What did a CASP registration application involve, and how were changes reported?

A duly completed application had to contain the details that would appear in the public register (name, trade name, legal form, LEI, physical address, services and website) and more. The CASP listed its crypto-asset addresses, meaning every public address of crypto-assets and every public key or digital wallet under its control, not postal or email addresses. It also stated which crypto-assets it dealt in, the types of clients it served, whether it offered payment services in crypto-assets, whether it ran crypto-asset ATMs and, if so, how many and where, the jurisdictions it operated in, and whether it was registered or supervised anywhere else.

CySEC first checked that the application was complete and then whether the applicant met the conditions for registration. The people holding management positions had to be honest and competent: of good reputation, with the knowledge, skills and experience needed, and able to devote enough time to their duties. The beneficiaries had to be of good reputation and able to keep the CASP financially sound. CySEC also looked at the applicant's close links with other persons, its AML/CFT policies and procedures, the procedures for running the business properly, and its controls to minimise the risk of clients' crypto-assets being stolen or lost. CySEC had six months to assess the application and tell the applicant whether it would be registered.

Changes were sorted by type. A change to the CASP's name, trade name, legal form, LEI or physical address required a request to amend the registration within one month of the change, and CySEC updated the register within three days of receiving it.

A change to operational information, such as the crypto-assets used, the types of clients, crypto-asset payment services, crypto-asset ATMs, the jurisdictions of operation, or registration or supervision elsewhere, had to be notified to CySEC within 15 days of the change at the latest.

Changes to the services or activities, the crypto-asset addresses, the Board or senior management, the beneficiaries or the website were material changes. They needed CySEC's approval before they took effect, as described in Who had to register as a CASP?

CySEC stopped accepting national applications on 17 October 2024. A firm that wants to provide crypto-asset services now applies for authorisation under MiCA. The competent authority checks whether the application is complete within 25 working days and decides within 40 working days of receiving a complete application, a period that can be paused for up to 20 working days while it asks for more information. MiCA sets its own requirements on the management body, shareholders, capital and procedures.