By the end of this section you can describe the licence journey as two layers — the harmonised EU application and one authority’s machinery around it — say which clocks are statutory and which are practical, and read a real member state’s full requirement lists without flinching. Malta and Austria are the full case studies — two authorisation cultures under one harmonised application — with Germany, Ireland, France and Italy profiled beside them.
In one screen · section 5 of 9
The whole regime, one map — this section's territory is lit; every section lights its own.
The application is a filed document stack with statutory clocks. The authorisation bench carries the proof: Malta and Austria as full case studies, with Germany, Ireland, France and Italy profiled beside them — full requirement lists, as each authority actually asks.
One application, two layers
What a CASPCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. application contains is EU law, the same in all thirty jurisdictions: the Regulation lists the information, and a technical standard plus a set of forms pin down its content and format. What happens aroundthe application — the meetings, the portals, the sequence of stages, the culture of the review — is each authority’s own. Confusing the two layers is how launch dates die: the statute harmonises the file, not the experience.
The statutory clocks live at the EU layer, and they gate on one word. Receipt is acknowledged within 5 working days; completeness is checked within 25; and the 40-working-day assessment — the number every pitch deck quotes — runs only from a complete application, with the decision notified within 5 more.
Check yourself
Two firms file the same day in two member states. One is licensed months before the other. Has either authority broken the Regulation's clocks?
Walk one application through, end to end
The practice’s application-journey dossier walks a composite applicant from perimeter analysis to the register entry, phase by phase, with the statutory clocks and the failure modes at each step. It pairs with this section: read the journey for the narrative, come back here for one authority’s real machinery.
What follows is real machinery, one member state at a time, as each authority itself published it — live case studies, not templates. The EU layer harmonises what an application contains; each authority runs its own process around it, and the differences between these studies are the lesson.
Malta Financial Services AuthorityMFSA
The staged-dialogue culture: a published charter, a pre-application conversation with real gates, and the people file at the centre.
Malta's process runs as a staged dialogue under a published Service Charter — the authority talks first, gates early, and iterates until the file is right.
1.The Intention Stage
Before any application exists, Malta asks for a Statement of Intent — a high-level presentation of who you are and what you propose — and may call a preliminary meeting. The Authority reviews the intention, may guide a proposal it considers outside its risk appetite or not yet mature, and closes the stage with a no-objection to apply.
⏱ A preliminary-meeting request, where the Authority wants one, is sent within 10 working days of receiving the Intention.
⏱ After the Authority's no-objection, the application must follow within 40 working days — or the Intention may be treated as withdrawn.
The full list — what MFSA asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
Identification and contact details of the prospective applicant.
Formation details — actual, or proposed including the proposed name where the company is not yet formed.
A diagram of the actual or proposed shareholding structure, with percentage holdings of every person up to the ultimate beneficial owners, highlighting qualifying shareholders and any regulated entities in the structure.
Any regulatory history of the applicant and related persons, including group entities and applications filed with other regulators.
Identification and contact details of the applicant's representative, where applicable.
The proposed organisational structure: a diagram, the names of directors and key function holders, reporting lines, and each person's time commitment.
The type of authorisation required and the proposed activities to be undertaken.
An outline of the business model, business strategy, local substance, client types and geographical target markets, location of risks, and outsourcing.
For MiCA applicants specifically: the Statement of Intent is signed by a prospective director or authorised signatory and submitted to the Authority's named mailbox; the MiCA thematic questionnaire follows upon receipt.
Check yourself
Alderhaven's deck for the Intention Stage names the directors but leaves out how many hours each will actually give the firm. Complete?
2.The Pre-Authorisation Stage
The application proper: submitted through the Licence Holder Portal, checked first for completeness — all documents plus the non-refundable fee, or nothing moves — then reviewed for quality in an iterating loop, alongside fitness-and-properness assessments of all relevant parties, until the Authority calls the file complete.
⏱ The completeness step closes within 5 working days of submission.
⏱ Missing documents or fee: 20 working days to revert, or the application may be treated as withdrawn.
⏱ In the quality loop: the applicant answers within 15 working days; the Authority responds, where required, within 20.
The full list — what MFSA asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
The application pack, submitted through the LH Portal, with all communication thereafter through the portal's messaging system.
