Crypto licensing in the Czech Republic

What a CASP authorisation is?

MiCA is the EU framework for crypto-asset markets. Under it, any firm providing crypto-asset services needs authorisation as a Crypto-Asset Service Provider — a CASP. The authorisation is granted by the Czech National Bank and passports across the European Union, so a Czech licence lets you serve clients in every member state without applying again in each one.

This is a supervisory regime, not a registration. The regulator examines your governance, your people, your capital, your custody arrangements, your AML framework and your operational resilience before granting anything, and supervises them afterwards.

Which services you need permission for

MiCA sets out ten crypto-asset services, and authorisation is granted service by service. Most businesses need several. The main ones:

– Custody and administration of crypto-assets for clients
– Operation of a trading platform
– Exchange of crypto-assets for funds, or for other crypto-assets
– Execution of orders, placing, and reception and transmission of orders
– Transfer services

Which combination you apply for determines everything downstream — your capital requirement, the weight of your file, and how long the process takes. It is the first thing to settle.

Capital requirements

CASP authorisations fall into three classes by initial capital, set according to the risk of the services provided. The entry class, at EUR 50,000, covers advice, reception and transmission, execution, placing and transfers. Custody and exchange sit above it, and operating a trading platform above that.

If you are issuing a token

Token issuance follows a different track from service provision. E-money tokens may only be issued by a bank or an authorised electronic money institution — a CASP authorisation does not confer that right. Asset-backed tokens have their own regime. Other crypto-assets are subject to a white paper obligation. And anything that qualifies as a financial instrument falls outside MiCA entirely, under MiFID.

Classification is worth settling before you build, not after.

DORA

Authorised firms are also subject to DORA, the EU regulation on digital operational resilience: documented ICT risk management, incident classification and reporting, resilience testing, and contractual control over technology providers. This forms part of the application file rather than a later compliance exercise, and it is the requirement most often underestimated.

What determines your timeline

The regulator’s review runs to statutory deadlines, but the clock stops each time further information is requested. In practice the completeness of the initial submission matters more than anything else — a well-prepared file moves; an incomplete one circulates.

Preparation is therefore the stage worth investing in. Firms with an operating history and existing documentation move faster than those starting from a blank page.

How we work

We handle the full process: jurisdiction analysis and legal structuring, the regulatory file, AML and compliance documentation, DORA arrangements, and correspondence with the ČNB.

We will also tell you when the Czech Republic is not the right answer for your model. That conversation is shorter and considerably cheaper before you commit.