In September 2024 the Commission said this went beyond DORA and ESMA's MiCA mandate, and its adopted text made the audit "if available". European Securities and Markets Authority (ESMA), Goodwin Procter
Our reading: plan for point (b) evidence. A supervisor told to probe ICT is likely to ask what testing you have done.
| Point | What to file | Status |
|---|---|---|
| 9(a)(i) | ICT risk framework, systems, protocols, tools, DORA and GDPR data safeguards | Required |
| 9(a)(ii) | ICT services behind critical or important functions, in-house or third-party | Required |
| 9(a)(iii) | Security and incident management procedures, policies and systems | Required |
| 9(b) | Description of a third-party cybersecurity audit | If available |
| 9(c) | Description of audits already done on ICT, DLT and security | If any |
| 9(d) | Non-technical description of points (a) and (b) | Required |
DLT and Smart Contract Documentation
Point (a) covers any DLT infrastructure you rely on, not only what you operate. Council of the European Union / European Commission
Our analysis: list nodes, RPC providers, bridges and signing services, with who controls each.
A contract audit answers point (b)(v), not the cloud, API and access tests in points (i) to (iv). Our guide to DORA source code review explains the gap.
Applicants that will hold client crypto-assets or the keys to them describe their key approval and safeguarding system, including multisig, under Article 10(1)(b).
Article 12(b) asks the custody policy to name operational and ICT risk sources and their controls, including outsourced custody.
Security Arrangements and Testing
Point (b) lists what a third-party audit should ideally cover. The auditor needs sufficient experience, judged by reference to DORA's TLPT standards. Council of the European Union / European Commission
Point (b)(iii) configuration reviews catch failures that contract review cannot. Guardian's public reports show two.
In one withdrawal backend, a test endpoint accepted any secret because its default config value was a wildcard. Anyone could credit subaccounts. Guardian
In another review, a keeper's cloud role could read every secret in the account.
Our analysis: give each point (c) audit its scope, date, tester and retest status. A pentest executive summary written for the board can feed point (d).
- Organisational cybersecurity, physical security and the secure software development lifecycle.
- Vulnerability assessments and scans, and network security assessments.
- Configuration reviews of ICT assets supporting critical or important functions.
- Black box pentests, starting from IP addresses and URLs only.
- Grey box pentests, with standard user knowledge at different privilege levels.
- White box pentests, with architecture, source code, identifiers and technical contacts.
- A cybersecurity source code review of smart contracts you use or develop.
Third-Party ICT Providers and DORA
For each provider under point (a)(ii), give its identity, location, outsourced activity and contract, and show how it meets MiCA Article 73 and DORA Chapter V. Council of the European Union / European Commission
Article 2(1)(k) and (l) add the outsourcing policy and a list of outsourced providers.
ESMA tells supervisors to judge outsourced ICT infrastructure against DORA. Outsourcing the staff who run ICT and security arrangements draws elevated scrutiny. European Securities and Markets Authority (ESMA)
Where outsourcing prevents effective supervision, ESMA says the application should be rejected.
Our analysis: automation and RPC providers belong on the list too, not only cloud and KYC vendors.
In one Guardian review, a breach of Gelato's secret store could have let an attacker claim all fees. Guardian
Controls around those dependencies matter too. In another review, a service accepted any https RPC URL, so whoever could set it could reach internal endpoints and cloud metadata credentials.
For the clauses those contracts need, use our DORA Article 30 clause checklist. For who sets which duty, read how MiCA and DORA work together.
Common Gaps That Delay Authorisation
No public dataset counts refusals by cause. These gaps come from the RTS, ESMA's briefing and its Malta peer review, plus our analysis where marked. European Securities and Markets Authority (ESMA), Council of the European Union / European Commission
Two items come from MFSA's June 2026 observations on 2025 applications across Malta's financial sector, not only CASPs, as reported by BDO Malta and A2CO. A2CO, BDO Malta
ESMA's peer review says supervisors should confirm, before authorising, that you can block malicious transactions efficiently.
Guardian found a vault that inherited a pause module but exposed no pause function, so wrap and unwrap could not stop. Guardian
Our analysis: exercise every pause and block step before you describe it under point (a)(iii). Our exchange incident response plan shows the first hour.
- No review of ICT systems and business continuity against DORA, which ESMA wants done before authorisation.
