What an Italian crypto licence is and who needs one
Two ambiguities have to go first. The topic is a company applying for a permit, not a wallet or a stolen balance, and the permit has a legal name that differs from the phrase people search for.
The definition: an authorisation under Article 63 MiCAR
Definition. An Italian crypto licence is the CASP authorisation granted by CONSOB under Article 63 of Regulation (EU) 2023/1114 (MiCAR) and Article 16(1) of Legislative Decree 129/2024. The decision names the company, lists the crypto-asset services it may provide, and is entered in the public register of crypto-asset service providers kept by ESMA.
Two definitions from the Regulation sit behind that sentence. A cripto-attività (crypto-asset) is a digital representation of value or of a right that can be transferred and stored electronically using distributed ledger technology or similar technology (Art. 3(1)(5) MiCAR). A CASP is a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and which is allowed to do so under Article 59 (Art. 3(1)(15)). Searches for a crypto license Italy and for CASP authorisation land on the same instrument, and only the second wording appears in any decision CONSOB signs.
The ten crypto-asset services an authorisation can cover
CONSOB sets out ten crypto-asset services for which a provider may be authorised on its CONSOB: MiCAR e CASP page:
- custody and administration of crypto-assets on behalf of clients;
- operating a trading platform for crypto-assets;
- exchanging crypto-assets for funds;
- exchanging crypto-assets for other crypto-assets;
- executing orders for crypto-assets on behalf of clients;
- placing crypto-assets;
- receiving and transmitting orders for crypto-assets on behalf of clients;
- providing advice on crypto-assets;
- providing portfolio management on crypto-assets;
- providing transfer services for crypto-assets on behalf of clients.
Read that list as the perimeter of the future decision, not as a menu. The authorisation expressly names the services the provider may supply, and adding one later runs as an extension through the Article 62 and Article 63 procedure, not as a notification (Art. 59(6),(8) MiCAR).
Who has to be authorised, and who provides services under Article 60
Nobody may provide crypto-asset services in the Union except a person authorised as a CASP under Article 63, or a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager allowed to do so under Article 60 (EUR-Lex: Regulation (EU) 2023/1114 (MiCAR), Article 59). Two routes to the same market follow. A specialised provider obtains an authorisation from CONSOB; an already supervised intermediary may provide certain services on a notification to its competent authority, the servizi notificabili (notifiable services), while the rest stay behind an authorisation. One further rule closes the back door: a person who is not a CASP may not use a name, corporate name or marketing communication that gives the impression of CASP status or is likely to mislead on that point (Art. 59(5)).
What this page does not cover
Four neighbouring topics have their own pages on this site. The Regulation itself, asset-referenced tokens, e-money tokens and the white paper belong to the MiCA guide. The payment institution and electronic money institution licences on their merits belong to the licensing page for those two statuses. Step-by-step incorporation sits on the company registration page. Taxation of crypto-assets appears here in no figure at all: a rate without a primary source has no business on a page of this kind.
The Italian market after 1 July 2026: the official snapshot
Most pages ranking for this query describe a market that no longer exists, because they were written while the transitional regime was still running. The state of play below is given exactly as the two Italian authorities published it, with the date attached to every figure.
What ended on 30 June 2026 and what is reserved from 1 July
The pan-European transitional regime allowed providers lawfully operating before 30 December 2024 to continue until 1 July 2026, or until an authorisation under Article 63 was granted or refused, whichever came first, with member states free to shorten it or not to apply it at all (Art. 143(3) MiCAR). That window has closed. In their CONSOB and Banca d'Italia: joint press release, 30 June 2026 the two authorities stated that from 1 July, throughout the European Union, the provision of crypto-asset services to European clients is reserved exclusively to persons authorised as CASPs and to already supervised intermediaries that have filed a notification, and that providing those services without an authorisation breaches European Union rules. No grey area sits between those two positions.
