Vara licence application in Czech Republic
Operating a digital-asset business in the Czech Republic without proper authorisation is not a theoretical risk – it is an immediate exposure to enforcement, banking termination and reputational damage that compounds quickly. Since MiCA (the EU Markets in Crypto-Assets Regulation) became directly applicable across all member states, Czech operators and businesses seeking a Czech-anchored EU licence face a layered question: what regime applies today, what authorisation is required, and how does the Czech regulatory posture interact with the cross-border reality of serving users across Europe? The short answer is that the Czech National Bank (ČNB) is the competent authority for CASP authorisation (Crypto-Asset Service Provider) under MiCA, and that the pathway from application to authorisation demands careful preparation across legal, compliance and banking dimensions. This page sets out the regulatory perimeter, the application process, the cross-border considerations and the decision points an inbound operator should resolve before committing capital.
What regulatory regime governs crypto licensing in the Czech Republic?
The Czech Republic is an EU member state, and MiCA is directly applicable there without national transposition – meaning any entity providing crypto-asset services in or from the Czech Republic must obtain CASP authorisation from the Czech National Bank under the MiCA regime. There is no separate domestic "VARA" licence in the Czech Republic; the term is sometimes used loosely by operators familiar with Dubai's Virtual Assets Regulatory Authority, which is an entirely distinct regime applicable in Dubai. The Czech authorisation regime is governed by MiCA and supervised by the ČNB, with ESMA providing cross-cutting guidance to ensure consistency across national competent authorities.
Before MiCA's full application, Czech law required virtual asset service providers to register with the Czech Trade Licensing Office (Živnostenský úřad) and comply with AML/CFT obligations under the Czech AML Act, which implements the EU's anti-money laundering directives. That prior registration regime is now being superseded. Businesses that held the old registration are not automatically grandfathered into a MiCA CASP authorisation; they must apply through the new process. In our cross-border practice, we regularly advise operators who assumed the old registration would carry forward – it does not, and the gap between legacy registration and full CASP authorisation represents a live compliance exposure.
ESMA coordinates with the ČNB and other national competent authorities across the EU to ensure that the CASP authorisation standard is applied consistently. Passporting is the structural advantage: a CASP authorised in the Czech Republic may passport its services into other EU and EEA member states without requiring a separate authorisation in each of those markets. For an operator building a pan-European digital-asset business, the Czech Republic therefore functions as a potential EU entry point, not merely a single-country licence.
Who needs a CASP authorisation under MiCA in the Czech Republic?
Any legal entity providing one or more of the regulated crypto-asset services enumerated under MiCA to clients – whether in the Czech Republic or cross-border into other EU member states – requires CASP authorisation from the ČNB if it is incorporated in the Czech Republic or provides services from a Czech-based establishment. The MiCA regime defines regulated services broadly. They include operating a trading platform for crypto-assets, exchanging crypto-assets for fiat or other crypto-assets, executing orders on behalf of clients, providing custody and administration of crypto-assets on behalf of clients, placing crypto-assets, providing advice on crypto-assets and providing portfolio management in crypto-assets.
The inclusion of custody as a separately regulated activity is significant. A business that holds client assets – even as a technical intermediary – is in scope. So is a business that provides only advisory or portfolio management services. Token issuers are not automatically CASPs, but they may be subject to MiCA's whitepaper and disclosure requirements depending on whether their tokens qualify as asset-referenced tokens (ARTs), e-money tokens (EMTs) or other crypto-assets. In our practice, we see issuers underestimate the extent to which marketing and distribution activities pull them into CASP scope even when primary issuance does not.
The jurisdictional perimeter extends to the location of users, not only the location of the entity. A company incorporated outside the EU but actively targeting Czech or EU-resident clients may be subject to the MiCA regime through its EU nexus. Determining that nexus requires analysis of where marketing is directed, where contracts are concluded and where client assets are held – a cross-border analysis the ČNB and ESMA are increasingly applying with precision.