- Unmapped intragroup ICT reliance or sub-providers in the architecture.
- Outsourced key management, IT control or risk assessment without oversight evidence; ESMA calls these highly important functions needing special scrutiny.
- Executive board members without at least a good understanding of how crypto-assets work technically.
- Management CVs that omit DLT, IT and cybersecurity experience, which Article 7(1)(d) asks to highlight.
- MFSA: missing business impact analyses and weakly documented backup and restoration procedures.
- MFSA: generic exit plans that ignore provider-specific risks.
Building the Evidence Pack
Our analysis: index the pack by RTS article and point, so each supervisor question maps to one document.
Check your authority's own forms too. Malta's MFSA requires Digital Operational Resilience Assessment and ICT Third-Party Provider Assessment annexes. Malta Financial Services Authority (MFSA)
Guardian's Compliance Assessment delivers a technical gap register, security reports mapped to the CASP application requirements and an indexed evidence pack. Legal interpretation stays with your counsel. Guardian
After authorisation, Managed Security maintains a threat model and adds continuous pentesting and 24/7 monitoring and response.
| RTS item | Evidence to file | Guardian output |
|---|---|---|
| Art 9(a)(i) ICT risk framework | Framework, system inventory, DORA and GDPR safeguard mapping | Cybersecurity control assessment, technical gap register |
| Art 9(a)(ii) third-party ICT | Provider list, locations, contracts, DORA Chapter V mapping | Reviews of critical cloud, custody and RPC dependencies |
| Art 9(a)(iii) incident management | Procedures, runbooks, drill records | Incident tabletops and recovery exercises |
| Art 9(b)(i) to (iv) audit | Scope, method, findings, retest results | Application and infrastructure pentests with retests |
| Art 9(b)(v) smart contracts | Source code review report | Review of relevant smart contracts |
| Art 10(1)(b) keys | Signer inventory, approval flows, tested recovery | Custody and key management review |
| Art 5 business continuity | Plan, periodic test records, third-party failure scenarios | Recovery exercises and exercise records |
Frequently Asked Questions
How long does MiCA authorisation take?
MiCA gives authorities 25 working days to check an application is complete, then 40 working days from a complete file to decide. A request for more information can pause the assessment for up to 20 working days. Time spent filling gaps comes on top. EUR-Lex
Can a CASP still rely on MiCA grandfathering?
No. Article 143(3) ran to 1 July 2026 at the latest, and many member states ended it sooner. ESMA expects unauthorised CASPs to stop onboarding EU clients and limit services to an orderly exit. European Securities and Markets Authority (ESMA), European Securities and Markets Authority (ESMA)
Is a third-party cybersecurity audit mandatory for a MiCA CASP licence?
Not under RTS 2025/305. France's AMF repeats the conditional wording; the Dutch AFM's mandatory list names no audit or pentest report. The AFM adds that its list is not exhaustive and the documents needed depend on the application. Other national forms may ask for more. Council of the European Union / European Commission, Autorité des marchés financiers (AMF), Autoriteit Financiële Markten (AFM)
What does the ESMA CASP register show?
Each entry lists the competent authority, home member state, LEI, website, authorisation or notification date, service codes and passported countries. ESMA describes the CSV format as interim until the register moves into its IT systems. European Securities and Markets Authority (ESMA)
Do CASPs that give access to DeFi face extra ICT rules?
Not yet. ESMA's September 2026 MiCA review response proposes a regulated service for CASPs acting as DeFi gateways, with protocol due diligence and cybersecurity safeguards. It is a proposal, not adopted law. European Securities and Markets Authority (ESMA)
Could an external audit become mandatory, or supervision move to ESMA?