The nine authorised operators named in the joint announcement of 30 June 2026
As at the joint CONSOB and Banca d'Italia announcement of 30 June 2026, CONSOB, working in close coordination with Banca d'Italia, had authorised eight crypto-asset service providers: CheckSig S.r.l., Conio S.r.l., CryptoSmart S.p.A., Hercle S.r.l., Hodlie S.r.l., Olliv Italia S.r.l., Riv Digital S.r.l. and Young Platform S.p.A. One banking intermediary, Banca Sella S.p.A., had filed a notification with Banca d'Italia, which brings the total in that announcement to nine authorised operators. The first of the eight came earlier: in a CONSOB: first CASP authorisation, 7 May 2026 communiqué the authority granted CheckSig S.r.l. Società Benefit its authorisation after the investigative procedure and a favourable opinion from Banca d'Italia, struck the company off the OAM register as a virtual asset service provider and entered it in the single European register.
Read that list as a snapshot tied to the date of the press release, not as a live count. Authorisations are granted, extended and withdrawn between announcements, so the figure above is accurate for 30 June 2026 and for nothing else.
Where the live list is kept: the ESMA register
ESMA keeps a public register that includes crypto-asset service providers (Art. 109(1) MiCAR), and the joint press release confirms the practical consequence: authorised operators are entered in the CASP register kept by ESMA and can offer their services in every EU country under the European passport regime. CONSOB itself points readers to the ESMA pages for the register and for the level 2 and level 3 measures. Anyone checking a counterparty, or checking this page, should read the ESMA: MiCA and the register of crypto-asset service providers entry rather than any secondary list, including this one.
What happened to operators that did not obtain authorisation
Italy ran its own version of the transition. Legal persons duly entered on 27 December 2024 in the special section of the register held under Art. 17-bis(1) of Legislative Decree 141/2010, the OAM register of virtual currency operators, could continue providing virtual currency and digital wallet services until 30 June 2026 if they had filed an Article 62 MiCAR application before 30 December 2025 (Normattiva: D.Lgs. 129/2024, Art. 45). Those that did not file stopped on that same date and were struck off by the OAM on its own initiative. Registered operators also had to publish on their websites and send to clients, by 30 September 2025, their plans for coming into compliance or closing in an orderly way, and to keep transaction data from 1 October 2025 for ten years. Operators left without an authorisation in at least one EU country after 30 June 2026 had to confine themselves to closing out client relationships, transferring or liquidating positions while still complying with conduct and AML rules, under piani di dismissione ordinata (orderly wind-down plans) required by ESMA. The regulators added a warning that founders of group structures should read twice: MiCAR protection applies only where the service is actually provided by a legal entity authorised in the Union, and not by another company of the same group, including a non-European one operating under the same brand.
The company behind the licence: permitted forms and what must sit in Italy
An authorisation is granted to a company, so the company comes first. Two rules govern it: one from the Italian decree on the permitted form, one from the Regulation on where the business must actually be.
S.p.A., S.a.p.a., S.r.l. or a cooperative
A specialised provider must take one of four forms: società per azioni (joint-stock company), società in accomandita per azioni (partnership limited by shares), società a responsabilità limitata (limited liability company) or società cooperativa (cooperative), under Art. 16(7)(a) of Legislative Decree 129/2024. Incorporation happens before the application, not alongside it, because the file has to describe an existing legal person with its own constitution and governance. Choosing the form with the licence in mind, rather than reworking it later, is the cheapest decision on the whole project, and it belongs to company registration in Italy rather than to the authorisation stage.
Registered office, effective management and the EU resident director
Article 59(2) MiCAR imposes three requirements at once, and a non-resident founder meets or fails all three at the structuring stage:
- the registered office sits in the member state where the company provides at least part of its crypto-asset services;
- the place of effective management sits in the Union;
- at least one member of the management body is resident in the Union.
Read together, those three lines mean an Italian authorisation cannot be held at arm's length from outside the Union. A registered address with no activity behind it, a board that meets abroad and a shareholder acting as sole director from a third country each break one of the three limbs.
What an authorised Italian CASP may do in addition
Beyond the crypto-asset services in its decision, a specialised provider may also issue asset-referenced tokens, offer them to the public and seek their admission to trading, provided it holds an authorisation under Article 21 MiCAR, and it may carry on connected and ancillary activities (Art. 16(7)(b) D.Lgs. 129/2024). Token issuance runs on its own track with its own approvals, and the MiCA authorisation page covers asset-referenced tokens, e-money tokens and the white paper regime that goes with them.