The process above describes the standard regulatory perimeter. Your specific facts – the entity structure, the services offered, the user base and the banking – will change the analysis materially. For a scoped assessment of your authorisation exposure, contact OBOLUS at info@oboluslaw.com.
How does the CASP application process work with the Czech National Bank?
The CASP application to the ČNB under MiCA is a structured administrative process that requires the applicant to demonstrate fitness across governance, capital, compliance, technology and AML dimensions before the ČNB will grant authorisation. The ČNB has published application requirements aligned to the ESMA guidelines on CASP authorisation, and the application package is substantial. Operators who approach it as a form-filling exercise rather than a substantive demonstration of institutional readiness consistently encounter delay or refusal.
The application must include: a detailed description of the services to be provided and the business model; governance arrangements, including the identity and fitness and propriety of shareholders with qualifying holdings and senior management; a programme of operations; a description of internal controls, AML/CFT policies and procedures; IT and security arrangements; a description of safeguarding and custody arrangements (if custody is in scope); and financial projections demonstrating the applicant's ability to meet the applicable own-funds requirements on an ongoing basis.
Own-funds requirements under MiCA vary by the class of services provided. The capital floor is calibrated against the activity class, and the applicable threshold can increase where the operator's activity volume exceeds defined levels. Because those thresholds carry a [VERIFY] status in our working registry, we describe them qualitatively: the capital requirement for a basic advisory or exchange-for-account service is materially lower than for a platform operator providing custody and portfolio management at scale. Applicants should model their capital position against the full spectrum of services they intend to provide from day one, not a subset.
The ČNB has a statutory review period under MiCA, during which it may request supplemental information. In practice, the total elapsed time from a well-prepared application to a decision is typically a matter of several months, though complex structures or incomplete submissions extend that materially. Operators we advise build a pre-submission engagement strategy – presenting the proposed structure to the ČNB in outline before the formal filing – to reduce the risk of a substantive information request after the clock starts.
What AML and Travel Rule obligations apply to Czech crypto businesses?
Czech CASPs operate within the EU's AML/CFT framework and are subject to FATF Recommendation 15, which requires that virtual asset service providers implement the Travel Rule – the obligation to pass originator and beneficiary identification data alongside transfers above the applicable threshold. Under MiCA and the associated Transfer of Funds Regulation (which applies across the EU), the Travel Rule applies to all crypto-asset transfers regardless of value, with no de-minimis exemption for transfers between VASPs. This is a materially stricter position than many non-EU jurisdictions adopt.
The practical consequence is that a Czech CASP must maintain a Travel Rule solution – either a proprietary system or a third-party protocol – capable of sending, receiving and screening originator/beneficiary data on every inter-VASP transfer. The ČNB expects to see this capability described in the application and operational before authorisation is granted. Counterparty due diligence – assessing whether the receiving VASP in another jurisdiction operates under an equivalent AML regime – is a related obligation that adds operational complexity for businesses with cross-border transfer volumes.
Beyond the Travel Rule, Czech CASPs must conduct customer due diligence, enhanced due diligence for higher-risk relationships and ongoing transaction monitoring. The AML obligations are enforced by the ČNB in its supervisory capacity, with the Financial Analytical Office (FAO) retaining jurisdiction over AML reporting. Operators we advise treat the AML architecture as a pre-application workstream, not an afterthought, because the ČNB's review will examine the policies, systems and procedures in detail.
How does Czech licensing interact with banking and cross-border payments?
Obtaining a CASP authorisation from the ČNB resolves the regulatory question but does not, by itself, resolve the banking question – and for digital-asset businesses, banking is frequently the harder constraint. Czech-licensed crypto businesses can and do maintain euro and CZK accounts with Czech and EU banks, but correspondent banking relationships and the attitude of individual institutions toward crypto clients vary widely.
