For a crypto founder entering Europe, one of the first regulatory questions is usually also one of the most misunderstood: do we actually need a crypto license?
The answer depends less on whether a company describes itself as “crypto” and more on what it actually does. A non-custodial software company, a token issuer, a crypto exchange and a business holding crypto on its own balance sheet can sit in very different regulatory positions.
Under the EU’s Markets in Crypto-Assets Regulation, MiCA, the decisive questions include which services are provided, which crypto-assets are involved, where clients are located and whether another financial-services regime already applies.
For founders, the objective is therefore not to find the fastest licence. It is to establish the correct regulatory perimeter before product, corporate structure and go-to-market decisions become expensive to reverse.
What a “crypto license” actually means in the EU
There is no single EU authorisation officially called a “crypto license”. In most founder conversations, the term refers to authorisation as a crypto-asset service provider, or CASP, under MiCA.
Article 59 of MiCA provides that a person may not provide crypto-asset services within the Union unless it is authorised as a CASP or is one of the regulated financial entities permitted to provide relevant services under Article 60. An authorised CASP can then provide the services covered by its authorisation across the EU through establishment or the freedom to provide services.
That distinction matters. Issuing a token does not automatically make a project a CASP. Likewise, building blockchain infrastructure does not automatically trigger a CASP authorisation.
MiCA separately regulates the issuance, public offering and admission to trading of crypto-assets, including specific regimes for asset-referenced tokens and e-money tokens. It also excludes certain assets already regulated under other EU financial-services legislation, including crypto-assets that qualify as financial instruments.
A founder should therefore start with regulatory classification, not a licence application.
Start with the activity, not the business label
A common mistake is asking whether an “exchange”, “wallet”, “DeFi project” or “Web3 startup” needs authorisation. Those labels are commercially useful but legally incomplete.
MiCA looks at the activity being performed. Relevant crypto-asset services include activities such as custody and administration, operating a trading platform, exchanging crypto-assets for funds or other crypto-assets, executing or transmitting orders, placing crypto-assets, providing advice or portfolio management and providing transfer services on behalf of clients.
That creates important distinctions between superficially similar businesses. A company developing wallet software may be in a different position from a company controlling private keys for clients. A project creating a token may face white paper and issuance obligations without itself providing regulated crypto-asset services. A platform combining exchange, custody and transfer functionality may require several services to be covered by the same CASP authorisation.
The asset itself also needs to be classified. MiCA does not apply to crypto-assets that qualify as financial instruments, and unique, non-fungible crypto-assets are outside its scope, subject to the actual characteristics and structure of the asset.
As dr. Peter Merc, Founder of Lemur Legal, puts it:
“Founders often come to us asking which licence they need, but that is usually not the first question. We first look at what the product actually does: who controls the assets, who executes the transaction and what service is really being provided to the user. A small change in the product setup can completely change the regulatory analysis. The commercial label of the business tells us very little.”
This is why changing a product description rarely solves a regulatory problem. The legal analysis follows the substance of the model.
Do you need a MiCA crypto license?
For most founders, the practical test has four parts.
First, determine whether the company is providing a crypto-asset service covered by MiCA. Second, determine whether it is providing that service professionally to clients rather than merely using crypto internally. Third, determine whether the relevant assets fall within MiCA rather than another regulatory framework. Finally, determine whether there is a genuine connection to the EU market.
If those elements point toward regulated crypto-asset services in the EU, CASP authorisation will generally need to be considered. Article 59 requires a CASP to have a registered office in a Member State where it carries out at least part of its services, effective management in the Union and at least one director resident in the Union.
There is a separate route for certain already-regulated financial entities. Credit institutions, investment firms and several other categories listed in Article 60 may provide specified equivalent crypto-asset services following the prescribed notification process rather than obtaining a completely separate CASP authorisation. This is not a general exemption for any regulated company. The permitted services depend on the entity’s existing status and authorisations.
For non-EU businesses, “we are incorporated outside Europe” is also not a regulatory strategy. MiCA contains a narrow exception where an EU client approaches a third-country firm entirely on the client’s own exclusive initiative. If the firm solicits, promotes or advertises to EU clients, a contractual disclaimer cannot manufacture reverse solicitation.
The MiCA transitional period is over
For founders planning in 2026, an important historical distinction has disappeared.
