MiCA License in Slovakia 2026

CASP authorization under MiCA vs the old VASP regime

The old VASP terminology is no longer the right starting point for new projects in 2026. For Slovakia, founders should think in terms of MiCA CASP authorization, not legacy-style VASP registration pages that still circulate online.

The key transition dates are:

• 30 June 2024 — MiCA stablecoin-related rules for ART and EMT tracks began applying;
• 30 December 2024 — the full MiCA CASP regime and TFR Travel Rule framework became applicable;
• 30 December 2025 — end of the main grandfathering context referenced by NBS practice for certain pre-existing providers;
• 2026 — new applicants should assume a fully MiCA-native authorization environment.

The practical difference is substantial. Under MiCA, the regulator expects a more structured authorization file, a clearer service map, stronger safeguarding logic, and a governance framework that integrates AML, DORA, outsourcing, complaints handling, and prudential controls. A legacy VASP mindset usually underestimates the depth of the current filing standard.

For a founder, the takeaway is simple: if you are launching now, build your dossier as a CASP in Slovakia, not as a historical VASP registration project.

What services require a Slovakia MiCA license

A business needs a Slovakia MiCA license when it provides one or more regulated crypto-asset services to clients on a professional basis. MiCA identifies 10 regulated crypto-asset services, and the exact combination matters because it drives class selection, capital, policy burden, and operational controls.

The 10 regulated crypto-asset services under MiCA

1. Custody and administration of crypto-assets on behalf of clients — relevant for custodial wallets and safekeeping models.
2. Operation of a trading platform for crypto-assets — relevant for venues matching third-party buying and selling interests.
3. Exchange of crypto-assets for funds — relevant for fiat on-ramp/off-ramp businesses.
4. Exchange of crypto-assets for other crypto-assets — relevant for swap and conversion services.
5. Execution of orders for crypto-assets on behalf of clients — relevant where the firm executes client instructions.
6. Placing of crypto-assets — relevant for distribution or offering arrangements without a firm commitment basis.
7. Reception and transmission of orders for crypto-assets on behalf of clients — relevant for broker-style models routing client orders.
8. Providing advice on crypto-assets — relevant for personalized recommendations.
9. Providing portfolio management on crypto-assets — relevant for discretionary management mandates.
10. Providing transfer services for crypto-assets on behalf of clients — relevant for arranging or executing transfers from one address or account to another for clients.

Business model examples founders actually recognize

• Exchange app: usually exchange of crypto for funds and/or crypto for crypto; may also trigger transfer and custody issues.
• Broker / OTC desk: often execution, transmission, exchange, and AML-heavy onboarding.
• Custodial wallet provider: custody service, safeguarding, reconciliation, key management, and incident controls.
• Advisory firm: advice only may be narrower in scope, but suitability of the recommendation process still matters.
• Managed crypto strategy: portfolio management and associated governance controls.
• Trading venue: operation of a trading platform, usually the most control-intensive retail-facing model.

The strongest applications map each business line to the exact MiCA service definition and then to the internal policy set. That service-to-control mapping is where many weak applications fail.

CASP classes, capital thresholds, and how to choose the right scope

The minimum capital thresholds under MiCA are straightforward: Class 1 — €50,000, Class 2 — €125,000, and Class 3 — €150,000. What is not straightforward is choosing the right scope. That is a legal and strategic decision, because the requested service set determines not only capital but also the intensity of governance, safeguarding, operational controls, and review scrutiny.

Class 1 is generally associated with narrower service sets such as custody-related activity. Class 2 typically covers intermediate service models such as brokerage, advice, portfolio management, exchange, or order-related services. Class 3 is generally relevant for operation of a trading platform and other higher-complexity models.

Two common founder mistakes appear at this stage. The first is over-scoping: applying for every service “just in case,” which increases the burden of proof and often slows the review. The second is under-scoping: filing for a narrow authorization that does not actually cover the intended product, which creates post-license restrictions and can trigger re-authorization work later.

The right approach is to map your real customer journey and ask four questions:

• Where do client assets touch your systems?
• Do you execute, route, advise, manage, transfer, or merely provide software?
• Do you operate a venue or only a bilateral service?
• Which functions are outsourced, and who keeps effective control?

RUE typically resolves class selection only after reviewing the business model, token exposure, wallet architecture, settlement flow, and passporting plan. That reduces the risk of filing for the wrong class and building the wrong policy stack.

Legal entity, substance, governance, and fit-and-proper requirements

A Slovak company for CASP authorization is usually formed as an s.r.o., but incorporation alone is not enough. NBS will assess whether the applicant has credible governance, transparent ownership, and effective management capable of running the proposed crypto-asset services in a compliant way.

Company form, registered office, and effective management

A registered office is a legal necessity; effective management is a supervisory necessity. Regulators and banks increasingly distinguish between a formal address and real operational substance. In practice, this means the applicant should be able to show who makes decisions, where oversight sits, how outsourcing is supervised, and whether the Slovak entity can evidence control over key risk areas.

A useful test is this: if NBS asks who can explain onboarding logic, safeguarding, vendor failures, customer complaints, or a wallet incident, can the Slovak entity answer without deferring everything to an external contractor? If not, the substance model is usually too thin.

