Crypto License in Slovakia 2026

MiCA sets minimum own-funds thresholds for CASPs based on the services provided:

• Class 1 – €50,000;
• Class 2 – €125,000;
• Class 3 – €150,000.

These are prudential requirements, not merely nominal incorporation capital. The funds should be demonstrable, lawfully sourced, and available in a form acceptable for regulatory review. For many applicants, the real funding envelope must also cover legal work, translations, AML tooling, audit support, ICT controls, staffing, and banking onboarding.

The applicant normally operates through a Slovak legal entity, most commonly an s.r.o., with a registered office in Slovakia. The NBS focuses on whether the entity has genuine operational capacity rather than a purely formal address. In practice, this means clear governance lines, documented decision-making, service agreements with key providers, and an operating model that can be supervised.

A virtual address may be acceptable for company-law purposes, but it is not by itself evidence of sufficient substance for a regulated CASP. Where key activities are outsourced, the outsourcing chain must remain transparent and controllable.

The NBS will assess the good repute, competence, and time commitment of directors, senior managers, and qualifying shareholders. Typical evidence includes:

• detailed CVs and role descriptions;
• criminal record certificates and integrity declarations;
• proof of relevant financial services, payments, AML, cybersecurity, or crypto experience;
• ownership charts up to the ultimate beneficial owner;
• source-of-funds and, where relevant, source-of-wealth documentation.

A common approval blocker is not nationality, but weak evidence that the proposed management can actually control a MiCA-regulated business on a day-to-day basis.

Applicants must implement a business-specific AML/CFT framework aligned with Act No. 297/2008 Coll., MiCA, and applicable EU standards. The framework should include:

• business-wide ML/TF risk assessment;
• CDD/KYC/KYB procedures and beneficial ownership checks;
• sanctions and PEP screening;
• transaction monitoring and alert escalation;
• suspicious transaction reporting workflow to the competent AML authority;
• record retention and staff training.

Generic template manuals copied from another jurisdiction are regularly challenged because they do not reflect the applicant’s actual services, client types, geographic exposure, or blockchain risk profile.

A Slovakia CASP application usually requires a policy stack covering the applicant’s exact service scope. Depending on the model, this includes:

• program of operations and service descriptions;
• complaints handling procedure;
• conflicts of interest policy;
• safeguarding and segregation arrangements for client assets and funds;
• outsourcing policy and register;
• market abuse controls for trading platforms;
• business continuity and incident escalation procedures.

For custody models, the regulator will expect a clear explanation of wallet architecture, key management, reconciliation, and how client assets remain identifiable in insolvency scenarios.

From an operating-model perspective, CASPs in Slovakia must be ready for the broader EU digital resilience stack, especially DORA (Regulation (EU) 2022/2554), applicable from 17 January 2025. The NBS and counterparties increasingly expect:

• ICT risk management framework;
• access-control and privileged-user governance;
• incident classification and reporting workflows;
• third-party ICT risk management;
• BCP/DRP testing;
• logging, audit trails, and vulnerability management.

A useful practical distinction is that cybersecurity is no longer treated as a purely technical annex. It is part of the governance package and must align with outsourcing, safeguarding, and incident response procedures.

The NBS will expect a business plan that explains what the company will do, for whom, through which channels, with what controls, and with what resources. A credible package usually includes:

• target markets and client segments;
• exact crypto-asset services requested;
• revenue model and fee structure;
• outsourcing map and vendor dependencies;
• staffing and governance chart;
• 3-year financial projections with realistic assumptions;
• capital adequacy logic and runway analysis.

Over-optimistic projections, missing cost lines for compliance and security, or no explanation of banking and fiat rails are common reasons for extended regulator questions.

Submission language is an operational issue, not a minor formality. In practice, the application pack is generally expected in Slovak, and foreign documents may require sworn translation, certification, or apostille depending on their nature. Applicants should plan translation work early, especially for:

• corporate extracts and shareholder documents;
• criminal record certificates;
• board resolutions and powers of attorney;
• policy documents and governance annexes.

Some technical annexes may be discussed on a case-by-case basis, but assuming that all IT documentation can remain in English often creates avoidable delays.