The old European crypto map was drawn by the fifth anti money laundering directive. Member states were told to bring exchange and custodian wallet providers into the AML perimeter, and each did it in its own way. The result was a patchwork of national registers with wildly different bars: a few weeks and a compliance manual in one country, a year of correspondence in another. Firms shopped for the easy one and then served clients across the continent from behind it.
MiCA replaced that. The regulation entered into force in 2023, its rules for crypto-asset service providers applied from 30 December 2024, and existing nationally registered firms were given a transitional window that could run no later than 1 July 2026. Several member states shortened it. That window is now shut.
Registration and authorisation are different animals
| National VASP registration | MiCA CASP authorisation | |
|---|---|---|
| What was assessed | AML programme, fit and proper test on management | Business model, governance, systems, conduct and financial resources |
| Capital | Usually none beyond company law minimums | Own funds floor by class of service, with a fixed overheads test alongside it |
| Client assets | Not addressed in most national regimes | Segregation, custody policy and liability for loss of client crypto |
| Cross border | None, the register was national | Notification based passporting across the EU |
| Supervision | Largely AML inspection | Prudential and conduct supervision on an ongoing basis |
The line that matters commercially is the last but one. A national registration never carried a right to serve clients in another member state, though plenty of firms behaved as though it did. Authorisation as a crypto-asset service provider does carry that right through a notification procedure, which is the single largest change to how a European crypto business is structured. The mechanics of the licence itself are set out in the guide to the MiCA licence.
What a firm has to build that it did not have before
Custody is the heaviest lift. MiCA requires client crypto-assets to be held separately from the firm's own, with a custody policy, records that let a client's holdings be identified at any moment, and liability sitting with the provider for loss of assets held in custody. Firms that ran a single hot wallet with an internal ledger have rebuilt that layer entirely.
Then governance: a management body that can be assessed, an internal control function, conflict of interest policies, a complaints procedure with published handling times, and outsourcing arrangements documented well enough that the regulator can see who does what. Marketing communications must be fair and identifiable as marketing, which ends the influencer campaigns that read as investment guidance.
Operational resilience sits alongside it. ICT risk management for financial entities is governed by its own regulation, and an authorised provider is inside that perimeter, with incident reporting and third party provider oversight to match. None of this existed in a registration file.
An authorisation is not a one time exercise. The obligations that follow it, from prudential reporting to complaints statistics, need someone whose job they are. Firms that budget for the application and not for the year after it are the ones that struggle at the first supervisory visit.
The routes that used to work and no longer do
Three practices went with the transitional period. Registering in the friendliest member state and serving the whole EU on that basis, which never had a legal foundation and now has an obvious answer. Operating from outside the EU while marketing to EU residents, which MiCA restricts directly and which pushes firms towards reverse solicitation arguments that are narrower than the marketing teams believe. And treating token issuance as a separate matter from service provision, when the regulation covers offerings and admissions to trading in their own right.
Alongside all of this runs the transfer of funds regulation, the EU implementation of the FATF travel rule, which obliges providers to collect and transmit originator and beneficiary information on crypto transfers. It came into application at the same time as the service provider rules and is a separate compliance workstream from the authorisation itself.
Outside the EU, VASP still means something
The term crypto-asset service provider is European. VASP, virtual asset service provider, is the FATF vocabulary used by regimes from the Gulf to the Caribbean to Southeast Asia, and firms operating there still hold VASP registrations that look much like the pre MiCA European model. Some of those regimes have since added capital and custody requirements of their own; others have not moved.
What does not transfer is scope. Comparing a non EU VASP registration to a MiCA authorisation is a translation exercise, service by service, because the activity definitions do not line up. A licence that permits exchange between crypto-assets and fiat in one jurisdiction may cover activities that MiCA splits across several service classes, each with its own capital floor. Anyone mapping an existing permission onto Europe should start from the service list rather than the licence name, and the same caution applies when reading the older national VASP registration requirements.
How firms are choosing
Three patterns have emerged. Apply in a member state with a supervisor that has processed a meaningful number of these files, and accept a longer queue for a cleaner outcome. Partner with an authorised provider and operate as its agent or introducer, which trades margin for time. Or step outside the EU perimeter entirely and serve other markets, which is defensible only if the firm genuinely stops soliciting European clients rather than continuing to accept them quietly.
The choice usually turns on custody. A firm that does not hold client assets faces a materially lighter build than one that does, and some businesses restructure the product to remove custody rather than carry the obligation. That is a legitimate answer, and it should be made deliberately at the design stage rather than discovered during the application.
"The registration era rewarded whoever filed the paperwork fastest. Authorisation rewards whoever can still answer the supervisor's questions two years later. Those are different companies."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- National AML registrations stopped being a route to EU clients when the transitional window closed on 1 July 2026.
- Authorisation adds own funds, custody segregation, governance and conduct duties that registration never touched.
- Passporting is the commercial prize: one authorisation, notified onward, covers the whole single market.
- Non EU VASP permissions do not map service for service onto MiCA, so compare activity lists, not licence names.
Frequently Asked Questions
Is a national VASP registration still valid in the EU?
No. Registrations granted under national anti money laundering regimes were only usable during the MiCA transitional period, which ran to 1 July 2026 at the latest and was shortened by several member states. Firms serving EU clients now need authorisation as a crypto-asset service provider under MiCA.
What is the practical difference between registration and authorisation?
A registration checked that the firm had an AML programme and fit and proper management. An authorisation adds prudential requirements, custody segregation, governance and complaints obligations, conflict of interest rules, outsourcing controls and supervision of how the service is actually run, plus the right to operate across the EU.
Does the term VASP still mean anything?
Outside the EU, yes. VASP is the FATF term used by regimes in many jurisdictions, and firms operating there still register as VASPs. Inside the EU the operative term is now crypto-asset service provider, and matching a non EU VASP registration to MiCA scope is a translation exercise rather than a like for like comparison.