MiCA Study: Why CASP Filings Stall

Most MiCA CASP filings do not stall because of the 40-working-day review. They stall before that - at completeness, RFIs, and staffing checks.

If I boil this study down, the message is simple: by July 31, 2026, only about 244–280 CASPs were listed as authorized across the EU, even though 1,200+ VASPs had been active under older national systems. That gap points to four repeat causes of delay:

• AML/CFT files are weak, especially source-of-funds records, monitoring proof, and the MLRO setup
• Governance is thin, with shell boards, weak reporting lines, or low senior experience
• Disclosure packs do not match the business, which leads to resets and new document requests
• Backlogs and transition issues stretch the full process to 8–12 months, and in some places even longer

Here’s the part many firms miss: the 40-working-day MiCA review clock starts only after the file is called complete. And that first gate often takes 45–60 days, not 25 working days on paper. Add 4–8 weeks per RFI cycle, plus interviews and DORA work, and the delay starts to make sense.

Quick comparison

Main delay area	What goes wrong	Common result
AML/CFT	Weak source-of-funds trail, outsourced MLRO, generic manuals, missing monitoring logs	File pause before review starts
Governance	EU substance doubts, poor board setup, weak compliance reporting lines	Extra questions, interviews, or rejection
Disclosure	White paper gaps, vague custody details, bad formatting, unsupported claims	Completeness failure or clock reset
Process/backlog	NCA queue, staff limits, local legal issues, holiday slowdowns	8–12 month total timeline

My takeaway: if you plan your MiCA filing around the statutory timeline alone, you are likely planning for the wrong process. The main risk is not the formal review period. It is the time lost before that review even begins.

sbb-itb-0796ce6

AML and CFT Gaps Are the Most Common Filing Blockers

AML/CFT is where many applications get stuck before the formal review even starts.

Where AML Files Commonly Break Down

The biggest trouble spots are usually beneficial ownership, transaction monitoring, and the MLRO role.

Beneficial ownership issues come up a lot. Regulators often pause the completeness review and ask for more source-of-wealth records, especially when the file doesn’t clearly show where funds or capital came from. If that paper trail feels thin, the application can sit there waiting.

The MLRO role is another frequent snag. Many regulators want this person to be an in-house, salaried officer with board access and a base in the EEA. When firms try to outsource the role, the file can stall for two to three months. On paper, outsourcing may look fine. In practice, it often slows things down.

AML manuals cause problems too. Regulators often reject template-based or old manuals because they aren’t tailored to the firm’s services or current AMLA and FATF standards. In one case, a firm ran into a two-month delay after its AML/CFT manual was found to be missing AMLA guidance published in late 2024.

Transaction monitoring gets checked in a hands-on way. Regulators don’t just want written policies. They look for proof that the system works in day-to-day use, such as test logs and incident reports. If an application includes policy documents but no supporting logs, it’s commonly rejected in the first review cycle.

How Regulators Respond to AML Deficiencies

Not all AML gaps are treated the same way. Some lead to a short pause. Others send the whole file back to square one.

AML/CFT Deficiency	Regulatory Expectation	Typical Regulator Response	Likely Effect on File
Outsourced MLRO	Dedicated, salaried employee with board access, based in the EEA	RFI or request to appoint an internal MLRO	Stall: 2–3 month delay
Generic AML manual	Entity-specific policies and risk methodology	Rejection or immediate return of the file	Reset: applicant must resubmit from the start
Unclear beneficial ownership	Documented source of wealth and funds	Request for bank statements and tax records	Delay: the 40-day clock does not start
Weak transaction monitoring	Operational, risk-based framework with logs	Technical review or interview request	Stall: 4–8 week delay per RFI cycle
Outdated AMLA/FATF standards	Up-to-date AMLA/FATF guidance	Requirement to overhaul the manual	Significant delay or possible rejection

Some issues are fixable with extra documents and time. Structural problems are different. A generic manual, an outsourced MLRO that doesn’t meet local expectations, or thin ownership evidence can stop the process before it gets moving.

Once AML/CFT issues are cleared, regulators usually shift their attention to governance and disclosure checks.