In our cross-border practice, we regularly advise businesses that obtain a Czech or other EU licence and then discover that their intended banking partner will not onboard the entity, or will restrict the account to activities that do not match the licensed scope. The intersection of MiCA authorisation and bank risk appetite is a structural challenge across the EU, not a Czech-specific issue, but it is one that must be addressed in parallel with the licensing process rather than sequentially.
For operators whose business model involves fiat on- and off-ramps, the banking strategy must account for: the currency pairs in scope, the correspondent banking chain for euro transfers, the position of the chosen bank on crypto-exposed business and the adequacy of the account structure to meet client-money segregation requirements under MiCA. An EMI (electronic money institution) licence or a partnership with a licensed EMI may be part of the solution for operators requiring a payments layer that sits alongside the CASP authorisation.
Cross-border into non-EU jurisdictions adds a further dimension. A Czech CASP serving clients in the UAE, Singapore or the US must satisfy not only the ČNB's requirements but also the regulatory expectations of those markets – whether that is VARA in Dubai, MAS in Singapore or FinCEN and state money-transmitter requirements in the United States. The MiCA CASP authorisation provides EU passporting but does not carry recognition in non-EU jurisdictions. Multi-jurisdiction operators therefore typically layer a Czech or other EU CASP authorisation with a hub licence in one or more non-EU markets.
If a banking relationship has already been declined or an application has stalled, a structural review can identify the root cause and the route to resolution. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw.
A real-world illustration: restructuring for MiCA readiness
In a recent licensing matter, a Central European payments business operating under the prior Czech VASP registration engaged us in anticipation of MiCA's full application. The business had assumed its legacy registration provided a transitional safe harbour for all its crypto-related activities. Our review identified that two of its service lines – custody of client crypto-assets and a referral arrangement that qualified as placing crypto-assets – were not covered by the old registration and would require standalone CASP authorisation under MiCA. We restructured the entity's service agreements to align activities clearly to the licensing perimeter, prepared a pre-submission memorandum for the ČNB, and advised on the capital and governance changes needed before a formal application could be filed. The business entered the formal MiCA application process with a clear scope, adequate capital documentation and an AML programme that had already been reviewed at senior management level. The matter illustrates that legacy registration in the Czech market provides a starting point, not a destination.
Which operator profile should pursue Czech CASP authorisation?
Not every digital-asset business should anchor its EU licensing strategy in the Czech Republic, and the right answer depends on the operator's profile, service mix and commercial priorities. The following matrix describes the typical decision paths we work through with clients.
A pan-European exchange or trading platform seeking broad EU market access and comfortable with a substantive regulatory dialogue will find the Czech Republic a credible entry point. The ČNB is an established financial regulator with well-developed supervisory practice. The Czech market itself provides access to a sophisticated Central European client base. The timeline to authorisation under MiCA is comparable to other EU member states with active supervision, though Malta and Lithuania historically offered faster AML registration paths under prior regimes – that differential is narrowing under MiCA harmonisation.
A custody-focused business or a fund administrator requiring strong civil-law property and insolvency protections for client assets will need to examine Czech law on asset segregation and insolvency closely alongside the MiCA safeguarding requirements. The Czech legal system provides a sound base, but the interaction between MiCA's safeguarding expectations and Czech civil law on trust-equivalent structures is an area requiring specialist advice rather than assumption.
A token issuer whose primary activity is ART or EMT issuance at scale may find that a larger EU member state's competent authority has more developed supervisory guidance on reserve management and redemption mechanics, given the novelty of MiCA's ART/EMT regime. For "other" crypto-asset issuers subject only to whitepaper obligations, the Czech regime is straightforward and the ČNB's oversight is proportionate.
A business whose principal market is outside the EU – focused on the UAE, Singapore or Hong Kong – will not derive material commercial benefit from Czech CASP authorisation alone. In that profile, the Czech licence adds EU-market access, but the primary licensing effort should address the hub market first. We regularly advise clients on sequencing multi-jurisdiction licensing stacks to avoid deploying capital in a market that is not yet a commercial priority.
