For crypto-asset operators choosing where to apply for a MiCA CASP license in 2026, the question is no longer "which jurisdiction has the lightest regulation" — MiCA harmonizes the substantive requirements across all 27 EU member states. The question is "which jurisdiction processes the application fastest, with the most predictable timeline, at the lowest operational cost". Two years into the practical implementation phase, the answer that consistently emerges from operators on the ground is Portugal — and specifically Madeira's free trade zone. This guide walks through the CASP license process step by step, with specific focus on what makes Madeira the fastest viable route to a fully-passportable EU license, and what the common pitfalls are at each stage.
What MiCA actually requires
MiCA — the Markets in Crypto-Assets Regulation — has been fully enforced across the EU since the second half of 2025, with the final transitional period for existing operators ending in July 2026. After that date, any entity providing crypto-asset services to EU customers without a CASP license will be operating illegally. The framework covers:
- Custody and administration of crypto-assets on behalf of clients;
- Operation of trading platforms for crypto-assets;
- Exchange of crypto-assets for funds (fiat) or other crypto-assets;
- Execution of orders for crypto-assets on behalf of third parties;
- Placing of crypto-assets;
- Reception and transmission of orders;
- Advice and portfolio management on crypto-assets;
- Transfer services for crypto-assets.
Each service category has its own minimum capital requirement (€50,000 to €150,000) and operational requirements. Most operators apply for a combined license covering multiple services, which is allowed but increases capital requirements proportionally.
The single most important property of the CASP license is passportability: once granted by any one EU member state's National Competent Authority (NCA), the license allows the holder to provide services across all 27 member states without separate authorization in each. The choice of which NCA to apply to is therefore primarily a logistical and strategic decision, not a regulatory scope decision.
Why Madeira specifically
Madeira is an autonomous region of Portugal, regulated by Portugal's national competent authority — the Comissão do Mercado de Valores Mobiliários (CMVM). From a MiCA standpoint, a CASP license issued through Madeira is identical in scope and validity to one issued through any other EU jurisdiction. What differs is the operational environment around the application.
Three properties make Madeira the operational sweet spot in 2026:
- Madeira International Business Centre (IBC) tax regime. Companies registered under the IBC regime benefit from a corporate tax rate of 5% on income generated outside Portugal — significantly lower than mainland Portugal's standard rate of approximately 21%, and competitive with the EU's tax-favorable jurisdictions. The regime is approved by the European Commission and runs at least through 2027 with renewal expectations beyond.
- CMVM application throughput. Portugal received a moderate volume of CASP applications relative to France, Germany or Italy. Lower queue depth translates to faster review cycles. As of Q1 2026, average CMVM CASP authorization timelines have been running between 4 and 7 months from complete-application submission to license grant — among the fastest in the EU. France's AMF has been running 8-12 months; Germany's BaFin 12-18 months; Italy's Consob 9-14 months.
- English business operability. While Portuguese is the official regulatory language, CMVM accepts substantial application documentation in English (with Portuguese translations of core legal documents), and Madeira's professional ecosystem operates fluently in English. This reduces translation costs and time relative to jurisdictions where full translation is required.
The trade-off relative to larger jurisdictions: Madeira (and Portugal generally) is not the location where you would build a full European retail brand. The depth of the local market is small. But for operators whose primary market is European-wide via passport, the Madeira route delivers the license in roughly half the time at lower ongoing cost than alternatives.
The CASP license process — step by step
Step 1: Establish a Portuguese legal entity
Before applying for the CASP license, the operator needs a registered Portuguese (or Madeira-domiciled) legal entity. This typically takes 1 to 3 weeks depending on the corporate structure chosen. Most operators register a Sociedade por Quotas (LDA) for simpler structures or a Sociedade Anónima (SA) for operations expecting external capital.
For Madeira IBC benefits, the entity must be specifically registered under the IBC regime — this requires registration with the SDM (Sociedade de Desenvolvimento da Madeira) and includes operational substance requirements: at least 1-2 employees in Madeira (depending on operational scale) and demonstrable economic activity in the region. The substance requirement is the area where most operators initially underestimate cost.
