MiCA Decoded is a 12-article weekly series for Bitcoin.com News, co-authored by LegalBison’s Co-Founding and Managing Directors: Aaron Glauberman, Viktor Juskin and Sabir Alijev. LegalBison advises crypto and FinTech companies on MiCA licensing, CASP and VASP applications, and regulatory structuring across Europe and beyond.

The Myth: You Can Get an Authorization in Just a Quarter

The crypto industry is not short of people who have read the regulation. By 2026, most operators, legal teams, and advisors working in the EU space are well past the stage of quoting the 40-working-day statutory figure as if it were a delivery promise. That timeline, drawn from MiCA Article 63(9), is widely understood to be one phase of a longer process, not the whole story.

The estimate that actually circulates, in boardrooms, in advisor briefings, and in project roadmaps, is considerably more sophisticated: three to six months. Sometimes stretching to seven at the pessimistic end. It accounts for some administrative lag, some back and forth between the regulator and the applicant, a degree of bureaucratic friction. It sounds reasonable. It is, in the experience of lawyers working through MiCA authorizations in 2026, still too optimistic by a factor of two or three.

The realistic timeline from submission to authorization for a well-prepared CASP application, submitted to a major EU National Competent Authority (NCA) under current conditions, is 8 to 12 months, depending on the jurisdiction.

This article maps exactly why, phase by phase, so that the gap between expectation and reality becomes not a surprise but a structure that can be understood and planned around.

Why the “1 to 3 Months” Estimate Falls Short

The one-to-three-month estimate is not naive. It reflects a genuine attempt to look beyond the statutory window and account for real-world friction. The problem is that it tends to account for the right variables in the wrong proportions, and to miss some entirely.

Most one-to-three-month estimates factor in: some delay before the formal assessment begins, perhaps one round of questions from the regulator, and a general buffer for administrative slowness.

Each of these instincts is correct. What the estimate typically misses is that each of these variables is significantly larger than intuition suggests, that they run sequentially rather than in parallel, and that there are additional variables, namely the fit and proper assessment process and hard calendar constraints, that rarely feature in informal planning conversations at all.

The result is an estimate that captures the shape of the process but compresses its scale. What follows is the uncompressed version.

Phase 1: The Completeness Gate

The most important number to understand before the 40-day assessment clock is the 25-day completeness check that precedes it. Under MiCA Article 63(2), an NCA has up to 25 working days from the date of receipt of an application to assess whether it is complete, by checking that all information required under Article 62(2) has been submitted.

The 40-day assessment clock does not start at submission. It starts only once the NCA has confirmed the application is complete and notified the applicant accordingly under Article 63(4).

If an application is found to be incomplete, the NCA sets a deadline for the applicant to provide the missing information under Article 63(2). If the applicant fails to provide the missing information by that deadline, the NCA may refuse to review the application altogether under Article 63(3).

The process does not simply reset. Rather, resolving these missing details via Requests for Information (RFIs) extends this initial phase significantly. This means an incomplete first submission can consume six to eight weeks before the formal assessment has started at all.

In current conditions, with every grandfathered firm approaching the July 1, 2026 deadline simultaneously, NCA inboxes are operating at elevated capacity. The average completeness phase is running 45 to 60 days, even for applications that clear on the first attempt.

The corrected understanding: The one-to-three-month estimate often implicitly treats submission as the start point. It is not. In practice, a firm may spend the first two months simply establishing the right to be assessed, before the 40-day clock under Article 63(9) has even begun.

Phase 2: RFI Cycles (The Pre-Clock Delay)

A structural feature of the MiCA process that the industry consistently underestimates is the Request for Information (RFI) cycle. Under MiCA Article 63(9) and 63(12), the formal 40-working-day assessment countdown cannot legally be suspended or paused for CASP applications. While the regulator can ask for more information during the assessment (no later than the 20th working day), it does not stop the clock.

Because of this strict limitation, regulators typically use the pre-clock completeness phase to issue their massive RFIs. They will not officially declare the application “complete” until they are satisfied with the answers. The cumulative burden of preparing substantive responses to multiple rounds of queries before the clock ever starts consumes significant time and legal resources. And this is not limited to CASPs: the same logic applies, for example, to Electronic Money Institutions (EMIs) and credit institutions, which are the organizations authorized to issue E-Money Tokens (EMTs, crypto-assets whose value references a single official currency).

RFIs are a standard feature of how NCAs review complex CASP applications covering governance structures, AML frameworks, market abuse monitoring policies, capital requirements, custody arrangements, and the fitness of the management body. The question is not whether an information request will arrive, but how many rounds of clarification it will take before the NCA finally allows the 40-day clock to begin.

