Five websites, among them cdzg36.it, went onto ESMA's interim MiCA register of entities that provide crypto asset services in breach of MiCA, each with a decision of Italy's Consob dated 14 October 2026.
A firm on that list has no MiCA status to point to, and no transition covers it either: Article 143(3) of MiCA let firms that served clients under national law before 30 December 2024 go on until 1 July 2026 at the latest, or until their application was decided.
What is a CASP, and which ten services make a firm one?
CASP means crypto asset service provider, and the Markets in Crypto Assets Regulation (MiCA) defines one in Article 3(1)(15) as "a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59". Article 59 opens two routes: authorization as a CASP under Article 63, or a notification by a bank, investment firm, electronic money institution or other listed entity under Article 60.
Article 3(1)(16) lists the ten services offered by CASPs, and the register records each entry's services by their letters:
- (a) Custody and administration for clients: lifts the capital class to 2.
- (b) A trading platform: class 3 only.
- (c) Exchange for funds and (d) exchange for other crypto assets: class 2.
- (e) Execution of orders, (f) placing, (g) reception and transmission of orders, (i) portfolio management and (j) transfer services: class 1.
- (h) Advice: class 1, and the one service the EU AML Directive leaves out of its CASP definition.
Who authorizes a CASP, and what does the authorization cover?
The authority of the member state where the firm has its registered office grants the authorization, and the register names that authority beside each entry: BaFin in Germany, the AMF in France, the CNMV in Spain, Banco de Portugal in Portugal. Under Article 63 it checks that an application is complete within 25 working days and decides within 40 working days of a complete file. Article 60 entities only notify. They do so at least 40 working days before their first service.
Article 59(6) requires each authorization to "specify the crypto-asset services" the CASP may provide. Article 59(7) lets those services run throughout the Union, Article 65 asks for a notice of the member states and services before business crosses a border, and a new service needs an extension under Article 59(8).
The second register file, of entities that provide crypto asset services in violation of Article 59 or 61 (MiCA Article 110), held 178 entries on 22 October 2026. Consob had filed 169 of them. ESMA's peer review of a CASP authorization in Malta (10 July 2025) calls the authorization process "the gatekeeper".
Because the authorization names services, a firm onboarding a CASP records which letters its entry holds. The 22 October 2026 file lists 384 entities from 27 EU and EEA countries, with Germany (114) and France (36) in front, and 22 of them list (b), operating a trading platform.
What are the key requirements and AML and KYC obligations for a CASP?
Table 1. The rules a CASP works under (as of October 2026).
| Rule | What it requires | Threshold or class | Applies from |
|---|---|---|---|
| MiCA Articles 59 and 63 | An authorization that names the services; a decision within 40 working days of a complete application | Services (a) to (j) | 30 December 2024; transition to 1 July 2026 at the latest |
| MiCA Article 60 | A notification by banks, investment firms, electronic money institutions and other listed entities | 40 working days before the first service | 30 December 2024 |
| MiCA Article 65 | A notice to the home authority of the member states and services for cross border business | None | 30 December 2024 |
| MiCA Article 67 and Annex IV | Prudential safeguards: the class minimum or a quarter of last year's fixed overheads, whichever is higher | EUR 50,000, 125,000 or 150,000 | 30 December 2024 |
| Regulation (EU) 2023/1113, Articles 14 and 16 | Originator and beneficiary data with every transfer; for a self hosted address, a check that the client owns or controls it | No minimum for the data; above EUR 1,000 for the ownership check | 30 December 2024 |
| Directive (EU) 2015/849, Articles 3(2)(g) and 3(19) | A CASP is an obliged entity: customer due diligence, monitoring, suspicious transaction reports | Advice (h) excluded | 30 December 2024 |
| EBA/GL/2024/01, Guideline 21 | Risk factors for CASPs: anonymity features such as mixers, self hosted addresses, decentralized platforms, crypto ATMs | None | 30 December 2024, until AMLA's own instruments on the subject enter into force |
| Regulation (EU) 2024/1624, Article 2(1)(6)(i) | A CASP is a financial institution under the AML Regulation | Advice (h) excluded | 10 July 2027 |
| Regulation (EU) 2024/1620, Articles 12 and 13 | Direct supervision by AMLA of high risk institutions active in several member states | At least six member states | First selection starts by 1 July 2027 |
Since 30 December 2024 a CASP has been an obliged entity under the AML Directive. It runs customer due diligence (CDD) and know your customer (KYC) checks at onboarding, ongoing monitoring of each relationship with transaction monitoring inside it, and suspicious transaction reports (STRs) to the national financial intelligence unit.
The travel rule data goes with every transfer, at any amount. A common misreading takes EUR 1,000 as an EU floor; that amount triggers only the check that a self hosted address is owned or controlled by the client (Articles 14(5) and 16(2)). From 10 July 2027 the AML Regulation applies directly.
Sanctions screening of clients and transfers, and PEP checks on clients, run beside these duties. complead, formerly Sanction Scanner, builds its AML checks for crypto firms on one entity that joins a wallet address and the identity behind it, screened again each time the wallet transacts.
Which CASP dates fell in 2026?
- 1 July. The longest transition Article 143(3) allowed ended; a firm with neither a CASP authorization nor an Article 60 notification may no longer provide crypto asset services in the EU.
- 14 October. Consob decisions put five more websites on ESMA's list of entities in violation of Article 59 or 61.
- 22 October. ESMA's register file counted 384 entities, the count used on this page.
How is a CASP different from a VASP?
Picture an exchange based in Singapore (illustrative) that swaps crypto for dollars for its customers. Under the Recommendations of the Financial Action Task Force (FATF) it is a virtual asset service provider (VASP) wherever it trades: the FATF Glossary defines a VASP by activity, as a person "not covered elsewhere under the Recommendations" that exchanges, transfers or safekeeps virtual assets for others, or offers financial services around an issuance, as a business.
CASP status needs an EU authority. Article 59(2) then asks for a registered office in a member state and effective management in the Union. Without that status it may serve an EU client only when the client approaches it at the client's own exclusive initiative (Article 61).
FATF defines virtual asset service providers by what they do, and MiCA defines crypto asset service providers by the status they hold: every CASP does VASP work, and a VASP is a CASP only once it holds MiCA status.
Onboarding a CASP therefore turns on one check a firm faces at every review: whether the service letters on the register entry, plus any Article 59(8) extension, cover what the business actually does.
Related terms
- Travel rule. The duty to send originator and beneficiary data with a transfer.
- Customer due diligence. Identifying and verifying a customer, its owners and the purpose of the relationship.
- Ongoing monitoring. Reviewing a relationship and its transactions after onboarding.
- VASP. FATF's term for a business that exchanges, transfers or safekeeps virtual assets for others.
- MiCA. The EU regulation that sets authorization and conduct rules for crypto asset services.
How this entry was checked. Barbaros Sercan (Customer Success Specialist, complead) and Ufuk Gürdaş, Compliance Specialist, took every article number on this page from the Official Journal text of Regulation (EU) 2023/1114 (Articles 3, 59, 60, 61, 63, 65, 67, 110, 143 and Annex IV), together with Regulation (EU) 2023/1113, Directive (EU) 2015/849 in its 30 December 2024 consolidation, EBA/GL/2024/01, Regulations (EU) 2024/1624 and 2024/1620, ESMA's Malta peer review of 10 July 2025 and the FATF Glossary (June 2026). Both of ESMA's register files of 22 October 2026 were counted again; the Singapore exchange is illustrative and the definition is Article 3(1)(15). Last reviewed: 30 October 2026.
