MiCA License Cost: Fees, Capital and the Security Budget

By the Guardian team Updated November 2026 6 min read

Quick answer. Application fees range from €5,000 per service in Cyprus to an hourly fee capped at €100,000 in the Netherlands. Capital: €50,000 to €150,000, or a quarter of fixed overheads if higher. Advisers, staff and security testing add more.

Watch: MiCA License Cost: Fees, Capital and the Security Budget 1:40

Video transcript

MiCA sets no EU-wide license fee. Each regulator sets its own, and the only number MiCA fixes is capital.

Only two of the five cost lines are published. Budget all five: regulator fees, capital, the application file, people, and ICT and security.

Cyprus charges five to thirty thousand euros per service. The Netherlands bills two hundred euros an hour, capped at one hundred thousand.

Capital is the higher of your class minimum or a quarter of fixed overheads. A Class 2 firm projecting one million euros of overheads needs two hundred fifty thousand euros.

The ICT section describes systems you already run: DORA technical documentation, critical vendor contracts, and incident procedures. If available, add a third-party audit, ideally with pentests and smart contract code review.

No regulator prices this. Software vendor Crassula estimates twenty to sixty thousand euros for a pentest and ICT audit. After authorization, DORA requires testing critical systems at least yearly.

Crassula puts a Class 2 or 3 firm's first year at three hundred fifty to nine hundred thousand euros all-in, capital included.

To cut cost, license only what you will run. Banks and investment firms may notify instead. File complete, and scope the audit to critical systems.

Guardian writes the ICT and security sections of your file and closes every pentest with a retest. Read the full article, or talk to Guardian.

MiCA sets no EU-wide authorization fee. Each national authority sets its own, and the published schedules differ widely.

Capital is the one number MiCA fixes. Advisers, staff, systems and security depend on your services and how you build.

Here is what regulators publish, what one vendor estimates, and where the security budget goes.

This article explains the technical and security side of MiCA (Regulation (EU) 2023/1114) and DORA (Regulation (EU) 2022/2554) for CASP authorization. It is not legal advice; confirm how it applies to you with counsel.

The Cost Components

Regulator fees: an application fee, then yearly supervision fees.
Capital: prudential safeguards held at all times (Article 67).
The file: Article 62(2) lists 19 items, including governance and ICT documentation.
People: a management body of good repute and skill (Article 68(1)), and qualified staff (Article 68(5)).
ICT and security: systems built to DORA, tested, with vendors under contract (Article 68(7), (8)).

Only the first two come with published numbers.

Regulator Fees by Country

These are the schedules we could read on regulators' own sites. Some give a method rather than a figure.

Authority	Application fee	Yearly fee
Malta (MFSA)	€10,000, €20,000 or €25,000 by class	€10,000 to €50,000 by class, plus per-service and volume charges
Cyprus (CySEC)	Per service, added up: €5,000 to €30,000 each	Fixed per service, plus a turnover surcharge; capped at €500,000
Netherlands (AFM)	€200 an hour, capped at €100,000	€8,000 base, plus turnover and per-service charges
Sweden (FI)	Set by estimated processing time	Linked to balance sheet; at least SEK 150,000
Germany (BaFin)	Set by time spent; due even if withdrawn or rejected	Not stated on BaFin's CASP page

The AFM adds €700 per person for the integrity test and €2,900 per person for the suitability test. The Dutch central bank, DNB, charges its own yearly levy on top.

Fees are not refundable in Malta. BaFin charges even when an application is withdrawn or rejected.

A worked example

Take a CASP offering custody, both kinds of exchange and transfers. That is Class 2. Below is our arithmetic from the two published schedules.

Fee	Malta	Cyprus
Application	€20,000	€25,000
Yearly, fixed	€33,000 (€25,000 plus €2,000 per service)	€25,000
Yearly, variable	0.05% of transaction volume, capped at €250,000	Surcharge once turnover passes €500,000

Capital Requirements

MiCA Article 67 requires prudential safeguards at all times, equal to the higher of:

the permanent minimum for your class (Annex IV);
one quarter of last year's fixed overheads, reviewed yearly.

Class	Adds these services	Minimum
Class 1	Execution, placing, transfers, order transmission, advice, portfolio management	€50,000
Class 2	Custody; exchange for funds or other crypto-assets	€125,000
Class 3	Operating a trading platform	€150,000

New firms use the projected fixed overheads in their application (Article 67(2)). A Class 2 firm projecting €1 million of fixed overheads needs €250,000, not €125,000.

Safeguards can be own funds, an insurance policy or comparable guarantee, or a mix (Article 67(4)). Capital is not a fee, but you hold it for as long as you operate.