What mistakes do operators make in Czech crypto licensing?
The most common error we see is treating the legacy Czech AML registration as equivalent to, or automatically convertible into, a MiCA CASP authorisation. It is neither. Operators who built their banking relationships and client contracts on the old registration must take affirmative steps to obtain CASP authorisation before MiCA's transitional provisions expire. The window is not indefinite, and the ČNB has discretion over the transitional period's duration in respect of specific entities and activities.
A second common error is scoping the application around the minimum viable activity set rather than the business as it will realistically operate within twelve to eighteen months. MiCA requires an application for each regulated service category. Adding a service category after authorisation requires a material variation – an additional process with its own timeline. Operators who scope narrowly to speed the first authorisation often encounter delays when they seek to expand, and those delays can be commercially material if a new service line is already in demand from clients.
A third error – one that applies across EU jurisdictions, not only the Czech Republic – is treating the licensing process and the banking process as sequential. They are not. A CASP authorisation is a necessary but not sufficient condition for operating. Banking must be pursued in parallel. Operators who secure their authorisation and then approach banks discover that the banking timeline adds months to market entry that could have been compressed. In our practice, we map the full stack – licensing, banking and compliance infrastructure – before any application is filed.
A common assumption is that a single offshore registration – a BVI VASP registration, a Cayman registration or a legacy registration from a non-EU jurisdiction – is sufficient to serve EU clients. It is not. MiCA requires a CASP authorised by an EU competent authority for services directed at EU clients. Operating from an offshore entity into the EU without CASP authorisation is not a grey area under MiCA – it is an enforcement exposure, and the ČNB and ESMA have been explicit about territorial scope. The offshore wrapper does not provide cover.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full scope of OBOLUS's licensing and regulatory authorisation practice across 70+ jurisdictions
- VASP licence application for early-stage founders – practical guidance on sequencing the first licensing application for founders building from scratch
- Fiat on/off-ramp banking under heightened scrutiny – how to structure banking relationships for crypto businesses facing elevated compliance requirements
FAQ
How long does a crypto licence take to obtain?
Timeline varies considerably by jurisdiction and by the complexity of the applicant's structure and service scope. Under MiCA, the ČNB has a defined statutory review period from receipt of a complete application, but in practice total elapsed time from pre-application preparation to a decision is typically several months. Well-prepared applications with clear governance, adequate capital documentation and a complete AML programme consistently move faster than those filed without prior regulatory engagement. Operators should plan for a runway that covers both the application period and the parallel banking timeline.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The right jurisdiction depends on where your clients are, which services you provide, your capital position and your banking strategy. For EU market access, a MiCA CASP authorisation from any EU national competent authority – including the ČNB – provides passporting rights across the EU and EEA. For businesses focused on the Gulf, VARA in Dubai or the FSRA in Abu Dhabi may be primary. For Asia-Pacific, MAS in Singapore or the SFC in Hong Kong. Multi-market businesses typically require a layered approach across two or more jurisdictions.
Do I need a separate custody licence?
Under MiCA, custody and administration of crypto-assets on behalf of clients is a distinct regulated service that must be specifically included in a CASP authorisation. A CASP authorised only for exchange or advisory services may not provide custody without extending its authorisation to cover that activity. The same logic applies in most other leading jurisdictions – Singapore's Payment Services Act, Hong Kong's VASP regime and VARA's activity-based licence structure all treat custody as a separately regulated function. Businesses that hold client assets as part of their model should include custody in their initial application scope.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance infrastructure that surrounds them. Digital assets are the whole of our practice. We map the licence, banking and compliance stack across operating, custody and payment layers before you commit – so that the structure you build into is the structure your business can actually operate within. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in MiCA CASP authorisation strategy, EU licensing-hub selection and cross-border VASP registration across Central and Eastern European jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.