Regulated United Europe OÜ
Registration number: 14153440
Anno: 16.11.2016
Phone: +372 56 966 260
Email: info@rue.ee
Address: Laeva 2, Tallinn, 10111, Estonia
In 2026, a Dutch crypto business typically needs CASP authorization under MiCA, not the legacy AML-only model. The Netherlands combines AFM authorization with DNB prudential oversight.
Book a CASP readiness assessmentA crypto license in Netherlands now means, in most cases, authorization as a Crypto-Asset Service Provider (CASP) under MiCA. The pre-MiCA Dutch regime built around DNB AML registration is no longer the main route for firms that provide regulated crypto-asset services in the EU market.
For founders, boards and compliance leads, the Dutch proposition is clear: a serious EU jurisdiction with strong supervisory expectations, real substance requirements and access to MiCA passporting after authorization and notification. The practical question is not whether the Netherlands is “easy”, but whether your model, governance and compliance stack are mature enough for Dutch scrutiny.
At RUE, we structure Dutch CASP projects around the full regulatory stack: MiCA + TFR/Travel Rule + Wwft + sanctions + governance + tax and substance. That is the difference between filing an application and building an operating business that can survive post-license supervision.
RUE supports Dutch CASP projects from scoping to filing readiness: service mapping, corporate setup, governance design, AML and Travel Rule framework, fit-and-proper preparation, application drafting and post-license operating support. Where needed, we align the licensing track with accounting, banking and Dutch substance planning.
In 2026, the relevant route is generally CASP authorization under MiCA. Legacy AML registration should not be confused with a full MiCA authorization.
The Dutch model is functionally split between AFM and DNB. Applicants should prepare for conduct, governance and prudential scrutiny rather than a single-point review only.
A Dutch CASP may provide cross-border services across the EU after authorization and the required passporting notification. This is not the same as instant operational freedom in every market.
Dutch readiness is not just a policy pack. Regulators expect workable controls for CDD/EDD, sanctions screening, wallet risk analysis, suspicious transaction reporting and Travel Rule operations.
A Netherlands CASP application is assessed on business model clarity, governance credibility, AML/CTF operability, ICT resilience and financial sustainability. The regulator does not review documents in isolation; it checks whether the operating model, website, client journey, outsourcing map and internal policies describe the same business.
The practical baseline usually includes:
A recurring Dutch issue is overreliance on group outsourcing without local control. If critical functions are delegated, the applicant still needs demonstrable oversight, escalation rights, board visibility and auditable vendor governance.
The applicant should have a real establishment in the Netherlands, not a mailbox structure. Substance is assessed in context: office, decision-making, management availability, local records and effective control over outsourced functions all matter.
The application must identify exactly which crypto-asset services are provided: custody and administration, exchange, execution, reception and transmission of orders, placing, transfer services, advice or portfolio management where applicable. Authorization is activity-based, not branding-based.
MiCA capital thresholds commonly referenced for CASPs are EUR 50,000, EUR 125,000 and EUR 150,000, depending on the service class. The highest-risk service in scope generally drives the minimum own-funds requirement.
Directors, qualifying shareholders and key function holders may be assessed for reputation, competence, time commitment and conflicts of interest. In practice, weak CV-to-role alignment and unclear reporting lines are frequent friction points.
The Dutch compliance stack extends beyond MiCA. Firms should be ready for customer due diligence, enhanced due diligence, sanctions and PEP screening, suspicious transaction reporting to FIU-Nederland, and crypto transfer data controls under the recast TFR.
Applicants should document access control, key management, segregation of duties, logging, backup, incident handling, wallet security and vendor oversight. For custody models, regulators typically focus on how private keys are generated, stored, recovered and access-controlled.
Compare Netherlands with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Dutch tax analysis should be separated from licensing analysis. A CASP authorization does not determine the final tax treatment of the business, and the VAT position of crypto-related services can differ materially depending on the exact service performed, contractual structure and whether the activity is treated as a financial-service-type exemption or a taxable advisory/technology service.
For planning purposes in 2026, founders usually review four layers in parallel:
Where licensing budget is concerned, minimum regulatory capital should not be confused with total launch cash. A more realistic formula is: minimum own funds + 12-month operating burn + compliance reserve + technology/security reserve + professional fees. For many Dutch CASP projects, the total implementation budget materially exceeds the formal capital threshold.
