Obtain a Finland MiCA license for CASP activities under FIN-FSA supervision. RUE supports exchanges, custody providers, brokers, and crypto platforms entering the EU market through Finland.
Prepared by RUE editorial team · Reviewed by Milana · Updated 4 November 2026
Request MiCA ConsultationA MiCA license in Finland gives access to the EU market through a regulated Nordic jurisdiction supervised by FIN-FSA. RUE helps founders scope the correct perimeter, build the application dossier, and launch with governance, AML, ICT, and passporting readiness.
"As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays."
RUE provides end-to-end support for obtaining a MiCA license in Finland: perimeter mapping, company setup, governance design, drafting of the CASP dossier, regulator-facing responses, and post-authorization compliance implementation.
We also coordinate related workstreams that usually delay launches in practice: banking preparation, AML/KYC architecture, Travel Rule implementation, outsourcing controls, and internal linking with tax, accounting, and operational teams.
Your CASP authorization is handled at national level by Finanssivalvonta, not by ESMA. This matters for application strategy, review style, and ongoing supervision.
Once authorized in Finland, a CASP can passport eligible services across the EU through the MiCA notification framework.
Finland is often a better fit for institutional-facing, custody-heavy, and security-sensitive models than for low-substance, volume-first structures.
In practice, launch readiness means MiCA plus AML/CFT, Travel Rule under Regulation (EU) 2023/1113, DORA, GDPR, tax, and outsourcing controls.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
A MiCA license in Finland is a CASP authorization under Regulation (EU) 2023/1114, supervised by FIN-FSA (Finanssivalvonta). For new projects in 2026, the correct legal route is generally MiCA/CASP, not the old Finnish virtual currency provider registration model. Existing pre-MiCA providers may still need transition analysis, but new founders should structure the project around the current EU framework from day one.
The regulator will assess more than a policy set. It will look at whether your Finnish entity has real operational substance, whether management is fit and proper, whether your safeguarding model works in practice, whether your AML and Travel Rule stack is operational, and whether your ICT environment can support a regulated crypto business. The strongest applications are internally coherent: service scope, capital, staffing, outsourcing, wallet architecture, and customer journey all match.
Below are the core requirements for a Finland MiCA license. The exact package depends on whether you provide custody, exchange, execution, reception and transmission, advice, portfolio management, transfer services, placing, or operate a trading platform.
You need a Finnish legal entity with a registered office in Finland and an operating model that is not a letterbox arrangement. In practice, FIN-FSA expects real substance: decision-making capacity in the EU, documented management oversight, a credible local operating setup, and clear responsibility lines for regulated functions.
Foreign founders can generally own 100% of the Finnish company, but opaque ownership chains, nominee-heavy structures, or weak source-of-funds evidence are common triggers for regulator questions.
MiCA requires prudential safeguards at all times equal to the higher of the applicable Annex IV amount (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. Providers operating for less than one year use projected fixed overheads for their first 12 months. The safeguards may consist of qualifying own funds, compliant insurance or a comparable guarantee, or a combination under Article 67. Operating expenses and company-law share capital must be planned separately. Annex IV assigns the following permanent minimums to the three service classes:
Capital must be properly evidenced and should not be confused with ordinary company law setup costs. A common founder mistake is to treat minimum own funds as the full market-entry budget. In reality, total launch funding usually includes regulatory capital plus legal work, compliance staffing, technology, security, office, audit, and banking onboarding.
FIN-FSA will assess whether directors, senior managers, and key function holders are fit and proper. This covers competence, integrity, time commitment, and governance capacity. The review is not limited to CVs; it also tests whether the proposed team can actually run a regulated crypto business.
Weak governance is one of the fastest ways to trigger RFIs. If the business model is complex but the management body is thin, generic, or outsourced on paper only, the application usually slows down materially.
A Finland CASP must operate a real AML/CFT framework, not a template manual. MiCA does not replace AML obligations. You need customer due diligence, sanctions screening, suspicious activity escalation, ongoing monitoring, and crypto-specific KYT controls.
