# CASP Authorisation in Finland: MiCA Requirements and Application Process 2026-06-05 — Max Atallah Who needs CASP authorisation in Finland, what the application contains and how the MiCA review stages work. MiCA’s framework for crypto-asset service providers has applied since 30 December 2024. In Finland, the transitional period for eligible providers under the former national VASP registration regime ended on 30 June 2025. A previous VASP registration is not a substitute for the authorisation or notification route required under MiCA. This guide explains the main authorisation routes, application requirements and regulatory review stages for businesses considering Finland. The appropriate route depends on the services, assets and entity involved. For help preparing your application, see our [crypto licensing services in Finland](https://www.nordiclaw.fi/en/crypto-license-finland). ## Who needs CASP authorisation? Article 59 distinguishes between businesses applying for CASP authorisation under Article 63 and certain already-regulated financial entities that may provide specified services under Article 60. An existing financial-sector licence does not automatically permit every crypto-asset service: the permitted scope and notification requirements must be assessed. A CASP authorised under Article 63 must have a registered office in a Member State where it performs at least part of its crypto-asset services. Effective management must be in the EU, and at least one director must reside in the EU. ## Which crypto-asset services does MiCA cover? - providing custody and administration of crypto-assets on behalf of clients - the operation of a trading platform for crypto-assets - the exchange of crypto-assets for funds - the exchange of crypto-assets for other crypto-assets - the execution of orders for crypto-assets on behalf of clients - placing of crypto-assets - the reception and transmission of orders for crypto-assets on behalf of clients - providing advice on crypto-assets - providing portfolio management on crypto-assets - providing transfer services for crypto-assets on behalf of clients The first step is to classify the assets and activities. [MiCA does not cover crypto-assets that qualify as financial instruments](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-2-scope), which are subject to a different regulatory framework. The service categories above therefore need to be assessed against the actual business model, not simply whether it uses blockchain technology. ## What must the application contain? Article 62 sets out the application information. It includes the programme of operations, governance and ownership, management suitability, prudential safeguards, risk controls, AML procedures, business continuity, ICT security, client-asset segregation and complaints handling. Additional policies depend on the services requested, such as custody, trading, exchange, execution, advice or transfers. The detailed information requirements are set out in [Delegated Regulation (EU) 2025/305](https://eur-lex.europa.eu/eli/reg_del/2025/305/oj/eng), and the application forms and procedures in [Implementing Regulation (EU) 2025/306](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R0306). These should be read alongside FIN-FSA’s filing instructions. Under Article 62(4), certain information already received under specified earlier authorisation procedures need not be submitted again if it remains up to date. See [MiCA Article 62](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-62-application-authorisation-crypto) for the application requirements. ## Prudential safeguards and application costs For a CASP authorised under Article 63, Article 67 requires prudential safeguards equal to at least the higher of the service-specific minimum in Annex IV and one quarter of the preceding year’s fixed overheads. Providers operating for less than a year use projected fixed overheads for their first 12 months. The safeguards may consist of eligible own funds, qualifying insurance or a comparable guarantee, or a combination, subject to Article 67. Entities using the Article 60 route are exempt from Article 67 under [Article 60(10)](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-60-provision-crypto-asset-services). Prudential safeguards are separate from regulatory fees, legal fees and the operational cost of running the business. Budgeting should distinguish these items. Obtain the current FIN-FSA fee schedule and an engagement-specific fee proposal rather than treating the capital requirement as the total cost of authorisation. See [MiCA Article 67](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-67-prudential-requirements) for prudential requirements. ## How does the application process work? Preparation comes first: define the service scope, identify gaps and assemble the application. The regulatory stages under Article 63 are distinct from that preparation. The authority acknowledges receipt within five working days and checks completeness within 25 working days. Missing information is requested with a deadline; an application that remains incomplete may not be reviewed. The applicant is notified once the application is complete. The substantive assessment and reasoned decision take place within 40 working days of receipt of a complete application. A request for necessary additional information must be made no later than the twentieth working day of that assessment. The assessment period is suspended between the request and the response, for no more than 20 working days; further requests do not create another suspension. The decision is notified within five working days. Cross-border supervisory consultations may also be required in the circumstances specified in Article 63. These statutory stages are not a guaranteed end-to-end completion date. Preparation and responding to completeness requests take additional time, and authorisation is not assured. See [MiCA Article 63](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-63-assessment-application) for the review stages and time limits. ## What happens after authorisation? Authorisation specifies the permitted services, and its conditions must continue to be met. Adding services requires an extension of the authorisation. Before providing services in another Member State, a CASP must follow the [Article 65 notification procedure](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-65-cross-border-provision-crypto) through its home authority. Authorisation therefore provides a route to EU expansion, while ongoing compliance and the cross-border notification remain separate operational responsibilities. ## How does the former VASP regime fit in? VASP registration belongs to the history of Finland’s national framework. The term VASP is also used internationally, so it should not be treated as simply obsolete everywhere. For Finnish market entry, distinguish that historical registration from the applicable MiCA route. Our [earlier VASP guide](https://www.nordiclaw.fi/en/news/how-to-be-a-vasp-in-finland) describes the former Finnish registration regime. [FIN-FSA’s explanation of Finland’s transitional period](https://www.sttinfo.fi/tiedote/71049658/requirements-for-crypto-asset-services-have-tightened-with-the-mica-regulation-consumers-still-need-to-be-careful?lang=en&publisherId=69817444) provides further background. ## Discuss your application If you need advice on your planned services or application readiness, contact our [crypto licensing team in Finland](https://www.nordiclaw.fi/en/crypto-license-finland).