Directors, shareholders, UBOs, and fit-and-proper review

NBS typically reviews management and ownership on a case-by-case basis. There is no safe basis for blanket claims such as “one director must be a Slovak citizen.” The more accurate position is that the regulator assesses whether the management and ownership structure is suitable, transparent, and proportionate to the business complexity.

Expect scrutiny of:

• CVs and role-specific experience;
• criminal record and integrity evidence;
• ownership chain and UBO disclosure;
• source of funds and, where relevant, source of wealth;
• conflicts of interest and governance independence;
• time commitment and actual availability of key persons.

One underappreciated point in 2026 is that fit-and-proper review increasingly interacts with outsourcing. If the proposed management team lacks the technical or operational capacity to oversee wallet providers, cloud vendors, white-label exchanges, or AML vendors, NBS may question whether governance is genuinely effective.

RUE supports this stage together with Legal Services in Slovakia and, where needed, banking preparation through Bank account in Slovakia.

Documents required for a MiCA license in Slovakia

A strong NBS application package is built in five layers: corporate, governance, AML, operational / IT, and financial. The regulator does not only check whether documents exist; it checks whether they are internally consistent and whether they describe a business that could actually operate compliantly.

Corporate and ownership documents

The corporate file usually includes incorporation documents, articles, ownership chart, UBO disclosures, passports or IDs, proof of address, and evidence supporting source of funds. Where ownership is layered, the chart should trace control clearly to the ultimate beneficial owners. Source-of-funds packages should be coherent, traceable, and supported by banking, tax, sale, dividend, or investment documentation as applicable.

Policies and procedures the NBS expects to see

The policy stack varies by service class, but a serious dossier often includes:

• AML/CFT policy and business-wide risk assessment;
• customer onboarding and KYC/KYB procedures;
• complaints handling procedure;
• conflicts of interest policy;
• outsourcing policy and oversight framework;
• safeguarding and reconciliation policy;
• custody / wallet control procedures where relevant;
• order handling or transmission procedures where relevant;
• market abuse controls for platform models;
• business continuity and incident response procedures;
• recordkeeping and governance documentation.

The differentiator is specificity. If the business claims to hold client assets, the safeguarding policy should explain wallet segregation, reconciliation frequency, authorization matrix, key ceremonies, and incident escalation. If the business routes transfers, the AML and TFR documents should explain Travel Rule data capture and counterparty handling. Generic policies are one of the fastest ways to trigger RFIs.

IT, cybersecurity, and DORA evidence pack

The IT file should describe the actual architecture: customer onboarding stack, wallet infrastructure, exchange engine or broker workflow, cloud environment, access controls, logging, monitoring, backup, recovery, and vendor dependencies. Since DORA applies, NBS will usually expect evidence of ICT governance, incident classification, third-party ICT risk management, and resilience testing logic.

One practical nuance many applicants miss is data lineage. If you cannot show where customer data, wallet data, Travel Rule data, and transaction monitoring outputs are stored and how they are reconciled, both compliance and DAC8 readiness become harder to defend later.

Post-licensing obligations in 2026: AML, Travel Rule, DORA, reporting, audit

A CASP authorization in Slovakia creates an ongoing supervised business. The firm must maintain compliance, not simply preserve a certificate. In 2026, the operational burden is shaped by four pillars: AML/CFT, TFR Travel Rule, DORA, and tax / data reporting readiness, including DAC8.

AML/CFT and suspicious transaction reporting

CASPs should maintain a risk-based AML framework covering onboarding, KYB, UBO verification, sanctions and PEP screening, transaction monitoring, escalation, and suspicious transaction reporting to the competent FIU where required. Recordkeeping periods should be checked against the applicable Slovak legal requirements, but firms should generally plan for long-form auditability rather than minimum-only retention.

One practical trend in 2026 is the increasing use of blockchain analytics not only for onboarding but for ongoing behavioral monitoring. Regulators expect firms to understand exposure to sanctioned wallets, mixers, darknet-linked flows, and typologies that may not be visible through fiat-side monitoring alone.

Travel Rule operations under TFR

Since 30 December 2024, the Travel Rule under Regulation (EU) 2023/1113 requires CASPs to collect, verify where applicable, and transmit originator and beneficiary information for in-scope transfers. This is an operational workflow, not a checkbox. Firms need data fields, screening logic, counterparty handling, exception management, and procedures for transfers involving unhosted wallets.

In practice, many firms use interoperability standards such as IVMS101 and connect to specialist Travel Rule networks. The legal point is simple: if your transfer flow is not technically able to exchange required information with counterparties, your compliance model is incomplete.

DORA operational resilience and incident reporting

DORA requires governance over ICT risk, not just technical controls. CASPs should maintain an ICT risk framework, incident classification and escalation logic, resilience testing, backup and recovery capability, and oversight of third-party ICT providers. Boards and senior management should be able to evidence oversight, not merely delegate everything to IT vendors.

DAC8 and tax-reporting readiness from 2026

DAC8 makes customer and transaction data architecture a board-level issue. If residency data, wallet identifiers, transfer metadata, and transaction categories are not captured cleanly at onboarding and execution stage, later reporting becomes expensive and error-prone. The best time to solve DAC8 is before launch, not after supervisory questions begin.

For broader operational preparation, founders often combine this page with Cryptocurrency Taxation in Slovakia and Accounting Services in Slovakia.