Selecting the right EU jurisdiction for a MiCA CASP licence is one of the most consequential decisions a crypto-asset business can make in 2026. Each competent authority – France's AMF, Luxembourg's CSSF, Malta's MFSA and Ireland's CBI – operates under the same Regulation but applies distinct supervisory priorities, resourcing constraints and practical timelines that materially affect how quickly and on what terms a licence is granted. With the MiCA transitional period having ended on 1 July 2026 and ESMA confirming no extensions, the window for orderly planning has narrowed sharply.
Why Jurisdiction Choice Still Matters Under a Single Regulation
MiCA is a directly applicable EU Regulation: its definitions, capital requirements, conduct-of-business rules and passporting mechanics are uniform across all Member States. A CASP authorisation granted in Luxembourg is, in principle, as valid for cross-border EU services as one granted in France. Yet the legal infrastructure around MiCA – supervisory culture, processing speed, staffing, language of engagement and the depth of published guidance – differs enormously between competent authorities.
There are also areas where MiCA expressly delegates to national law or national supervisory discretion. AML/CFT supervision, for instance, remains a national competence; the extent to which a competent authority integrates its MiCA review with its anti-money laundering assessment of beneficial owner structures varies. These gaps mean that choosing a jurisdiction is choosing a supervisory relationship, not merely a regulatory label.
Since ESMA's statement of 23 June 2026, unauthorised CASPs serving EU clients are required to stop onboarding new users and halt marketing, limit remaining activity to helping clients sell or transfer assets or close positions, and wind down in an orderly manner. For any business still outside the authorised perimeter, the urgency of selecting and pursuing a jurisdiction is acute.
The Regulatory Landscape as of Mid-2026
By 12 August 2026, the ESMA public register recorded 325 authorised CASPs across the EU. That figure – up from approximately 210 full authorisations noted in May 2026 – reflects an acceleration in national processing as the 1 July 2026 deadline approached. The concentration of those authorisations across jurisdictions is uneven: some competent authorities have processed dozens of applications; others remain at single digits or have not yet published meaningful application statistics.
ESMA's statement of 17 April 2026 made explicit that the transitional grandfathering period would not be extended, removing any residual ambiguity about the timeline. For firms that relied on Member State transitional provisions to continue operating while their applications were pending, the end of that period was a hard stop, not a soft deadline.
If you are evaluating whether your current position is compliant or whether a jurisdiction pivot remains possible, our team is available to discuss your circumstances in detail. Please reach out at info@ferrazwhitmore.com or visit our contacts page.
France: AMF as a MiCA Pioneer with Established Market Practice
France moved early. The AMF operated a voluntary PSAN (Prestataires de Services sur Actifs Numériques) regime under national law before MiCA applied, which meant it had already processed a substantial number of crypto-asset business files. That operational experience – familiarity with business models, internal expertise on technology risk, established AML/CFT liaison channels – translates into a competent authority that understands crypto natively rather than treating it as an exotic annex to securities regulation.
The practical advantages for applicants include:
- Deep institutional knowledge. AMF staff have reviewed wallet custody, exchange and staking models under the pre-MiCA framework. Application reviewers are unlikely to be encountering crypto-asset business plans for the first time.
- Published interpretive positions. The AMF has issued guidance on matters including the classification of crypto assets and the treatment of DeFi-adjacent structures, reducing interpretive uncertainty for applicants.
- Paris as a financial hub. Correspondent banking relationships, qualified staff and institutional investor counterparties are accessible, which matters for operational credibility assessments embedded in the MiCA review.
The considerations on the other side are equally real. The AMF has a well-resourced enforcement culture. Firms that pass through authorisation should expect ongoing supervisory engagement proportionate to their risk profile. For smaller or operationally simple CASPs, AMF scrutiny may be calibrated to a standard that reflects Paris's ambitions as a global crypto-asset hub rather than to the complexity of the applicant's own model. The language of regulatory engagement is primarily French, which creates a practical barrier for management teams without French-language capacity.
Luxembourg: CSSF, Substance and the Gateway to Institutional Capital
Luxembourg's CSSF is among the most experienced securities regulators in Europe, with decades of practice supervising fund management companies, payment institutions and investment firms. Its approach to MiCA applications reflects that background: emphasis on governance documentation, substance of management, independence of compliance and risk functions, and the operational resilience of IT infrastructure.
For crypto-asset businesses whose investor or client base skews institutional – family offices, alternative investment funds, regulated financial institutions – Luxembourg offers structural advantages. The Grand Duchy's position as the leading EU fund domicile means that the legal, banking, audit and compliance ecosystem surrounding a Luxembourg CASP is dense and specialised. Passporting a Luxembourg CASP licence into other Member States benefits from the reputational weight that Luxembourg authorisations carry with institutional counterparties and correspondent banks.