Governance and Disclosure Problems That Slow Reviews

After AML/CFT, regulators usually turn to governance and disclosure.

Governance Gaps in Staffing, Controls, and Accountability

MiCA asks for governance that is real and easy to verify. Reviews often drag when a firm has weak EU substance, thin senior-level experience, or reporting lines that don't hold up under scrutiny.

One issue shows up again and again: the shell board. On paper, the directors exist. In practice, the real calls happen outside the EU. Regulators such as BaFin and the AFM want to see at least one EEA-resident director who actually works in the EU and has real decision-making power, not a nonresident director who just shows up for meetings.

Some regulators also want senior staff with five-plus years of relevant experience. That point mattered in TradeBlock Iberia's case. The firm was first rejected in 2024 because of weak board experience and a generic conflict policy, then approved in 2025 after fixing both issues.

Reporting lines matter too. Compliance should report straight to the board, and many regulators want the MLRO to be an internal employee rather than an outside consultant.

There is also a plain timing issue: in-person suitability interviews in France, Ireland, and Spain can add 4–6 weeks.

Governance Element	Observed Gaps in Stalled Filings	Source Type
Management Suitability	Lack of 5+ years' experience	Regulatory Requirement
EU Substance	Shell boards; no resident director with decision-making power	Regulatory Requirement
Independent Compliance	Compliance reporting to the COO	Structural Conflict
Internal MLRO	External consultants or outsourced AML officers in key roles	Staffing Deficiency
ICT Resilience (DORA)	Missing incident logs or exit plans for cloud providers	Technical Standards

Once regulators finish looking at staffing and controls, they usually compare the formal disclosure package with how the business actually runs. That's where a lot of filings start to wobble.

White Paper and Disclosure Errors That Reset the Process

A noncompliant white paper can push completeness back by 6–8 weeks. Even format problems can cause the same reset.

The biggest mistakes usually aren't dramatic omissions. They're the smaller gaps that show the filing doesn't match the firm's day-to-day setup. Generic risk warnings, missing board declarations of responsibility, vague explanations of asset segregation, and thin technical detail are all common triggers for follow-up questions.

You can think of it this way: the paperwork says one thing, but the operating model says another. Regulators notice that fast.

White Paper Requirement	Typical Compliance Error	Regulator Consequence
Risk Disclosures	Generic boilerplate warnings; missing platform-specific risks	RFI cycle / Clock reset
Management Statements	Missing formal declarations of responsibility from the board	Completeness check failure
Technical Omissions	Vague custody descriptions; incomplete evidence of technical implementation	Technical review delay
Outsourcing Arrangements	No DORA-compliant exit plans for cloud or custody providers	Application stall
Formatting/Accessibility	Gitbooks or non-permanent PDFs used instead of fixed MiCA format	Rejection of filing
Unsupported Claims	Marketing-heavy language without technical or financial proof	RFI / Substantiation request

When these problems show up, they often stop the clock before the statutory review even begins. And that's what makes timeline slippage so hard to control.

Timing, Backlogs, and Transition Rules Add More Delays

Not every stalled filing points to a weak application. A lot of delays are built into the system itself: regulator staffing limits, transition rules, and the sheer number of files National Competent Authorities are trying to process. In other words, the issue isn't only what firms submit. It's also how the process works and how much capacity regulators have.

Why Statutory Deadlines Do Not Guarantee Fast Authorization

On paper, MiCA looks fast. In practice, the statutory clock is not what slows most firms down. Queue time does. In 2026, filings typically take 8 to 12 months.

The main bottleneck shows up before a file is even treated as complete. The formal review clock starts only after the NCA confirms completeness. Until then, requests for information, or RFIs, can keep the application in limbo. Each RFI cycle can add another 4 to 8 weeks. Suitability interviews for management and shareholders can tack on 4 to 6 weeks, and holiday slowdowns can add 3 to 6 more weeks.

Country-level differences make this worse. The Netherlands ended its transition period on June 30, 2025, which left firms there with much less time to get ready. In Poland, two presidential vetoes in December 2025 and February 2026 stopped the KNF from accepting CASP applications. That left Polish VASPs without a legal route to comply before the July 2026 deadline.