In practice, many crypto firms now integrate tools such as Chainalysis, TRM Labs, or Elliptic, and Travel Rule messaging standards such as IVMS101. The regulator does not mandate a specific vendor, but it does expect the control outcome.
If your model includes custody or handling client funds in connection with crypto-asset services, safeguarding is a core licensing issue. You must show how client crypto-assets and any related client money are identified, segregated, reconciled, and protected from misuse, loss, or insolvency leakage.
Where client fiat is received in connection with services, firms should pay close attention to timing and safeguarding arrangements. In practice, regulators increasingly expect founders to explain the full money flow from customer onboarding to settlement, not just wallet custody diagrams.
By 2026, no serious CASP application can treat IT security as a side annex. Your Finland MiCA license project should be built with DORA in mind, especially for ICT risk management, incident handling, resilience testing, logging, third-party oversight, and business continuity.
Useful market benchmarks include ISO/IEC 27001, formal incident response playbooks, and regular penetration testing. These are not substitutes for law, but they help evidence operational maturity.
The application package should be built as a regulator-grade dossier, not a set of disconnected files. A strong submission usually includes:
Founders often underestimate how closely the regulator reads consistency across documents. If your financial model assumes high-volume exchange activity but your staffing, AML tooling, and support model look like a small advisory firm, expect detailed follow-up questions.
Before filing, you must confirm that MiCA is actually the correct route. A token or service can fall outside MiCA or overlap with other frameworks.
Wrong classification is one of the most expensive mistakes in crypto licensing. RUE usually starts with service mapping and token classification before any drafting begins, because a mis-scoped application can waste months.
Compare Finland with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
MiCA does not harmonize taxes. A Finland MiCA license gives regulatory authorization for crypto-asset services, but the tax treatment of your Finnish company remains a matter of Finnish tax law, accounting treatment, transaction structure, and the exact nature of your revenue streams.
Finland applies a 20% corporate income tax rate to company profits. For crypto businesses, the practical tax result depends on how income is characterized: trading revenue, service fees, spreads, custody fees, software income, treasury gains, staking-related income, or cross-border payments can all require separate analysis. A licensed CASP should align tax treatment with accounting policy from the start, especially where crypto inventory, treasury holdings, or client asset segregation create balance-sheet complexity.
VAT treatment depends on the service. Some exchange-related services may fall within financial-services logic, while advisory, software, white-label, analytics, or ancillary support services may be taxable. The correct answer is activity-specific, not license-specific. A founder should never assume that holding a MiCA license automatically makes all revenue VAT-exempt.
In practice, founders should separate regulatory capital from operating budget. A useful planning formula is:
For many Finland CASP projects, the real bottleneck is not tax rate but the combination of staffing, compliance tooling, banking friction, and security architecture. We usually recommend budgeting a 10-20% contingency for RFIs, document upgrades, translations, and delayed onboarding.
For tax structuring, accounting setup, and transaction classification, we normally coordinate the licensing workstream with accounting services and Finland-specific crypto tax review through Finland Crypto Tax.
Authorization is the start of supervision, not the end of the project. A Finland MiCA license requires ongoing controls across reporting, AML, safeguarding, ICT resilience, outsourcing, and governance.
A MiCA license in Finland is a FIN-FSA authorization for a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114, allowing an eligible firm established in Finland to provide regulated crypto-asset services and then passport them across the EU.
This is the right legal lens for crypto license Finland 2026 searches. In 2026, founders should not structure new EU-facing projects around the old Finnish VASP vocabulary unless they are analyzing a legacy transition case.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Define whether the model falls under MiCA CASP, issuer rules, MiFID II, or a mixed perimeter. Confirm Finland suitability, target services, token classification, and passporting plan. Typical duration: 1-3 weeks.
Incorporate the Finnish company, register through PRH, structure ownership disclosures, prepare substance plan, and align tax and accounting setup. Banking preparation can start in parallel. Typical duration: 2-6 weeks.
