In 2026, a Dutch crypto business typically needs CASP authorization under MiCA, not the legacy AML-only model. The Netherlands combines AFM authorization with DNB prudential oversight.
Prepared by RUE editorial team · Updated 12 May 2026
Book a CASP readiness assessmentA crypto license in Netherlands now means, in most cases, authorization as a Crypto-Asset Service Provider (CASP) under MiCA. The pre-MiCA Dutch regime built around DNB AML registration is no longer the main route for firms that provide regulated crypto-asset services in the EU market.
For founders, boards and compliance leads, the Dutch proposition is clear: a serious EU jurisdiction with strong supervisory expectations, real substance requirements and access to MiCA passporting after authorization and notification. The practical question is not whether the Netherlands is “easy”, but whether your model, governance and compliance stack are mature enough for Dutch scrutiny.
At RUE, we structure Dutch CASP projects around the full regulatory stack: MiCA + TFR/Travel Rule + Wwft + sanctions + governance + tax and substance. That is the difference between filing an application and building an operating business that can survive post-license supervision.
RUE supports Dutch CASP projects from scoping to filing readiness: service mapping, corporate setup, governance design, AML and Travel Rule framework, fit-and-proper preparation, application drafting and post-license operating support. Where needed, we align the licensing track with accounting, banking and Dutch substance planning.
In 2026, the relevant route is generally CASP authorization under MiCA. Legacy AML registration should not be confused with a full MiCA authorization.
The Dutch model is functionally split between AFM and DNB. Applicants should prepare for conduct, governance and prudential scrutiny rather than a single-point review only.
A Dutch CASP may provide cross-border services across the EU after authorization and the required passporting notification. This is not the same as instant operational freedom in every market.
Dutch readiness is not just a policy pack. Regulators expect workable controls for CDD/EDD, sanctions screening, wallet risk analysis, suspicious transaction reporting and Travel Rule operations.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
A Netherlands CASP application is assessed on business model clarity, governance credibility, AML/CTF operability, ICT resilience and financial sustainability. The regulator does not review documents in isolation; it checks whether the operating model, website, client journey, outsourcing map and internal policies describe the same business.
The practical baseline usually includes:
A recurring Dutch issue is overreliance on group outsourcing without local control. If critical functions are delegated, the applicant still needs demonstrable oversight, escalation rights, board visibility and auditable vendor governance.
The applicant should have a real establishment in the Netherlands, not a mailbox structure. Substance is assessed in context: office, decision-making, management availability, local records and effective control over outsourced functions all matter.
The application must identify exactly which crypto-asset services are provided: custody and administration, exchange, execution, reception and transmission of orders, placing, transfer services, advice or portfolio management where applicable. Authorization is activity-based, not branding-based.
Under MiCA Article 67, a CASP must maintain prudential safeguards equal to the higher of the applicable Annex IV minimum (EUR 50,000, EUR 125,000 or EUR 150,000, depending on the services) and one quarter of the preceding year’s fixed overheads. A new provider uses projected fixed overheads for its first 12 months. The safeguards may consist of eligible own funds, qualifying insurance or a comparable guarantee, or a combination.
Directors, qualifying shareholders and key function holders may be assessed for reputation, competence, time commitment and conflicts of interest. In practice, weak CV-to-role alignment and unclear reporting lines are frequent friction points.
The Dutch compliance framework also requires customer due diligence, enhanced due diligence where applicable, sanctions screening and reporting of unusual transactions to FIU-Nederland when an applicable objective or subjective indicator is met. Crypto transfers are also subject to the recast TFR’s information requirements.
Applicants should document access control, key management, segregation of duties, logging, backup, incident handling, wallet security and vendor oversight. For custody models, regulators typically focus on how private keys are generated, stored, recovered and access-controlled.
Compare Netherlands with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Dutch tax analysis should be separated from licensing analysis. A CASP authorization does not determine the final tax treatment of the business, and the VAT position of crypto-related services can differ materially depending on the exact service performed, contractual structure and whether the activity is treated as a financial-service-type exemption or a taxable advisory/technology service.
