VASP License by Country: Where to Register in 2026

A VASP license by country means matching your crypto business to one competent authority and one regulatory regime, either a registration or a full authorisation. In 2026 the EU answer is a MiCA CASP authorisation with an EU passport, while Switzerland, Dubai, Cayman, Seychelles and El Salvador offer distinct non-EU routes.

This guide compares where to register a VASP across the European Union and the leading non-EU jurisdictions. For each country we name the competent authority, classify the regime as registration or authorisation, and state its 2026 MiCA transition status with the dates that matter. The most consequential 2026 fact sits at the heart of the page: the MiCA sunset on 1 July 2026, after which a national VASP registration alone no longer permits operation inside the EU (ESMA).

By Magnus Müller · Reviewed by Magnus Müller · Last updated: 2026-06-14

VASP license by country at a glance (registration vs authorisation)

Before comparing individual countries, fix the one distinction that decides everything: a VASP license is either a registration or an authorisation, and the activity you run usually dictates which tier applies. Custody, exchange or trading-platform operation and broking typically trigger the heavier authorisation or licence tier, while lower-risk services may qualify for a lighter registration in some jurisdictions.

The second thing to settle is terminology. VASP is the global term coined by the Financial Action Task Force; CASP is the European Union's MiCA-specific authorised class. Inside the EU, "where to register a VASP" now resolves to "where to obtain a CASP authorisation," because national VASP registrations are being replaced by the single MiCA rulebook (ESMA). For a full comparison of the two terms, see our explainer on VASP vs CASP.

What "VASP license" means in 2026 (and why the EU now says CASP)

A VASP, or Virtual Asset Service Provider, is the global regulatory class defined by FATF for businesses that exchange, transfer, safeguard or administer virtual assets. A CASP, or Crypto-Asset Service Provider, is the European Union's MiCA authorisation for the same activities. Since MiCA went live, the EU regime supersedes national VASP registers, and a CASP authorisation is the only forward-looking route for an EU crypto business (ESMA).

The practical consequence is that legacy registration jurisdictions inside the EU, including Estonia, Lithuania and Poland, no longer offer a distinct "lighter" national VASP register for new entrants. They all route through the same harmonised MiCA framework. To understand the upstream context of becoming a licensed operator, read our pillar on becoming a licensed VASP.

Registration vs authorisation: the distinction that decides everything

Registration is the lighter tier. A provider notifies or enrols with a regulator, satisfies baseline anti-money-laundering obligations, and is entered on a public register. Authorisation, or full licensing, is the heavier tier. A provider must meet prudential, governance and conduct requirements and receive an affirmative grant before it may operate.

Across the jurisdictions in this guide the buckets sort as follows. Authorisation applies to EU MiCA CASP (all national authorities), Lithuania, Czechia and Dubai. Registration or licensing-by-activity applies to Cayman and Seychelles, where custody and trading-platform services trigger the licence tier. Pure registration applies to El Salvador. Switzerland operates a hybrid model: a self-regulatory-organisation AML baseline for most intermediaries, with a FINMA licence only above defined thresholds (FINMA).

VASP license by country: full comparison table

The table below is the decision spine. Each row gives the country or region, its competent authority, the regime type, and the 2026 MiCA status with the controlling dates from the brief. All entries trace to primary sources cited in this guide.

Infographic 1 sits immediately below this table to visualise the same data as three regime buckets.

How to read the table (regime labels explained)

Three labels carry the analysis. "Authorisation" means a full grant is required before you may operate, and inside the EU it confers an EU passport. "Registration" means a lighter enrolment with baseline AML obligations. "Hybrid / threshold" describes Switzerland, where SRO membership is the AML baseline and a FINMA licence applies only once defined thresholds are crossed (FINMA). Read the "2026 status" column for the dates that determine when each regime takes effect.

Where to register a VASP in the EU (MiCA CASP authorisation)

The European Union is the single largest decision cohort. Under MiCA, Regulation (EU) 2023/1114, a CASP authorisation granted by any one Member State carries an EU passport, letting you serve clients across all 27 from a single licence (ESMA). Because the rulebook is harmonised, the choice of EU country is no longer a choice between "lighter" and "stricter" rules; it is a choice between national competent authorities and their processing track records.

Estonia (FIU Estonia)

Estonia's Financial Intelligence Unit is the notified competent authority under MiCA. Its historic "virtual currency service provider" register, long the EU's best-known crypto registration, is sunsetting into the MiCA CASP regime, so new entrants apply for a CASP authorisation rather than the old registration (ESMA). For the country-specific process, see registering in Estonia. The exact Estonian national sunset date relative to the EU 1 July 2026 default needs direct confirmation and is flagged below.

Lithuania (Bank of Lithuania)

The Bank of Lithuania is the competent authority, and Lithuania runs an authorisation regime, not a registration. Existing virtual-currency exchange and wallet operators needed a MiCA authorisation to operate after 1 June 2025, and the national transitional period ended on 31 December 2025; operating without a MiCA licence after that date is illegal financial activity (Bank of Lithuania via ESMA NCA list). For the step-by-step path, see VASP registration in Lithuania.

