MiCA License M&A: Why Crypto Firms May Buy Rather Than Apply

MiCA flipped from “coming soon” to “you must have it” this summer. That changed boardroom math overnight. If you want to keep serving EU users, you either hold a CASP authorisation or you get out of the way.

Plenty of teams built toward an application. Others are now eyeing something faster: buy a licensed platform, then plug in your product and passport across the bloc.

This isn’t a theoretical exercise. Supervisors have drawn the line. And the authorised market already holds most of the volume, so the pressure is real.

Point Details MiCA enforcement is live EU/EEA crypto-asset service providers must hold a CASP authorisation from 1 July 2026; those without should wind down EU activities (CSSF). Authorised venues dominate Exchanges with MiCA authorisation handled roughly 83% of European trading volume by June 2026 (The Block/Kaiko). Licences are finite and clustered 338 CASPs listed as authorised across 26 EEA states as of 26 July 2026, with heavy concentration in Germany, France, and the Netherlands (Penning; MICA Watch). Why buy vs apply Time-to-market, passportability, and supervisory track records can outweigh the cost and uncertainty of a fresh application. Big caveat Change-of-control approvals, fit-and-proper checks, and integration risks can stretch timelines if you underestimate the compliance lift.

Why M&A is on the table now

On 1 July 2026 the MiCA transition window shut. From that date, only authorised CASPs can legally offer in-scope services to EU/EEA clients, and those without authorisation are expected to wind down EU business. That’s not rumor; Luxembourg’s markets watchdog said it plainly (CSSF).

The market is already skewed toward licensed shops. Research cited by The Block, attributing the analysis to Kaiko, put about 83% of European trading volume on authorised exchanges by June 2026 (The Block/Kaiko). If most liquidity lives on the licensed side, late movers have two realistic paths: file and wait, or buy and integrate.

There’s also a supply reality. A live register snapshot counted 338 authorised CASPs by late July across 26 home states (Penning). That’s a workable universe of targets, but not a bottomless one. When availability is finite, prices and timelines move.

Time-to-market vs the compliance lift

De novo authorisation is doable. Many have done it. But it’s also a grind. You’ll build policies, staff a second line, implement surveillance, formalize custody controls, document outsourcing, prove prudential safeguards, and line up auditors. Timelines vary by member state and by how complete your file is. For a firm racing against competitors, “varies” is a risk category of its own.

Buying a licensed entity compresses the calendar if you choose well and prepare for change-of-control approvals. You’re paying for a supervised operating model, not just a badge. That said, you inherit history. Any weakness in AML, custody, or governance becomes your problem on day one. Budget for remediation, not just the purchase price.

Path Typical Pros Typical Cons Apply from scratch Clean slate; tailor the control framework to your stack; fewer legacy issues. Uncertain timeline; heavier upfront hiring; opportunity cost while competitors scale. Acquire a CASP Faster EU launch once change-of-control clears; existing passport potential; proven supervisory history. Integration work; remediation of legacy findings; regulator approval gating the close.

Pro tip: Model two clocks in your plan: regulatory approvals and technical integration. Either one can slip and sink the “faster to market” thesis if it’s not managed like a product launch.

Where the licences are and how that shapes deals

Authorisations aren’t spread evenly. A tracker snapshot in late July showed concentrations in a few states: Germany with 69, France 39, and the Netherlands 38 (MICA Watch). That clustering nudges M&A toward those jurisdictions, because buyers like depth and comparables.

Home state matters for more than optics. Under MiCA, once you’re authorised in one EEA state you can typically passport services across the bloc, but supervisors still look through to your center of operations, governance, and outsourcing. A buyer headquartered in one country scooping a licence in another needs a crisp story for where key functions live and how oversight works in practice. That story should line up with the target’s existing supervisory record.

Some teams will try to buy in a jurisdiction where they already have people, banks, and auditors. Others will pick the home state whose regulator already knows the target well. There isn’t a universal “best” here. The right move is the one you can explain cleanly to the home authority and replicate in your operating model.

What gets priced in: valuations that make sense

Prices aren’t just about the paper licence. Buyers (and their lenders) look at the whole control stack and the target’s relationship with its supervisor. Things that usually push value up:

• A clean supervisory history with timely remediation of findings.
• Proven passport notifications in place for the services you need.
• Documented client asset segregation and robust custody controls.
• A functioning AML program with casework and STOR/SAR evidence.
• Modern tech with audit trails, role-based access, and tested key management.

Things that discount deals fast:

• Open regulatory findings, especially in AML/CFT or custody.
• Reliance on shadow IT or unmanaged third-party tools for core processes.
• Weak financials, thin own funds, or missing insurance where expected.
• Board or management gaps; no independent directors or no risk function with teeth.

Structures vary. Earn-outs tied to remediation milestones are common. Escrows live longer than you think. If there’s a pending on-site inspection or a thematic review coming, price in the result by adjusting consideration at close or using contingent payments.

A practical diligence list for buyers

Regulatory and governance

• Authorisation scope and services: does the licence cover what you plan to do, or will you need a variation later?
• Passport status: which EEA states are already notified? Any denials or withdrawals?
• Supervisory correspondence: recent findings, letters, remediation plans, and deadlines.
• Change-of-control expectations: what the home authority will ask for, and how long approvals have taken in comparable cases.
• Board composition and management fitness: minutes, conflicts, and training records.

AML/CFT and market integrity

• Customer risk assessment, ongoing monitoring rules, and sanctions screening tools.
• Travel Rule implementation and counterparty list; false positive rates and tuning history.
• Case management: samples of alerts, escalations, suspicious reports, and outcomes.
• Market abuse surveillance for trading venues; evidence of detection and escalation.