Capital: the corporate minimum is not the prudential minimum
Two different figures answer the question "how much capital do I need", and they come from two different bodies of law. Confusing them is the single most common error in the material published on this topic.
The three Annex IV classes and which services fall into each
Annex IV MiCAR sets the permanent minimum capital by class, and the class follows from the services applied for rather than from the size of the business:
- Class 1, EUR 50 000: execution of orders on behalf of clients, placing crypto-assets, transfer services, reception and transmission of orders, advice on crypto-assets and portfolio management.
- Class 2, EUR 125 000: everything in class 1, plus custody and administration of crypto-assets, exchanging crypto-assets for funds and exchanging them for other crypto-assets.
- Class 3, EUR 150 000: everything in class 2, plus operating a trading platform.
Anyone planning a venue is in class 3 from the first day, whatever else the business does. That is why the service perimeter is fixed before the capital is modelled, not after.
The "higher of" rule in Article 67(1) and what it means for a new company
Annex IV gives a floor, not the answer. Prudential safeguards must at all times be at least the higher of two amounts: the permanent minimum capital for the class, or one quarter of the previous year's fixed overheads, reviewed annually (EUR-Lex: MiCAR, Article 67 and Annex IV). A company that has not been trading for a full year computes the second limb on its projected fixed overheads for the first 12 months of providing services, submitted with the application for authorisation (Art. 67(2)). Two consequences follow. The requirement is not a constant, it moves with the cost base. And the overheads projection stops being a financial exercise the moment it is filed, because the supervisor reads it as the source of a binding number.
Own funds or an insurance policy
Cover can be provided by own funds in the form of Common Equity Tier 1 instruments, by an insurance policy covering the Union territories where the services are provided, by a comparable guarantee, or by a combination of these (Art. 67(4)-(5) MiCAR). A policy used for this purpose has conditions of its own: an initial term of at least one year, a cancellation notice period of at least 90 days, an authorised insurer, and provision by a third party. Its cover must extend to loss of documents, misleading statements, acts and omissions leading to a breach of the provider's duties, conflicts of interest, system failures and gross negligence in the custody of clients' crypto-assets and funds (Art. 67(6)).
Corporate capital compared with the prudential floor
Company law sets a separate and much lower bar. The minimum subscribed capital of an S.r.l. is EUR 10 000 (Art. 2463(2)(4) of the Civil Code), and of an S.p.A. EUR 50 000 (Art. 2327). Put the two rules side by side and the gap is obvious: an S.r.l. incorporated on the statutory minimum exists perfectly well as a company and fails the prudential requirement of even class 1. Capital has to be raised to the level Article 67(1) requires and held there permanently, subject to the annual review of the overheads limb.
Two figures come from company law and are labelled corporate minimum: an S.r.l. at EUR 10 000 under Art. 2463(2)(4) c.c., and an S.p.A. at EUR 50 000 under Art. 2327 c.c. Three come from Annex IV MiCAR and are labelled CASP prudential minimum: class 1 at EUR 50 000, class 2 at EUR 125 000 and class 3 at EUR 150 000. A cut-off line drawn at EUR 50 000 marks the class 1 prudential floor, and the S.r.l. bar at EUR 10 000 does not reach it.
The application file: what CONSOB actually reads
Article 62 MiCAR lists what the application must contain, and the list is long enough that assembling it is the real project.
The nineteen items of Article 62(2)
Nineteen items run from (a) to (s). Grouped by subject, they come to this:
- Identity and constitution: the name and the legal entity identifier, the legal form, the articles of association.
- Programme of operations: the crypto-asset services the applicant intends to provide and how they will be marketed.
- Prudential evidence: proof that the applicant meets the Article 67 requirements.
- Governance: a description of the governance arrangements, evidence of the reputation and competence of the members of the management body, and details of every direct and indirect holder of a qualifying holding.
- Controls and continuity: the internal control mechanisms, the AML and counter-terrorist-financing procedures, and the business continuity plan.
- ICT: technical documentation on the information and communication systems and the security arrangements, together with a description of the same in non-technical language.
- Client assets: a description of the procedure for segregating clients' crypto-assets and funds.
- Clients: the complaints handling procedure.
Four of those items are underestimated most often: the programme of operations, the evidence under Article 67, the non-technical ICT description and the segregation procedure. None can be lifted from another applicant.