The full required documentation — the Authority does not proceed until everything listed is in.
The non-refundable application fee, paid in full, under the Markets in Crypto-Assets Act (Fees) Regulations 2024 (L.N. 295 of 2024).
Answers to the quality-review comments: clarifications, additional documents, revised versions — iterated until no matters remain open.
Fitness-and-properness material for all relevant parties (the Personal Questionnaire machinery), with further feedback as the due-diligence process raises matters.
For firms transitioning from Malta's earlier VFAVirtual Financial Asset — the category of Malta's pre-MiCA national framework. VFA licences fed the MiCA transition: grandfathering and a simplified application for firms already licensed. framework: a board resolution confirming the MiCA application and surrender of the VFA licence on grant, plus the thematic-exercise confirmationOne block built on top of the block containing a transaction. More confirmations, more settled. or questionnaire, depending on category.
Check yourself
Viktor budgets the whole Maltese process off the Regulation's 40-working-day assessment clock. What has he missed?
3.The Authorisation Stage
The finalised file goes to the Authority's decision-making body. Where the Authority is minded to grant, it first issues a letter of intent with pre-authorisation requirements — conditions to satisfy before any licence exists — and the decision, when it comes, may still carry conditions or limitations.
⏱ At the EU layer above this stage: 40 working days to assess a complete application, and 5 working days to notify the decision once taken.
The full list — what MFSA asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
Any further clarifications the decision-making body requests.
Satisfaction of the pre-authorisation requirements in the Authority's letter, within the timeframe it states.
Acceptance that a grant may be conditional: limitations on services, client types or involvements are on the table where requirements or fitness criteria are not fully met.
Check yourself
The MFSA's letter of intent arrives with pre-authorisation requirements attached. Rutger reads it as 'we're licensed'. Is he right?
4.The Post-Authorisation Stage
The grant is the beginning, not the end: the firm enters Malta's public Financial Services Register, post-authorisation requirements fall due, and the Authority schedules its first supervisory interaction — the file becomes a supervisory relationship.
⏱ The first supervisory interaction is expected 6 to 12 months after the grant.
The full list — what MFSA asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
Entry in the Financial Services Register — the public record of the authorisation, its services, instruments and client types.
Satisfaction of any post-authorisation requirements, at pre- or post-commencement of business, embedded in the firm's own policies and compliance monitoring.
Immediate reporting of any difficulty implementing those requirements.
A post-authorisation supervisory interaction, expected between 6 and 12 months after grant — earlier and more often where nature, scale and complexity warrant.
Check yourself
Where would a counterparty verify that Alderhaven's Maltese licence is real, and what would they see?
Finanzmarktaufsicht (Austria)FMA (AT)
The mechanised-intake culture: no staged dialogue, a rigidly formatted submission, the suitability burden on the applicant — and a supervisor whose first published fine was for marketing mechanics.
Austria publishes no staged charter; its process speaks through the application form itself — mechanised, prescriptive, and unforgiving of format errors — and through what the FMA has actually done since.
1.The intake — the form is the process
Where Malta opens with a conversation, Austria opens with a machine: access to the submission platform is issued by email before anything is filed, and the form's own instructions carry the discipline — one document per information point, references not prose in the fillable sections, file names following the form's structure.
⏱ The FMA publishes no charter equivalent in the held record; the clocks that govern are the EU layer's — acknowledgement within 5 working days, completeness within 25, assessment within 40 from a complete file.
The full list — what FMA (AT) asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
Request access to the FMA Incoming Platform by email before submission — the door is opened for you, not by you.
Answer each of the form's points I to XVII in a separate PDF, with the fillable sections carrying only references to those documents.
Name every file following the structure of the form.
Where any provision does not apply to you, justify the non-applicability in writing — a blank is not an answer.
Cite the harmonised application acts precisely — and check the numbers yourself: the form's own cover has confused the delegated and implementing acts, and the distinction is genuinely easy to slip on.
Check yourself
Viktor proposes pasting Alderhaven's full AML policy text into the FMA form's fillable fields 'so nothing gets missed'. What has he misread?