Custody and client assets

• Wallet architecture, key ceremonies, HSM usage, and access segregation.
• Reconciliation procedures and frequency; handling of stuck or failed transactions.
• Insurance policies or equivalent safeguards; claims history and exclusions.
• Client asset segregation evidence and legal opinions, especially for omnibus setups.

Technology and operations

• Change management, deployment pipelines, and rollback plans.
• Incident logs, disaster recovery tests, and RTO/RPO evidence.
• Outsourcing registers and contracts for critical services; exit clauses and SLAs.
• Data protection posture, DPIAs, and data residency mapping.

Financials and prudential resources

• Own funds and liquidity coverage versus internal assessments.
• External audit reports; management letters and resolved vs open items.
• Revenue quality: concentration, churn, and exposure to prohibited geographies.

Pro tip: Ask for the target’s last two supervisory on-site scopes. The themes they were tested on tell you what the regulator will test you on after the deal closes.

Deal structures and the approvals you’ll need

You’ve got two broad paths: buy the shares of the authorised company, or try to carve out assets and move the business into your entity. In practice, most buyers go for a share deal because the authorisation sits with the company itself and migrating it can be impractical. But that also means you inherit everything inside it, good and bad.

Expect a change-of-control approval from the home authority. In European financial services, supervisors typically assess the acquirer’s fitness, reputation, financial soundness, and the plan for the combined business. Crypto isn’t exempt from that logic under MiCA. Build time for Q&A rounds and be ready to file a full pack: ownership charts, funding sources, governance plans, and bios for key function holders.

Closing often becomes “conditional close” subject to regulatory approval. Some buyers sign and wait; others align closing with the approval letter to avoid holding costs. Either way, plan the communications choreography with clients and partners so you don’t spook banks or market makers mid-process.

Post-close, notify passporting changes quickly. If you plan to expand the service scope, treat that as a Phase 2 with its own application and testing timeline. Don’t stack them on day one unless you’re comfortable re-running governance approvals in parallel.

Integration traps to avoid

• Rushing product changes before you update the target’s policies. Supervisors read release notes too.
• Re-papering clients without a comms plan. Re-KYC, new T&Cs, and consent for data transfers all take time.
• Letting the old and new control environments run in parallel for too long. Dual standards are audit fodder.
• Under-scoping the Travel Rule. Your pipelines have to talk to the same counterparties with the same messages.
• Moving keys or changing custody vendors without rehearsing the ceremony and sign-off path. Nothing stresses a deal like a frozen withdrawal queue.

Pro tip: Treat the first regulatory meeting post-close as a product demo and a board meeting combined. Bring the remediation tracker, your tech map, and one owner per critical function. Keep it tight.

How to pick a target when everyone is shopping

With 338 authorised CASPs on the board by late July 2026 (Penning), you’ve got options, but the best fits go quickly. Here’s how teams are narrowing the field:

• Match on service scope first. If you need custody plus exchange operations, skip brokers with limited permissions.
• Pick the home authority you’re prepared to engage with for years, not months. Concentrations in Germany, France, and the Netherlands (MICA Watch) mean more comparables and possibly more predictable processes.
• Prioritise targets with clean audits and recent passport activity. It signals living processes, not shelf licences.
• Insist on a remediation budget at term sheet stage. Surprises get cheaper if you price them before exclusivity.

If you’re later to the hunt, consider partnerships while you evaluate acquisitions: white-label, introducing broker models, or institutional routing into a licensed venue. Those won’t replace a licence long term, but they can keep EU flows alive as you run your M&A play.

One more angle: the market share picture suggests buyers should ask how a target participates in that 83% authorised flow (The Block/Kaiko). Are they connected to active market makers? Are bank relationships stable? A licence without durable rails is just paper.

If this feels like a lot, it is. But buying instead of applying can still be the pragmatic move. It just works when you make the control environment your product for the first 90 days.

For steady updates on MiCA authorisations, enforcement notes, and real-world operator stories, keep an eye on Crypto Daily. We track the plumbing so you don’t have to.

Frequently Asked Questions

Does buying a MiCA-authorised CASP guarantee passporting across the EU?

No. Passporting is available, but you still have to notify other EEA states properly and ensure your actual operations and oversight align with the home state authorisation. Expect paperwork and checks.

How long do change-of-control approvals usually take under MiCA?

It depends on the home authority and the complexity of your ownership and business plan. Plan for months, not weeks, and factor in Q&A cycles where supervisors ask for more detail.

Are certain jurisdictions better for acquisitions?

Authorisations are concentrated in Germany, France, and the Netherlands per tracker snapshots, which can make processes and peer examples easier to navigate. The “best” jurisdiction is still the one that fits your footprint and product plan.

What’s the biggest hidden cost when buying a licence?

Remediation. Fixing AML tooling, custody controls, or governance gaps after close often costs more time and money than buyers expect. Budget for audits, consultants, and possible team upgrades.

Can I run my old unlicensed EU activities while a deal is pending?

Supervisors have been clear: from 1 July 2026 you need authorisation to serve EU/EEA clients. If you’re not licensed, plan to pause or wind down EU services while you apply or pursue M&A, per public guidance like the CSSF’s notice.

Will buying a CASP speed up future scope changes?

Having a working relationship with a supervisor helps, but scope changes are still assessed on substance. Treat them as fresh applications with testing and documentation, even if you’re an existing licensee.

What if the target’s tech stack doesn’t match ours?

Don’t rip and replace on day one. Map controls first, then phase migrations with clear sign-offs. Keep the regulator informed if changes touch custody, client assets, or reporting.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.