Poland (KNF)

The Polish Financial Supervision Authority (KNF) is the notified competent authority, and the legacy "virtual currency activity" register is migrating to the MiCA framework (ESMA). The precise Polish national deadline to migrate the old register was not retrievable during research, so this guide defaults to the EU 1 July 2026 ceiling and flags the exact Polish date for verification. For the country detail, see our Poland VASP timeline.

Czechia (Czech National Bank)

The Czech National Bank (CNB) has been empowered to grant CASP authorisations since 15 February 2025, the date on which the old "unqualified trade" regime ended. Transitional applicants had to file by the end of July 2025 and may operate under transition until the CNB decides, but no later than mid-2026. From August 2025 only legal entities, not natural persons, may apply (CNB).

Other EU entry points (Malta, Ireland, Germany, France)

Beyond the common entry points, four further notified competent authorities are converting legacy national regimes into MiCA CASP authorisations. Malta's MFSA is transitioning its Virtual Financial Assets licences; the Central Bank of Ireland is the notified Irish NCA; Germany's BaFin is converting its KWG crypto-custody licences; and France's AMF, with the ACPR for banking aspects, is converting the PSAN regime (ESMA NCA list). In every case the underlying rulebook is the same harmonised MiCA framework.

The MiCA sunset: what changes on 1 July 2026

The MiCA sunset is the single most important 2026 fact for any EU crypto business. Under Article 143(3) of MiCA, entities that lawfully provided crypto-asset services before 30 December 2024 under national law may continue until 1 July 2026, or until a MiCA authorisation is granted or refused, whichever is earlier. Member States may shorten this window (ESMA).

After 1 July 2026 there is no EU-wide fallback. A national VASP registration alone no longer permits operation, and a provider without a CASP authorisation can no longer legally operate inside the EU. For the full chronology, see our MiCA transition dates page. Infographic 2 below maps the timeline from go-live to sunset.

National early-sunsets (Lithuania, Czechia)

The EU date is a ceiling, not a guarantee. Several Member States cut the window short. Lithuania's national transitional period ended on 31 December 2025 (Bank of Lithuania via ESMA). Czechia's old unqualified-trade regime ended on 15 February 2025, and transition applicants who filed by the end of July 2025 may run only until the CNB decides, no later than mid-2026 (CNB). Always check the Member-State notice, not just the EU ceiling.

Why an EU CASP licence works in all 27 countries (the passport)

A CASP authorisation carries an EU passport: service across all 27 Member States from a single licence, granted by one national competent authority (ESMA). This is why the choice of EU country is about the authority, not the breadth of market access. One caveat applies during a national transitional period: a provider running under transition may serve only its country of registration, and cross-border service requires the full authorisation (Bank of Lithuania via ESMA).

Where to register a VASP outside the EU (non-EU options)

Outside the EU, five jurisdictions offer concrete, separately-sourced routes for businesses seeking faster processing, lighter activity-based regimes, or global positioning. Each maps to one regulator and one statute, and the registration-versus-authorisation distinction still governs which tier your activity triggers.

Switzerland (FINMA + SRO)

Switzerland operates a hybrid model under the Anti-Money Laundering Act. Most crypto intermediaries satisfy AML obligations through mandatory membership in a self-regulatory organisation, which is the baseline route. A FINMA licence, including the FinTech licence, is required only once thresholds are crossed, for example public deposits over CHF 100 million or collective custody (FINMA). The Swiss regime is not MiCA, and its high reputation makes Zug's "Crypto Valley" a long-standing base for digital-asset firms, which is the vantage point of our advisory at Crypto Valley Partners.

Dubai, UAE (VARA)

The Virtual Assets Regulatory Authority (VARA) authorises VASPs under the Virtual Assets and Related Activities Regulations 2023 through a two-step licensing process. VARA's remit covers Dubai's mainland and free zones except the DIFC, which is a separate financial jurisdiction with its own regulator (VARA). The two-step structure, an initial approval followed by a full operating licence, gives Dubai a tailored regional positioning for exchange and custody operators.

Cayman Islands (CIMA)

The Cayman Islands Monetary Authority (CIMA) administers the Virtual Asset (Service Providers) Act 2020. Cayman is a clear registration-or-licence example: lower-risk services may register, but from 1 April 2025 virtual-asset custody and trading-platform services require a full VASP licence under the 2024 amendment, and existing Registered Persons had 90 days from that date to apply (CIMA). Whether all other VASP activities now require a licence rather than registration is flagged for verification below.

Seychelles (FSA)

The Seychelles Financial Services Authority (FSA) licenses VASPs by category under the Virtual Asset Service Providers Act 2024, covering exchange, wallet provision, broking and investment provision or advice (FSA Seychelles). The category-based, offshore structure suits firms that want a defined activity licence. The exact regularisation deadline for pre-existing IBC-based providers needs the Act's transitional text and is flagged for verification.

