MiCAR Lawyer Romania - CASP Licensing: A Practical Roadmap (ASF, 2024–2026)

If you are building a crypto exchange, custody platform, brokerage, trading venue, or "crypto rails" business and you want EU scalability, the question is no longer whether to be regulated - it's where and how to obtain a MiCAR CASP (Crypto-Asset Service Provider) authorization efficiently, with a file that can withstand supervisory scrutiny.

MiCAR (Regulation (EU) 2023/1114) created a single licensing regime for CASPs across the EU. It became fully applicable for CASPs on December 30, 2024, with a transitional ("grandfathering") mechanism under Article 143 that can allow certain pre-existing providers to continue operating for a limited period - up to July 1, 2026, depending on the Member State's choice.

This article is a practical licensing roadmap for founders and investors targeting Romania - where the Financial Supervisory Authority (ASF) is the key regulator for most CASP models. It explains what to prepare, how timelines work, what policies and evidence typically matter, and how to avoid the pitfalls that slow down or derail applications.

MiCAR CASP licensing in Romania: five key points

1. Authorization is a growth lever, not a compliance cost
   A single home-country license enables EU passporting instead of fragmented, country-by-country registrations.
2. Regulators assess what you actually do, not what you call it
   Misclassified services and de facto custody are the fastest routes to a stalled application.
3. The file needs operational substance, not policy theater
   Governance, AML/CTF plus the Travel Rule, DORA-grade ICT resilience and outsourcing oversight - with evidence.
4. Document consistency is the silent application killer
   Org charts, contracts, policies and marketing must tell one coherent story - reviewed before submission.
5. Romania's own implementation adds friction - plan for it
   ASF is the core counterpart, but coordination with BNR, the Ministry of Finance, ADR and ANPC is still maturing.

Key terms in plain English (quick reference)

Expand each term for the working definition used throughout this roadmap:

MiCAR CASP authorization in Romania (ASF): what changed after December 30, 2024

"MiCAR requires any company providing crypto-asset services in the EU on a professional basis to obtain CASP authorization from its home Member State regulator - after which the CASP can passport services across the EU through a notification process."

- MiCAR in one sentence

Why Romania and ASF? Romania's ASF supervises non-banking financial markets and, under Romania's MiCAR implementation approach, it is the practical point of entry for many CASP models. For founders and investors comparing options, the key strategic point is: if your core revenue depends on serving EU clients, MiCAR authorization is a commercial growth lever, not just a compliance cost - because authorization enables EU passporting instead of fragmented, country-by-country registrations.

The 2024–2026 timeline you must internalize

June 30, 2024 - the stablecoin regime applies

MiCAR Titles III and IV (the ART/EMT "stablecoin" regime) became applicable - issuer, reserve and redemption rules for asset-referenced and e-money tokens.

December 30, 2024 - the full CASP regime applies

The rest of MiCAR became applicable, including the full CASP authorization framework. The EBA's CASP-specific AML risk-factor guidance applies from the same date.

January 17, 2025 - DORA applies

The EU's ICT resilience rulebook shapes supervisory expectations for incident response, resilience testing and vendor controls in every post-2025 CASP application.

July 1, 2026 - the outer grandfathering boundary

The latest possible end of the Article 143 transitional window. Providers relying on grandfathering without a credible authorization path face wind-down expectations, not extensions.

Grandfathering and passporting: the two clauses that shape your strategy

MiCAR Article 143

The transitional ("grandfathering") period - and the 2024–2026 reality

Article 143 allows Member States to grant a transitional period for providers legally operating under national rules before MiCAR fully applied, up to July 1, 2026. ESMA tracks Member States' choices, and Romania is listed among the jurisdictions that opted for an 18-month transitional window, per ESMA's published list of grandfathering periods under Article 143(3).

Practical implication: even where a transitional window is available, regulators expect firms to apply early and to have orderly wind-down planning if authorization is not obtained. ESMA has repeatedly stressed timely authorization and client protection in its statements on transitional measures.

Passporting: your Romanian license can scale EU-wide

Once authorized, a CASP can provide services cross-border within the EU through MiCAR's notification framework. ESMA publishes an Interim MiCA Register listing authorized CASPs - meaning your regulatory status becomes centrally visible to banks, counterparties and institutional clients.

