CASP authorization in Finland under MiCA in 2026.
Legal, tax and compliance roadmap for exchanges, custody and crypto service providers.
Prepared by RUE editorial team · Updated 12 May 2026
Request eligibility assessmentIn 2026, “crypto license in Finland” usually means authorization as a Crypto-Asset Service Provider (CASP) under Regulation (EU) 2023/1114, known as MiCA. The legacy Finnish VASP framework remains relevant mainly as historical context and for transition analysis, but new market entry planning should be built around the MiCA/CASP regime, the role of the Finnish Financial Supervisory Authority (FIN-FSA / Finanssivalvonta), and EU-wide conduct, governance and prudential expectations.
Finland is not a shortcut jurisdiction. It is a rules-based EU member state where applicants are expected to show real control over AML/CFT, sanctions screening, Travel Rule compliance, governance, ICT security, outsourcing oversight and client-asset protection. For serious founders, that is often an advantage: the same application architecture can support later EU passporting after authorization and notification.
RUE structures Finland CASP projects from service-scope mapping to document architecture, AML/CFT framework, governance pack, regulator-facing remediation and launch-readiness controls. We also align company setup, tax positioning, banking preparation and post-authorization operating model.
The practical licensing discussion in Finland is now centered on CASP authorization under MiCA, not on outdated “easy VASP registration” narratives.
After home-state authorization, a CASP may expand into other EU member states through the MiCA notification framework, subject to scope and procedural requirements.
FIN-FSA-facing applications require substance in AML, governance, ICT security, outsourcing and safeguarding. This can improve banking and institutional counterpart perception.
Finnish company incorporation is handled separately from regulatory authorization. This distinction helps founders structure ownership, governance and tax planning correctly.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
A Finnish company alone does not give the right to provide regulated crypto-asset services. The applicant must align its legal entity, actual business model and control framework with the authorization perimeter under MiCA. In practice, the regulator will look beyond the website and legal form and assess how the service really works: who controls client assets, who executes instructions, where onboarding happens, how monitoring is performed, and whether critical functions are outsourced with proper oversight.
The key mistake in this market is confusing corporate formation with regulatory readiness. A Finnish limited liability company may be incorporated first through the Finnish Patent and Registration Office (PRH), but authorization analysis then turns to ownership transparency, fit-and-proper management, AML/CFT controls, Travel Rule operations, complaints handling, ICT security, financial planning and internal governance.
The applicant normally needs a properly structured Finnish entity with a business model that can be mapped to specific crypto-asset services. Scope errors at this stage often cause later re-drafting of the full application pack.
Beneficial ownership must be transparent and documentable. Foreign ownership is possible in principle, but opaque chains, nominee-heavy structures or unexplained source-of-funds issues can create immediate regulatory friction.
Management must show competence, integrity and time commitment. The regulator will expect evidence that key persons understand the actual crypto service model, not only generic corporate governance language.
AML is an operating system, not a template. You need customer due diligence, risk scoring, ongoing monitoring, suspicious activity escalation, sanctions and PEP screening, recordkeeping and a workable Travel Rule process for relevant transfers.
The application must show who controls what. This usually includes board oversight, segregated responsibilities, compliance reporting lines, conflict-of-interest handling, complaints procedures and documented decision-making.
Where client crypto-assets or keys are involved, technical architecture matters. Regulators increasingly expect detail on wallet segregation, access control, key lifecycle, incident response, logging and vendor dependency management.
Outsourcing does not outsource accountability. If onboarding, monitoring, custody tech or compliance tooling is delegated, the applicant still needs contracts, controls, escalation paths and an outsourcing register.
Share capital and regulatory own funds are different concepts. The prudential requirement depends on the service category and operating model; it should not be confused with the minimum capital mechanics of company incorporation.
Compare Finland with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
For 2026, the headline corporate tax point is straightforward: Finnish corporate income tax is 20%. The difficult part is not the headline rate but the classification of revenue streams, cross-border flows, custody-related fees, token-related activity and the VAT treatment of specific services. Crypto businesses should therefore separate tax planning for the company from tax treatment of users, founders or investors.