Step 2: Build the regulatory application package
The CMVM CASP application package is approximately 250-400 pages of documentation, depending on the scope of services. Core components include:
- Business plan and operational model — including projected volumes, target client base, revenue model, geographic distribution, three-year financial projections, and capital adequacy demonstration.
- AML/CFT framework — written policies covering customer onboarding (KYC), ongoing monitoring, suspicious transaction reporting, sanctions screening, and PEP identification. The AML/CFT framework must be aligned with the EU's 6th AML Directive and Portugal's national AML law.
- Operational risk management — including governance arrangements, internal control framework, business continuity plans, IT and cybersecurity policies, outsourcing arrangements, and conflict of interest management.
- Custody arrangements (if custody is part of the service scope) — segregation of client assets, hot/cold wallet policies, key management procedures, insurance coverage, and disaster recovery for custodial systems.
- Senior management fitness assessments — covering board members, key managers, and beneficial owners. Each individual is assessed for professional experience, knowledge of crypto-assets, and personal integrity (criminal record checks, financial standing).
- Capital adequacy proof — €50,000 to €150,000 in initial capital depending on services, with documented funding source.
- Legal opinions — typically including a Portuguese law firm's opinion on the corporate structure and a tax opinion on the IBC regime application.
This step typically takes 3 to 5 months with experienced counsel. Operators attempting to assemble the package internally without local Portuguese regulatory counsel routinely take 6-9 months and submit packages that require significant rework.
Step 3: Submit to CMVM and respond to requests for information (RFIs)
Once the application package is submitted, the CMVM begins formal review. The first RFI typically arrives within 30 to 60 days of submission and contains requests for clarification, additional documentation, or operational adjustments. Most applications receive 2-4 rounds of RFIs before final review.
The areas that consistently generate the most RFI traffic in CMVM reviews:
- AML/CFT operational details — particularly around how customer risk classification is performed and how transaction monitoring rules trigger investigation;
- Custody segregation in practice — auditable wallet structures and recovery procedures;
- Outsourcing concentration — when significant operations are outsourced to third-party providers (custody tech, KYC tech, market making), CMVM probes the supervision and continuity arrangements;
- Senior management substance — particularly when key managers will be physically located outside Portugal, the regulator scrutinizes the actual decision-making and supervision arrangements.
Each RFI cycle typically takes 30 to 60 days to respond, depending on complexity. The total RFI cycle in successful applications averages 3 to 5 months.
Step 4: Final assessment and license grant
After RFI cycles conclude and the CMVM team is satisfied, the application moves to final committee review. Final approval typically takes 4 to 8 weeks after the last RFI response. Upon approval, the operator receives the formal CASP authorization, which is published in the CMVM register and the EU's centralized CASP register maintained by ESMA.
Total elapsed time from Step 1 to license grant, in successful Madeira-route applications running in parallel: 9 to 15 months. Operators starting from scratch in jurisdictions with longer review queues (Germany, France, Italy) typically extend this to 14-22 months.
Costs to budget
Realistic cost estimates for a complete Madeira CASP application, based on operations completing in 2025-2026:
- Portuguese legal counsel — €80,000 to €150,000 for full application support, depending on service scope complexity.
- Tax and corporate structuring — €15,000 to €30,000 for Madeira IBC structuring and tax opinions.
- Compliance technology — KYC/AML software, transaction monitoring, sanctions screening: €30,000 to €60,000 in implementation and first-year licensing.
- Initial capital reservation — €50,000 to €150,000 (held, not spent).
- Madeira IBC operational substance — €60,000 to €120,000 annually (1-2 local employees, office, supporting infrastructure).
- CMVM application fees — approximately €15,000 to €25,000 in regulatory fees.
Total cash investment to license grant: €250,000 to €450,000 depending on scope and complexity, plus the capital reservation. Operators typically extend by another €200,000 to €400,000 in the first year of operation to cover ongoing compliance, audit, and team buildout to operational scale.
Comparison with other EU CASP routes
For operators considering alternatives, the high-level comparison as of Q1-Q2 2026:
- France (AMF): Reputation: high. Timeline: 8-12 months. Cost: similar to Madeira but with higher ongoing operational costs in Paris. Best for operators whose primary distribution will be in France or French-speaking Europe.