Extra documents that depend on the services applied for
On top of the nineteen items, Article 62(2)(m) to (r) adds documents tied to individual services. Custody calls for a custody policy. A trading platform calls for operating rules and a system for detecting market abuse. Exchange services call for a non-discriminatory commercial policy and a pricing methodology. Execution of orders calls for an execution policy. Advice and portfolio management call for evidence of the knowledge and experience of the specific individuals providing them. Widening the perimeter after the file is built therefore opens several new workstreams at once.
Criminal record and fit-and-proper evidence
Proof of a clean criminal record, and of the absence of penalties under commercial, insolvency and financial services law or in respect of money laundering, terrorist financing, fraud or professional liability, is required for every member of the management body and for every direct and indirect holder of a qualifying holding (Art. 62(3)(a),(c) MiCAR). Italian law adds its own layer for the esponenti aziendali (corporate officers): reputation, propriety, competence, availability of time and an adequate collective composition of the body, under the decree adopted in implementation of Art. 26(3) of the banking act, while the requirements for the partecipanti al capitale (qualifying shareholders) come from the decree implementing Art. 14(2) of the financial services act (Art. 17(8),(9) D.Lgs. 129/2024). Chapter 3 of the Banca d'Italia Provvedimento adopted on 30 September 2025, in force 15 days after publication in the Gazzetta Ufficiale, applies that suitability assessment to CASPs authorised under Article 63 MiCAR and Article 16 of the decree.
Forms, EU level 2 rules and the CONSOB template
Format is prescribed rather than left to the applicant. Delegated Regulation (EU) 2025/305 specifies the content of the information in the application, and Implementing Regulation (EU) 2025/306 sets the formats, templates and standard procedures, both as recorded on the CONSOB MiCAR and CASP page. CONSOB has published its own application form with guidance on completing it, updated on 27 October 2025. Working from an older version of the template is a straightforward way to lose the completeness check.
The statutory timetable and the official fee
Only two things about timing are verifiable: the statutory deadlines in the Regulation and the fee payable at filing. Everything else depends on the file. The sequence below follows the instruments.
- Prepare the structure: a company in one of the four permitted forms, a registered office in Italy where part of the services is actually provided, effective management in the Union and at least one EU-resident director.
- Fix the service perimeter among the ten services, which sets the Annex IV class and the starting figure for the capital calculation.
- Run the "higher of" calculation against a quarter of the projected fixed overheads for the first 12 months.
- Assemble the Article 62(2) file, the service-specific documents and the criminal record evidence, on the CONSOB form in its 27 October 2025 version.
- File by PEC and pay the supervisory contribution of EUR 20 000 at the moment of filing.
- Acknowledgement of receipt: 5 working days
- Completeness check: 25 working days
- Reasoned decision on a complete file: 40 working days, with Banca d'Italia's opinion involved.
- Notification of the decision to the applicant: 5 working days
- Transmission to ESMA: 2 working days, with publication in the register by the date the services start.
Filing: PEC, the CONSOB form and the EUR 20 000 supervisory contribution
Applications go to CONSOB or to Banca d'Italia by posta elettronica certificata (certified electronic mail), on the dedicated form and with the enclosures, as the Banca d'Italia: market access for crypto-asset service providers page states. The contributo di vigilanza (supervisory contribution) of EUR 20 000 was introduced by CONSOB delibera 23700/2025, published on 1 December 2025; under Article 4 of that delibera it falls on persons filing a CASP application and is paid at the moment of filing (CONSOB: MiCAR e CASP). Note what the figure is: a state charge levied by the supervisor, not an adviser's fee.
The regulatory clock: 5, 25 and 40 working days
Article 63 MiCAR runs the procedure on three deadlines. The competent authority acknowledges receipt of the application within 5 working days. It checks the completeness of the file within 25 working days. It adopts a fully reasoned decision to grant or refuse within 40 working days of receiving a complete application, and notifies the applicant of that decision within 5 working days (Art. 63(1),(2),(9)).
Requests for further information and the 20 working day suspension
The assessment period is not continuous. A request for further information may be made no later than the 20th working day of that period, and time then stops running, but for no more than 20 working days (Art. 63(12)). Completeness of the file at the outset therefore governs the calendar more than the speed of the authority does.
