Crypto-asset service provider

Article 3(1)(16) of Regulation (EU) 2023/1114 names the services that make a company a crypto-asset service provider, and the ESMA register marks them with the letters a to j. Custody and administration of crypto-assets on behalf of clients (a) is the business of a custodian such as Tangany or BitGo Europe. Operation of a trading platform (b) is the order book of an exchange, while exchange of crypto-assets for funds (c) or for other crypto-assets (d) is the business of a broker that quotes its own price.

Execution of orders (e), placing (f) and reception and transmission of orders (g) are the services of brokers and banks that route client orders, and most German Volksbanken notified order execution for their customers. Advice on crypto-assets (h) and portfolio management (i) are the services of asset managers, and transfer services (j) move crypto-assets between addresses on behalf of clients. The crypto custody answer in the Knowledge Hub explains why custody carries the strictest duties of the ten.

VASP stands for virtual asset service provider, the term of the Financial Action Task Force for the anti-money-laundering rules that countries applied to crypto firms before MiCA. National registers used it: the Netherlands registered VASPs with the central bank, and Germany gave crypto custodians a license under the Banking Act. A VASP registration was an anti-money-laundering status and said nothing about capital, conduct or client protection.

A CASP authorization under MiCA adds exactly those duties, from minimum capital and the segregation of client assets to complaint handling and market abuse rules, and it is valid across the EU. The anti-money-laundering duties stay: a CASP is an obliged entity under the EU Anti-Money Laundering Regulation, and the travel rule of Regulation (EU) 2023/1113 applies to every transfer between providers since 30 December 2024. Firms that held only a VASP registration had to obtain a CASP authorization before the end of the transitional period, at the latest by 1 July 2026.

A crypto-native firm applies for authorization under Article 59 and receives it under Article 63 from the authority of its home state, after a review of its program of operations, governance, controls, IT and client-asset arrangements. Annex IV sets the minimum capital by service class: 50,000 euros for advice, order services, placing and transfers, 125,000 euros for custody or exchange, and 150,000 euros for a trading platform. The register of 22 October 2026 marked 75 entries as such authorizations, among them eight in Germany.

A bank, an investment firm, an e-money institution, a UCITS management company, an alternative investment fund manager or a central securities depository uses the second route: it notifies its supervisor at least 40 working days before the first service under Article 60 and may provide the services that match its existing license, as MiCA Article 60 explains. The register marked 136 entries as notifications, 109 of them in Germany, where DZ BANK, DekaBank, Commerzbank, Deutsche Bank and dozens of Volksbanken notified BaFin. Both routes give the firm the MiCA passport of Article 65 into every other EU and EEA state.

A CASP acts honestly, fairly and professionally in the interest of its clients under Article 66, keeps the prudential safeguards of Article 67, places client funds with a credit institution or a central bank under Article 70 and runs a complaints procedure under Article 71. A custodian keeps the crypto-assets of its clients legally separate from its own under Article 75, so that creditors have no claim on them in an insolvency, and ESMA reminded providers in April 2026 that custody may not be outsourced to a firm without a CASP authorization.

The market abuse rules of Title VI apply to every CASP that operates a trading platform or executes orders, and the Digital Operational Resilience Act treats a CASP as a financial entity with the same ICT risk management and incident reporting as a bank. The full catalog of duties, with the reporting and the fines under Article 111, is set out under MiCA compliance.

Finance Loop hosted the Digital Finance Night in Frankfurt during the Crypto Assets Conference, with a speaker from Tangany, the Munich custodian that BaFin authorized as a CASP under Article 63 in August 2025. At the Bybit EU Crypto Evening at TechQuartier, Mykolas Majauskas of Bybit EU, a CASP authorized by the Austrian FMA, spoke on compliance under MiCAR. The MiCAR certificate program of EBS Executive School and HEUKING, listed among the Finance Loop education offers, covers the duties of a CASP in German.

CASP means crypto-asset service provider, the legal term of the EU Markets in Crypto-Assets Regulation for a company that provides one or more of the ten crypto-asset services to clients on a professional basis. The term covers exchanges, brokers, custodians, wallet providers with custody, advisers and portfolio managers alike, while a software provider that never holds client assets or executes orders is not a CASP.

A VASP is a virtual asset service provider under the anti-money-laundering standards of the Financial Action Task Force, a status that national registers granted before MiCA. A CASP is a provider authorized under MiCA, with capital, conduct, custody and market abuse duties on top of the anti-money-laundering rules, and with a license that is valid across the EU. Since 1 July 2026 a VASP registration alone no longer permits crypto-asset services to EU clients.

The interim register of ESMA held 387 entries on 22 October 2026, of which 385 were active and two had ended. Germany led with 117 entries, followed by France with 36, the Netherlands with 29, Cyprus with 25 and Malta with 23, and 27 of the 30 EU and EEA states had at least one entry. The MiCA register describes the file, and the MiCA CASP list shows every entry.

The eight German firms authorized under Article 63 are Boerse Stuttgart Digital Custody, Bitpanda Asset Management, Crypto Finance (Deutschland), BitGo Europe, Tangany, Bullish Europe, Hauck Aufhäuser Digital Custody and Tradevest Digital Assets. The 109 German notifications under Article 60 come from banks and investment firms such as Trade Republic, DZ BANK, DekaBank, Commerzbank and Deutsche Bank, and MiCA in Germany explains the national rules under the KMAG.

A CASP authorized or notified in one member state needs no second license, because it notifies its home supervisor of the other countries it wants to serve under Article 65, and it may start there 15 calendar days after the complete notification at the latest. The countries column of the ESMA register counts those states, and a value near 30 means the firm uses the passport across the whole EU and EEA market.