Then there's the backlog itself. By late June 2026, only 244 valid CASP authorizations were listed with ESMA, compared with roughly 3,000 active providers before the deadline. That's a huge gap. It shows how stretched NCAs have been, and why even a strong filing can sit in line for months.

Planning Steps for CASPs and Applicants

The practical move is simple: plan for the queue, not the statutory clock. If a firm builds its capital runway, hiring plan, and go-live dates around the formal timeline alone, it's asking for trouble.

A few steps tend to cut down delays in practice:

• Use pre-filing services or innovation hubs 1 to 3 months before submission so missing documents show up early.
• Front-load AML and governance pre-audits before filing.
• Classify the business model early so the application fits the intended license scope.
• Map customer flows in detail so the file matches the right license class from day one.

The biggest hold-up usually happens before formal review starts. That's where planning does the most good. The table below shows where timelines slip the most and where extra prep matters most.

Phase	Statutory Timeline	Observed Practice	Planning Impact
Completeness Check	25 business days	45–60 days	High: Often involves 1–2 RFI cycles
RFI Cycles	Not specified	4–8 weeks per cycle	Critical: Regulators use this to delay the formal start
Suitability Interviews	Part of 40-day review	+4–6 weeks	Medium: Scheduling is the main bottleneck
Calendar/Staffing Delays	None	+3–6 weeks	Medium: August and December slowdowns are structural
Total Duration	~3 months	8–12 months	Requires a 12-month runway

Key Findings From the Study

Taken together, the filing data points to the same pattern across markets. Applications tend to stall for the same four reasons, and in most cases, the root cause is simple: teams went in underprepared.

AML/CFT weaknesses are the biggest blocker. This is usually the first place where an application gets held up. If the AML/CFT manual hasn't been updated to match current FATF and AMLA guidance, or if it doesn't line up with how the firm actually works day to day, regulators tend to kick off RFI cycles before the formal review even begins.

Governance gaps are the next major cause of delay. Regulators want clear proof that management is fit and proper, and they also want independent compliance reporting lines. If either point is missing or fuzzy, the review can grind to a halt. Once governance is in place, the spotlight shifts to disclosure quality.

Disclosure defects reset the process when paperwork and operations diverge. If the documents say one thing but the operating model shows another, the file is rejected. And the completeness clock doesn't start until those two match. Even when a file is clean, queue time and staffing shortages can still slow progress.

Structural delays compound everything else. As of June 2026, NCA backlogs, RFI cycles, and the completeness gate push realistic timelines to 8 to 12 months from submission to authorization.

FAQs

Why does the MiCA clock start late?

The MiCA clock for CASP applications doesn't start the day you submit.

Under Article 63, the formal 40-business-day review starts only after the NCA says the application is complete.

Before that, the authority can use up to 25 business days to check whether the file is complete and ask for missing information. If the application has gaps, the official review period can slip by weeks or even months.

What usually triggers RFIs?

RFIs often show up when an application is incomplete or doesn’t give enough proof that the firm can actually run the business it describes during the first completeness check.

Common triggers include gaps in AML controls, weak governance, poor IT risk management under DORA, missing fit-and-proper evidence for key personnel, and thin third-party risk documentation for cloud providers. Put simply, regulators want operational proof, not just policy templates.

How can CASPs avoid filing delays?

CASPs can cut MiCA filing delays with solid pre-submission prep and steady follow-up after filing. In practice, that matters a lot. NCAs often use the completeness check to send repeated requests for more information, so an application needs to be complete, well-documented, and technically sound before it goes in.

Start early with the areas that tend to slow things down most:

• governance
• AML
• internal policies
• executive fitness interviews
• beneficial owner documentation

This is where delays often begin. If one piece is thin, unclear, or missing, the back-and-forth can drag on.

Timing matters too. Try not to file right before national holidays or peak vacation periods. Even a strong application can stall if key reviewers are out of office.

Related Blog Posts

• MiCA Explained: EU Crypto Licensing Guide
• Step-by-Step Guide to CASP Licensing Under MiCA
• Top 5 Compliance Steps for CASPs After Registration
• 5 AML Issues in Crypto License Applications