Grounds on which authorisation is refused, and what follows a decision
Refusal follows where the management body poses a threat to sound and prudent management or to the client's interests, or creates a serious risk of money laundering or terrorist financing; where the members of the body fail the requirements of Article 68(1); where the qualifying holders lack sufficient reputation under Article 68(2); or where the applicant does not meet, or is likely not to meet, the requirements of Title V. Refusal is mandatory where the laws of a third country applicable to persons with whom the applicant has close links prevent effective supervision (Art. 63(8),(10)). On a grant, the authority communicates the details to ESMA within 2 working days and ESMA publishes them in the register by the date the services begin (Art. 63(13)).
| Requirement | Figure | Article or source | Authority |
|---|---|---|---|
| Prudential minimum, class 1 | EUR 50 000 | Annex IV MiCAR | CONSOB |
| Prudential minimum, class 2 | EUR 125 000 | Annex IV MiCAR | CONSOB |
| Prudential minimum, class 3 | EUR 150 000 | Annex IV MiCAR | CONSOB |
| Alternative prudential floor | one quarter of fixed overheads | Art. 67(1)(b) MiCAR | CONSOB |
| Corporate minimum capital, S.r.l. | EUR 10 000 | Art. 2463(2)(4) c.c. | Register of Companies |
| Supervisory contribution on filing | EUR 20 000 | delibera CONSOB 23700/2025 | CONSOB |
| Acknowledgement of receipt | 5 working days | Art. 63(1) MiCAR | CONSOB |
| Completeness check | 25 working days | Art. 63(2) MiCAR | CONSOB |
| Reasoned decision on a complete file | 40 working days | Art. 63(9) MiCAR | CONSOB |
| Maximum suspension of the assessment | 20 working days | Art. 63(12) MiCAR | CONSOB |
Passporting an Italian CASP authorisation across the EU
One authorisation, twenty-seven markets. The mechanism has a procedure behind it, and the procedure is worth knowing before the launch plan is written.
Establishment and the freedom to provide services
An authorised provider may supply its services throughout the Union, either through the right of establishment, including through a branch, or through the freedom to provide services, and cross-border activity requires no physical presence in the host member state (Art. 59(7) MiCAR). Keep that separate from the substance requirement of Article 59(2): what is dispensed with abroad is presence in the host state, while the office, the effective management and the EU-resident director in the home state stay exactly where they were.
The notification mechanics: 10 working days and the 15th calendar day
Passporting runs through the home authority. The provider submits the list of member states in which it intends to operate, the list of services, the intended start date and the list of any other activities. The home authority transmits that information to the single points of contact of the host states, to ESMA and to the EBA within 10 working days. Work may begin from the date the provider is notified of that transmission or, at the latest, on the 15th calendar day after the information was submitted (Art. 65(1)-(4)).
The ESMA register as public evidence of the passport
Publication is not decoration. An entry in the ESMA register is what makes the status checkable by a counterparty, a bank or a payment partner without asking the provider for its own paperwork, and the joint press release of 30 June 2026 ties the two together: authorised operators are in the register and can offer their services across the Union on that basis. Anyone who wants the live position on an Italian operator reads the ESMA: MiCA and the register of crypto-asset service providers entry.
What the authorisation obliges the company to do afterwards
Obligations start on the day of the grant, and several of them are visible from outside the company, which is what makes them easy for a supervisor to check.
Conduct and what has to be published on the website
A provider must act honestly, fairly and professionally in the best interests of its clients, and all information it addresses to them, marketing communications included, must be fair, clear and not misleading. Two publication duties follow: the policy on prices, costs and fees goes in a prominent place on the website, and the same place carries information on the principal adverse impacts on the climate of the consensus mechanism used to issue each crypto-asset in relation to which services are provided (Art. 66(1),(2),(4),(5) MiCAR).
Records and client funds
Records of all crypto-asset services, activities, orders and transactions are made available to clients on request and retained for five years, or for up to seven years where a competent authority requests it before the five years expire (Art. 68(9)). Clients' funds other than e-money tokens must be placed with a credit institution or a central bank by the end of the business day following the day of receipt, in an account separately identifiable from the provider's own accounts; that rule does not apply to providers that are themselves electronic money institutions, payment institutions or credit institutions (Art. 70(3),(5)).
