Since the EU Markets in Crypto-Assets Regulation (MiCA) began to apply to crypto-asset service providers, a company that wants to provide crypto-asset services in the European Union needs an authorisation under that regulation. In Estonia the authority that grants it is the Financial Supervision Authority (Finantsinspektsioon). This guide explains in plain language who needs a MiCA authorisation, what the application contains, how the authority assesses it, what it costs in capital and fees, and how we work on such a project. Our prices for this work are on the MiCA crypto licensing page and in the price list.
The guide is general information, not legal advice. Every figure below links to the official text it comes from.
Who needs a MiCA authorisation
MiCA is Regulation (EU) 2023/1114. Its Article 59 says that a person shall not provide crypto-asset services within the Union unless it is authorised as a crypto-asset service provider (CASP) under Article 63, or it is one of the other financial entities listed there — for example a credit institution, an investment firm, an e-money institution or an alternative investment fund manager that is allowed to provide crypto-asset services on the basis of its existing authorisation (Regulation (EU) 2023/1114, EUR-Lex).
Crypto-asset services include, among others:
- custody and administration of crypto-assets on behalf of clients;
- operation of a trading platform for crypto-assets;
- exchange of crypto-assets for funds, or for other crypto-assets;
- execution of orders for crypto-assets on behalf of clients, and reception and transmission of orders;
- placing of crypto-assets;
- providing transfer services for crypto-assets on behalf of clients;
- providing advice on crypto-assets and portfolio management of crypto-assets.
If your business model does any of these things for clients in the EU, the question is not whether you need an authorisation, but which services it must cover and in which Member State you apply.
Where to apply: the home Member State
Under Article 62 of MiCA the application is submitted to the competent authority of the applicant's home Member State. For a company registered in Estonia that is the Financial Supervision Authority. MiCA expects the applicant to be a legal person with its registered office in the Member State where it applies, and to carry out at least part of its crypto-asset services there, with its place of effective management in the Union and at least one director resident in the Union. These are substance requirements: a letterbox company will not satisfy the authority.
Once authorised, the provider can serve clients in other Member States. Article 65 sets out the information it must submit to its home authority before it starts to provide services cross-border — the list of Member States, the services, the starting date and a list of any other activities. Planning for cross-border activity from the start saves a second round of work later.
The three classes
MiCA groups crypto-asset service providers into three classes in Annex IV. The class decides the minimum capital, so it is worth getting right at the start:
- Class 1
- Execution of orders, placing, transfer services, reception and transmission of orders, advice and portfolio management.
- Class 2
- Any Class 1 service, plus custody and administration of crypto-assets on behalf of clients, and/or exchange of crypto-assets for funds or other crypto-assets.
- Class 3
- Any Class 2 service, plus operation of a trading platform for crypto-assets.
A common misunderstanding is that custody requires Class 3. It does not: custody is a Class 2 service. Only the operation of a trading platform moves a provider into Class 3. Our guide to MiCA licence classes and capital explains the classes and the capital calculation in more detail.
What the application contains
Article 62(2) of MiCA lists what an application must contain. In practice the file is built around these parts:
- Corporate information — the legal name, legal form, articles of association, registered office and the planned website.
- Programme of operations — which crypto-asset services the company will provide, to which types of clients, in which Member States, and how it will market them.
- Prudential safeguards — proof that the company meets the capital requirement of Article 67.
- Governance — the management body, the good repute, knowledge, skills and experience of its members (Article 68), and the shareholders with qualifying holdings.
- Internal control and risk management — including the policies on conflicts of interest, complaints handling and business continuity.
- ICT systems and security — a technical description of the ICT systems and security arrangements, which must also fit the digital operational resilience rules of DORA (Regulation (EU) 2022/2554).
- Anti-money laundering — the procedures for preventing money laundering and terrorist financing, and the Travel Rule arrangements for crypto-asset transfers under Regulation (EU) 2023/1113.
