The three questions that decide the answer, and why authorisation is not a formality but the condition of there being someone to sue.
Spain’s transitional regime ended on 1 July 2026. Until that date, a firm listed on 30 December 2024 in the Banco de España’s register of virtual currency exchange providers could continue providing its existing services while its authorisation was processed. Since then, in the CNMV’s own words, only providers authorised by the CNMV or by other European authorities may operate in Spain. The question has stopped being prospective.
It is also still badly put. Whoever asks whether they need a CASP licence tends to describe their company — “we are a platform”, “we only provide infrastructure”, “we never touch client money” — when Regulation (EU) 2023/1114 does not ask what you are. It asks what you do. There are ten listed services, and one is enough.
What the Regulation lists
Article 3(1)(16) defines as crypto-asset services the custody and administration of crypto-assets on behalf of clients; the operation of a trading platform; the exchange of crypto-assets for funds; the exchange of crypto-assets for other crypto-assets; the execution of orders on behalf of clients; the placing of crypto-assets; the reception and transmission of orders on behalf of clients; advice on crypto-assets; portfolio management of crypto-assets; and transfer services for crypto-assets on behalf of clients.
That list repays a second reading, because three of its entries catch firms that believed themselves outside it. Transfer services on behalf of clients reach whoever moves someone else’s assets, even without custody in any accounting sense. Reception and transmission of orders reaches whoever merely routes. And advice requires no advisory contract: it reaches whoever recommends a particular crypto-asset to a particular client, however firmly the screen says this is not investment advice.
First question: do I provide one of the ten services to third parties?
If the answer is yes, Article 59(1) closes the door. No one may provide crypto-asset services in the Union unless they are a legal person authorised under Article 63 or one of the financial entities listed in Article 60. There is no third route, and Article 59(2) adds two requirements that often come as a surprise: the registered office must be in a Member State where at least part of the services are provided, the place of effective management must be in the Union, and at least one director must reside there.
The only genuine way out is Recital 22: where crypto-asset services are provided in a fully decentralised manner without any intermediary, they fall outside the Regulation. But “fully” means fully. If there is a company collecting fees, an interface someone maintains, admin keys someone holds, or a team able to halt the protocol, there is an intermediary. Decentralisation is a question of fact, not of narrative.
Second question: am I already a regulated financial entity?
If so, Article 60 replaces authorisation with notification. Credit institutions may provide crypto-asset services; central securities depositories, custody and administration; investment firms, the services equivalent to those they are licensed for; electronic money institutions, custody and transfer but only in respect of the e-money tokens they themselves issue; UCITS management companies and AIFMs, what is equivalent to portfolio management and ancillary services; and market operators, the operation of a trading platform.
The notification is not a formality. It must be filed at least forty working days before services are provided for the first time, together with a programme of activity, internal anti-money-laundering controls, the risk assessment framework, a business continuity plan, technical documentation of the ICT systems, a description of the segregation of client assets and funds and, depending on the service, a custody policy, the platform’s operating rules, a commercial and pricing policy, an execution policy, or evidence of staff competence.
Third question: am I a third-country firm relying on the client’s initiative?
Here lies the most repeated trap. Article 61(1) exempts from authorisation a service initiated by a client established in the Union at that client’s exclusive initiative. But the second subparagraph provides that where the firm solicits clients or prospective clients in the Union — by whatever means of communication, for the purposes of solicitation, promotion or advertising — the service is not deemed to be provided at the client’s exclusive initiative. And the third subparagraph settles the matter: that applies notwithstanding any contractual clause or disclaimer purporting to state otherwise.
In other words, the clause everyone includes does not work. No drafting turns solicitation into client initiative. Article 61(2) adds that the client’s initiative does not entitle the firm to market new types of crypto-assets or services to that client afterwards.
What it costs, if the answer is yes
Article 67 requires permanent prudential safeguards at the higher of two amounts: the minimum capital in Annex IV or one quarter of the previous year’s fixed overheads. Annex IV sets three classes: EUR 50,000 for execution of orders, placing, transfer services, reception and transmission of orders and advice or portfolio management; EUR 125,000 where custody and exchange are added; and EUR 150,000 where a trading platform is operated. They may be met with Common Equity Tier 1 own funds, with an insurance policy or comparable guarantee, or with a combination.
The time limits in Article 63 are twenty-five working days for the completeness check and forty working days from a complete application for the assessment, with a suspension of up to twenty working days where information is requested. Add the real time needed to prepare the file, and the honest figure is not the one in the Regulation.
Why this is not a compliance matter
From where we look at it, authorisation is not a regulatory label. It is the condition of there being someone to sue.
An award ordering the delivery or restitution of crypto-assets needs, before anything else, an identified and locatable debtor. That is what authorisation supplies. Article 59(2) requires a registered office in a Member State where at least part of the services are provided, effective management in the Union and at least one resident director: in other words, a place to serve process and a place to enforce. Article 67 adds permanent minimum own funds, which is what distinguishes a solvent debtor from an empty company.
It is worth being precise here about what the Regulation does not say, because the point is often confused. MiCA does not establish a general liability regime under which any authorised provider answers for non-compliance with an award. Article 75 governs one of the ten services only — the custody and administration of crypto-assets on behalf of clients — and its paragraph 8 makes the custodian liable to its clients for the loss of crypto-assets or of the means of access where the incident is attributable to it, capped at the market value of the crypto-asset at the time of the loss and excluding incidents unconnected with its operations. It is a custody regime, not an enforcement guarantee. Against an authorised provider that does not hold custody, the award creditor has a supervised and locatable legal person, not a specific liability action.
That does not diminish the importance of authorisation; it puts it in its proper place. What authorisation supplies is not the guarantee of payment but the precondition of any payment, which is knowing against whom and where. Against an unauthorised provider, the award is correct and enforcement becomes an exercise in locating someone.
Authorisation therefore matters in two directions. It matters to whoever needs it, because operating without it is unlawful. And it ought to matter to whoever buys the service, because it determines whether, on the day something goes wrong, they will face a supervised legal person or an email address.
One last observation, from practice. “I don’t need a licence” is rarely a legal conclusion. It is almost always the description of a business model that has not yet been changed.
Institutional interest note: BACS (Blockchain Arbitration & Commerce Society) is a non-profit arbitral institution registered in the European Union Transparency Register under number 9106897105368-14. This analysis does not constitute legal advice on any particular case.
Sources: Regulation (EU) 2023/1114, Articles 3(1)(16), 59, 60, 61, 63, 67 and 75(8), Annex IV and Recital 22; CNMV, Nueva regulación de criptoactivos — Reglamento MiCA and questions and answers of 15 December 2025.
