From VASP registration to CASP authorisation under MiCA

The short answer

A VASP registration was a national status, granted in most Member States under the statute implementing the anti-money-laundering directives, and it said that a firm had been enrolled and checked. A CASP authorisation is granted under Regulation (EU) 2023/1114 and says that a competent authority has assessed the firm against capital, governance, conduct, client-asset and operational requirements and permitted it to provide particular named services. Every national transitional period has now closed. The old status is not a route to anything.

The word survives because the regimes overlapped for eighteen months and because search engines kept the old term alive. If you are looking at Lithuania specifically, the four names people use for this permission are sorted out on the Lithuania page. This page is about the regime change itself, across the Union.

What actually changed

Two of those rows do more work than the rest. The capital line is where most former registrants find the real number, because Article 67 does not stop at the Annex IV floor: it asks for the higher of the floor and a quarter of your fixed overheads, recalculated every year. Work out which limb binds you. The cross-border line is where the regime gives something back, because an authorisation obtained once is notified into the other Member States rather than applied for again.

When each national regime closed

Article 143(3) let each Member State run its existing providers on for a period of its own choosing, up to eighteen months from 30 December 2024, and they chose very differently. The spread is the single most useful thing to understand about how uneven this transition was: a firm in the Netherlands had six months to convert, one in Malta or Cyprus had three times that.

What the European register will not tell you

The obvious way to check how the transition went is to count the register. It is also the quickest way to publish a wrong number, and a good deal of the commentary on this subject has done exactly that.

So the register is two registers wearing one name. Where the national authority fills in the legal basis you can tell an authorised firm from a licensed institution that has notified an additional activity. Where it does not, every row looks the same, and nineteen authorities leave it empty for everything they report, Lithuania among them.

That ratio is worth sitting with. On the part of the register where the basis is stated, most entries are not firms that went through an authorisation at all. They are banks and e-money institutions adding a crypto-asset service to a licence they already held, which Article 60 allows by notification. Germany is the extreme case and it is not close: 109 notifications against eight authorisations. Anyone describing Germany as Europe's largest CASP market is counting savings banks.

The practical reading for an applicant is narrow. If you already hold a banking, e-money, payment or investment-firm licence, find out whether Article 60 reaches what you intend to do before you budget for an authorisation. If you do not hold one, Article 60 is not available to you and the comparison set is smaller than the register makes it look. How that plays out in Lithuania.

Does this reach your business?

The test is not whether you call yourself a crypto company. It is whether you provide one of the services MiCA names, to clients, in the Union. Each one of them brings you inside the regime on its own, and a firm that thought it was running a wallet often finds it is also executing orders or transferring assets for clients. Pick the services and see the class.

Some cases come up often enough to name. A firm whose only activity is issuing its own token is in a different Title of the regulation and is not answering this question at all. A firm holding an e-money or payment licence may be able to notify rather than apply, which is the Article 60 route above. The one that causes the most argument is the software case: a firm that writes tools other people use to transact is usually outside the perimeter, and the line is control. If client assets or client orders pass through your hands, you are inside, and how the contract describes you does not change that.

What a former registrant does now

There is no conversion. Nothing in the regulation turns a national registration into an authorisation, and the simplified procedures some Member States offered their own registrants still ended in an application and a decision. If you were registered and did not apply before your national period closed, you are an applicant like any other, and the first task is not drafting.

It is scoping. The service set you name fixes your class, your capital floor and roughly half your documents, and naming it wrongly at the start is the error that costs the most to unwind later. After that comes the honest version of the capital calculation, then governance and the people who have to be real, and only then the file itself. How an authorisation project runs, and the Lithuanian route in detail.

One thing not to do is treat the closed regime as a credential. A former registration is a fact about your operating history and it may help you evidence that history, but it carries no weight as a permission and no authority treats it as a partial answer to an application.

What this page could not verify

Questions

What is the difference between a VASP and a CASP?

A virtual asset service provider, or VASP, held a registration under a national regime that in most Member States existed to apply anti-money-laundering rules. A crypto-asset service provider, or CASP, holds an authorisation under Regulation (EU) 2023/1114 (MiCA) to provide named crypto-asset services, and that authorisation carries prudential, governance, conduct and client-asset obligations the older registrations generally did not impose.

Is a VASP registration still valid in the European Union?

No. Every Member State transitional period permitted by Article 143(3) of Regulation (EU) 2023/1114 has now closed, the longest of them on 1 July 2026. A firm providing crypto-asset services in the European Union does so under a MiCA authorisation or, where it already holds a banking, e-money, payment or investment-firm licence, under an Article 60 notification.

Does a VASP registration convert into a CASP authorisation automatically?

No. Nothing in Regulation (EU) 2023/1114 converts a national registration into an authorisation. Some Member States offered a simplified procedure for firms already registered with them, but each one still required an application and a decision by the competent authority.

What replaced the VASP licence in Lithuania?

Authorisation as a crypto-asset service provider granted by the Bank of Lithuania under Regulation (EU) 2023/1114. The former Lithuanian registration regime for virtual currency exchange operators and depository virtual currency wallet operators closed on 31 December 2025, and four firms held a Lithuanian authorisation under Article 63 as at 23 October 2026.

Does a CASP authorisation work across the whole European Union?

Yes. Under Article 65 of Regulation (EU) 2023/1114 an authorised crypto-asset service provider notifies its home competent authority of the Member States it intends to serve, and the home authority communicates that to the host authorities within ten working days. A separate authorisation in each country is not required, which is the clearest practical break from the national registration regimes MiCA replaced.

How many crypto-asset service providers are authorised in the European Union?

The ESMA crypto-asset service provider register held 387 rows covering 384 entities when it was read on 23 October 2026, but that figure is not a count of authorisations. Only 207 of those rows state a legal basis, and among them notifications under Article 60 outnumber authorisations under Article 63 by 131 to 76. Any single headline number taken from the register without that split is unreliable.