Ongoing supervision: what each authority looks at
Supervision after the grant follows a twin peaks split (Normattiva: D.Lgs. 129/2024, Art. 17). CONSOB is responsible for transparency, proper conduct, orderly trading and client protection, which in practice means the duty to act in the client's best interest, the procedures and internal controls, the knowledge and competence of staff, record keeping, conflicts of interest, complaints handling and the transparency duties of Title V (Art. 17(1),(2)). Banca d'Italia takes capital adequacy and risk containment, the officers and the holders of capital, the piano di liquidazione ordinata (orderly wind-down plan), corporate governance, organisational structure, internal controls, outsourcing, business continuity and the arrangements for custody and segregation of clients' crypto-assets and funds (Art. 17(3)). One competence cuts across the split: supervision of a trading platform under Article 76 MiCAR sits with CONSOB, whoever operates the platform (Art. 17(5)).
How an authorisation is withdrawn
Withdrawal is mandatory in defined cases: the provider has not used the authorisation within 12 months of the grant, has provided no crypto-asset services for nine consecutive months, obtained the authorisation by improper means, no longer meets the conditions under which it was granted, lacks effective systems against money laundering and terrorist financing, or has seriously breached the Regulation (Art. 64(1)). Withdrawal may be partial, limited to a specific crypto-asset service, and on withdrawal the provider must ensure the timely and orderly transfer of clients' crypto-assets and funds to another provider (Art. 64(4),(8)).
Penalties for providing crypto-asset services without authorisation
Two separate regimes attach to unauthorised activity in Italy, one criminal and one administrative, and the figures below are the reason the question "do we really need the licence" answers itself.
Criminal liability under Article 30
Providing crypto-asset services governed by Regulation (EU) 2023/1114 in breach of Article 59(1)(a) is punished by imprisonment of six months to four years and a fine of EUR 2 066 to EUR 10 329 (Normattiva: D.Lgs. 129/2024, Art. 30). The same article covers three neighbouring offences: offering asset-referenced tokens to the public or seeking their admission to trading without the authorisation required by Art. 16(1)(a) MiCAR, issuing e-money tokens in breach of the reservation in Art. 48(1) MiCAR, and offering e-money tokens without the written consent of the issuer. Italian practice calls the whole family abusivismo (unauthorised activity).
Administrative fines under Article 31
Administrative penalties run alongside the criminal ones. Legal persons face EUR 30 000 to EUR 5 000 000 or, where greater, up to 3%, 12.5% or 5% of total annual turnover depending on the type of breach; individuals, including corporate officers, face EUR 5 000 to EUR 700 000 (Normattiva: D.Lgs. 129/2024, Art. 31). Where the benefit obtained by the offender exceeds the maximum penalty, the fine rises to twice that benefit, provided its amount can be determined (Art. 31(2)).
| Who and what | Sanction | Article |
|---|---|---|
| Any person providing crypto-asset services in breach of Art. 59(1)(a) MiCAR | imprisonment from 6 months to 4 years plus a fine of EUR 2 066 to EUR 10 329 | Art. 30(1) D.Lgs. 129/2024 |
| Legal persons, administrative sanction | EUR 30 000 to EUR 5 000 000, or up to 3%, 12.5% or 5% of total annual turnover depending on the breach | Art. 31(1)(a) D.Lgs. 129/2024 |
| Individuals, including corporate officers | EUR 5 000 to EUR 700 000 | Art. 31(1)(b) D.Lgs. 129/2024 |
| Where the profit obtained exceeds the cap | up to twice the profit obtained, where its amount is determinable | Art. 31(2) D.Lgs. 129/2024 |
How supervisors react to suspected abusivismo
Enforcement has a procedure of its own. On reasonable suspicion that someone is providing crypto-asset services in breach of Art. 59(1)(a), Banca d'Italia or CONSOB may report the facts to the public prosecutor so that the measures under Art. 2409 of the Civil Code may be applied, or apply to the court for them, and the company bears the cost of the inspection itself (Art. 17(10) D.Lgs. 129/2024). Penalties in this area are therefore not a distant abstraction: an authority can open the procedure on suspicion alone, and the target pays for the examination of its own affairs.
