CASP Licensing for Web3 Game Developers: A Practical Guide

A CASP licence (Crypto-Asset Service Provider authorisation) is the regulatory requirement for most Web3 game developers who want to serve EU players legally under MiCA.

This guide covers what it is, whether your game needs one, what it costs, how long it takes, and what developers are actually doing about it.

What a CASP licence is

MiCA (Markets in Crypto-Assets regulation) is the EU regulation governing crypto-asset services. Under MiCA, any entity offering specific crypto-asset services to people in the EU needs authorisation from a National Competent Authority (NCA) — one per EU member state.

That authorisation is the CASP licence.

The services that require it include:

Providing custody and administration of crypto-assets on behalf of clients
Operation of a trading platform for crypto-assets
Exchange of crypto-assets for fiat currency or other crypto-assets
Providing transfer services for crypto-assets
Receiving, transmitting, or executing orders for crypto-assets

For Web3 games: if your game holds player wallets (custodial), runs a marketplace where players trade assets, or processes token transfers — you almost certainly need either a CASP licence or to operate under one.

Does your game need a CASP licence?

Run through this checklist:

Custodial wallets — Does the game manage wallets on behalf of players (players log in with email, no seed phrase)? → CASP required.

Marketplace — Does the game run an in-game marketplace where players buy and sell assets using cryptocurrency or in-game tokens? → CASP required if there is a trading/exchange function.

Token transfers — Do players send tokens to each other within the game? → CASP likely required.

NFT minting — Minting alone typically does not trigger CASP. The marketplace where minted NFTs are traded does.

Fiat on-ramp — Does the game allow players to buy cryptocurrency or in-game currency with real money (credit card, bank transfer)? → CASP likely required.

If you answered yes to any of these and serve EU players, the licence applies. MiCA applies based on where players are located, not where the developer is based. A US studio, a UK studio, a Singapore studio serving EU players — all within scope.

What it costs

The full year-one cost of holding a CASP licence independently is typically €500,000 to €1,000,000. The breakdown:

Application fees: €2,000 to €50,000 depending on jurisdiction. Malta and Lithuania are at the lower end. Sweden, Germany, France, and Netherlands are higher. Fees are not the large cost.

Capital reserves: Article 67 of MiCA requires CASP entities to hold own funds of at least:

Class 1: €50,000
Class 2: €125,000
Class 3: €150,000
Or 25% of prior year fixed overhead — whichever is higher

These reserves must be CET1 (Common Equity Tier 1) own funds or qualifying insurance from an authorised insurer. Crypto holdings do not count. The capital is locked — it cannot fund operations.

Qualified personnel: MiCA requires a compliance officer, an AML (Anti-Money Laundering) officer, and a board that meets fitness and propriety standards. Annual cost: €200,000–€500,000 for a minimal compliance function.

Legal counsel: Drafting the application, ongoing regulatory advisory, submissions to the NCA. €100,000–€300,000 year one.

External audits: Required annually. €50,000–€100,000.

The total before any product work: €500,000 to €1,000,000 in year one.

The timeline

Getting a CASP licence is not fast.

Preparation (months 1–3). Choose your jurisdiction. Draft governance and risk frameworks. Appoint required personnel. Establish capital reserves.

Application submission (months 3–4). Submit to the National Competent Authority. The NCA conducts an initial completeness review.

Legal review (months 4–9). Once the application is deemed complete, the NCA has up to 25 working days (approximately 5 months) for the formal assessment. In practice, the NCA can pause the clock to request additional information, which extends the timeline.

Decision (months 9–12+). Approval, conditional approval, or rejection. Conditions might require additional capital, staff changes, or revised governance documents.

Realistic total: 6 to 12 months from start to approval when everything goes smoothly. Applications with errors or gaps take longer.

Which jurisdiction to choose

MiCA is EU-wide regulation. A CASP licence from any EU member state gives access to all EU markets (passporting). The choice of jurisdiction affects:

Fees and costs. Malta and Lithuania have low application fees and relatively fast NCA turnaround. Sweden, Germany, and France have higher fees and often more stringent requirements.