A practical ASF CASP licensing roadmap: five steps

The licensing project should be treated like a product launch with a compliance-engineering workstream. This is the structure we use at Buju, Stanciu & Asociații to move from "business model" to an application file that is coherent, consistent and evidence-backed:

1. Confirm you are (really) a CASP, and map your services correctly
   Services map, customer-journey diagrams, custody exposure, agency vs. principal on each leg - plus a token classification memo.
2. Choose your Romanian licensing vehicle and governance model
   Corporate form, management body, key functions (risk, compliance, internal audit - sized proportionately), fit-and-proper dossiers for management and qualifying shareholders.
3. Build your policy stack - what ASF expects to see and test
   Governance and risk, AML/CTF plus the Travel Rule, ICT/DORA, outsourcing, complaints, conflicts of interest, custody and client assets (detailed below).
4. Build the application file and pre-empt the "completeness loop"
   A single, coherent application narrative tying together business model, financial forecasts, governance and staffing, and the full policy stack with supporting evidence.
5. Plan your timeline - realistic and investor-friendly
   Budget time for implementation, not just drafting; the real timeline is driven by completeness and the quality of your Q&A responses.

Step 1 in depth: the services map and the token classification memo

A recurring failure mode is misclassification: marketing calls the product "execution," but the operating model is actually "dealing on own account"; or custody is embedded in operational flows without being labeled as such; or OTC trading is run as a "platform." Authorities assess a service based on how it works in practice, not what it's called - a point ESMA's Q&As and supervisory outputs make repeatedly.

Deliverable: the services map

Which MiCAR services you provide (and which you explicitly do not); customer-journey diagrams (retail vs. institutional); where custody happens, if at all, including who controls keys; and who is counterparty on each leg (agency vs. principal).

Deliverable: the token classification memo

For every token you list, issue or integrate with: is it an EMT (tracks a single official currency), an ART (tracks a basket, other values or combinations), or another crypto-asset under the general Title II regime? The answer drives whitepaper triggers, marketing constraints, redemption mechanics - and the supervisory questions ASF asks.

The memo's inputs typically cover: token economics and any value-stabilization mechanism; redemption rights and their legal basis; rights attached (governance, profit share, yield, utility, claims on reserves); issuer and control (minting, burning, admin keys); distribution model (primary issuance vs. secondary trading, public offer, airdrops); marketing statements ("stable," "backed," "guaranteed value," yield claims); reserve backing and its custody chain; and geographic scope and target users. The practical output is a short, Romania-ready memo - with stated assumptions and supporting documents - that becomes the single source of truth across the ASF file, investor materials and product/marketing teams.

The policy stack ASF expects to see (and test)

MiCAR compliance is not "policy theater." Authorities look for operational reality: controls, escalation paths, logs and evidence that procedures are understood and actually implemented. Expand each block of the minimum policy stack:

Interactive: is your application file exam-ready?

Tick each deliverable that exists today - finalized and consistent with the rest of the pack, not "in draft somewhere":

The CASP file-readiness checklist (ASF / Romania)

• A written services map: which MiCAR services you provide, which you explicitly do not, and who is counterparty on each leg
• A token classification memo (EMT / ART / other crypto-asset) for every token you list, issue or integrate with
• A governance pack: organigram, board terms of reference, key-function role descriptions, fit-and-proper dossiers
• A business-wide AML/CTF risk assessment with KYC/EDD methodology, including self-hosted wallet handling
• A Travel Rule operating model: vendor, messaging format, exception handling, recordkeeping
• A DORA-aligned ICT pack: risk policy, incident response with classification logic, BC/DR plan with a testing schedule
• An outsourcing register plus agreements with audit/access rights and exit clauses - accountability kept in-house
• A complaints-handling policy with a log and management reporting (Article 71)
• A custody analysis: segregation model, key-control architecture, reconciliation - or a documented conclusion that no custody arises
• A completed cross-document consistency review: org chart, contracts, policies and marketing tell one story

Every unticked item extends the completeness loop

In EU licensing practice, the real timeline is driven by completeness and the quality of responses to follow-up questions - not by the formal assessment clock. Each gap above becomes an ASF question, a document revision, and weeks of delay. Get a gap analysis of your application pack.

Project plan and realistic timelines

A practical project plan for a well-prepared CASP file typically runs as follows:

Timeline expectations in Romania/ASF practice

Your build time - largely within your control - often runs roughly 3–6 months end-to-end for a "file-ready" pack, depending on complexity and outsourcing. Regulator review time is partly outside your control; the fastest cases are those where the file is internally consistent and the CASP can answer follow-ups quickly with evidence. For founders, the funding consequence is clear: budget time for implementation, not just drafting.

Quick test: delay risk or file-ready?

Four situations from real licensing projects. Pick the assessment you think is right:

Situation 1: "We're not a custodian - we just temporarily hold client assets to pre-fund execution, and we run the recovery process if users lose access."

Delay risk - Pitfall 1 territory. If you ever control private keys, recovery processes or "means of access," or temporarily hold client assets, you may trigger custody obligations under Article 75. Run a custody-exposure audit during scoping and document the architecture - before ASF asks.

Situation 2: The compliance and risk functions are fully outsourced to a third-country provider - "they're the experts, we focus on product."