- Germany (BaFin): Reputation: highest. Timeline: 12-18 months. Cost: 30-50% higher than Madeira. Best for operators serving German institutional clients where the BaFin badge carries marketing value.
- Italy (Consob): Reputation: moderate. Timeline: 9-14 months. Cost: similar to Madeira. Best for operators with Italian primary market.
- Lithuania: Reputation: developing. Timeline: 6-9 months (fastest after Madeira). Cost: lower than Madeira. Best for low-cost operators willing to accept reputational positioning.
- Cyprus: Reputation: contested. Timeline: 6-10 months. Cost: lower than Madeira. Best for operators with existing Cyprus operations from non-MiCA structures.
- Malta: Reputation: damaged. Timeline: 10-14 months. Cost: similar to Madeira. Historically the leader in crypto licensing pre-MiCA, now displaced by faster jurisdictions.
The pattern that emerges: Madeira occupies the cross-section of speed, reputation and cost that is hard to replicate elsewhere. France and Germany are slower; Lithuania and Cyprus are faster but with reputational concessions; Malta has lost the speed advantage that made it attractive five years ago.
Common pitfalls that delay or sink applications
Five recurring failure modes from operators who applied through Portugal in 2024-2026:
1. Inadequate operational substance in Madeira. Operators register the Madeira entity but staff and decision-making remain entirely outside Portugal. CMVM and tax authority both probe substance requirements; insufficient substance results in either license refusal or loss of IBC tax benefits. The minimum threshold is real local employment, real local decision-making for at least key supervisory functions, and real local accounting.
2. Underdeveloped AML/CFT framework. Many operators submit AML policies that are essentially copy-paste from generic templates, without genuine integration with the operator's actual customer base and transaction flows. CMVM identifies this immediately and requires extensive rework. Building the AML/CFT framework as a serious operational system from the start saves 2-4 months of RFI cycles.
3. Custody arrangements not auditable end-to-end. When the operator's custody design relies on third-party providers (which is standard), the operator must demonstrate end-to-end visibility — including the third-party provider's controls. Operators who present a "we trust our custody partner" position without evidence of supervision controls are routinely required to redesign before approval.
4. Senior management fitness gaps. Each named senior manager needs documented professional experience (typically 5+ years in financial services or crypto), demonstrable knowledge of MiCA-relevant subjects, and clean regulatory history. Operators who name founders without traditional finance backgrounds need to compensate with deep crypto-specific experience or supplement with experienced hires before submission.
5. Conflict of interest from token issuance. If the operator (or affiliated entities) has issued or plans to issue crypto-assets that will trade on the operator's platform, MiCA imposes specific conflict of interest provisions. Many operators underestimate the depth of disclosure and structural separation required, leading to extensive RFI cycles or scope reduction.
Frequently asked questions
How long does it take to obtain a MiCA CASP license in Madeira, Portugal in 2026?
The Madeira route to a full MiCA CASP license typically takes 9 to 15 months total, from initial entity registration to license grant. The CMVM (Portugal's national competent authority) has been processing CASP applications in 4 to 7 months from complete-application submission, which is among the fastest review timelines in the EU as of Q1-Q2 2026. The remaining 4-8 months go to entity setup, application preparation and RFI response cycles.
What is the cost of obtaining a MiCA CASP license through Madeira?
Total cash investment to license grant ranges from €250,000 to €450,000, including legal counsel (€80K-150K), tax structuring (€15K-30K), compliance technology (€30K-60K), Madeira IBC substance (€60K-120K annually), and regulatory fees (€15K-25K). Initial capital requirements of €50,000 to €150,000 are reserved separately, held not spent. First-year operational costs typically add €200,000 to €400,000 for ongoing compliance and team buildout.
Why is Madeira faster than other EU jurisdictions for CASP licensing?
Three reasons: (1) Portugal received a moderate volume of CASP applications relative to France, Germany or Italy, resulting in lower queue depth; (2) the CMVM processes applications in 4-7 months versus 8-18 months for larger jurisdictions; (3) English business operability reduces translation overhead and Madeira's professional ecosystem is set up for international financial services. The combined effect is roughly half the elapsed time of the Germany BaFin route.
What is the Madeira IBC tax regime?