El Salvador (CNAD)

El Salvador runs a registration regime. Digital-asset service providers register as a PSAD (Proveedor de Servicios de Activos Digitales) with the Comisión Nacional de Activos Digitales (CNAD) under the Ley de Emisión de Activos Digitales (LEAD) (CNAD). An August 2024 reform changed the classification scope between Bitcoin service providers and PSADs, so the precise category for a given activity should be confirmed against the consolidated LEAD text before filing.

How to choose the right country for your VASP license

Choosing a jurisdiction is a decision problem, not a sales pitch. Work through the following logic, matching your need to the regime rather than chasing a headline "easy" country. The numbered steps below map common business needs to the right route.

1. Need EU market access? Obtain a MiCA CASP authorisation in any one Member State; it passports to all 27. Choose the national competent authority on processing track record, language and substance requirements, not on a "lighter" regime, because the rulebook is harmonised (ESMA).
2. Need cross-border service within the EU? A full CASP authorisation is mandatory; national-transition status covers only the home country, so transition alone will not let you serve other Member States (Bank of Lithuania via ESMA).
3. Want a non-EU, faster or global option? Match the regulator to your activity. Switzerland (FINMA/SRO), Dubai (VARA), Cayman (CIMA), Seychelles (FSA) and El Salvador (CNAD) each offer distinct positioning.
4. Match the regime to the activity. Custody, exchange or trading-platform operation and broking usually trigger the heavier licence tier rather than a registration, as seen in Cayman, Seychelles and the FINMA thresholds.
5. Plan for substance and timeline. A local entity, fit-and-proper management, an AML/CFT framework and, in the EU, prudential capital are required everywhere; the differences are in degree, not in kind.

For a broader country view beyond VASP specifics, see our hub to compare crypto licence jurisdictions.

Need EU market access? Choose a CASP NCA on track record, not "lighter" rules

Because MiCA harmonises the substantive rules, the only real lever inside the EU is the national competent authority. Estonia's FIU, the Bank of Lithuania and the Czech National Bank are common entry points, but all apply the same CASP standard (ESMA). Compare published processing timelines, working language, and how each authority handles substance and governance reviews, then choose on operational fit.

Need cross-border within the EU? A full CASP authorisation is mandatory

If your model serves clients in more than one Member State, you cannot rely on a national transitional status. Transition covers only the home country, so a full CASP authorisation is the only route to the EU passport (Bank of Lithuania via ESMA). Plan the application as a passporting exercise from day one, not as a domestic-only filing you upgrade later.

Want a non-EU, faster or global option? Match the regulator to your activity

Outside the EU, the activity drives the tier. Custody and trading-platform operators in Cayman need a licence rather than a registration since 1 April 2025 (CIMA); Seychelles licenses by category under the VASP Act 2024 (FSA Seychelles); and Switzerland's threshold model escalates from SRO membership to a FINMA licence as deposits and custody scale (FINMA). Define your activity precisely, then pick the regime that fits it.

Common requirements across every jurisdiction

Whichever country you choose, the core obligations rhyme. Every regime in this guide expects a local operating entity, fit-and-proper management, a documented AML/CFT framework, and, in the EU, prudential capital. The differences between jurisdictions are in degree, not in kind, which is why an "easy" jurisdiction rarely means a light compliance burden once you account for substance and ongoing supervision.

For the full anti-money-laundering and know-your-customer obligations that sit beneath every VASP regime, see our crypto compliance guide.

One licence is not global compliance

A single country's licence does not confer worldwide rights. Only an EU CASP authorisation passports, and it passports only inside the EU's 27 Member States (ESMA). A FINMA, VARA, CIMA, FSA or CNAD authorisation governs activity in that jurisdiction alone. If you operate across regions, you will need a deliberate multi-licence strategy, not a single registration you assume travels with you.

VASP license cost by country (and where to compare)

Costs vary widely by jurisdiction and by the activity you run, and this guide deliberately focuses on the regulator, the regime and the 2026 status rather than fees. Capital requirements, application charges and ongoing supervisory costs differ enough between a Swiss SRO route and a full MiCA CASP authorisation that they deserve their own treatment.

For a structured breakdown of registration fees, capital thresholds and recurring expenses, compare VASP licence costs on our dedicated cost page.

From our practice

In our advisory work from Zug, the most common and most expensive mistake we see is treating "where to register a VASP" as a search for the lightest regime. Since MiCA went live, the EU question is settled: the route is a CASP authorisation, and the only meaningful variable is which national competent authority fits your operating language, timeline and substance plan. Founders who pick an authority on reputation rather than processing fit often lose months. Outside the EU, the recurring error is underscoping the activity, so a firm that intends to custody assets in Cayman or Seychelles discovers late that it needs the licence tier, not the registration tier. We frame every jurisdiction decision around the activity first and the passport second, which is the order the regulators themselves apply.