Delay risk. Authorities expect the CASP itself to be capable of compliance and risk management, even where support tasks are outsourced. ESMA explicitly warns that high levels of outsourcing - and third-country outsourcing in particular - increase scrutiny and may justify refusal where they impair supervision.

Situation 3: Every document in the pack - org chart, employment contracts, policies, marketing - is checked against a single maintained "source of truth" file with version control before submission.

File-ready. Most negative momentum in applications comes from inconsistency - policies referencing services you don't provide, mismatched terminology, org charts that contradict contracts. A cross-document consistency review before submission is exactly what pre-empts the completeness loop.

Situation 4: "Travel Rule? We signed with a vendor - that's handled. DORA we'll look at after authorization."

Delay risk - two pitfalls at once. Travel Rule compliance is governance, onboarding logic, exception handling and recordkeeping under Regulation (EU) 2023/1113 - not just procurement. And DORA has applied since January 17, 2025: expect serious authorization questions on incident response, resilience testing and vendor controls.

Five common pitfalls in Romania/ASF MiCAR filings

1. "We're not custody" … but your flow is custody
   Controlling private keys, recovery processes or "means of access," or temporarily holding client assets to pre-fund execution, may trigger custody obligations. Perform a custody-exposure audit during scoping.
2. Over-outsourcing core compliance and risk
   The CASP itself must be capable of compliance and risk management. High or third-country outsourcing increases scrutiny and may justify refusal where it impairs supervision.
3. Treating AML/CTF and the Travel Rule as a "vendor problem"
   It's governance, client onboarding logic, exception handling and recordkeeping - with the EBA expecting a CASP-specific, risk-based approach.
4. Leaving DORA for "later"
   DORA applies since January 17, 2025 and shapes supervisory expectations on ICT governance and third-party risk for every post-2025 applicant.
5. Inconsistent documents - the silent application killer
   Org charts that don't match contracts, policies referencing services you don't provide, mismatched terminology. Run a cross-document consistency review before submission.

2025–2026 regulatory reality check: Romania's implementation bottleneck

The roadmap above assumes a reasonably smooth national implementation of MiCAR. In practice, Romania's own transposition has been anything but smooth - and that gap between the EU regulation and its domestic rollout is itself a risk factor founders should plan around.

Speaking on Profit.ro TV in mid-2025, Victor Buju - partner at Buju, Stanciu & Asociații, specializing in financial regulation - described MiCAR as, in effect, a shared EU "rulebook of the road" for crypto-asset service providers. Because MiCAR is directly applicable but leaves supervision and enforcement to each Member State, Romania had to legislate its own implementing framework. Romania missed its original end-2024 deadline - largely due to political disruption - and ended up legislating through an emergency ordinance (OUG) instead of an ordinary law.

Who's actually involved in a Romanian CASP authorization

Buju noted that the ordinance does get some fundamentals right - ASF designated for CASP and issuer licensing, BNR for stablecoins and their issuing institutions, clearer sanctions for unlicensed activity. But he flagged a structural problem: beyond ASF and BNR, the Ministry of Finance, the Romanian Digitalization Authority (ADR) and the National Authority for Consumer Protection (ANPC) are also involved, without a clear coordination mechanism - a confusing "bureaucratic pilgrimage" between institutions for any firm seeking a license, which risks pushing serious operators toward faster EU jurisdictions or offshore centers.

He also pointed to Romania's competitive position: Germany's "single-window" model where one authority coordinates on the applicant's behalf; Switzerland, Estonia and Lithuania as more permissive, investor-friendly regimes; and Malta as a standout - having issued more crypto licenses than any other EU jurisdiction and attracted substantial capital inflows relative to its size. His recommendations for Romania: a single digital "one-stop" licensing window, a regulatory sandbox, and clearer marketing rules - the ordinance's ban on unsolicited "mass" messages doesn't define what counts as "mass," raising the question of whether an announcement to a 100-person Telegram group could be treated as sanctionable.

Practical takeaway for founders

The technical roadmap in this article remains the right way to build a licensable file. But because Romania's coordination between ASF, BNR, the Ministry of Finance, ADR and ANPC is still maturing, budget extra time and legal support specifically for navigating inter-institutional handoffs - not just for drafting the ASF-facing documents.

Funding narrative: why MiCAR authorization improves bankability and partner access

For investors, MiCAR authorization isn't just "regulatory hygiene" - it changes how counterparties underwrite your risk:

Banking and payments

Regulated status, documented controls (AML/CTF, Travel Rule, governance) and supervisory visibility can materially improve the ability to obtain and retain bank accounts, payment rails, and card/IBAN partners - compared with operating in a grey zone.

Institutional counterparties

Market makers, custodians, liquidity venues and prime-broker-style providers often require a clear regulatory perimeter and documented outsourcing/security controls before onboarding.

Enterprise clients

B2B pilots (treasury, tokenization, "crypto rails") tend to convert faster when procurement and risk teams can point to a home-state license and an EU passporting model.