2.The assessment — the burden sits with you
The FMA announced its 2025 authorisation focus in its own words the day MiCA fully applied: own fundsThe firm's own capital — the money that absorbs losses before anyone else's. MiCA sets floors and can require more., robust risk management, adequate internal controls, transparent business models, and consistently implemented fit-and-proper checks — with the ICT expectations of DORA announced in the same breath.
⏱ The EU layer's assessment clock — 40 working days from a complete application — with the completeness question governed by the intake discipline above.
The full list — what FMA (AT) asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
Supply the results of your own suitability assessment of each management-body member AND of the body's collective suitability, including the assessment report itself — the FMA receives your completed analysis, where Malta's questionnaire machinery assesses the person directly.
Show sufficient own fundsThe firm's own capital — the money that absorbs losses before anyone else's. MiCA sets floors and can require more., robust risk management and adequate internal control systems — the authority's own announced 2025 focus.
Present the business model transparently — the same announcement names it alongside the prudential items.
Treat the ICT limb as co-equal from day one: the FMA flagged DORA applying in parallel, expecting gapless IT monitoring, regular stress tests and clear contingency plans.
Check yourself
In Malta the authority runs its Personal Questionnaire on each director; what is the Austrian equivalent — and who carries the burden?
3.The decision — and the hinge to the old regime
The grant, when it comes, does double work: alongside authorising the CASPCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union., the FMA declares the firm's pre-MiCA virtual-currency registration extinguished — the national implementing act is the hinge between the two regimes, and the authority's own published notice of its first CASP authorisation shows the mechanism in operation.
⏱ Decision notification: the EU layer's 5 working days from the decision.
The full list — what FMA (AT) asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
Expect the authorisation decision to address your § 32a FM-GwGThe Swiss Anti-Money Laundering Act of 1997 (SR 955.0). Says who must do money-laundering checks and who supervises them. Often written AMLA in English. registration: on grant, the FMA declares it extinguished ('als erloschen') under § 23 of the MiCA-VVG read with Article 143(3) MiCA.
Budget the authority's fees under its own fee ordinanceA rule made by the government or a regulator under a power given by an Act. Binding law, but below the Act. — the Austrian cost layer is published, not negotiated.
Check yourself
A firm holds Austria's pre-MiCA § 32a registration and has just received its CASPCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. authorisation. What happened to the registration — and why does the answer matter to its clients?
4.After the grant — the conduct rules bite first
Austria's record answers what supervision feels like after the licence: the FMA's first published MiCAR penal decision, sixteen months after it authorised the same firm, fined four breaches — three of them marketing-communication mechanics — and the decision is final.
⏱ The 20-working-day white-paper transmission clock of Art 8 — the one this record shows being enforced.
The full list — what FMA (AT) asks at this stage›
Transcribed from the authority's own published documents, cited below the case study — the complete asks, not a summary.
Run the white-paper clock: the crypto-asset white paperThe disclosure document MiCA requires before most crypto-assets are offered to the public or admitted to trading — contents prescribed, liability attached, notified to the regulator. must reach the FMA at latest 20 working days before publication — the first of the four published breaches was exactly this.
Hold every marketing communication to the disclosure mechanics: no dissemination before the white paper is published, the required no-approval statement included, contact details complete — the other three breaches.
Read the record for what it is: a same-day companion notice warns that the first published case establishes no special position ('begründet für sich genommen keine Sonderstellung') for the firm or the breaches.
Check yourself
Rutger reads the Austrian sanction and concludes 'so the serious risk after authorisation is market abuse'. What does the record actually say the first fine was for?
The bench’s next seats: profiles
Substantial profiles from each authority’s own published process pages — grown to full studies as more of their paper is acquired. Same rule as above: every claim from a held, dated capture.
Bundesanstalt für Finanzdienstleistungsaufsicht (Germany)
BaFin
The two-authority culture: a pre-application conversation like Malta's, a paper formality all its own — and the Bundesbank reading your file alongside BaFin.
Profile, from BaFin's own CASP page (its English node is an under-construction stub; the substance lives on the German side). Grown to a full study as further documents are acquired.
Arrange the Erstgespräch — a preliminary meeting — before any formal filing: BaFin asks applicants to book it expressly to settle open questions about the authorisation procedure first.
