Acquiring an authorised CASP: MiCA change of control

For firms on the wrong side of a MiCA transitional deadline - or firms that never held a national registration at all - the realistic options have narrowed to applying fresh or acquiring a company that is already authorised. We covered the first path in our guide to missing the CASP deadline. This article is about the second.

The arithmetic behind the acquisition route is simple: an authorised CASP can operate today, and an application cannot. The supply side is less friendly. Public trackers listed roughly two hundred authorised CASPs across the EEA as of May 2026, only a fraction of which will ever come to market. Sellers know what they hold, and negotiations reflect that.

Scarcity also changes how you should buy. When inventory is thin, the temptation is to take the first available authorisation and bend the business model around it. That is usually backwards: an authorisation with the wrong service classes, or with passporting notifications that were never actually filed, can cost you the very time you were trying to save. If you want to see what a screened pipeline looks like, our catalogue of licensed companies is the starting point.

Buying an authorised CASP is not a private matter between shareholders. Under the MiCA framework (Articles 83-84), acquiring a qualifying holding in an authorised CASP must be notified to the national competent authority and assessed before completion. Signing is your decision; closing, in practice, waits on the regulator.

The assessment window runs up to 60 working days - but the clock stops whenever the regulator requests further information and only restarts when you answer. A thin or inconsistent acquirer dossier can therefore stretch the process well past the headline number. In our experience, the quality of the first filing is the single biggest variable the buyer controls.

Two practical consequences follow. Deal timetables need to be built around the assessment rather than squeezed in front of it - a completion date that ignores the 60-working-day window, and the stops built into it, is a completion date you will renegotiate. And confidentiality has limits: the regulator becomes a participant in the transaction the moment you notify, so both sides should agree early on who prepares what, and when.

If you have bought licensed companies in other regulated sectors, the mechanics will feel familiar - we walk through the generic playbook in our change-of-control guide. What MiCA adds is a harmonised framework applied by national regulators, each with its own forms, working style and appetite for information; the practical texture varies by member state.

Ordinary M&A diligence buys you accounts, contracts and liabilities. With a CASP you are also buying a regulatory file, and three parts of that file decide whether the target actually fits your model.

First, scope. CASP authorisations specify service classes: a target authorised for exchange and custody is not automatically authorised for portfolio management. If your model depends on a class the target does not hold, you are buying an application project, not an operating permission.

Second, passporting. Cross-border activity into other EEA states runs on notifications, made state by state. Diligence which notifications are actually in place rather than assuming the home authorisation travels by itself.

Third, DORA. The ICT risk framework applies to CASPs, and the acquired company's DORA compliance state is part of the file you inherit - gaps included. Whatever remediation the target has deferred becomes your programme on day one.

None of these checks is exotic, but sellers in a thin market have little incentive to volunteer weaknesses, and a data room rarely flags what is absent. Ask for the authorisation decision itself, the notification correspondence and the DORA documentation as primary evidence, and treat a summary table prepared by the seller as a starting point for verification, not the end of it.