Why the group structure does not shield anyone
The regulators addressed group arrangements directly in the joint announcement of 30 June 2026: MiCAR protection applies only where the service is actually provided by a legal entity authorised in the European Union, and not by another structure of the same group, including a non-European one operating under the same brand without a MiCAR authorisation. Clients are told to check which legal entity is actually providing the service. A brand shared between a licensed EU company and an offshore operating entity therefore protects nobody, and marks the structure out rather than hiding it.
Non-EU firms, reverse solicitation and the limits of the exemption
A share of enquiries arrives with the same proposition: a third-country platform wants European clients without a European authorisation. One narrow exemption exists, and it is narrower than the plans built on it.
The narrow exclusive-initiative exemption
Where a client established or situated in the Union initiates at its own exclusive initiative the provision of a crypto-asset service by a third-country firm, the authorisation requirement in Article 59 does not apply to that service (Art. 61(1) MiCAR). Frame that as an exemption from a prohibition, not as a route to market. The provision covers a service the client went looking for, and nothing beyond it.
Why solicitation and disclaimers do not save the structure
Three limits sit in the same article. A third-country firm that solicits clients or prospective clients in the Union by any means of communication, including through a person acting on its behalf or having close links with it, is not treated as providing the service at the client's exclusive initiative. No contractual clause and no disclaimer changes that characterisation. And a client's exclusive initiative does not entitle the firm to market new types of crypto-assets or crypto-asset services to that client (Art. 61(1)-(2)). Sollecitazione inversa (reverse solicitation) survives only where there was genuinely no solicitation at all.
The supervisors' own reading
CONSOB set out the practical position in a notice of 23 April 2026: operators outside the European Union may not provide MiCA services to European investors, save inside the narrow reverse solicitation exemption. Where a business model involves any marketing in the Union, the live question stops being the exemption and becomes the choice of authorisation route, which brings the discussion back to the Article 16 split between CONSOB and Banca d'Italia.
How we work on a CASP authorisation
Work on an authorisation splits into three stages, and the first one decides most of what the other two cost in time. Pricing on request, through the contact form.
Structuring review before the file is opened
Before anything is drafted we check the structure against the rules that will be applied to it: the company form measured against the four permitted by Art. 16(7)(a); the service perimeter and the Annex IV class that follows from it; the calculation under Article 67(1) against projected fixed overheads for the first 12 months; at least one EU-resident director; the place of effective management; and whether the registered office in Italy corresponds to services actually provided there, as Article 59(2) requires. A negative answer to any of those is cheaper to find before the file opens than after the completeness check.
Building the Article 62 file
Assembly covers the nineteen items of Article 62(2) and the documents specific to the chosen services: the programme of operations with the marketing description, the governance description, the ICT documentation and its non-technical companion, the segregation procedure, the complaints handling procedure, and criminal record and suitability evidence for the management body and the qualifying shareholders. Filing goes by PEC on the CONSOB form. One adjacent point belongs to this stage rather than to marketing: Article 59(5) MiCAR bars an unauthorised person from using a name that creates the impression of CASP status, which turns the choice of name into a regulatory question and makes an Italian trademark filing part of the same conversation.
After the decision
Once the decision is signed the work changes shape: the entry in the ESMA register, passport notifications for each member state where the company intends to operate, the conduct, records and client-fund obligations described above, the prudential cover maintained through the annual review of one quarter of fixed overheads, and an extension of the authorisation whenever a new crypto-asset service is added. If you want us to look at a specific structure, start the onboarding form and describe the services you plan to provide.
From our practice
Accuracy note: this page states the position under the instruments cited, as published at the update date, and is not legal advice. The number of authorised operators is given as at the joint CONSOB and Banca d'Italia announcement of 30 June 2026; the live list is the register kept by ESMA. Sources verified 6 to 8 September 2026.
Frequently asked questions about the Italian crypto licence
Authority, licence and company
Who issues a crypto licence in Italy, CONSOB or the Bank of Italy?
Both, in different roles. CONSOB, having heard Banca d'Italia, authorises a specialised CASP under Article 63 MiCAR and Article 16(1) of Legislative Decree 129/2024. Banca d'Italia, having heard CONSOB, authorises electronic money institutions and payment institutions to provide crypto-asset services under Article 16(5) and 16(6).
