Operating a digital-asset business in Central Europe without the correct authorisation is not a calculated risk – it is a direct path to enforcement action, frozen payment rails and banking relationships that disappear overnight. The Czech Republic has moved from a light-touch registration regime toward a fully supervised licensing environment aligned with the MiCA (Markets in Crypto-Assets Regulation) framework, and the transition has sharpened the compliance stakes for every operator with Czech nexus. Whether your business is incorporated in Prague, passporting services into the country from another EU member state, or evaluating the Czech Republic as a gateway to the broader EU single market, the legal question is the same: do you hold the right authorisation, structured the right way, before you serve a single client?
The Czech National Bank (ČNB) is the competent authority responsible for supervising crypto-asset service providers under the MiCA regime and the transitional domestic provisions that precede full application. Under MiCA, a CASP (crypto-asset service provider) authorised in the Czech Republic may passport that authorisation across the entire EU and EEA – a structural advantage that a standalone offshore licence cannot replicate. This page sets out the regulated perimeter, the licence categories, who needs one, and the practical cross-border considerations that shape the decision for an inbound operator.
The Czech Regulatory Environment for Digital Assets
The Czech National Bank is the single competent authority for financial regulation in the Czech Republic, and it has assumed responsibility for CASP supervision under the MiCA framework as it takes full effect across EU member states. The ČNB operates within the ESMA-coordinated network of national competent authorities, meaning its supervisory standards align with the pan-European baseline rather than a local idiosyncratic approach. That alignment is a key commercial consideration: a CASP authorisation granted by the ČNB carries the same passporting weight as one granted by the French AMF or the German BaFin.
Before MiCA reached its current application timetable, the Czech Republic operated a domestic VASP registration regime administered through the Financial Analytical Unit (FAÚ) – the country's anti-money-laundering authority – alongside the ČNB. That prior registration framework covered entities providing exchange services, wallet custody and related activities, primarily through an AML/CFT lens rather than a full prudential and conduct-of-business one. MiCA replaces that lighter framework with a comprehensive authorisation requirement that imposes ongoing capital adequacy, governance, prudential safeguarding and conduct obligations. Operators who relied on the old registration as a long-term compliance solution now face a material uplift in what is required of them.
In our practice, we have seen businesses underestimate this transition. A FAÚ registration was always a floor – never a ceiling – and treating it as a finished compliance posture has exposed operators to gaps that the ČNB's supervisory examinations are now equipped to identify.
Who Needs a CASP Authorisation in the Czech Republic?
Any business providing crypto-asset services on a professional basis to clients with a connection to the Czech Republic requires authorisation under the applicable regime – whether that business is incorporated in Prague or providing services cross-border from another EU state. The MiCA regime defines the regulated activities broadly: operating a trading platform for crypto-assets, exchanging crypto-assets for fiat or for other crypto-assets, executing orders, placing crypto-assets, providing transfer services, providing custody and administration of crypto-assets on behalf of clients, and advising on crypto-assets all fall within the CASP perimeter.
The reach of the regime extends beyond the formally incorporated entity. A foreign operator serving Czech-resident clients on a cross-border basis without a passported authorisation risks enforcement by the ČNB – including public censure, administrative fines and, in serious cases, referral to criminal prosecution authorities. The enforcement posture of EU competent authorities under MiCA is materially more robust than what preceded it, and the ČNB has the tools to act.
Certain activities sit outside the CASP perimeter. Purely technical service providers, decentralised protocol operators who do not control client assets and certain intra-group arrangements may fall outside the mandatory authorisation requirement, but the boundaries are not self-defining. The substance-over-form principle applies: if your business exercises control over client assets, determines pricing or provides investment-adjacent services, the absence of a formal label does not determine the regulatory outcome.
To map whether your activity triggers the CASP requirement in the Czech Republic, contact OBOLUS at info@oboluslaw.com. The perimeter analysis is the first step, and getting it wrong in either direction – treating a regulated activity as exempt, or over-engineering compliance for an exempt activity – has real cost consequences.
CASP Licence Categories Under MiCA
MiCA establishes a tiered authorisation structure under which the specific crypto-asset services a business provides determine the scope of its CASP authorisation – not a single blanket licence that covers all activities. An operator wishing to provide multiple services must obtain an authorisation that covers each of them, either at the point of initial application or by way of subsequent extension.
The core service categories under the MiCA CASP regime include: custody and administration of crypto-assets on behalf of third parties; operation of a trading platform; exchange of crypto-assets for fiat currency; exchange of crypto-assets for other crypto-assets; execution of orders for crypto-assets on behalf of third parties; placing of crypto-assets; reception and transmission of orders; and providing advice on crypto-assets. Each category carries its own minimum own-funds requirement and governance expectations, though the specific capital thresholds are set in the regulation and confirmed by ESMA guidance rather than invented here – consult current legislation for the applicable figures.
