On-shore VASP in European Union
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in European Union with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP authorization triggers full AML/CFT compliance under AMLD6 (EU 2024 AML harmonisation directive).
- Travel Rule compliance under TFR recast (EU 2023/1113) — EUR 0 threshold (no de minimis), applies to all crypto-asset transfers.
- Must transmit and retain detailed originator/beneficiary data (name, address, wallet address) per EBA Travel Rule Guidelines (final July 2024, effective Dec 30, 2024).
- Suspicious transaction reporting (STR/SAR) obligations to home NCA financial intelligence unit (FIU).
- Customer due diligence (CDD) and ongoing monitoring obligations under national implementation of AMLD6.
- DAC8 tax reporting obligations (effective 2026) — crypto transaction reporting to tax authorities.
Key Restrictions
- Must obtain CASP authorization from home National Competent Authority (NCA) under MiCA (EU 2023/1114) before offering services.
- Minimum capital requirements vary by service class: custody (EUR 50K), trading platform (EUR 150K), exchange (EUR 125K), order execution/placing/reception/advice/portfolio mgmt/transfer (EUR 50K each).
- Asset segregation mandatory for custody services — client assets held on trust.
- Passporting rights across EU via home NCA notification (20 business days), but transitional provisions vary by member state (e.g. France ~6 months, Germany 12 months, up to 18 months allowed under Art. 127).
- No de minimis exemption for Travel Rule — applies to all transfers regardless of value.
- Must comply with prudential governance, risk management, and ongoing reporting obligations per MiCA.
Key Risks
- Supervisory fragmentation — some NCAs had not finalised MiCA enforcement guidelines by Q1 2026 (ESRB March 2026 analysis), creating uneven oversight across member states.
- Transitional provision variability — member states have chosen different transition windows (France ~6 months, Germany 12 months, up to 18 months), creating compliance timeline risk for operators in multiple jurisdictions.
- Enforcement precedent growing — first MiCA enforcement action (Jan 2026, AMF against unregistered non-EU CASP) and AFM warnings (Feb 2026 against incomplete applications) signal active supervision.
- Dual regulatory burden from MiCA + AMLD6 + TFR + DAC8 creates overlapping compliance obligations that require integrated compliance programmes.
- ESMA thematic reviews and supervisory stress tests (2025-2026) on governance, custody, and disclosures may reveal gaps for newly authorised CASPs.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
MiCA Regulation (EU 2023/1114) (2023) — Comprehensive CASP authorization, token issuance, white paper requirements — fully effective Dec 30, 2024
National Competent Authorities — CASP authorization in home member state (AMF, BaFin, CNMV, CBI, etc.)
VASP: CASP authorization under MiCA via home NCA. 9 service classes: custody (EUR 50K), trading platform (EUR 150K), exchange (EUR 125K), order execution (EUR 50K), placing (EUR 50K), reception/transmission (EUR 50K), advice (EUR 50K), portfolio mgmt (EUR 50K), transfer services (EUR 50K). Prudential: higher of fixed minimum or 1/4 prior year fixed overhead.
CUSTODY: CASP Class 1 — EUR 50,000 minimum capital. Asset segregation mandatory. Client assets held on trust.
EXCHANGE: CASP authorization with EU-wide passporting (notify home NCA, 20 business days). Transition: up to 18 months for existing operators (July 2026 deadline). France chose 6 months, Germany 12 months.
Travel Rule adopted — threshold: EUR 0 (no threshold under TFR recast)
Threshold Amounts: No de minimis threshold; the rule applies to all crypto-asset transfers, exceeding basic FATF requirements.
Technical Implementation Requirements: CASPs must securely transmit and retain detailed data on originators (e.g., name, address, wallet addresses) and beneficiaries during transfers. EBA's Travel Rule Guidelines (finalized July 2024, applicable December 30, 2024) specify detecting/handling missing data, risk-based approaches, and compliance with prior guidelines like JC/GL/2017/16. The EU mandates more extensive data points than FATF or jurisdictions like Singapore.
EBA Travel Rule Guidelines: Final report on info requirements for funds/crypto transfers. Direct PDF: https://www.eba.europa.eu/sites/default/files/2024-07/6de6e9b9-0ed9-49cd-985d-c0834b5b4356/Travel%20Rule%20Guidelines.pdf
AMLD6 (2024) — AML/CFT harmonization across EU
DAC8 (2024) — Crypto reporting directive for tax authorities — effective 2026
Transfer of Funds Regulation (recast) (2023) — Travel Rule — EUR 0 threshold (no de minimis)
A March 2026 analysis by the European Systemic Risk Board (ESRB) identified that 8 of the 27 EU NCAs had not yet finalized their MiCA enforcement guidelines by Q1 2026, creating "supervisory fragmentation risks" for CASPs operating across multiple member states; the ESRB warned that this could lead to inconsistent application of authorization requirements and investor protections by the April 2026 enforcement date ESRB Analysis of MiCA Supervisory Fragmentation
In January 2026, the French Autorité des Marchés Financiers (AMF) became the first NCA to publicly announce a formal enforcement action under MiCA, issuing a cease-and-desist order against an unregistered non-EU CASP (CryptoFlow Ltd., registered in the Cayman Islands) for soliciting French residents without authorization; the AMF noted this action as a "test case" for MiCA enforcement coordination across NCAs AMF MiCA Enforcement Action January 2026
The European Commission's March 2026 enforcement update confirmed that the Netherlands Authority for the Financial Markets (AFM) had issued formal warnings to 14 crypto-asset firms for failing to submit complete authorization applications by the February 28, 2026 deadline; the AFM warned that firms without approved authorization by April 1, 2026, would face immediate suspension orders European Commission MiCA Enforcement Update March 2026
The application of national transitional provisions under Article 127 is optional for Member States, leading to significant variability: for example, Germany has applied a transitional period until June 30, 2026 for existing CASPs, while France opted for a shorter period ending March 31, 2025, creating uneven enforcement intensity across jurisdictions BaFin Transitional Provisions; AMF France MiCA
By April 2026, ESMA and NCAs will have conducted at least one round of thematic reviews and supervisory stress tests on authorized CASPs, focusing on governance, custody of client assets, and disclosure requirements, as part of ESMA's 2025-2026 Supervisory Convergence Work Programme ESMA Work Programme 2025
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — an on-shore VASP may operate in the EU by obtaining full CASP authorization under MiCA from its home National Competent Authority, subject to class-specific minimum capital (EUR 50K–150K), AML/CFT obligations under AMLD6 and TFR (Travel Rule at EUR 0 threshold), prudential governance, asset segregation for custody, and EU-wide passporting with member-state-varying transitional deadlines.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?