CASP (crypto-asset service provider)

"CASP" is the term MiCA uses for regulated crypto businesses: exchanges, brokers, custodians and similar firms. The definition is in Article 3(1)(15) of the regulation, and the authorisation rules are in Title V.

How CASP authorisation works

A company applies to the supervisor of its home member state (Article 62). The application covers governance, the fitness of managers and major shareholders, prudential capital, IT security, segregation of client assets, complaints handling and anti-money laundering controls. Once an application is complete, the supervisor has 40 working days to decide (Article 63). The authorisation names the specific services the firm may provide.

After authorisation a CASP must, among other things:

• keep client crypto-assets and funds separate from its own, and place client money with a bank or central bank by the end of the next business day (Article 70);
• publish a firm price or a pricing method when it exchanges crypto for money, and execute orders at the price shown when the order is final (Article 77);
• follow an order execution policy aimed at the best possible result for clients (Article 78);
• apply the EU anti-money laundering rules, including KYC checks.

A CASP authorised in one country can serve clients in others. Its home supervisor sends the list of target countries to their authorities (Article 65), and the firm needs no physical office there.

CASPs and Bulgaria

In Bulgaria the Financial Supervision Commission (КФН) authorises and supervises CASPs under the Markets in Crypto-Assets Act. The transition period for firms that operated under the old National Revenue Agency registration ended on 1 July 2026. From that date only licensed providers, or providers passported from another EU country, may offer crypto-asset services in Bulgaria.

ESMA's interim register, in the version last updated on 9 September 2026, listed four CASPs with Bulgaria as home member state, all authorised by the КФН. Many more firms authorised elsewhere in the EU list Bulgaria among the countries where they may operate.

Example

Before buying EUR 500 of EURC through an app, look the company up in ESMA's register. Check three things: the legal entity matches the one in the app's terms, "exchange of crypto-assets for funds" is among its authorised services, and BG is in its list of countries. If the entry only shows custody or portfolio management, the firm is not authorised to sell you crypto for euros.

Common confusion

• Registration is not a licence. A past entry in the NRA register did not make a firm a CASP.
• A licence covers named services only. A firm authorised for custody is not automatically authorised to run an exchange.
• A CASP licence does not remove market risk. It sets conduct and safeguarding rules. It does not protect you from price falls.
• Using your own wallet is not a CASP service. If you alone hold the keys in a self-custody wallet, no provider has custody of your assets.