Appoint directors and key function holders, map responsibilities, prepare fit-and-proper materials, and design the governance framework expected by FIN-FSA. Typical duration: 2-4 weeks.
Prepare the full application package: programme of operations, business plan, 3-year financials, AML/CFT framework, safeguarding, complaints, outsourcing, ICT security, DORA-aligned controls, and supporting annexes. Typical duration: 6-12 weeks.
Submit the application in final form, ensure internal consistency across documents, and prepare management for regulator-facing questions. Completeness review timing depends on the file quality and regulator workflow.
FIN-FSA conducts substantive review and usually issues one or more rounds of questions or remediation points. Typical real-world review window for many projects is 3-6+ months after submission, depending on complexity.
After approval, finalize operational readiness: banking/payment flows, customer onboarding, Travel Rule connectivity, internal reporting, staff training, and passporting notifications where relevant.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
A MiCA license in Finland is a CASP authorization granted by FIN-FSA under Regulation (EU) 2023/1114. It allows a Finnish crypto-asset service provider to offer regulated crypto services and, after the relevant notification process, passport those services across the EU.
FIN-FSA (Finanssivalvonta) issues and supervises the authorization in Finland. ESMA does not issue the license; ESMA’s role is EU-level coordination, registers, and supervisory convergence.
No for most new applicants. In 2026, new EU-facing projects should generally be structured around MiCA/CASP authorization. The old Finnish virtual currency provider regime remains relevant mainly for legacy and transition analysis under the Act on Virtual Currency Providers (572/2019).
You may need a Finland MiCA license if you provide regulated services such as custody, exchange crypto-fiat, exchange crypto-crypto, execution, reception and transmission of orders, placing, advice, portfolio management, transfer services, or operate a trading platform.
MiCA requires prudential safeguards at all times equal to the higher of the applicable Annex IV amount (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. Providers operating for less than one year use projected fixed overheads for their first 12 months. The safeguards may consist of qualifying own funds, compliant insurance or a comparable guarantee, or a combination under Article 67. Operating expenses and company-law share capital must be planned separately.
A realistic timeline for many projects is 4-8+ months end to end, with complex cases taking longer. The total duration depends on scoping quality, document readiness, ownership transparency, governance strength, and how many regulator questions arise during review.
Yes, in principle. Foreign ownership is generally possible, including 100% ownership, provided the ownership chain, UBOs, and source of funds are transparent and acceptable from a regulatory and AML perspective.
You need real substance, not just a mailbox. The regulator expects a Finnish legal entity with a registered office and a credible operating model. The exact local setup depends on the business, but a letterbox structure with no real management or operational capacity is a weak licensing position.
Yes, through MiCA passporting. Once authorized in Finland, a CASP can notify cross-border services into other EU member states under the MiCA framework. Passporting does not remove the need to comply with local tax, consumer, marketing, and data-protection rules in target markets.
MiCA covers ARTs and EMTs, but under a stricter regime than ordinary CASP services. Stablecoin-related rules have applied since 30 June 2024. If your model involves issuing, offering, or servicing stablecoin products, you need separate issuer and prudential analysis, not just a standard CASP filing.
Yes. Travel Rule obligations for crypto-asset transfers arise primarily under Regulation (EU) 2023/1113, not from MiCA itself. A Finnish CASP usually needs both MiCA authorization and an operational Travel Rule compliance framework.
Usually not if the token qualifies as a financial instrument. In that case, the relevant perimeter may shift to MiFID II and related securities law. Token classification must be assessed case by case; labels such as “utility” or “security” are not legally decisive on their own.
Sometimes, but not automatically. The answer depends on whether there is an identifiable issuer, operator, intermediary, or service provider. Many projects marketed as DeFi still have centralized control points that can create regulatory obligations. The analysis is functional, not branding-based.
Operating without required authorization is a serious enforcement risk. Consequences can include cease-and-desist measures, administrative penalties, loss of banking access, contractual disruption, and reputational damage. If you are already active, urgent perimeter and remediation analysis is advisable before expanding further.