The corrected understanding: Regulators cannot legally pause the 40-day clock, so they delay starting it. One to two RFI cycles is standard, and each cycle can take 4 to 8 weeks of pre-clock delay. A one-to-three-month estimate that accounts for some back and forth significantly underestimates this variable.

Phase 3: MiCA Fit and Proper Assessment Is Not a Checkbox

MiCA authorization is not only an assessment of systems, policies, and capital. It is an assessment of the people responsible for operating the entity. Under Article 68(1), members of the management body of a crypto-asset service provider must be of sufficiently good repute and possess the appropriate knowledge, skills, and experience, both individually and collectively, to perform their duties.

Under Article 68(2), shareholders and members with qualifying holdings are subject to a separate good repute assessment. Article 63(10) makes clear that the NCA must refuse authorisation where the management body poses a threat to effective and prudent management, or where its members do not meet the criteria set out in Article 68(1).

This is a substantive assessment, not a formality, and in 2026 it has become more demanding in practice than many planning conversations anticipate.

NCAs in several major jurisdictions, France and Ireland among them, now routinely schedule live interviews with members of the management body as part of the fit and proper evaluation. These interviews probe understanding of regulatory obligations, governance judgment, and the specific experience that qualifies an individual for their role in a licensed entity.

The scheduling of these interviews is where the underestimation tends to compound. Regulator availability, public holidays, and competing caseloads mean that a firm whose application is otherwise complete may wait four to six weeks simply for an interview date.

The 40-day assessment clock continues to run during this period, but since authorization cannot be granted until the fit and proper assessment is resolved, the practical effect on the authorization date is equivalent to a suspension.

The corrected understanding: The fit and proper assessment under Article 68 is a mandatory substantive requirement, not a procedural box-tick. While MiCA explicitly sets an imperative for physical presence (mandating that the place of effective management must be in the EU and at least one director must be an EU resident) regulators will test the substantive competence of the entire management body. Where NCAs require live interviews to verify this collective suitability, which is increasingly standard in major jurisdictions, the scheduling lag represents four to six weeks of additional lead time that is largely outside the applicant’s control.

Phase 4: Calendar Events Slowing Down the Process

The phases above describe procedural variables grounded in the regulation. There is a fourth category that sits outside the formal process but affects it materially in almost every engagement: the calendar.

NCAs are public institutions. They observe national public holidays. Staff take annual leave. Certain periods of the year are structurally slower for authorization processing regardless of application quality or applicant responsiveness.

This is simply how institutions operate, and it is a variable that experienced practitioners build into every timeline from the outset.

The 2026 context adds a specific multiplier to every row in this table. Under Article 143(3) of MiCA, crypto-asset service providers that provided services in accordance with applicable law before 30 December 2024 may continue to do so until 1 July 2026, or until they are granted or refused authorization under Article 63, whichever is sooner. Every firm relying on this transitional provision is now facing the same deadline. The volume of applications arriving simultaneously at NCAs that were already near capacity has produced a structural backlog that affects processing times across the board.

The corrected understanding: Calendar friction is rarely modelled in informal estimates because it feels like a soft variable. In practice it adds three to six weeks in aggregate to almost every authorization, and significantly more if submission timing is unlucky.

The Reality of the Timeline: Why Good Applications Still Stall

A technically flawless application is not immune to calendar drift. Founders often build their launch and staffing models around the statutory processing times, underestimating the human and administrative variables that govern the actual pace of a National Competent Authority (NCA).

To make an authorization timeline predictable, a good practice is to build buffers for the following practical realities:

• The “Completeness” Gate Delays the Clock: Under Article 63(9) of MiCA, the formal 40-working-day assessment period only begins after the NCA officially deems the application complete. If the regulator issues a reasonable request for clarification during the initial 25-working-day review phase (such as asking for additional source-of-wealth documentation for a beneficial owner), the timeline is paused until the applicant provides it.
• Calendar Drag and Human Factors: NCAs are staffed by human beings with standard working hours, seasonal leave, and national public holidays. Submitting an application in late November or right before a cluster of national holidays will inevitably introduce weeks of “calendar drag”.
• The Fit and Proper Scheduling Lag: As noted, the fit and proper assessment of the management body under Article 68(1) is a substantive review. Where NCAs require live interviews to verify this competence, coordinating the schedules of the executive team with the regulator’s availability can easily add four to six weeks of lead time that is entirely out of the services provider’s control.

The takeaway: A four-to-five-month estimate resulting in a six-month outcome is not a catastrophic regulatory miss, but it has real business consequences. When coordinating operational readiness, capital deployment, and commercial launch around a MiCA authorization date, planning for administrative friction does not make the process faster, but it does make the launch predictable.