EMT payments raise the floor. The EBA advises applying MiCA and PSD2 capital cumulatively: its example, a Class 2 custodian that also executes payment transactions, needs €250,000 (EBA/Op/2025/08).

The Security and ICT Line

The ICT section of the file describes systems you must already run. RTS 2025/305 Article 9 asks for:

Technical documentation of ICT systems, DLT infrastructure and security arrangements built for DORA.
Critical ICT services from third parties, with contracts, mapped to MiCA Article 73 and DORA Chapter V.
Security and incident management procedures.
If available, a third-party cybersecurity audit, ideally with black, grey and white box pentests.
Within that audit, ideally, a source code review of any smart contracts you use or develop.

Authorization does not close this line. Under DORA, critical systems need appropriate tests at least yearly (Article 24(6)), and detection must be in place and tested (Article 10).

What it costs

No regulator publishes a figure. Crassula, a white-label banking software vendor, estimates €20,000 to €60,000 for a pentest and ICT audit.

For public price points, see what a Web3 pentest costs.

What drives it

Surface: web and mobile apps, APIs, admin tools, cloud and signing systems.
Smart contracts: each one you use or develop adds source code review.
Custody model: your own signing stack means more to test than a custody partner.
Vendors: each critical provider needs due diligence, DORA contract terms and an exit plan.
Retests: every finding fixed and the fix validated (DORA Article 24(5)).
TLPT: a threat-led test every 3 years, if your authority identifies you (Article 26).

For the full control list, see our MiCA compliance checklist. For how the two texts split the work, see MiCA and DORA.

Advisers, Staff and Totals

Advisers and staff have no published price. These are Crassula's estimates, updated 9 October 2026:

Item	Crassula's estimate
Legal counsel for the application	€40,000 to €150,000
Policies and documentation	€25,000 to €80,000
Compliance officer or MLRO, year one	€60,000 to €120,000
Technology stack, year one	€150,000 to €600,000 to build, or €5,000 to €30,000 a month white-label
First year all-in, Class 2 or 3	€350,000 to €900,000, including €125,000 to €150,000 of capital

Crassula sells white-label banking software with crypto modules, so read its technology line with that in mind.

Time costs money too. Authorities have 25 working days to check completeness, then 40 working days from a complete file to decide (Article 63).

Ways to Reduce Cost

License only what you will run. Your services set your capital, and in Malta and Cyprus your fee.
Use a license you hold. Banks, investment firms and some other regulated firms may notify under Article 60 instead.
Notification is cheaper. The AFM caps it at €50,000; FI charges SEK 25,500.
Do not resend documents. Authorities may not ask for current information already filed for an e-money, MiFID II or PSD2 license (Article 62(4)).
File complete. Authorities may refuse to review a file still incomplete after their deadline (Article 63(3)).
Scope the audit to critical systems. Those are the systems DORA tests every year.
Write vendor terms once, to meet MiCA Article 73 and DORA Article 30 together.

How Guardian Helps

Guardian's Regulatory & Compliance team writes the ICT, security, custody and continuity sections of an authorization file from the system as built.

Its gap assessment lists each provision with the control that meets it and the evidence that proves it. Gaps are ordered by what blocks authorization.

Guardian's audit reports close with a fix review, and Guardian maps them to RTS 2025/305 Article 9. Its pentests close with a retest.

Guardian does not publish pentest prices; it scopes from your system. Vanguard returns half the package cost as credits toward Guardian's offchain assessments.

Frequently Asked Questions

How much does a MiCA license cost?

Application fees range from €5,000 per service (Cyprus) to an hourly fee capped at €100,000 (Netherlands). Capital starts at €50,000. Software vendor Crassula estimates €350,000 to €900,000 for a Class 2 or 3 CASP's first year, capital included.

How long does MiCA authorization take?

Authorities have 25 working days to check an application is complete, then 40 working days from a complete file to decide (MiCA Article 63). Sweden's FI says it can add 20 working days if a file needs supplementing.

Is the MiCA capital requirement a fee?

No. It is a prudential safeguard you hold at all times, as own funds, insurance or both. It is the higher of your class minimum (€50,000 to €150,000) and a quarter of last year's fixed overheads.

What does a MiCA license cost each year?

Supervision fees are set nationally: €10,000 to €50,000 by class in Malta plus per-service and volume charges, and at least SEK 150,000 in Sweden. Add DORA's yearly tests of critical systems, staff and audits.

Sources

Budget the security line of your MiCA file

Guardian writes the ICT and security sections of your application and runs the audits and pentests behind them.

Talk to Guardian Explore regulatory compliance