In addition to the CASP framework, MiCA introduces separate authorisation regimes for issuers of ARTs (asset-referenced tokens) and EMTs (e-money tokens). An operator issuing a stablecoin pegged to the euro, a basket of currencies or another asset class will need to assess whether it falls within the ART or EMT regime, each of which carries its own whitepaper, reserve and redemption obligations that sit alongside – not instead of – any CASP authorisation. In our cross-border practice, we regularly advise token issuers who discover mid-way through a product build that the instrument they are creating triggers multiple layers of the MiCA framework simultaneously.
How Does the CASP Application Process Work in Czech Republic?
A CASP application submitted to the Czech National Bank involves a structured file covering the entity's legal form, ownership and governance, financial resources, AML/CFT programme, custody and safeguarding arrangements, IT security posture, conflicts-of-interest policy and the business plan that scopes the proposed activities. The ČNB reviews the application against the MiCA requirements as transposed and the ESMA guidance issued under the regulation, and may request supplementary information during the review period. The total elapsed time from submission of a complete file to the grant of authorisation varies depending on the complexity of the application and the volume of queries raised by the regulator – applications that arrive incomplete or with structural deficiencies invariably take longer.
A critical point for inbound operators: the completeness of the initial filing is the single strongest determinant of timeline. Regulators in EU member states applying MiCA have signalled that incomplete applications will not start the statutory review clock until a complete file is received. An operator that submits a partial file to meet an internal commercial deadline often discovers that the actual review period runs from a later date than anticipated.
The MiCA regime also provides for a transitional period during which entities that were already providing crypto-asset services under domestic law before the regulation's full application date may continue to operate under their prior authorisation or registration for a defined period. The conditions and duration of that transitional regime vary at the member-state level – and operators should not assume that their prior FAÚ registration extends that window indefinitely. The ČNB has communicated expectations about the transition, and businesses operating under the prior regime should be actively working toward a full MiCA-compliant application.
What Does the EU Passporting Advantage Mean in Practice?
A CASP authorisation granted by the Czech National Bank under MiCA confers the right to passport crypto-asset services across every EU and EEA member state without requiring a separate national authorisation in each country – and this is the defining commercial argument for EU-based licensing over an offshore alternative. The passport operates by way of notification to the host-member-state regulator through ESMA's coordination mechanisms, and it is not a formality to be overlooked: the notification must correctly scope the services and the jurisdictions to which the passport applies.
The passporting right is contingent on the authorisation remaining in good standing. A breach of MiCA obligations in the home member state – the Czech Republic, in this case – can lead to conditions, restrictions or suspension that affect the passport and, consequently, the ability to serve clients across the EU. In our practice, we have seen operators treat passporting as a static administrative step rather than an ongoing supervisory obligation, and that framing creates exposure.
For a business domiciled outside the EU – in a third country such as the UAE, Singapore or the BVI – that wants structured EU market access, the Czech Republic presents a practical entry point: a well-resourced financial regulator with EU membership, a Central European talent pool, and the full benefit of the single-market passport. Comparing that against alternative EU entry points such as Lithuania or Malta involves weighing regulator workload, supervisory intensity, timeline and local substance expectations – all of which vary and are not reducible to a single correct answer. The right choice depends on the operator's specific activity mix, existing entity structure and banking strategy.
To map the EU licensing and passporting strategy for your build, write to OBOLUS at info@oboluslaw.com. The choice of home member state has consequences across multiple years of regulatory relationship, and it deserves proper analysis before commitment.
AML, CFT and the Travel Rule in Czech Republic
Czech Republic CASP operators are subject to the FATF Recommendations as implemented under EU law, including Recommendation 15 (the application of AML/CFT standards to virtual asset service providers) and the Travel Rule – the obligation to collect, verify and transmit originator and beneficiary information alongside virtual-asset transfers above the applicable threshold. The Czech Republic's AML/CFT framework applies the EU's AML Directives, and the Travel Rule obligations for crypto-asset transfers are carried through into the MiCA-adjacent transfer-of-funds regulation at the EU level.
For an operator building a compliance programme, the practical implications are substantial. Transfers to or from unhosted wallets require enhanced due diligence procedures in line with the applicable regime. Transaction monitoring systems must be calibrated to the risk profile of the business. The Financial Analytical Unit retains an oversight role in relation to AML/CFT compliance alongside the ČNB's broader CASP supervision, meaning operators may face inquiries from both authorities.
The cross-border dimension here is particularly acute for exchanges that operate across multiple jurisdictions. A Czech-authorised CASP passporting into Germany or France, for example, is subject to the home-state AML/CFT framework but may also be expected to meet host-state supervisory expectations in areas where local implementation diverges from the baseline. We regularly advise on how to structure a single AML programme that satisfies both the home-state regulator and the host-state expectations across the passport perimeter.
Banking, Tax and the Structural Decisions Around Czech Licensing
A CASP authorisation from the ČNB does not, by itself, resolve the banking question – and for many operators, access to fiat payment rails is the more operationally urgent issue than the licence itself. Czech banks have historically applied heightened due diligence to digital-asset businesses, and a newly authorised CASP should expect to present its AML programme, governance documents and business plan as part of the account-opening process. A complete and professionally documented authorisation file is a prerequisite, not a guarantee, of banking access. In our cross-border practice, we regularly advise on structuring the banking layer across multiple jurisdictions to reduce concentration risk.