For planning purposes in 2026, founders usually review four layers in parallel:
Where licensing budget is concerned, minimum regulatory capital should not be confused with total launch cash. A more realistic formula is: minimum own funds + 12-month operating burn + compliance reserve + technology/security reserve + professional fees. For many Dutch CASP projects, the total implementation budget materially exceeds the formal capital threshold.
A Dutch crypto license is not a one-time filing exercise. In 2026, the operating burden usually includes governance, AML/Travel Rule operations, incident handling, outsourcing oversight and recurring policy refresh.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
We classify the business model under MiCA, identify whether custody, exchange, transfer, advisory or platform elements are in scope, and define the likely capital tier.
We align the Dutch entity, ownership chain, substance model, management roles and banking strategy with the intended authorization scope.
We prepare the program of operations, governance set, AML and Travel Rule framework, outsourcing file, financial model and fit-and-proper package.
We test consistency across policies, website wording, onboarding flow, client terms, vendor map and risk controls before formal submission.
We support submission, regulator communication and evidence management during completeness checks and formal review.
We coordinate responses to AFM and DNB questions, refine documents where needed and help management prepare for deeper supervisory scrutiny.
After authorization, we assist with compliance operations, accounting coordination, policy refresh, banking documentation and change-management planning.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
No. In 2026, firms providing regulated crypto-asset services generally need CASP authorization under MiCA, not reliance on the old AML-only registration concept. Legacy Dutch registration should not be treated as equivalent to a full MiCA authorization.
The Dutch framework involves AFM and DNB, with FIU-Nederland relevant for suspicious transaction reporting. In practice, applicants should prepare for both conduct and prudential scrutiny, not a single-topic review.
Under MiCA Article 63, the authority has 25 working days to check completeness and 40 working days from receipt of a complete application to decide on authorisation. A qualifying request for further information may suspend the assessment period for up to 20 working days. The applicant must be notified within five working days of the decision. Preparation, remedying an incomplete application and operational readiness can make the overall project substantially longer.
Under MiCA Article 67, a CASP must maintain prudential safeguards equal to the higher of the applicable Annex IV minimum (EUR 50,000, EUR 125,000 or EUR 150,000, depending on the services) and one quarter of the preceding year’s fixed overheads. A new provider uses projected fixed overheads for its first 12 months. The safeguards may consist of eligible own funds, qualifying insurance or a comparable guarantee, or a combination.
Yes, foreign ownership is possible, but ownership transparency matters. The authorities may review the shareholding chain, UBO information, source-of-funds context and the suitability of qualifying holders. Opaque structures create avoidable friction.
Yes, real substance is generally expected. The Netherlands is not designed for mailbox-only regulated structures. The exact level of substance should be proportionate to the service scope, risk profile and outsourcing model, but effective local control is a core issue.
Yes, a startup can apply, but no-revenue status does not reduce regulatory expectations. The key issue is whether the applicant can show credible funding, realistic projections, competent management and an operationally workable compliance framework from day one.
Usually yes. Custody models tend to attract deeper scrutiny because they raise questions around private key control, segregation, recovery, access management, incident response and client asset protection. They also often push the project into a higher capital tier.
They need a workable Travel Rule operating model from launch where the rules apply. Whether that is handled through a software vendor, internal tooling or a hybrid workflow depends on the business, but manual, undocumented handling is usually not enough for scale.
Not automatically in the everyday sense. A Dutch CASP may use MiCA passporting across the EU after authorization and the required notification process. Passporting helps with market access, but local practical issues such as banking, consumer-facing conduct and marketing implementation still matter.
No. Licensing may improve the firm’s credibility, but banks and payment providers still apply their own risk-based onboarding standards. They typically assess AML maturity, sanctions exposure, source of funds, transaction profile and management credibility.
A material change in services, jurisdictions, outsourcing, custody design or governance should be assessed before implementation. In regulated practice, post-license change management is critical because the licensed scope, policy pack and real operating model must remain aligned.
The main obligations usually include governance maintenance, AML/CTF operations, sanctions screening, suspicious transaction reporting where required, Travel Rule handling, incident response, outsourcing oversight, record retention, accounting support and periodic policy review.
