Cryptoasset Business Registration in 2026: MiCA, CASP and Beyond

The 2026 crypto registration landscape

Running a crypto business in 2026 is a very different job from 2023. The EU's Markets in Crypto-Assets Regulation (MiCA) has been in full application since 30 December 2024, and the fragmented patchwork of national crypto registers is being replaced with a single authorization: the Crypto Asset Service Provider (CASP) license. Outside the EU, the UK FCA still runs its own MLRs-based register, the US is reshaping rules after the 2024-2025 enforcement wave, and jurisdictions from Dubai to Singapore are aligning with FATF standards.

If you want to operate an exchange, a custodian wallet, a brokerage, an OTC desk or a token issuance platform, you now pick a lead regulator, meet its capital and governance bar, and passport across the rest of the bloc. The registration is heavier than the old VASP regime, but the prize is a 27-country market and a credible brand signal for banks, auditors and institutional clients.

MiCA in plain English

MiCA splits crypto-assets into three buckets, and each has its own rulebook. Knowing which bucket your product touches tells you which authorization you need and what capital you have to post.

A practical rule of thumb: if you operate a crypto service for clients, you need a CASP authorization. If you issue a stablecoin, you additionally need an EMT or ART authorization (or to be a credit institution). NFTs that are genuinely unique and not fractionalised remain outside MiCA, as do pure DeFi protocols with no identifiable intermediary - but regulators are watching that border closely.

CASP capital and the three service classes

MiCA groups CASP services into three classes with different minimum capital floors. Your own funds must always be the higher of the fixed floor or one quarter of your previous year's fixed overheads.

On top of the own-funds floor you need professional indemnity insurance or additional capital, plus a governance package: fit-and-proper directors, a named compliance officer, an MLRO, segregated client custody, business continuity and an ICT-risk framework aligned with DORA. Existing VASPs registered before 30 December 2024 benefit from a transition period that ends at the latest on 1 July 2026, so national regulators are processing a wave of upgrade applications through spring 2026.

Picking a jurisdiction in 2026

Because of passporting, your lead CASP jurisdiction matters less than it did under the VASP era - but it still shapes timelines, fees, language of the application and the regulator's appetite for innovation.

Ireland, the Netherlands, Luxembourg and Austria are also seeing flows, while Cyprus and Portugal remain competitive for smaller setups. Outside the EU, the UK's FCA runs a separate cryptoasset register under the MLRs with no equivalent passporting, and its forthcoming full financial services regime for crypto is expected to land in 2026 - a parallel track any UK-facing business has to track.

What a CASP application actually contains

Every EU regulator works from the same template under MiCA Article 62 and the related RTS. The dossier is heavier than the old VASP checklist, but it is also predictable. Budget four to nine months from kick-off to authorization, plus a readiness phase of two to three months if you are starting from scratch.

1. Programme of operations. Services offered, target clients, jurisdictions served, expected volumes, marketing strategy, outsourcing map.
2. Governance and fit-and-proper. Board composition, named compliance officer and MLRO, CVs, police clearance, conflicts-of-interest policy.
3. Own funds and financial projections. Evidence of paid-up capital, three-year projections, stress scenarios, professional indemnity cover.
4. Custody and client asset segregation. Hot-wallet and cold-wallet architecture, key-management policy, insurance, reconciliation cadence.
5. ICT and cyber resilience. DORA-aligned ICT-risk framework, incident reporting, third-party register, penetration testing.
6. AML / CTF package. Business-wide risk assessment, KYC, transaction monitoring, Travel Rule implementation, SAR process, sanctions screening.
7. Market abuse and conflicts. For trading venues: pre- and post-trade transparency, order-book rules, insider lists, market-manipulation monitoring.
8. Complaints handling and client communications. Fair marketing, pre-contractual disclosures, complaints workflow, redress procedures.

ESMA keeps a public CASP register. Once authorized, you notify your home regulator of each Member State you want to passport into, and you can usually start operating there within 15 working days.

The Travel Rule in practice

The EU Transfer of Funds Regulation (TFR, Regulation (EU) 2023/1113) has applied to crypto since 30 December 2024. Unlike the FATF "travel rule" in some non-EU jurisdictions, there is no de minimis threshold: every crypto transfer between CASPs must carry originator and beneficiary information, regardless of amount.

The operational answer is a travel-rule solution: TRP, Sumsub Travel Rule, Notabene, 21 Analytics, or direct integration into a crypto core. Expect your regulator to test the full chain during inspections: originator verification, counterparty discovery, beneficiary CASP onboarding and evidence retention for five years.

The UK and other non-EU regimes

Outside the EU, the headline regimes in 2026 look like this:

For a global product the typical setup is one EU CASP (passporting across the bloc), one UK FCA registration, one UAE VARA or DIFC entity, and a Singapore or Hong Kong entity for APAC. Each adds overhead, but mixing them reduces single-jurisdiction risk and opens the widest banking network.

Building the stack: how Crassula fits

Getting the license is one job. Shipping a product that meets the CASP rulebook on day one is another. A compliant crypto exchange or wallet in 2026 needs at least: a ledger, a matching engine or liquidity aggregator, fiat on- and off-ramps, hot and cold custody, KYC and KYB, transaction monitoring, travel-rule messaging, market-surveillance tooling, a client portal, and an admin back office.

Crassula powers crypto exchanges, wallets and OTC desks on top of this stack. We bring a production-ready crypto core with native support for MiCA reporting, the Travel Rule, DORA-aligned ICT controls, and integrations with leading custody, liquidity and KYC providers. You focus on the license, the vertical and the customer. We ship the plumbing.

A pragmatic 2026 registration playbook

If you are starting or upgrading a crypto business this year, a workable plan looks like this:

1. Define the perimeter. Decide which MiCA services you offer (Class 1, 2 or 3), whether you issue any EMT or ART, and which non-EU jurisdictions you need.
2. Pick a lead jurisdiction. Match regulator appetite, language, cost and banking access to your product. Plan passporting from day one.
3. Set up the legal entity and capital. Incorporate, inject own funds at the right class level, appoint qualified directors, compliance officer and MLRO.
4. Build the compliance stack. AML, KYC, transaction monitoring, travel rule, sanctions, DORA, complaints, client asset segregation. Document everything.
5. Pick the technology backbone. Ledger, matching, wallet, KYC, travel-rule, admin. Either build in-house (18-24 months) or integrate a platform like Crassula (8-16 weeks to MVP).
6. File the application and engage. Treat the regulator as a partner: clear answers, proactive updates, honest gap analysis.
7. Go live and passport. After authorization, notify the Member States you want to serve, onboard the first clients, measure transaction monitoring and KPIs from week one.

The firms that move now, while the transition period is still open, will enter 2027 with a genuine MiCA passport, a banked balance sheet, and a clean enforcement record. The firms that wait will face a tougher market with more competition and stricter supervisory benchmarks.

FAQ