VAT analysis must be service-specific. Finland’s standard VAT rate is 25.5% in 2026 where VAT applies generally, but crypto-related services cannot be reduced to a single blanket answer. Whether a given fee is exempt, taxable or mixed depends on the legal nature of the service, contractual structure and applicable EU VAT interpretation. This is particularly relevant for exchange interfaces, brokerage-like models, technology layers, SaaS compliance tools and bundled service packages.
Tax governance also matters operationally. A regulated crypto company should align bookkeeping, wallet reconciliation, fee recognition, treasury treatment, transfer pricing where relevant, and audit trail retention from day one. Founders often underestimate how quickly accounting complexity grows once the platform handles multiple asset flows, rebates, spreads, staking-related revenues or outsourced settlement operations. For tax implementation support, see accounting services and our jurisdiction-specific page on Finland crypto tax.
Authorization is the start of supervision, not the end of the project. In 2026, a Finland CASP must maintain live controls across AML, governance, ICT, outsourcing and client-facing operations.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Define the exact crypto-asset services, custody model, target markets and client journey. This is the step that determines the rest of the file.
Incorporate the Finnish entity through PRH and align ownership, governance, UBO disclosure and corporate records with the planned regulated activity.
Prepare the program of operations, business plan, AML/CFT framework, risk assessment, governance documents, ICT policies, outsourcing register and financial projections.
Validate onboarding, sanctions screening, transaction monitoring, Travel Rule workflow, complaints handling, custody controls and vendor oversight before filing.
File the application and manage regulator questions, clarification rounds and remediation requests. Review is iterative and timing depends on completeness and complexity.
After authorization, activate day-one controls, reporting logic, governance routines and operational monitoring so the business can launch on a supervised basis.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
In 2026, new planning should generally be assessed under the CASP framework of MiCA. The older VASP terminology remains useful mainly for historical and transition context. If your model involves regulated crypto-asset services, the safer legal starting point is MiCA scoping and FIN-FSA-facing authorization analysis.
The key regulator for authorization is the Finnish Financial Supervisory Authority (FIN-FSA / Finanssivalvonta). PRH handles company registration, while the Finnish Tax Administration handles tax matters. At EU level, MiCA sits within the broader framework shaped through EUR-Lex, ESMA and, where relevant, EBA.
Yes, foreign ownership is possible in principle. The practical condition is full ownership transparency, proper UBO disclosure and a structure that does not create unresolved compliance or source-of-funds concerns.
Not every case can be reduced to a blanket yes or no. The key issue is whether governance, effective management and local substance are credible for the actual business model. Some structures can work without a simplistic “mandatory local director” rule, but the regulator will still assess management effectiveness case by case.
A realistic project window is often measured in months, not weeks. Preparation may take 1-3 months or more depending on readiness, and regulator review can take 3-9+ months depending on complexity, completeness and remediation rounds. There is no reliable one-size-fits-all deadline.
The core file usually includes a program of operations, business plan, governance framework, AML/CFT manual, risk assessment, ICT and security policies, outsourcing documentation and financial projections. Custody-heavy models also need a much deeper explanation of wallet architecture, key management and client-asset protection.
Operating a regulated crypto-asset service without the required authorization creates enforcement and business-interruption risk. Founders should not assume that a company registration, a website disclaimer or a third-party white-label engine removes the licensing issue.
It can support EU expansion, but passporting is procedural. After authorization in the home member state, the firm must follow the relevant notification process for cross-border services or branch activity. “Licensed in one country means automatic operation everywhere” is too simplistic.
The headline corporate income tax rate is 20%. VAT treatment is more nuanced and depends on the exact service. Finland’s standard VAT rate is 25.5% in 2026 where VAT applies generally, but crypto services require case-specific analysis.
The biggest mistake is filing a generic package that does not match the real operating model. Weak service scoping, template AML documents, unclear custody logic, thin outsourcing oversight and unrealistic financials are the most common reasons for delays and expensive rework.