Both are proposals. In September 2025 the French, Austrian and Italian authorities called for an independent audit before authorisation and periodically after. ESMA's September 2026 MiCA review response does not repeat that call. A Parliament committee vote on moving CASP supervision to ESMA is due on 1 December 2026. Autorité des marchés financiers (AMF), European Securities and Markets Authority (ESMA), Norton Rose Fulbright (Regulation Tomorrow)
Related reading
- mica and dora
- mica compliance checklist security
- mica license cost
- dora penetration testing requirements
- crypto tabletop exercise scenarios
Sources
- EUR-Lex: Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), Official Journal L 150 (9 June 2023)
- EUR-Lex: Commission Delegated Regulation (EU) 2025/305, RTS on the information in an application for authorisation as a CASP (published 31 March 2025)
- EUR-Lex: Commission Implementing Regulation (EU) 2025/306, ITS on standard forms, templates and procedures for CASP authorisation applications (published 31 March 2025)
- European Securities and Markets Authority (ESMA): List of grandfathering periods decided by Member States under Article 143 of MiCA
- European Securities and Markets Authority (ESMA): Statement on the End of Transitional Periods under MiCA (ESMA75-113276571-1679, 17 April 2026)
- European Securities and Markets Authority (ESMA): Public Statement: ESMA calls on unauthorised crypto-asset service providers to wind down orderly as MiCA transitional period ends (ESMA75-113276571-1710, 23 June 2026)
- European Securities and Markets Authority (ESMA): Interim MiCA register, crypto-asset service providers file (CASPS.csv, update of 11 November 2026)
- Council of the European Union / European Commission: Council document 15164/24: Commission Delegated Regulation C(2024) 6904 final of 31.10.2024, RTS on the information to be included in an application for authorisation as a CASP (later published as Delegated Regulation (EU) 2025/305)
- Národná banka Slovenska: Commission Delegated Regulation (EU) 2025/305 of 31 October 2024: document record
- European Securities and Markets Authority (ESMA): Opinion on MiCA regulatory technical standards on the authorisations of crypto-asset service providers and notifications by certain financial entities (ESMA35-1872330276-195)
- European Securities and Markets Authority (ESMA): Supervisory Briefing: Authorisation of CASPs under MiCA (ESMA75-453128700-1263)
- European Securities and Markets Authority (ESMA): Peer Review Report Executive Summary: Fast-track peer review on [a CASP] authorisation and supervision in Malta (ESMA42-2004696504-8164)
- European Securities and Markets Authority (ESMA): Interactive Single Rulebook: MiCA Article 62, Application for authorisation as a crypto-asset service provider
- European Securities and Markets Authority (ESMA): Markets in Crypto-Assets Regulation (MiCA): Interim MiCA Register
- Autorité des marchés financiers (AMF): The French, Austrian and Italian markets authorities call for a stronger European framework for crypto-asset markets
- European Securities and Markets Authority (ESMA): ESMA Response to the EC Consultation on the review of Regulation (EU) 2023/1114 (MiCA) (ESMA75-113276571-1721)
- Goodwin Procter: ESMA Pushes Back on the EU Commission's New MiCA CASP Requirements
- Norton Rose Fulbright (Regulation Tomorrow): European Parliament progresses negotiations on MISP package
- Norton Rose Fulbright (Regulation Tomorrow): Commission proposes legislative package aimed at market integration and EU-level supervision
- Guardian: Bracket Contract Updates, finding H-01: Missing Pause Functions
- Guardian: Synthetix Withdrawal Flow, finding L-11: Wildcard Test Deposit Endpoint
- Guardian: Synthetix Auto-Compounding LP Vault, remediation finding M-03: Keeper Wildcard SecretsManager Policy
- Guardian: GMX Fee Automation, finding I-12: Reliance On Gelato Key-Store Values
- Guardian: Bounce Tech Automation Layer and Contract Updates, finding L-05: Insufficient RPC URL Validation
- Guardian: Compliance audits for digital asset businesses
- Guardian: Managed Security
- Autorité des marchés financiers (AMF): Instruction DOC-2025-05: Information deemed complete for assessment of a CASP authorisation application
- Autoriteit Financiële Markten (AFM): Contact and frequently asked questions: ICT risk management / DORA
- Malta Financial Services Authority (MFSA): Follow-Up Circular to the Industry on the Authorisation Process for MiCA Applicants
- Central Bank of Ireland: Markets in Crypto Assets Regulation (MiCAR)
- A2CO: MiCA and DORA: From Authorisation to Resilient CASP Operations
- BDO Malta: MFSA Circular on DORA Authorisations (2025)
- European Securities and Markets Authority: ESMA Q&A 2364: Applicability of DORA and TFR requirements to VASPs
Find the Gaps in Your ICT File Before Your Regulator Does
Guardian's Compliance Assessment tests your applications, infrastructure, custody and relevant smart contracts, then delivers a gap register and security reports mapped to the CASP application requirements.