Substance requirements deserve particular attention. The CSSF has consistently required that authorised entities demonstrate genuine operational presence rather than a brass-plate structure. Minimum staffing, local senior management, board composition and the location of key decision-making are examined critically. A CASP applicant that cannot demonstrate credible Luxembourg substance – or a realistic roadmap to it – is unlikely to succeed regardless of the quality of its policy documentation.
AML/CFT compliance is reviewed with attention proportionate to Luxembourg's position as an international financial centre. Structures involving complex beneficial owner chains, jurisdictions with elevated financial crime risk, or novel custody arrangements will be subject to detailed scrutiny. Firms with straightforward ownership and robust existing compliance frameworks are better positioned to navigate this efficiently.
Malta: First-Mover Legacy and the Transition From National to MiCA Framework
Malta's MFSA introduced the Virtual Financial Assets Act in 2018, positioning the island as an early European domicile for crypto businesses. That first-mover reputation attracted a large number of registrations during the pre-MiCA period. The MiCA transition, however, has required those firms – and any new applicants – to migrate from the national VFA framework to the MiCA authorisation standard, which is a more demanding exercise than a straightforward renewal.
The strategic considerations for Malta in 2026 include:
- Established crypto ecosystem. Malta retains a community of compliance professionals, legal advisers and technology suppliers with direct VFA and early-MiCA experience. Operational setup costs can be lower than in larger financial centres.
- MFSA's learning curve. The regulator has had to manage a large volume of transitional applications simultaneously. Processing timelines during the peak transition period have been variable, and the MFSA has invested in supplementing its supervisory capacity accordingly.
- Reputational signals in the market. Some institutional counterparties apply enhanced due diligence to Malta-domiciled entities as a default posture, reflecting perceptions shaped by the pre-MiCA era. Applicants should factor this into their correspondent banking strategy.
- Scale economics. For mid-market CASPs focused on retail or semi-professional clients across the EU, Malta's cost base and existing infrastructure can make it a sensible choice provided the substance and compliance standards are met.
It is worth noting that the end of the transitional period affected Malta-domiciled firms operating under VFA registrations as much as it affected businesses in any other jurisdiction. ESMA's June 2026 statement applied uniformly: entities without a MiCA authorisation were required to cease onboarding and marketing. For further context on how the transitional deadline operated in comparable small-state contexts, our alert on the end of the MiCA transition in Cyprus illustrates the practical consequences.
Ireland: CBI and the Anglophone Advantage
Ireland's Central Bank of Ireland has become a significant European financial regulatory authority, in large part because the English-language environment and common-law legal culture made it a natural landing point for US and UK financial services groups seeking EU market access after Brexit. For many international crypto-asset businesses – particularly those whose legal and compliance infrastructure was built around English-language regulatory practice – this familiarity matters.
The CBI's approach to MiCA applications reflects its existing supervisory standards for payment institutions, e-money firms and investment intermediaries. Governance expectations are high: the CBI applies its Fitness and Probity regime to key function holders, and applicants should expect granular scrutiny of proposed directors, heads of compliance and money laundering reporting officers. Demonstrating that control functions are genuinely senior and independent is a prerequisite, not a box-ticking exercise.
Ireland offers operational depth. Access to qualified English-speaking legal, audit and compliance professionals is good, and correspondent banking relationships for regulated financial institutions based in Dublin are generally accessible. For firms that intend to grow their EU operations organically and may seek additional regulatory permissions over time – e-money, payment services, fund administration – Ireland offers a single-regulator relationship that can accommodate that expansion.
The CBI has been deliberate rather than fast in processing complex financial services applications historically. Applicants should engage early, provide comprehensive initial submissions and plan for an iterative review process. Incomplete applications are typically returned rather than reviewed on a best-efforts basis.
Comparative Overview: Key Dimensions for Decision-Making
| Dimension | France (AMF) | Luxembourg (CSSF) | Malta (MFSA) | Ireland (CBI) |
|---|---|---|---|---|
| Crypto-specific experience | High (PSAN legacy) | Moderate (securities background) | High (VFA legacy) | Developing (MiCA-era build-up) |
| Institutional market access | Strong | Very strong (fund ecosystem) | Moderate | Strong (post-Brexit hub) |
| Language of engagement | Primarily French | French / English / German | English | English |
| Substance expectations | Meaningful | High | Moderate | High |
| AML/CFT integration in review | High | Very high | High | High |
| Cost and operational overhead | High | High | Moderate | High |
Cross-Border Passporting: What the CASP Passport Actually Delivers
A MiCA CASP authorisation from any of the four jurisdictions above enables the holder to passport crypto-asset services into other EU Member States by notification rather than full re-authorisation. This is one of MiCA's most commercially significant features and a key reason why EU domicile matters for businesses with pan-European client bases.
