Do you need a CASP authorisation, or can you notify?

The short answer

If you already hold one of six authorisations, Article 60 of Regulation (EU) 2023/1114 lets you provide crypto-asset services by notifying your home competent authority at least 40 working days in advance, instead of applying for authorisation under Article 63. If you hold none of them, there is no notification route and the question does not arise.

Read that list for what is missing from it. A payment institution is not there. The term is defined in MiCA, at Article 3(1)(46), and payment institutions appear elsewhere in the regulation, but Article 60 does not extend to them. A firm holding a payment licence and planning crypto-asset services is on the authorisation route like anyone else, and the proximity of the two regimes in every other respect makes this an easy and expensive thing to assume the other way.

What each of the six may actually provide

The two narrow rows are where the mistakes live. An electronic money institution reads custody and transfers and stops before the qualifier, which is the part that decides the business case.

Only the tokens you issue. Not a client's holding of someone else's stablecoin, not bitcoin, not an exchange service of any kind. An e-money institution that wants to let customers hold or swap assets it did not issue is outside Article 60(4) for that activity and needs an authorisation for it. What that means for a payments product.

An investment firm's position is the opposite kind of limit: generous, but bounded by something it already has. The crypto permissions mirror the MiFID permissions one for one, so a firm authorised to deal on own account gets exchange, a firm authorised to run an MTF or OTF gets trading platform operation, and a firm with neither gets neither. The first question is not what you want to offer but what your existing licence already says.

What the notification route switches off

This is the part worth the most money and the part least often stated.

Article 67 is the prudential requirement, and it is the one that governs every page on this site about capital: the higher of the Annex IV floor and a quarter of annual fixed overheads, recalculated yearly. A notifying entity is outside it. It does not hold €125,000 against a custody permission the way an authorised CASP does, because its own sectoral regime already sets its capital and MiCA does not add a second layer. What the Article 67 calculation does to everyone else.

Articles 83 and 84 go too, which matters if anyone is likely to buy you. The MiCA change-of-control assessment does not apply, although the equivalent regime under your own directive certainly does. And Articles 62 and 63 go, so there is no application file and no 40-working-day assessment of it.

What replaces them is lighter but not nothing. The notification under Article 60(7) still has to carry a programme of operations, the AML control mechanisms and risk framework, a business continuity plan, ICT documentation with a non-technical description, the client-asset segregation procedure, and then whichever service-specific items apply: the custody policy, the operating rules and market-abuse system, the commercial policy and pricing methodology, the execution policy, the competence evidence for advisers and portfolio managers.

So the clock is comparable to the authorisation clock in shape and shorter in substance, and the same trap sits inside it: the suspension applies to the first request for missing information only, and you may not begin providing services while the notification is incomplete. How the authorisation clock compares.

The catch nobody puts in the pitch

A notification has no independent life. Lose the banking, investment firm or e-money licence it sits on and the crypto permission goes with it, in the same moment, without a separate proceeding. An authorised CASP that loses an unrelated permission keeps its CASP authorisation; a notifying entity has nothing left to keep. For a group deciding where to put a crypto business that is a structural question rather than a compliance one, and it argues for a separate authorised entity more often than cost alone would.

The two routes are used by different businesses

Which of these is theoretical and which is real can be read off the register, because national authorities that record a legal basis let you see both populations side by side.

The shapes are not subtle. An Article 60 entity takes one permission, and seven times out of ten that permission is execution of orders: a bank letting customers buy and sell, routing the order, holding nothing. An Article 63 applicant takes four, built on custody, transfers and exchange, which is a crypto business rather than an additional product line on a banking one.

That is useful in both directions. If your intended service set looks like the right-hand column, the notification route will not cover you even if you qualify for it, and you should plan for an authorisation. If it looks like the left-hand column and you hold one of the six licences, you may be about to pay for a project you do not need.

How to settle it

Three questions in order, and the first one is binary. Do you hold a credit institution, CSD, investment firm, e-money, fund management or market operator authorisation today? If no, stop: you are applying under Article 63 and the rest of this page is background.

If yes, the second question is what your paragraph permits, not what you want. For an investment firm that means reading your MiFID permissions against the equivalence list. For an e-money institution it means asking whether every asset involved is a token you issue. Then the third: does the service set you actually need fit inside that, with nothing left over. One service outside the paragraph puts the whole activity on the authorisation route, and a split where the group notifies for part and authorises a separate entity for the rest is a normal answer rather than a failure.

Pick the services first, then come back to this page. Doing it the other way round is how firms end up arguing for a reading of Article 60 that their own permission does not support.

What this page could not verify

Questions

Can a bank provide crypto-asset services without a CASP licence?

Yes. Under Article 60(1) of Regulation (EU) 2023/1114 a credit institution may provide crypto-asset services if it notifies the competent authority of its home Member State at least 40 working days before providing them for the first time. It does not apply for authorisation as a crypto-asset service provider, and Article 60(1) places no service-by-service limit on the institution itself.

Does an e-money institution need a CASP authorisation?

Not for a narrow set of activities. Article 60(4) of Regulation (EU) 2023/1114 lets an electronic money institution notify instead of applying, but only to provide custody and administration of crypto-assets and transfer services, and only in relation to the e-money tokens it issues itself. Any other crypto-asset service, and any service touching assets it did not issue, requires authorisation under Article 63.

Can a payment institution use the Article 60 notification route?

No. Article 60 of Regulation (EU) 2023/1114 lists credit institutions, central securities depositories, investment firms, electronic money institutions, UCITS management companies and alternative investment fund managers, and market operators. A payment institution authorised under Directive (EU) 2015/2366 is not among them, so a payment institution intending to provide crypto-asset services applies for authorisation under Article 63.

Which crypto-asset services can an investment firm provide by notification?

Those equivalent to the investment services and activities it is specifically authorised for under Directive 2014/65/EU. Article 60(3) of Regulation (EU) 2023/1114 sets the equivalences out individually: dealing on own account corresponds to exchange of crypto-assets, operating a multilateral or organised trading facility corresponds to operating a crypto-asset trading platform, and execution, placing, reception and transmission, advice and portfolio management each correspond to their MiFID counterpart.

Does the Article 60 route avoid the MiCA capital requirement?

Yes. Article 60(10) of Regulation (EU) 2023/1114 provides that entities providing crypto-asset services under Article 60 are not subject to Articles 62, 63, 64, 67, 83 and 84. Article 67 is the prudential requirement, so the MiCA own-funds calculation does not apply to them. The capital requirements of the licence they already hold continue to apply.

How long does an Article 60 notification take?

The notification must be made at least 40 working days before the services are first provided. Under Article 60(8) of Regulation (EU) 2023/1114 the competent authority has 20 working days from receipt to assess whether the notification is complete, and a request for missing information sets a deadline of no more than 20 working days and suspends the period. Later requests do not suspend it, and the entity may not begin providing the services while the notification is incomplete.

What happens to the crypto permission if the underlying licence is withdrawn?

It goes with it. Article 60(11) of Regulation (EU) 2023/1114 provides that the right to provide crypto-asset services under Article 60 is revoked upon withdrawal of the authorisation that enabled it. Unlike an authorisation granted under Article 63, the permission has no independent existence.