Regulatory context
ESMA closed the back door
Buying an authorized Crypto-Asset Service Provider already on a Member State’s register beats a greenfield filing on every dimension that matters to a board: time-to-revenue, regulator familiarity, banking lines that already exist. Cadena Brokers presents pre-vetted CASPs under MiCA, all with EEA passporting active and change-of-control diligence already done.
The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, has been in force across all 27 Member States since 30 December 2024. National Competent Authorities issue the authorization — AFM in the Netherlands, BaFin in Germany, the Bank of Lithuania, the MFSA in Malta, the CSSF in Luxembourg, CySEC in Cyprus, and their counterparts — coordinated by ESMA and the EBA at EU level.
ESMA’s 4 December 2025 statement (ESMA75-113276571-1631) ended the easy on-ramp. Legacy national VASP registrations are expiring on a Member-State-by-Member-State schedule; firms that have not converted are being told to wind down and transfer client assets to authorized CASPs. NCAs have been instructed to apply the same scrutiny to last-minute filings as to any other application. No leniency for stragglers.
For an acquirer, the timing is helpful. Supply of authorized entities will not grow as quickly as demand from displaced VASP customers. A live, change-of-control-ready CASP is now a scarcer, more strategic asset than it looked twelve months ago.
Service scope
Ten services, three capital tiers
Article 3(1)(16) of MiCA enumerates the ten crypto-asset services a CASP may be authorized to provide: custody and administration, operation of a trading platform, exchange of crypto for funds, exchange of crypto for crypto, execution of orders, placing, reception and transmission of orders, advice, portfolio management, and transfer services. A single authorization can cover any combination, and the home NCA decides the perimeter on the basis of the applicant’s business plan and capital.
Article 67 sorts those services into three classes for prudential purposes. The headline figure most acquirers need to know: a CASP authorized for custody and trading-platform operation must hold permanent own funds of at least EUR 150,000, with lower floors for advisory and execution-only scopes. Above the floor, a CASP must also hold own funds of at least one quarter of its prior-year fixed overheads, and ESMA’s February 2026 Q&A made that calculation strict (full overhead base, only the deductions in Article 67(3)(a)–(d)).
Two operating obligations matter most at change of control. Article 70 requires segregation of clients’ crypto-assets and funds from the CASP’s own balance sheet, with on-chain identifiability for crypto and segregated client-money accounts at credit institutions for fiat. Article 65 grants the passport: once authorized in the home Member State, a CASP can provide its scope of services across the EEA on a notification, not a re-authorization. That is the asset our acquirers come to buy.
Our book
The acquirer profile we typically place
Entities in our EU CASP book typically present at the Class 2 or Class 3 capital tier, with at least one production banking relationship at a credit institution that supports crypto-derived flows. Most have a working AML programme audited within the last twelve months and a compliance team a regulator will not insist on rebuilding. Service scope tends to cluster around custody, exchange, and execution, which is also the highest-conviction acquisition profile because that combination is what most strategic buyers actually need.
We do not name targets at this stage. Profile-level briefings come after NDA and a buyer mandate; entity disclosure follows fit-and-proper readiness. Each CASP has been pre-vetted on three gates that determine whether a change-of-control approval lands cleanly: regulatory standing (no open enforcement, no material findings outstanding), banking continuity (whether the carved-out entity’s IBAN survives the deal), and AML / sanctions / litigation history.
The Member State chosen at original authorization is not always where an acquirer wants to remain. Cross-border re-domiciliation under MiCA is procedurally unsettled in 2026, and most strategic buyers stay put with the home NCA they inherit. We screen for that explicitly: every entity in our book has a regulator the buyer can live with, not just one the seller could obtain.
Process
Brief-first, four stages, single mandate
Tell us the service scope you need authorized and the Member State you prefer (or whether you want us to recommend one based on banking depth, fit-and-proper culture at the NCA, and notification-route comfort). Tell us your acquisition envelope. We come back with a shortlist drawn from our pre-vetted book.