MiCA previously allowed Member States to operate transitional measures for certain firms that had already been providing crypto-asset services under national law before 30 December 2024. The final EU-wide deadline was 1 July 2026.
ESMA confirmed in April 2026 that after that date an entity providing crypto-asset services to EU clients without the required MiCA authorisation is in breach of EU law and must cease providing those services.
This changes the decision calculus for founders. A legacy national VASP registration should not be treated as a route for launching a new EU-wide service today. For a new entrant, the relevant question is generally what authorisation or regulatory route is required under the current framework before regulated activities begin.
It also makes timing more commercially important. Licensing should sit on the product roadmap alongside fundraising, banking, hiring and launch, rather than being treated as paperwork to complete once the product is already live.
What a CASP application actually requires
A CASP application is not simply a company registration with an additional compliance form attached.
Under MiCA Article 62, an applicant must provide, among other matters, its corporate information, articles of association, programme of operations, services and marketing model, prudential safeguards, governance arrangements, information on management and qualifying shareholders, AML/CFT risk controls, business continuity arrangements, ICT and security documentation, client-asset segregation procedures and complaints processes. Service-specific policies are then required depending on whether the business provides custody, exchange, execution, advice, portfolio management, transfers or operates a trading platform.
Capital is also activity-dependent. MiCA’s permanent minimum capital requirements range from EUR 50,000 for Class 1 services to EUR 125,000 for Class 2 and EUR 150,000 for Class 3, which includes operating a trading platform. However, Article 67 requires prudential safeguards equal to the higher of the applicable permanent minimum capital amount or one quarter of the preceding year’s fixed overheads.
The practical point is that a founder should not choose a jurisdiction based only on a headline incorporation cost or an advertised “fast licence”. The authority will be assessing the business behind the application: management, substance, ownership, systems, policies and whether the operating model is credible.
A realistic licensing strategy therefore works backwards from the actual product.
When a crypto license is not the right answer
Some founders discover that they do not need a CASP authorisation, but still have significant regulatory work to complete.
A token project making a public offer may instead fall under MiCA’s issuer and disclosure framework. For crypto-assets other than asset-referenced tokens and e-money tokens, Article 4 generally requires the relevant legal person to prepare, notify and publish a crypto-asset white paper before an in-scope public offer. MiCA contains specific exemptions, but those need to be tested against the actual structure of the offer.
Asset-referenced tokens have a substantially more demanding regime. Under Article 16, offering an ART to the public or seeking its admission to trading generally requires an EU-established issuer authorised for that purpose, or a qualifying credit institution, subject to specified exemptions.
Other projects may fall partly or entirely outside MiCA because the asset qualifies as a financial instrument or because the activity is not a regulated crypto-asset service. That does not necessarily mean “unregulated”. Securities, payment, AML/CFT, consumer, data-protection and other rules may still affect the model.
A crypto legal opinion can be useful precisely at this stage: before a company spends time and capital pursuing the wrong regulatory path.
Build the regulatory map before the application
The most efficient preparation starts with a written map of the business model.
That map should identify who contracts with the customer, where the customer is located, which entity operates each part of the product, which party controls crypto-assets or private keys, how orders and transfers are executed, how revenue is generated and which tokens or other assets the platform supports.
Next comes asset and service classification. Only then does jurisdiction selection make sense. The home Member State is not simply a flag on a corporate-services package. MiCA requires an authorised CASP to maintain a genuine EU organisational connection, including its registered office, effective management and management presence.
The corporate structure, shareholders, management team, financial resources and compliance architecture should then be aligned with the intended application. A founder who does this before development and commercial contracts are locked in usually retains more options than one trying to retrofit compliance immediately before launch.
For projects that need support across classification, authorisation and operational compliance, Lemur Legal approaches these questions as one connected regulatory architecture rather than separate documents.
A crypto license is an outcome of the business model
The right question is not simply, “Where can we get a crypto license?”
It is: what regulated activity are we performing, under which legal framework, for which clients, through which entity?
Once those questions are answered, the licensing path becomes considerably clearer. In some cases, that means a MiCA CASP authorisation. In others, it means a notification by an already-regulated financial entity, a MiCA white paper, a different financial-services regime or no CASP authorisation at all.
The expensive mistakes usually happen when classification comes after incorporation, product development or launch.
For founders building in the EU, regulatory work is most useful when it informs those decisions early. The objective is not more documentation. It is a defensible structure that allows the business and its legal position to match from the beginning.