The Madeira International Business Centre (IBC) is an EU-approved free trade zone tax regime offering a 5% corporate tax rate on income generated outside Portugal, compared to mainland Portugal's standard rate of approximately 21%. The regime requires real operational substance in Madeira (at least 1-2 local employees depending on scale, demonstrable local economic activity). The IBC regime has been approved by the European Commission and runs through at least 2027, with renewal expected.
Is the MiCA CASP license valid in all EU countries?
Yes. The MiCA CASP license is fully passportable across all 27 EU member states. Once granted by any one National Competent Authority — including the Portuguese CMVM — the license allows the holder to provide crypto-asset services in every EU country without separate authorization in each jurisdiction. This is one of the central design features of MiCA and the primary reason the choice of jurisdiction is a logistical decision rather than a market scope decision.
What services does a CASP license cover?
A MiCA CASP license can cover up to eight distinct service categories: custody and administration of crypto-assets, operation of trading platforms, exchange of crypto-assets for funds or other crypto-assets, execution of orders on behalf of third parties, placing of crypto-assets, reception and transmission of orders, advice and portfolio management, and transfer services. Operators apply for the specific combination of services they intend to offer; minimum capital requirements scale with the scope (€50,000 to €150,000).
What happens to crypto exchanges that do not obtain a CASP license by July 2026?
Exchanges and crypto-asset service providers operating in the EU without a CASP license after the July 2026 transitional deadline will be operating illegally and subject to enforcement actions including service suspension orders, fines (up to 5% of total annual turnover), and criminal liability for individual managers in serious cases. Existing operators are using the transitional period to either complete the CASP application process or wind down EU operations.
Can a non-EU company apply for a MiCA CASP license?
Non-EU companies cannot directly apply for a MiCA CASP license. The license is granted to legal entities incorporated in an EU member state. Non-EU operators wishing to provide services to EU customers must establish an EU subsidiary (for example, a Portuguese entity in Madeira), which then applies for the CASP license. The parent-subsidiary structure is permitted but the CMVM (or any other NCA) will assess the EU entity's standalone capability to comply with MiCA requirements, including governance, capital, and operational substance independent of the parent.
Can the CASP license be revoked after it is granted?
Yes. National competent authorities retain the power to revoke a CASP license if the holder fails to maintain ongoing compliance — for example, if AML/CFT obligations are breached, if capital adequacy falls below thresholds, if the holder ceases operations for 6+ months, or if the senior management fitness criteria are no longer met. License holders are also subject to ongoing supervision including periodic reporting (monthly, quarterly and annual), regulatory inspections, and material event notifications. Most license holders dedicate at least 1-2 full-time equivalents to ongoing compliance functions.
The ON3X perspective
Three closing observations:
1. The strategic question is no longer "if" but "when". For any crypto-asset operator with EU customer exposure, the post-July 2026 reality is binary: licensed or illegal. Operators still in evaluation mode in mid-2026 are running out of runway — even on the Madeira fast track, a 9-15 month process started today lands the license in mid-2027. The decisions that matter now are about which jurisdiction, not whether to apply.
2. Madeira's advantage is structural but not permanent. The current speed advantage is partly a function of relative application volume — as more operators choose Portugal, the CMVM queue will deepen and processing times will extend. The window of "fastest meaningful EU CASP route" is open today and likely through Q3-Q4 2026; by 2027 the gap with Lithuania, Cyprus and Italy may compress. Operators choosing the route now are capturing a timing advantage that won't be available indefinitely.
3. The license is the floor, not the ceiling. A successfully obtained CASP license proves regulatory compliance. It does not prove product-market fit, distribution capability, brand strength, or operational excellence. Many operators treat the license as the destination; in practice it is the starting line of a more demanding ongoing compliance regime, plus the actual hard work of building a regulated crypto business in 27 fragmented EU markets. The structural advantage goes to operators who treat the license as part of an integrated strategy, not as a standalone milestone.
For ON3X readers operating in the European market or considering it, the Madeira route is the path we have been recommending consistently throughout 2026 — not because it's the cheapest (it isn't, in absolute terms), but because the combination of speed, reputation, EU passport and tax efficiency is, in 2026, hard to replicate elsewhere. The operators who close this window in the next twelve months will have a structural advantage in the European crypto market through the rest of the decade.