Crypto-Asset Service Provider (CASP)
The authorization category under the EU’s Markets in Crypto-Assets Regulation for firms providing crypto services — custody, exchange, transfer, trading platforms and advice. A crypto-asset service provider is authorized by one member state’s regulator and can then passport across the EU.
Also called: MiCA CASP
Before MiCA, crypto firms in the EU were caught by a patchwork of national anti-money-laundering registrations that differed in every member state and gave no rights anywhere else. CASP status replaces that. One national competent authority authorizes the firm, and the authorization is then recognized across the bloc through passporting.
Passporting runs by notification rather than a second application. The firm tells its home authority which services it intends to provide and where; the home authority passes that on to the host states’ single points of contact, to ESMA and to the EBA within ten working days; and the firm may begin in the host state from its receipt of that communication, or at the latest on the fifteenth calendar day after submitting the information.
Authorization is granted for named services rather than for crypto generally. A firm approved to run an exchange and hold client assets in custody has not been approved to operate a trading platform or to place crypto-assets, and adding a service means extending the authorization. CASP authorization is also not the only way in: credit institutions, investment firms, electronic money institutions, central securities depositories, market operators, and UCITS and alternative investment fund managers may provide certain crypto-asset services by notifying their regulator instead of applying for one.
The transitional period is over
Firms that had been providing crypto-asset services under national law before 30 December 2024 were allowed to carry on under it for a period, and several member states shortened that period. It expired everywhere on 1 July 2026. ESMA’s position is that any entity providing crypto-asset services to EU clients without a MiCA license is in breach of EU law and must stop offering them, and that third-country firms may not serve or solicit EU clients outside a narrow reverse-solicitation exception — business to business included.
Where the confusion starts
The activities a crypto-asset service provider performs are close to what FATF describes as a virtual asset service provider. The two are not the same kind of thing. VASP is a descriptive category in an international standard, used to decide who a country ought to bring inside its anti-money-laundering rules. CASP is a status a named EU regulator grants to a named firm after an application, with capital, governance and conduct obligations attached.
In practice
CASP is an EU authorization status, not a description of a business model. A firm outside the EU doing exactly what a crypto-asset service provider does is not a CASP, and a FATF-style VASP registration elsewhere is not interchangeable with one, however heavily the activities overlap. The transitional arrangements that let national registrations carry on ended across the EU on 1 July 2026, so as things stand in September 2026 there is nothing left to fall back on.
Example
An exchange authorized as a CASP in Ireland can serve customers in Germany and Spain under the same authorization by notifying the host regulators, with no second application. The same exchange holding a VASP registration in a non-EU country has no EU rights at all — that registration stops at the border of the country that issued it.
Commonly confused with
| Term | How it differs |
|---|---|
| Virtual Asset Service Provider | VASP is FATF’s descriptive category for anti-money-laundering purposes; CASP is an authorization an EU regulator grants, refuses or withdraws. |
| MiCA | MiCA is the regulation; crypto-asset service provider is the authorization status the regulation creates. |
See also
- MiCAMiCA, the Markets in Crypto-Assets Regulation, is the EU law governing the offer of crypto-assets, their admission to trading, and the provision of crypto-asset services, with one set of rules applying directly across every member state. Service providers are authorized once and can then passport through the bloc.
- Virtual Asset Service ProviderA virtual asset service provider, or VASP, is the FATF category for a business that exchanges, transfers, safekeeps or administers virtual assets for other people, or provides financial services around their issuance. It is an international standard-setter’s term, not a license.
- PassportingPassporting is the mechanism by which a firm authorized in one EEA state may provide its services in the other EEA states without seeking separate authorization in each one. The home state regulator continues to supervise the firm throughout.
- Crypto CustodyCrypto custody is holding someone else’s crypto-assets, or the means of access to them, in a way that lets you move them. The test is control in fact — who could move the balance without the customer’s cooperation — not how the service describes itself in its terms.
Go deeper
Regulatory information checked: 22/Sep/2026