The passporting mechanism, however, operates within ESMA's co-ordination framework and is subject to the home competent authority's ongoing supervisory oversight. A firm licensed in Ireland that is predominantly serving French retail clients, for example, may attract attention from the AMF in its capacity as host authority. The quality and responsiveness of the home authority relationship therefore affects the operational reality of cross-border activity, not merely the initial authorisation.
ESMA maintains the public register of authorised CASPs, which recorded 325 entities as of 12 August 2026. Clients and institutional counterparties are increasingly using that register as a due diligence tool, which means that the visibility of a firm's authorisation – and the jurisdiction from which it was granted – has commercial as well as regulatory significance.
For businesses whose EU client base spans multiple jurisdictions and whose services include custody, exchange or transfer of crypto assets, we would welcome the opportunity to map the passporting mechanics against your specific service model. Contact us at info@ferrazwhitmore.com or visit our contacts page.
AML/CFT Considerations Across All Four Jurisdictions
MiCA does not displace the EU's AML/CFT framework, and all four competent authorities conduct their MiCA reviews against a backdrop of AML/CFT compliance expectations that are set by EU directives, national legislation and, increasingly, the emerging standards of the new EU Anti-Money Laundering Authority. The treatment of beneficial owner disclosure, politically exposed persons in ownership structures, and the adequacy of transaction monitoring systems is not uniform in depth of scrutiny even where the legal standard is formally identical.
For crypto-asset service providers, the Travel Rule – requiring originator and beneficiary information to accompany transfers – is a live operational requirement that competent authorities assess during the authorisation process. Firms that cannot demonstrate a credible Travel Rule compliance framework face questions that can delay or derail their application. The same applies to customer due diligence procedures, particularly for custody arrangements where the ultimate beneficial owner of assets held on-platform requires identification and monitoring.
Our AML/CFT compliance advisory practice works alongside MiCA licensing engagements to ensure that the compliance architecture presented to a competent authority is operationally coherent. For a parallel perspective on AML compliance structuring in an EU financial centre context, our AML compliance practice page for the Netherlands illustrates the cross-jurisdictional considerations involved.
Portugal as an Alternative Consideration
This analysis has focused on France, Luxembourg, Malta and Ireland, but a comprehensive jurisdiction assessment should also evaluate Portugal. Banco de Portugal is the competent authority for MiCA in Portugal, and it operates in a jurisdiction that combines a growing financial services regulatory infrastructure with a comparatively accessible cost environment. For businesses with existing operational ties to Portugal – through staff, technology partners or investor relationships – a Portuguese CASP authorisation may offer practical advantages that the four primary options do not.
Our MiCA licensing practice in Portugal is detailed on our dedicated Portugal MiCA licensing service page, which covers the Banco de Portugal process, documentation requirements and typical engagement timelines.
Strategic Recommendations and Open Questions
No single jurisdiction is objectively superior for all applicants. The appropriate choice depends on the interaction of several factors: the firm's ownership structure and beneficial owner profile, the crypto-asset services to be authorised, the target client base and geographic distribution, existing operational footprint, management team experience and language capacity, and the firm's longer-term regulatory ambitions within the EU financial services perimeter.
Several open questions continue to affect jurisdiction strategy in the second half of 2026:
- Supervisory convergence. ESMA has signalled its intention to promote consistent MiCA supervision across Member States. The pace and depth of that convergence will affect whether jurisdictional differences narrow materially in the medium term.
- National AML/CFT authority alignment. The establishment of the EU Anti-Money Laundering Authority and its eventual direct supervisory role over certain obliged entities introduces a further layer of regulatory interaction that competent authorities are still calibrating.
- Passporting friction in practice. As the ESMA register grows and host authority oversight of passporting CASPs develops, the practical experience of cross-border service delivery under MiCA will become clearer. Early-market experience suggests that some host authorities are more proactive than others in asserting their oversight rights.
- Market structure effects. The concentration of CASP authorisations in certain jurisdictions – a pattern visible in the distribution of the 325 registered entities as of August 2026 – may generate supervisory capacity pressures that affect processing times and engagement quality in those jurisdictions.
For businesses navigating these questions with time pressure, the most important immediate step is to confirm the jurisdiction of intended application, begin pre-application engagement with the relevant competent authority where that is possible, and ensure that the internal compliance framework is structured consistently with the supervisory expectations of that authority. Leaving the jurisdiction decision unresolved while building out compliance documentation is a significant operational risk given the current regulatory environment.
If you would like to discuss the strategic and legal considerations relevant to your specific situation, including jurisdiction selection, application preparation or ongoing compliance structuring, please contact our team at info@ferrazwhitmore.com or use our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.