How long can you stay on a VASP license?

The EU has launched a comprehensive reform of crypto market regulation. Starting in 2024, all companies providing digital asset services must obtain a CASP license. Legacy VASP licenses are no longer sufficient: in most countries, they are temporarily recognized only under transitional arrangements. However, the duration of these transitional periods depends on national laws, and some jurisdictions have opted to forgo them altogether. Violating the new MiCA requirements can lead to business shutdowns, significant fines, and loss of access to financial services. In this article, we’ll explore how long VASP licenses remain valid, which countries are tightening their rules, and what risks businesses face if they delay the transition.

Why do VASP licenses become invalid with the enactment of MiCA?

Since 29 June 2023, Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA) has entered into force across the EU, marking a fundamental shift in how crypto companies are regulated. Before MiCA, each EU Member State applied its own rules to virtual asset service providers (VASPs). This patchwork framework is now being replaced by a unified licensing regime — the Crypto Asset Service Provider (CASP) license.

Key differences between VASP and CASP:

1. Legal status. VASP registrations are valid only at the national level, while CASP is a full EU-wide license that grants cross-border rights.
2. Organisational structure. MiCA requires firms to have physical presence within the EU, appropriate governance bodies, and internal control mechanisms.
3. Compliance and risk management. CASPs must implement extensive frameworks for IT risk management, customer data protection, and cybersecurity (Articles 63–69 MiCA).
4. Marketing and cross-border activities. CASPs can freely provide services throughout the EU under the passporting regime, which was not available to VASPs.

As of 30 December 2024, national VASP registrations will no longer be legally sufficient, and providing services without a valid CASP license will be considered a regulatory breach. However, the transitional rules vary by Member State: each jurisdiction sets its own conditions for the temporary recognition of legacy VASP registrations. Some countries have already announced that they will not extend VASP status under MiCA and are requiring firms to undergo immediate reauthorisation.

Non-compliance can lead to severe consequences. Under Article 111 of MiCA, national regulators have the authority to suspend or prohibit operations, impose administrative fines of up to €5 million or 12.5% of annual turnover, and remove entities from national or EU-wide crypto registers.

Which VASP activities fall under the MiCA framework?

According to Article 3(1) of MiCA, any company offering at least one of the following services must be licensed as a CASP:

• Custody and administration of crypto-assets and access keys;
• Buying or selling crypto-assets for fiat currency;
• Executing client orders for crypto-assets;
• Transferring crypto-assets between wallets;
• Receiving and transmitting orders;
• Placing crypto-assets;
• Managing crypto-asset portfolios;
• Providing personalised investment advice related to crypto-assets.

Importantly, even firms that previously did not qualify as VASPs are now subject to licensing if they offer any of these services on a professional and ongoing basis within the EU. The CASP licensing requirement also applies to non-EU entities that actively target clients in the European market.

What is a transition period and who can take advantage of it?

With the entry into force of MiCA, the EU introduced a transitional regime for companies already registered as VASPs. This measure allowed businesses to continue operations without immediate disruption and granted them additional time to prepare for the new licensing requirements. However, only crypto companies meeting the following conditions are eligible:

• They were officially registered as a VASP before 30 December 2024;
• They operate in compliance with national legislation;
• They are listed in the public register of the relevant regulator;
• They formally notified the competent authority of their intention to use the transitional period;
• They commit to submitting a CASP license application within the timeframe specified by local law.

Important! If a VASP has been removed from the register, failed a compliance review, or failed to notify the regulator in time, it loses the right to operate under the transitional regime and must suspend all activities.

Duration of the transitional period across EU Member States

While MiCA provides a unified legal framework, the actual length of the transitional period is determined by each Member State. According to the ESMA list, the following deadlines have been established by national regulators for VASPs to continue operations without a CASP license:

• France: full period — 18 months, until 1 July 2026
• Germany: shortened period — 12 months, until 30 December 2025
• Italy: 12 months, until 30 December 2025
• Spain: 12 months, until the end of 2025
• Cyprus: maximum duration — 18 months, until 1 July 2026
• Lithuania: short period — 5 months, until 1 June 2025
• Netherlands: 6 months, until 30 June 2025
• Poland: 6 months, until 30 June 2025
• Estonia: maximum duration — 18 months, until 1 July 2026

When is it necessary to transition to CASP?

Companies that fail to obtain a CASP license in time risk being removed from official registers and losing access to the European crypto market. According to Article 111 of the MiCA Regulation, service providers that continue operating without a valid CASP license after the transitional period may face the following sanctions:

1. Financial penalties — up to €5,000,000 or up to 12.5% of annual turnover;
2. Suspension or full prohibition of business operations;
3. Removal from the public EU Crypto Register, which automatically signals to banks and counterparties that the company is non-compliant;
4. Public disclosure of non-compliant entities can result in reputational damage.

Risks for companies still operating under VASP registration

Firms continuing to operate under legacy VASP registration may encounter growing limitations:

1. Banks may refuse to provide services, especially if the company lacks a clear transition plan toward CASP authorization;
2. Liquidity providers and crypto platforms are increasingly unwilling to engage with entities that do not comply with MiCA;
3. Investors and insurers may hesitate, as the VASP status is no longer seen as a reliable legal framework;
4. Hiring and business development difficulties, particularly in highly regulated EU jurisdictions.

How Key2Law can help companies transition from VASP to CASP

Transitioning from VASP to CASP under MiCA is a complex process that requires deep regulatory expertise, a clear understanding of regulatory expectations, and a strategic approach. The Key2Law team provides comprehensive support at every stage of this transition, helping companies meet new compliance standards while minimizing compliance and operational risks.

Our services include:

1. Assessment of your current operations: we help identify whether your business falls within the scope of MiCA and which services require CASP licensing;
2. Evaluation of your VASP status: we determine whether and when a CASP application is necessary based on your current registration and jurisdiction;
3. Jurisdiction selection: we compare available EU Member States in terms of regulatory timelines, supervisory practices, and application conditions;
4. Transition strategy development: from pre-licensing audits to application submission and follow-up planning;
5. Document preparation: we assist in drafting a complete application file, including your business plan, AML/KYC policies, internal controls, and key personnel profiles;
6. Regulatory liaison: we represent your interests throughout the licensing process, responding to regulatory queries and supporting you in case of amendments;
7. Post-licensing support: ongoing compliance audits, policy updates, and legal representation in case of regulatory challenges.

We support crypto businesses both within and outside the EU in navigating the CASP licensing process in full alignment with MiCA and local regulatory frameworks. Ready to transition from VASP to CASP? Contact the Key2Law team, we’ll help you assess your risks, build a tailored strategy, and obtain your license with confidence.