The Netherlands applies corporate income tax on company profits. Because tax bands and thresholds can change, the applicable rate should be confirmed with Belastingdienst or Dutch tax counsel at the time of structuring and filing. For related guidance, see our page on Netherlands crypto tax.
The standard VAT rate in the Netherlands is 21%. That does not mean every crypto service is taxed at 21%. Exchange-type services may be treated differently from software, consulting, token design, marketing or ancillary operational services. Blanket statements that “crypto is VAT exempt” are too broad for transaction planning.
If the Dutch CASP has local staff, management or secondees, payroll registration and wage tax compliance should be planned early. This is often overlooked in licensing budgets, especially where local substance is built shortly before filing.
In group structures, founders should review transfer pricing, intercompany service charges, IP ownership, financing flows and any withholding implications. Tax substance that contradicts licensing substance is a common red flag in regulated group setups.
A Dutch crypto license is not a one-time filing exercise. In 2026, the operating burden usually includes governance, AML/Travel Rule operations, incident handling, outsourcing oversight and recurring policy refresh.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
We classify the business model under MiCA, identify whether custody, exchange, transfer, advisory or platform elements are in scope, and define the likely capital tier.
We align the Dutch entity, ownership chain, substance model, management roles and banking strategy with the intended authorization scope.
We prepare the program of operations, governance set, AML and Travel Rule framework, outsourcing file, financial model and fit-and-proper package.
We test consistency across policies, website wording, onboarding flow, client terms, vendor map and risk controls before formal submission.
We support submission, regulator communication and evidence management during completeness checks and formal review.
We coordinate responses to AFM and DNB questions, refine documents where needed and help management prepare for deeper supervisory scrutiny.
After authorization, we assist with compliance operations, accounting coordination, policy refresh, banking documentation and change-management planning.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
No. In 2026, firms providing regulated crypto-asset services generally need CASP authorization under MiCA, not reliance on the old AML-only registration concept. Legacy Dutch registration should not be treated as equivalent to a full MiCA authorization.
The Dutch framework involves AFM and DNB, with FIU-Nederland relevant for suspicious transaction reporting. In practice, applicants should prepare for both conduct and prudential scrutiny, not a single-topic review.
The statutory review benchmark often cited is 105 working days after a complete application is accepted for review. Real end-to-end timing is often around 5-8+ months, because pre-filing preparation and regulator Q&A usually take substantial time.
The commonly referenced MiCA own-funds tiers for CASPs are EUR 50,000, EUR 125,000 and EUR 150,000. The applicable threshold depends on the services provided, and the highest-risk service in scope usually drives the minimum level.
Yes, foreign ownership is possible, but ownership transparency matters. The authorities may review the shareholding chain, UBO information, source-of-funds context and the suitability of qualifying holders. Opaque structures create avoidable friction.
Yes, real substance is generally expected. The Netherlands is not designed for mailbox-only regulated structures. The exact level of substance should be proportionate to the service scope, risk profile and outsourcing model, but effective local control is a core issue.
Yes, a startup can apply, but no-revenue status does not reduce regulatory expectations. The key issue is whether the applicant can show credible funding, realistic projections, competent management and an operationally workable compliance framework from day one.
Usually yes. Custody models tend to attract deeper scrutiny because they raise questions around private key control, segregation, recovery, access management, incident response and client asset protection. They also often push the project into a higher capital tier.
They need a workable Travel Rule operating model from launch where the rules apply. Whether that is handled through a software vendor, internal tooling or a hybrid workflow depends on the business, but manual, undocumented handling is usually not enough for scale.
Not automatically in the everyday sense. A Dutch CASP may use MiCA passporting across the EU after authorization and the required notification process. Passporting helps with market access, but local practical issues such as banking, consumer-facing conduct and marketing implementation still matter.
No. Licensing may improve the firm’s credibility, but banks and payment providers still apply their own risk-based onboarding standards. They typically assess AML maturity, sanctions exposure, source of funds, transaction profile and management credibility.
A material change in services, jurisdictions, outsourcing, custody design or governance should be assessed before implementation. In regulated practice, post-license change management is critical because the licensed scope, policy pack and real operating model must remain aligned.
The main obligations usually include governance maintenance, AML/CTF operations, sanctions screening, suspicious transaction reporting where required, Travel Rule handling, incident response, outsourcing oversight, record retention, accounting support and periodic policy review.