The Complete Picture

Here is the full MiCA CASP authorization timeline, mapped phase by phase:

Phase 0 – Pre-Requisite Corporate Structure: A MiCA CASP authorization is granted to a legal entity (or an equivalent undertaking). This entity requires a credit institution account to deposit the share capital and must be structured to meet strict operational and substance requirements, specifically, the place of effective management must be in the EU, and at least one director must be an EU resident. The entity must be fully compliant with MiCA requirements, as well as DORA regulations governing the resilience and auditing of its technical and ICT infrastructure. We call it “Phase 0”, as it is the structural layer of the process, but it can be done in parallel with the other stages to some extent.

Phase 1 – Initial Completeness Check: Up to 25 working days. The NCA reviews the submission to determine if all required information is present. If anything is missing, they set a deadline for the applicant to provide it.

Phase 2 – RFI Cycles (The Pre-Clock Delay): One to two cycles is standard. Each cycle takes 4 to 8 weeks. Because regulators cannot legally pause the formal assessment clock once it starts, they use this pre-clock phase to issue Requests for Information and resolve all missing details.

Phase 3 – Fit and Proper Interviews: Scheduling lead time of 4 to 6 weeks in jurisdictions requiring live interviews. This, too, is typically finalized before the NCA officially stamps the application as complete.

Phase 4 – Formal Assessment: Exactly 40 working days. This strict statutory countdown only begins once Phases 1 through 3 are fully resolved. This clock does not pause. Any final clarifying questions must be issued by the 20th working day and do not stop the countdown.

Phase 5 – Calendar Friction: 3 to 6 weeks in aggregate. This depends on submission timing, public holidays, staff leave, and jurisdictional backlogs compounding across the entire process.

Realistic total: 8 to 12 months from submission to authorization.

The one-to-three-month estimate is not wrong in its instincts. It identifies the right landscape. What it misses is the true scale of the terrain. The ESMA CASP register reflects authorizations that took this long not because of inefficiency or bad faith, but because a process assessing the fitness of an entity to operate in regulated financial markets is genuinely complex, and complexity takes time.

Understanding that, with enough specificity to model each phase accurately, is what separates a timeline that surprises from one that does not.

Key Takeaways:

1. The industry estimate of 1 to 3 months is still too optimistic. It captures the right instincts but compresses the scale of each variable. The realistic figure for a well-prepared application under current conditions is 8 to 12 months.

2. Submission is not the start line. The 40-working-day assessment period only begins after the NCA formally declares an application complete. The completeness check is a separate phase where the NCA has up to 25 working days just to review the initial submission. If information is missing, the NCA sets a strict deadline for the applicant to provide the missing details, and may refuse to review the application entirely if that deadline is missed.

3. RFIs stall the timeline, but they do not pause the 40-day clock. Under MiCA, the formal 40-working-day assessment countdown cannot legally be paused for CASP applications. While the regulator can ask for more information during the assessment, they must do so no later than the 20th working day, and it does not stop the clock. Because of this strict deadline, regulators typically use the pre-clock completeness phase to issue their Requests for Information (RFIs). At least one multi-week RFI cycle should be factored into the initial phase of any realistic timeline.

4. The fit and proper assessment covers the management body and qualifying shareholders. Article 68(1) requires members of the management body to demonstrate good repute, knowledge, skills, and experience. Article 68(2) applies a good repute standard to qualifying shareholders. Where NCAs require live interviews, which is increasingly standard in major jurisdictions, a scheduling lag of 4 to 6 weeks should be built into any realistic timeline.

5. August and December are structural delays, not soft risks. An application whose completeness window or assessment period overlaps with the August or December-January break carries a default delay of 3 to 4 weeks, regardless of the quality of what was submitted.

6. The grandfathering deadline under Article 143(3) is a hard cliff, not a rolling extension. Firms that provided crypto-asset services under applicable national law before 30 December 2024 may continue until 1 July 2026 or until authorization is granted or refused, whichever comes first. This is a statutory deadline, not an administrative one. Applications still pending authorization after that date are operating without a lawful basis. In fact, if a Member State has opted to apply a reduced transitional period, this hard cliff will arrive even sooner than July 2026.

7. Pre-application preparation is where the battle is actually won (or lost). It’s not possible to retrofit compliance architecture after submitting the paperwork. Building structural independence, conducting collective suitability assessments, and aligning your entity with MiCA’s strict data and governance standards requires designing the organism before presenting it to the regulator. To survive this scrutiny, firms must partner with experienced legal counsel who understand the regulatory mechanics deeply enough to architect the firm correctly from day one.

This article was produced in partnership with LegalBison. The content is for informational purposes only and does not constitute legal advice.