Prepare against the harmonised layer by name: the RTS on application content, the ITS's standard form from its own annex — and prove DORA compliance inside the application, against BaFin's published documentation checklist.
File to a precise address: the application goes to BaFin's Referat ZK 4 (postal to Bonn, or electronically) — with an electronic copy also to the Deutsche Bundesbank's competence centre for payments and crypto supervision. Two authorities read the German file.
Respect the completeness deadline with no illusions: BaFin checks completeness first, requests missing documents with a deadline set on ESMA's recommended four weeks — and states plainly that it can and will reject an application still incomplete when the deadline passes.
Budget fees by time, not tariff: MiCAR authorisation fees follow the time actually spent under the federal fee ordinance — and are payable even where the application is withdrawn or refused.
Expect a three-register publication on grant: the Bundesanzeiger, BaFin's own company database, and ESMA's register — the German trail is checkable in three places.
The national implementing act is the Kryptomärkteaufsichtsgesetz — the German hinge equivalent to Austria's MiCA-VVG.
Check yourself
Alderhaven's German counsel says 'we file to BaFin and wait'. What two features of the German intake does that sentence miss?
Central Bank of Ireland
CBI
The gated-portal culture: everything through one portal, a presentation before the first meeting, and a Key Facts Document that decides whether a formal application is even invited.
Profile, from the Central Bank's own MiCAR page and authorisation-process overview. Grown to a full study as further documents are acquired.
From 2 April 2026, everything moves through the Central Bank Portal — submissions, status, follow-ups, secure messaging — with a published Systems Submission Guide the Bank 'strongly encourages' applicants to learn before filing.
First contact is an email to the CASP authorisation team with prescribed information; the initial engagement meeting follows — and your presentation must be submitted at least ten working days before it.
The pre-application gate is the Key Facts Document: a standard template at a deliberately prescriptive level of detail (DORA included), assessed against the Bank's authorisation and supervision expectations — and the Bank says outright that the quality of engagement at this stage has a critical impact on the timelines.
Only after the KFD stage clears are you invited to submit the CASP application form — the formal filing is by invitation, not by right of arrival.
Firms not already Irish-registered VASPs complete an additional AML/CFT and financial-sanctions pre-authorisation questionnaire — the AML layer arrives inside the authorisation file.
The EU clocks run with an Irish quirk stated on the face of the page: completeness within 25 working days, refusal-to-review for files still incomplete after the cure period (Art 63(3)) — and during the 40-working-day assessment, one request for additional information may suspend the clock, once, for no more than 20 working days.
Check yourself
Rutger counts Ireland as '25 plus 40 working days, like everywhere'. Which two Irish gates sit before his count even starts — and what can stop the clock inside it?
Autorité des marchés financiers (France)
AMF
The early-door culture: applications taken for pre-examination half a year before MiCA even applied, a simplified lane for the firms France had already licensed — and supervision split by function, not shared over one file.
Profile, from the AMF's own in-depth MiCA page — which is itself dated 29 November 2024 on its face, and reads like it: a lesson in dating your sources travels with it. Grown to a full study as further documents are acquired.
France opened the door early: from 1 July 2024 — six months before MiCA applied — the AMF accepted CASP applications for pre-examination, with the authorisation itself only grantable once the Regulation was in force.
The intake is an email, not a portal: applications go to the AMF's dedicated psan@ mailbox — no submission platform machinery stands between an applicant and the authority.
Firms France had already licensed get a simplified lane: a DASP with 'enhanced' registration or a licence under the PACTE framework files a complete MiCA-compliant application, but information the AMF has already analysed and that is unchanged receives a limited review — no duplication of diligence already done.
Supervision splits by function, not by file: CASPs answer to the AMF, while ART and EMT issuers are authorised by the ACPR, France's prudential authority — the French counterpart to Germany's two-readers-of-one-file is two authorities for two regimes.
The national transition is a phase-out: the PACTE framework of 2019 — ICOs and digital-asset service providers — is being retired as MiCA replaces it, with the AMF running webinars and a continuously updated in-depth page to move its population across.
And read the page's own date before citing it: the captured version, dated 29 November 2024, still points applicants to the DRAFT application RTS in ESMA's final report — the adopted act (CDR 2025/305) arrived later. Even an authority's guidance carries a stage.