What is a crypto licence in Italy?
An Italian crypto licence is the CASP authorisation granted by CONSOB under Article 63 of Regulation (EU) 2023/1114 (MiCAR). The decision lists the specific crypto-asset services the company may provide, out of the ten services CONSOB identifies. Adding a service later requires an extension of the authorisation under Articles 62 and 63.
What company form and how much capital does an Italian CASP need?
A specialised CASP must be an S.p.A., S.a.p.a., S.r.l. or a cooperative under Article 16(7)(a). Corporate capital and prudential capital are separate requirements: the 10 000 EUR minimum of an S.r.l. does not meet even the class 1 prudential figure of 50 000 EUR set by Annex IV MiCAR.
Do I need an EU resident director for an Italian crypto licence?
Yes. Article 59(2) MiCAR requires at least one director resident in the Union, the place of effective management in the Union, and a registered office in the member state where the company actually carries out at least part of its crypto-asset services. The licence cannot be held at arm's length.
Money, time and the current market
How long does CASP authorisation take in Italy?
Only the statutory clock is verifiable. Under Article 63 MiCAR the authority acknowledges receipt within 5 working days, checks completeness within 25 working days and adopts a reasoned decision within 40 working days of a complete file, with a suspension of no more than 20 working days.
What does an Italian crypto licence cost in official fees?
CONSOB charges a supervisory contribution of 20 000 EUR, payable when the application is filed, introduced by delibera 23700/2025. Separately, prudential safeguards of 50 000, 125 000 or 150 000 EUR apply by service class, or one quarter of fixed overheads where that figure is higher.
How many CASPs are authorised in Italy?
As at the joint CONSOB and Banca d'Italia announcement of 30 June 2026, eight CASPs had been authorised, plus one bank, Banca Sella S.p.A., operating through notification, making nine authorised operators. The live list is the public register of CASPs kept by ESMA.
Scope, risk and alternatives
Can an Italian CASP licence be passported to other EU countries?
Yes. Under Articles 59(7) and 65 MiCAR a CASP may operate across the Union through establishment or the freedom to provide services, with no physical presence required in the host state. The home authority forwards the notification within 10 working days and activity may start by the 15th calendar day.
What happens if crypto services are provided in Italy without authorisation?
Article 30 of Legislative Decree 129/2024 sets criminal liability of six months to four years of imprisonment plus a fine of 2 066 to 10 329 EUR. Article 31 sets administrative fines of 30 000 to 5 000 000 EUR for companies, or up to 12.5% of annual turnover, and 5 000 to 700 000 EUR for individuals.
What happened to companies registered with OAM as VASPs?
Operators regularly entered in the special OAM section on 27 December 2024 that filed an Article 62 application by 30 December 2025 could continue until 30 June 2026, or until a decision. Those that did not file stopped on that date and were struck off by OAM on its own initiative.
Can a non-EU exchange serve Italian clients without a licence?
Only inside the narrow exemption of Article 61 MiCAR, where a client established in the Union approaches the firm at its own exclusive initiative. Any solicitation of clients in the Union removes the exemption, no contractual clause or disclaimer changes that, and new services may not be marketed on the back of it.
Can the licence be withdrawn after it is granted?
Yes. Under Article 64 MiCAR withdrawal is mandatory where the authorisation has not been used within 12 months, where no crypto-asset services have been provided for nine consecutive months, or where the CASP no longer meets the conditions. Withdrawal may be partial and limited to one service.
Is an EMI licence an alternative to a CASP licence?
An EMI licence is a different route rather than a substitute. Banca d'Italia, having heard CONSOB, authorises electronic money institutions and payment institutions to provide crypto-asset services where ring-fenced assets have been set up. Initial capital is at least 350 000 EUR for an EMI and 125 000 EUR for a payment institution providing services 1 to 5.
By Marta De Luca, Regulatory and Licensing Lead, Milan office. Marta De Luca works on authorisations: who has to be licensed in Italy, by which authority, and what the file has to contain. Four years inside the compliance function of an Italian payment institution taught her what a supervisor actually reads.
Reviewed by Giulia Mancini, Head of Corporate Formation. Updated 9 September 2026.