Cross-border scale

Passporting enables a single authorization-plus-notification approach rather than fragmented, country-by-country compliance - reducing legal overhead and accelerating go-to-market.

The diligence questions it answers quickly

"Are you authorized, and can we verify it?" (ESMA register visibility). "Who holds accountability if critical functions are outsourced?" (outsourcing governance and exit planning). "How do you manage the Travel Rule and higher-risk flows?" (operating model, not vendor marketing). "Is the ICT stack resilience-ready post-DORA?" (incident response, BC/DR testing, vendor controls). Bottom line: a file-ready MiCAR/ASF program is an investable milestone - it reduces friction with banks and partners, supports higher-quality institutional revenue, and makes EU expansion predictable.

How Buju, Stanciu & Asociații supports CASP projects

Through its blockchain and cryptocurrency practice, BSA supports crypto founders and investors with a practical MiCAR licensing workstream that connects regulatory requirements to real operating models:

Service perimeter and licensing strategy

We translate your product into a MiCAR service map and identify "hidden" regulated functions: custody triggers, execution vs. dealing, transfer services, platform operation.

Application narrative and document coherence

We draft and structure the application file so ASF can assess it efficiently - reducing the completeness back-and-forth that often stretches timelines.

Policy stack with implementation logic

We build policies that are audit-ready: roles, controls, logs and evidence - not generic templates.

AML/CTF plus contracting and IT depth

Many CASPs stumble at the interface between legal obligations and technology execution. Our commercial and IT law practice implements the contracting foundations - outsourcing agreements, SaaS terms, security clauses - because under MiCAR/DORA, your vendor contracts become supervisory evidence.

Navigating institutional fragmentation

Given the coordination gaps between ASF, BNR, the Ministry of Finance, ADR and ANPC, we help sequence engagement with each body so the licensing "pilgrimage" doesn't stall your launch timeline.

Why the integrated approach matters

A licensing file is a product of corporate, regulatory, IP and IT contracting layers working together. BSA's business-law profile covers all of them - which is what makes a file actually "exam-ready" rather than a stack of disconnected policies.

"The technical roadmap - services mapping, token classification, governance, the policy stack - remains the right way to build a licensable file. But in Romania, the winning strategy also sequences the institutions: ASF licensing is only the first of several approvals, and the coordination gaps are where unprepared timelines go to die."

- Victor Buju, Partner, Buju, Stanciu & Asociații

Key takeaways

1. Treat licensing as a growth milestone, not a legal checkbox
   CASP authorization has applied since December 30, 2024 - and it unlocks EU passporting.
2. ASF is the core counterpart - but not the only one
   Coordination with BNR, the Ministry of Finance, ADR and ANPC remains a practical bottleneck to plan for.
3. The file needs more than policies
   Governance substance, an AML/CTF-plus-Travel-Rule operating model, DORA-grade ICT resilience and outsourcing oversight - with evidence.
4. Finalize the token classification memo early
   ART vs. EMT vs. other crypto-asset drives whitepaper, marketing and licensing obligations across the entire pack.
5. Start early - transitional measures don't remove urgency
   Misclassified services, de facto custody, over-outsourcing and inconsistent documents cause most delays; Romania's implementation gaps add extra reason not to wait.

Frequently asked questions about CASP licensing in Romania

Planning a CASP launch or acquisition in Romania?

The highest-leverage first step is a two-part readiness sprint: (1) MiCAR perimeter and service mapping - what you are licensing, exactly - and (2) a gap analysis of your ASF application pack: governance, AML/CTF, ICT/DORA, outsourcing and client protection. Discuss your model confidentially and map a licensing plan with Buju, Stanciu & Asociații.

Contact us

Sources and references

Regulation (EU) 2023/1114 (MiCA/MiCAR): EUR-Lex · ESMA - Markets in Crypto-Assets Regulation (MiCA) hub, list of grandfathering periods (Article 143(3)), statement on transitional measures, Interim MiCA Register, Supervisory Briefing on the Authorisation of CASPs, final rules on conflicts of interest, Single Rulebook Article 71: esma.europa.eu · EBA - guidance for CASPs on money-laundering/terrorist-financing risk management (January 16, 2024): eba.europa.eu · Regulation (EU) 2023/1113 (Travel Rule): EUR-Lex · Regulation (EU) 2022/2554 (DORA): EUR-Lex · ASF Romania (EN) and ASF FinTech Hub: asfromania.ro · Profit.ro - interview with Victor Buju on Romania's crypto OUG (June 25, 2025): profit.ro · Buju, Stanciu & Asociații (BSA): bsa.ro / Blockchain & Cryptocurrencies Legal Assistance

Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice. Its application depends on the specific facts, documents and business model of each project; a dedicated legal analysis is required for a formal opinion.