NCA responsiveness. Some NCAs have more experience with crypto-asset applications. Malta’s MiCA regulator (MFSA) and Lithuania’s (Bank of Lithuania) have handled substantial volumes.

Local substance requirements. Most NCAs require real local presence — not a letterbox company. A registered office, local management, potentially a physical presence.

Perception. Some jurisdictions are considered more rigorous by the market. A licence from BaFin (Germany) may carry different weight to one from a smaller NCA.

What developers are actually doing

The reality is that most Web3 game developers cannot carry the CASP licence burden independently. The options they are choosing:

Option 1: Obtain own licence. The full compliance path. Appropriate for well-funded studios with long time horizons, existing regulatory experience, and the resources to maintain an ongoing compliance function. Slow and expensive but provides full control.

Option 2: Block EU players. The avoidance path. Geo-block the EU. No EU players, no EU regulatory obligation. This means abandoning an estimated 100 million potential players — the largest single crypto-asset market in the world.

Option 3: Build on a licensed platform. The platform path. A licensed infrastructure provider holds the CASP licence and provides the regulated services (custody, marketplace, payments) as a platform layer. Developers integrate via SDK. They operate under the platform’s regulatory perimeter rather than holding their own licence.

Genesis Engine is building option 3 — pursuing the CASP licence in Sweden (Finansinspektionen) and providing the regulated infrastructure as a platform that game developers integrate with.

The alternative compliance paths

Transitional provisions. Some entities that held national crypto registrations before MiCA came into force are covered by transitional provisions that give them additional time. Most game developers launching now are not covered by these provisions.

White-label compliance. Some compliance firms offer to set up and manage a CASP entity on behalf of clients. Costs are high and control is limited. Not widely used in the gaming market.

Limiting the game mechanics. Some developers have re-architected their games to remove the specific mechanics that trigger CASP — removing custodial wallets, removing the marketplace, allowing only non-custodial wallet connections. This can work but significantly limits what the game can offer to players.

What happens if you do not comply

Operating a CASP-required service without authorisation exposes the studio to:

Regulatory enforcement. National Competent Authorities can issue public warnings, prohibitions on services, and fines. ESMA can also act in cross-border cases.

Payment processing issues. Fiat payment providers and banks increasingly check for regulatory compliance before onboarding. Non-compliant crypto-asset services find it harder to access banking and payment rails.

Reputational risk. Regulatory action against a game studio is public. It affects player trust, partnership opportunities, and fundraising.

Criminal liability. In some EU jurisdictions, running unauthorised crypto-asset services carries personal criminal liability for directors.

The window for ignoring this without consequence has closed. Enforcement is active.

Common questions about CASP licensing for games

Does minting NFTs require a CASP licence? Minting alone typically does not trigger CASP. The triggering activities are the subsequent services: holding minted assets in custody, running a marketplace where they are traded, processing transfers. The mint event itself is separate.

Does a CASP licence cover all EU member states? Yes. A licence from any EU NCA gives the right to provide services across all EU member states (passporting). The applicant chooses one “home” member state and registers to operate in others.

What is the Transfer of Funds Regulation (TFR) and does it apply to games? TFR is the EU regulation requiring originator and beneficiary information for crypto transfers above certain thresholds, similar to the FATF Travel Rule. It applies to crypto-asset transfers processed by CASPs. If your game involves token transfers between players, TFR compliance is required alongside MiCA. A licensed platform like Genesis Engine handles TFR at the infrastructure level.

Can an indie developer afford a CASP licence? In most cases, no. The ongoing compliance function alone costs more than most indie studios generate. The practical path for indie developers is a licensed platform layer.

Does a UK studio need an EU CASP licence? The UK has its own crypto-asset framework. An EU CASP licence does not cover UK operations (and vice versa). If a UK studio serves both EU and UK players, it may eventually need regulatory authorisation in both jurisdictions.

What is the difference between MiCA and MiCAR? They refer to the same regulation. MiCA is the commonly used abbreviation; MiCAR stands for Markets in Crypto-Assets Regulation (the formal EU legislative shorthand). Both mean the same thing.

Genesis Engine holds the CASP licence at the platform level so developers do not need to. Web3 game developers building for EU players can apply to join the waitlist at triolith.com.