Check yourself
A French DASP with a PACTE licence asks whether it must rebuild its whole file for MiCA. What does the AMF's simplified lane actually spare it — and what does it not?
Commissione Nazionale per le Società e la Borsa (Italy)
CONSOB
The certified-mail culture with a statutory duet: Consob authorises with the Bank of Italy's opinion, every filing travels by certified email to a named division with a prescribed subject line — and the authority split is written into the implementing decreeAn individual, binding order made by a Swiss authority to a named party (German: Verfügung). It can be appealed to a court, which can quash it. itself.
Profile, from CONSOB's own MiCAR section, CASP page and English-language operational guidance. Grown to a full study as further documents are acquired.
Italy's implementing decree (D.Lgs. 129/2024) writes the supervision split into national law: for CASPs, Consob supervises conduct, transparency and client protection while the Bank of Italy supervises prudential soundness — two authorities over the same firm, by statute. EMT issuers answer to the Bank of Italy alone; Title II offers to Consob alone; ARTs to both.
The CASP authorisation runs to Consob, which takes its decisions with the Bank of Italy's opinion ('con il parere della Banca d'Italia') — already-supervised entities such as banks and SIMs use a notification to whichever authority licensed them instead.
Italy invites the conversation first: under Consob communication 1/24 (12 September 2024), applicants are expressly invited to open informal preliminary discussions — for CASPs, at a dedicated mailbox — before filing anything.
The filing itself is certified email, addressed like a court document: CASP applications to Consob's PEC address, white-paper filings to the Issuers Supervisory Division, suspicious-transaction reports to the Market Monitoring Division — each with the prescribed subject-line prefix, down to 'MiCAR STOR'.
The application machinery is published and dated: an application form (updated 27 October 2025), a compilation guide, and the slides of Consob's own implementation workshop on CASP authorisation.
ART white-paper approvals go to the Bank of Italy, not Consob — the duet divides the paperwork as well as the supervision.
The transitional regime ran through Italy's pre-MiCA register: operators in the special section of the OAM register carried transitional rights and transparency duties under Article 45 of the decree.
Check yourself
Alderhaven's Italian counsel says 'in Italy you deal with Consob, full stop'. What does the decreeAn individual, binding order made by a Swiss authority to a named party (German: Verfügung). It can be appealed to a court, which can quash it. actually provide — and where would a stablecoinA token designed to track a currency, run by an issuer who can typically freeze balances — e.g. USDT or USDC.white paperThe disclosure document MiCA requires before most crypto-assets are offered to the public or admitted to trading — contents prescribed, liability attached, notified to the regulator. go?
The bench grows: Lithuania joins as its authority’s process documents are acquired, verified and logged — profiles first, full studies as the paper allows. No jurisdiction appears here before its documents are held.
Speed against completeness
So what— So what — build the application backwards from the completeness test: draft every document the lists above name before anyone books a filing date, and let the one clock you control — the quality of the first submission — be the one you spend money on. The register entry at the end is the subject of the sibling programme on licensing and registers.
Regulation (EU) 2023/1114 (MiCA) · applicable — this binds · verified 2026-08-26 · Read the text ↗
Commission Delegated Regulation (EU) 2025/305 · applicable — this binds · verified 2026-08-26 · Read the text ↗
Commission Implementing Regulation (EU) 2025/306 · applicable — this binds · verified 2026-08-26 · Read the text ↗
MFSA Service Charter: the authorisation process · issued guidelines — comply-or-explain, binding authorities rather than firms · verified 2026-08-26 · Read the text ↗
MFSA Circular: the authorisation process for MiCA applicants · issued guidelines — comply-or-explain, binding authorities rather than firms · verified 2026-08-26 · Read the text ↗
MFSA Crypto-Assets Rulebook (the MiCA Rulebook), version 3.00 · issued guidelines — comply-or-explain, binding authorities rather than firms · verified 2026-08-26 · Read the text ↗
As at — instrument lifecycle stages verified 2026-08-26 to 2026-08-27, per instrument (each citation above shows its own date); register figures are from the dated snapshots of 24 August 2026. The statutory clocks re-read in the held Regulation text; Malta's stages, lists and working-day numbers transcribed from the held MFSA Service Charter and circulars.