From shortlist to closing runs through diligence, regulator-side change-of-control approval (a notified qualifying-holding acquisition under MiCA Articles 78 to 84), and signing. Read the full sequence on our process page. Expedited closings depend more on the home NCA’s queue than on Cadena. Our job is to make sure the file that arrives at the regulator is already complete.
Why Cadena
A buy-side desk for licensed crypto
Single-side mandate
We act for the acquirer only. No split fees, no dual representation, no soft-pedaling diligence findings to keep both sides at the table.
MiCA-specific diligence
Our checklists are built around the Title V conditions: management-body fit and proper, segregation under Article 70, governance under Article 68, ICT resilience under DORA. Every entity in our EU book has cleared all four before we pitch it.
Banking continuity is the deal-breaker
Most failed CASP acquisitions die at the bank, not at the regulator. We screen the target’s banking stack before we ever introduce the entity to a buyer. If the IBAN is not survivable, the file does not go in our book.
FAQ
Common questions from acquirers
Is a MiCA CASP authorization passportable across the entire EEA?
Yes. Article 65 of MiCA allows a CASP authorized in any one of the 30 EEA jurisdictions (the 27 EU Member States plus Iceland, Liechtenstein and Norway, once they adopt MiCA into the EEA Agreement) to provide its authorized services in any other Member State on a notification basis through the home NCA. The notification is procedural, not substantive. There is no fresh authorization round.
What survives a change of control under MiCA — the licence, or only the entity?
Both. The CASP authorization attaches to the legal entity, and the entity continues. What changes hands at signing is voting control. The acquirer files a qualifying-holding notification under Articles 78 to 84, and the home NCA has up to 60 working days to oppose. If the NCA does not oppose within that window, approval is taken to be given.
Why not just apply for fresh authorization?
ESMA’s January 2025 Supervisory Briefing (ESMA75-453128700-1263) made clear NCAs are no longer running anything resembling a fast track; ESMA explicitly states that there are no “low-risk” CASPs. Banking onboarding for a brand-new crypto entity, even one holding a paper authorization, can take longer than the application itself. And the supply of authorized entities is finite while transitional VASPs are wound down. There is a window, and it is not getting longer.
Which Member States make sense for which acquirer profile?
Different answer for different buyers. France, Germany and the Netherlands suit institutional acquirers who value depth of regulator and have the patience for change-of-control timelines. Lithuania and Cyprus have stayed practical for mid-market crypto-native acquirers. Malta was the obvious answer until ESMA’s July 2025 peer review of the MFSA fast-track reset expectations. Ireland and Luxembourg become rational once tokenized fund or custodial structures are part of the strategy. We match Member State to mandate.
Does the existing AML programme transfer with the entity?
The programme transfers with the entity, but the home NCA will reassess fit and proper at the new beneficial-owner level. Plan on refreshing the MLRO’s regulatory references and the board’s collective suitability dossier as part of the change-of-control filing. A weak MLRO is a credible reason for an NCA to oppose under Article 84.
How does MiCA interact with our existing EMI or MiFID firm?
Article 60 lets credit institutions, MiFID investment firms, EMIs, UCITS managers and AIFMs provide listed CASP services on a notification basis, within the scope of their existing authorization. If your group already holds one of those, the cleaner acquisition target may be the underlying licensed entity rather than a standalone CASP. We routinely structure deals along that path.
Adjacent options
Where else our book reaches
For acquirers who do not need EEA passporting, a non-EU VASP can deliver crypto-asset operating capacity at a different cost and oversight profile. See our extended coverage hub for the non-EU VASP jurisdictions we broker (Seychelles, the British Virgin Islands, Saint Vincent and the Grenadines, Costa Rica, Panama, Cayman, Anjouan, Bahamas, Mauritius). For EU buyers who also need an e-money or payment institution alongside the CASP, we cross-refer with our core EU and UK e-money and payment book.
Send us a buy-side brief
Service scope, jurisdiction preference, acquisition envelope. We come back with two or three pre-vetted MiCA CASP targets, profile-level, under NDA.
