Multipass is a financial services provider offering global business accounts, multi-currency payments, and cross-border transaction solutions.
Read case study
Crypto Banking
Request demo
Malta · CASP
Crypto banking for crypto-asset service providers licensed by the MFSA
Malta's VFA transitional measures expired on 30 June 2026, so crypto firms there now operate on a MiCA licence or not at all. Before the MFSA issues your commencement of business letter, your board must declare the systems tested and implemented. Start on a platform that already runs.
- Per-client crypto and fiat ledger
- Liquidity via Kraken
- Systems ready for the MFSA's pre-commencement checks
- Input for your MiCA outsourcing notification
Case Studies
Paysend & Crassula - a banking solution for international companies
Read case study
LuxPay is at the forefront of providing advanced financial services, designed to meet the needs of modern businesses and consumers alike.
Read case study
Wickie offers secure and scalable fiat and cryptocurrency payment solutions, providing users with digital wallets and seamless financial services across multiple platforms.
Read case study
What an MFSA CASP licence lets you offer
Crypto accounts and deposit addresses
Each client gets crypto accounts with their own deposit address and QR code, so top-ups in stablecoins or other crypto arrive without leaving your app.
Exchange against euro and other crypto
Buy, sell and swap with liquidity from a connected provider, with the rate and fee shown up front.
Euro accounts with client money kept apart
IBAN accounts and SEPA, SEPA Instant and SWIFT transfers through your banking partner. The ledger tracks the fiat owed to each client against the accounts you hold only for client funds.
Crypto transfers
Internal transfers and on-chain withdrawals, with Travel Rule data and self-hosted wallet checks handled through a connected provider.
Onboarding clients from closed providers
Questionnaires and identity checks through connected providers for clients moving over from VASPs that wound down at the end of the transition.
Clients across the EU
After notifying your passport you can serve clients in other member states from the same platform and apps.
What this licence does not cover
- Operating on a VFA licence. Its transitional measures expired on 30 June 2026.
- Handing custody to a firm that is not an authorised CASP. The MFSA reminded licence holders of this prohibition in June 2026.
- Issuing e-money tokens. Under MiCA that is reserved for credit institutions and e-money institutions.
What the regulator asks about your IT
Each requirement, what the platform gives you for it and who owns it after launch.
A configured live environment, test runs and walkthroughs your board can rely on before it signs.
Your board, with our inputService description, hosting locations, sub-providers and exit support to complete the form.
You, with our inputOur contract and service terms, ready to sign once you hold in-principle approval.
YouTechnical documentation of the architecture, access roles, 2FA, audit trail, backups and incident handling.
Crassula drafts, you adoptCrypto holdings per client on the ledger, client and own accounts kept apart, exports to reconcile against your wallets.
Your operations team, on platform dataThe platform holds no keys. Wallets run on custody infrastructure you control, or with an authorised CASP.
YouFiat owed to each client on the ledger, with exports to reconcile against the safeguarding accounts at your credit institution.
Your finance team, on platform dataOnboarding questionnaires per client type, identity checks through connected providers, client limits.
Your MLRO
Payment rails and providers
Rails your customers can use
SEPASEPA InstantSWIFTOn-chain transfersInternal transfers
Kraken
Holds a MiCA authorisation from the Central Bank of Ireland and can offer regulated services across the EEA. Liquidity for your exchange service, or Kraken Embed if you want to start before your own licence.
24/7
real-time processing, no batch window
60+
payment and provider integrations connected
150+
companies run on Crassula
15+
languages the platform speaks
Dates to plan around
Rules that change what you have to build, in the order they apply.
30 Dec 2024
MiCA rules for CASPs apply, together with the crypto Travel Rule under Regulation (EU) 2023/1113.
17 Jan 2025
DORA applies to crypto-asset service providers.
25 Jun 2026
The MFSA writes to VFA licence holders: operational VASPs without a CASP licence must wind down in an orderly way.
30 Jun 2026
Transitional measures under Article 66 of the VFA Act expire. From 1 July, clients of VASPs no longer have MiCA protections.
6 months
Time allowed after an MFSA in-principle approval letter to meet the pre-licensing conditions, unless the MFSA grants an extension.
Applying to the MFSA as a CASP? Name us in your application.
The MFSA checks your systems twice: in the application, and again before you may start business. We give you a working platform and the technical documentation for both stages, while your legal advisers handle the rest.
01
A platform you can demonstrate
A configured environment to show the regulator, not slides.
02
The technical part of your application, prepared
ICT systems and DORA, outsourcing and business continuity sections, plus input for the MFSA outsourcing notification.
03
Providers lined up
Liquidity through Kraken, plus banking, custody and KYC providers from our network, matched to your licence.
Crassula provides technology and documentation support. We do not provide legal or regulatory advice and cannot guarantee the outcome of an application.
How a launch usually runs
Take a team in Sliema that has just received its in-principle approval letter from the MFSA for custody and exchange. The clock is running: six months to meet the pre-licensing conditions, including signed engagement letters for outsourced functions and key staff in place. We sign the service agreement, configure the environment in its brand with Kraken liquidity and the custody set-up it chose, and supply the details for its MiCA outsourcing notification.
Once the licence is issued, the team runs test cycles on the live configuration, so the board can sign the declaration that systems are tested and implemented. With the commencement letter in hand it opens onboarding, including clients arriving from VASPs that closed at the end of June 2026, whose due diligence its MLRO reviews under the FIAU rules.
For the regulatory background, read our guide to Malta's VFA to MiCA transition and the MiCA CASP licence guide.
Read the licence guides
FAQ
You get up to six months to meet the pre-licensing conditions, such as final documents, recruited key function holders, proof of capital and signed engagement letters for outsourced functions. After the licence, the MFSA sets pre-commencement requirements, including a board declaration that your systems are tested, before it issues the commencement of business letter.
If the platform supports a critical or important operational function, the MFSA rulebook asks for a MiCA Outsourcing Notification Form at least 60 calendar days before the arrangement starts. We provide the information you need to complete it.
Only with care. In June 2026 the MFSA reminded CASPs that custody may not be outsourced or delegated to firms that are not authorised CASPs. Crassula never holds keys: you run custody on infrastructure you control, or with an authorised CASP.
MiCA sets 25 working days for the completeness check and 40 working days for the decision, with up to 20 working days of suspension when the MFSA asks for more information. In-principle approval, pre-licensing conditions and pre-commencement checks come on top.
Yes, but the MFSA has asked for special attention here. If you want to rely on the data and documents another firm collected, follow section 4.6.6 of the FIAU Implementing Procedures.
EUR 125,000 for custody and exchange (class 2) and EUR 150,000 if you run a trading platform (class 3), or a quarter of last year's fixed overheads if that is higher.
Kraken holds a MiCA authorisation from Ireland and markets Embed to banks and fintechs that keep the front end while Kraken handles execution. Its first launch, with bunq, did not include Malta, so confirm availability with Kraken and the legal position with your advisers.