- Service-specific policies — for example the custody and administration policy (Article 75) where the company will hold clients' crypto-assets, the operating rules of a trading platform (Article 76), or the suitability assessment for advice and portfolio management (Article 81).
Each part must be consistent with the others. The most frequent reason an application stalls is not a missing document but an inconsistency — for example a programme of operations that describes custody while the capital plan assumes Class 1, or a governance chart that does not match the staffing in the business plan.
How the authority assesses the application
Article 63 of MiCA sets the procedure. The authority acknowledges receipt of the application in writing within five working days. Within 25 working days of receipt it assesses whether the application is complete; if it is not, it sets a deadline for the missing information, and it may refuse to review an application that remains incomplete after that deadline. Once the application is complete, the authority has 40 working days to assess it and adopt a reasoned decision to grant or refuse the authorisation. It may request further information during that period, and the assessment period is suspended while the applicant answers.
These are the authority's statutory periods, not a promise of how long your project will take. The real duration depends on the quality of the file, the number of rounds of questions and how quickly the applicant answers them. We never promise a date, and we cannot promise the outcome: the authority decides.
Capital and fees
A CASP must at all times have prudential safeguards equal to at least the higher of the permanent minimum capital in Annex IV and one quarter of its fixed overheads of the preceding year (Article 67(1)). The Annex IV minimums are 50,000 euros for Class 1, 125,000 euros for Class 2 and 150,000 euros for Class 3 (Annex IV, EUR-Lex). The capital belongs to the company; it is not a fee and not part of our price.
The Financial Supervision Authority charges a procedural fee for the application. For a crypto-asset service provider the fee is 3,000 euros in the wording of the Financial Supervision Authority Act in force on 29 September 2026 (§ 45³(2), Riigi Teataja). An authorised provider then pays annual supervision fees. Our guide to state fees and capital for EU licences collects these figures for all the licences we work on.
Transitional period
MiCA allowed providers that were already providing crypto-asset services under national law before 30 December 2024 to continue until 1 July 2026 or until they were granted or refused a MiCA authorisation, whichever was sooner (Article 143(3)); Member States could shorten or disapply that period. That date has passed. Today a company that wants to provide crypto-asset services in the EU needs the MiCA authorisation itself; an older national registration does not replace it.
How we work with you
- Scoping. You describe your planned services, clients, markets, ownership and team through the quote form. We tell you which services and class the project falls into and what is in scope.
- Quote. We send a written quote by email before any work starts. Our fee is for the corporate and regulatory work; it is not the price of a licence.
- File preparation. We prepare the programme of operations, the governance and internal-control documents and the policies, and coordinate the fit-and-proper information about managers and shareholders.
- Submission and questions. We submit the application with you and manage the authority's questions until it decides.
Optional add-ons include a crypto-asset white paper, Travel Rule set-up, a custody and administration policy and a security and key management procedure. After authorisation, the compliance services — DORA tooling, banking introductions and compliance audits — help the company run.
Frequently asked questions
Can I provide crypto-asset services in the EU without a MiCA authorisation?
Only if you are one of the financial entities that Article 59 of MiCA allows to provide crypto-asset services on the basis of their existing authorisation, such as a credit institution or an investment firm. Otherwise a MiCA authorisation as a crypto-asset service provider is required.
Which authority decides on an Estonian MiCA application?
The Estonian Financial Supervision Authority (Finantsinspektsioon), as the competent authority of the home Member State.
How long does the authority have to decide?
Under Article 63 of MiCA it checks completeness within 25 working days and then has 40 working days from a complete application to decide, with the period suspended while it waits for further information. The total time depends on the file and cannot be promised.
How much capital does a CASP need?
At least the higher of the Annex IV minimum (50,000, 125,000 or 150,000 euros for Classes 1, 2 and 3) and one quarter of the previous year's fixed overheads.
Is your price the price of the licence?
No. Our price is our professional fee for the corporate and regulatory work. State and supervisory fees, regulatory capital and third-party costs are separate, and the authorisation is granted by the Financial Supervision Authority.