On the tax side, the Czech Republic treats income from digital-asset activities under its general income and corporate tax framework. Token classification – whether a token represents a financial instrument, a commodity, a payment medium or something else – influences how gains, staking rewards and trading profits are characterised and taxed. The interaction between Czech domestic tax law and the EU's emerging digital-asset reporting requirements (including DAC8, the directive on administrative cooperation covering crypto-asset reporting) adds another layer that operators should map at the structuring stage rather than after the first tax year. The specific rates and thresholds applicable are set by Czech law and updated through the legislative process – consult current legislation for the figures in effect.
In a recent licensing and structuring matter, a payments company operating across Central Europe had relied on an informal AML registration for several years without mapping the full regulatory uplift required under the MiCA transition. We conducted a gap analysis across the entity's CASP perimeter, governance structure and AML programme, identified the priority remediation steps, and prepared a structured application file for submission to the ČNB. The entity moved from an unresolved compliance position to a submitted, complete application within a matter of weeks.
How Does Czech Republic Compare for an Inbound Operator?
For an operator evaluating EU entry points, the Czech Republic offers a combination of EU membership (with the associated passporting benefit), a sophisticated regulatory environment under the ČNB, and a Central European cost base that compares favourably with Western European alternatives. The ČNB is a well-regarded supervisor with experience across financial services broadly – it is not a newly created crypto-specific authority, which means its supervisory approach draws on established financial regulation practice rather than ad hoc improvisation.
The considerations that weigh against Czech Republic as a first choice for some operators include the relative newness of the ČNB's crypto-specific supervisory track record under MiCA (as distinct from the prior FAÚ registration framework), the local substance expectations that the ČNB will apply as it builds its supervisory programme, and the practical requirement to engage Czech-qualified counsel for aspects of the application that require local law analysis. These are manageable factors, not disqualifying ones – but they inform the timeline and resource commitment an operator should anticipate.
A common assumption we encounter from businesses evaluating EU licensing is that a single offshore licence – whether from a CIMA-registered Cayman fund, a BVI VASP-Act entity or a UAE VARA licence – is sufficient to serve EU clients at scale. It is not. MiCA's third-country provisions are explicit: an entity established outside the EU may only serve EU clients on a reverse-solicitation basis (at the exclusive initiative of the client) and without any active marketing into the EU. Reliance on reverse solicitation as a long-term EU market strategy is a structural vulnerability, not a compliance position. An operator that has grown on the back of an offshore licence and now wants to formalise EU market access needs a proper CASP authorisation, and the Czech Republic is one of the credible entry points for that process.
A useful decision framework: an exchange seeking pan-EU retail access with an established legal infrastructure should evaluate the Czech Republic alongside Lithuania and Malta, weighing each regulator's current application throughput and local substance expectations. A stablecoin issuer also needs to assess the ART or EMT authorisation separately from the CASP layer. A custody-only provider entering the EU from a third-country parent may find that the Czech Republic's ČNB offers a cleaner regulatory conversation than some of the smaller EU member-state authorities that are less experienced with the custody perimeter under MiCA.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – how we build and manage the licence stack across 70+ jurisdictions
- VARA Licence Application in Mauritius – licensing process, timelines and cross-border structuring for Mauritius
- Stablecoin Issuance Authorisation: Legal Counsel for Digital-Asset Firms – ART, EMT and reserve obligations under MiCA and beyond
FAQ
How long does a crypto licence take to obtain?
The elapsed time from first instruction to a granted CASP authorisation varies by jurisdiction, the complexity of the applicant's business model and the completeness of the initial filing. In EU member states applying MiCA, the statutory review period begins only once a complete application is received. Operators should allow for a preparatory phase – covering governance, AML programme drafting and financial projections – before the review clock starts. An incomplete filing extends the total timeline significantly. A realistic planning assumption is several months from file preparation to decision, though simpler applications in well-resourced regulatory environments have moved faster.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on the services you provide, the clients you intend to serve, your existing entity structure, your banking strategy and the passporting rights you need. An EU CASP authorisation – for example from the Czech Republic – provides single-market access across the EU and EEA. A UAE VARA licence serves a different market and regulatory relationship. Offshore registrations in BVI or Cayman serve specific fund and structural purposes but do not confer EU market access. We map the full licence, banking and tax stack before recommending a specific structure.
Do I need a separate custody licence?
Under MiCA, custody and administration of crypto-assets on behalf of third parties is a defined CASP service category that requires explicit inclusion in the authorisation scope – it is not automatically covered by other service authorisations. An exchange operator that also holds client assets in custody requires an authorisation that covers both the trading and custody activities. The capital and governance requirements for custody-inclusive CASPs reflect the additional client-asset protection obligations. Whether a standalone custody entity needs a separate vehicle or can be combined within a multi-service CASP depends on the business structure and the jurisdiction's supervisory expectations.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit, and we have advised crypto businesses across more than seventy licensing jurisdictions worldwide. To discuss your Czech Republic licensing situation or your broader EU market strategy, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU and cross-border CASP authorisations, MiCA transition structuring and multi-jurisdiction licence stacks for digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.