How Crypto Licensing Applications Are Actually Prepared

What this guide covers

Licensing applications generally follow a recognizable multi-stage pattern, even though the specific requirements differ by jurisdiction. This guide walks through that general pattern using two real, directly-researched processes -- the Central Bank of Ireland's MiCA CASP process and VARA's UAE process -- as concrete illustrations, distinguishing what's commonly expected from what's specifically legally mandated in those two cases. It's educational information, not legal advice.

Stage 1: initial engagement, before a formal application

Several regulators expect some form of pre-application contact before a formal filing. The Central Bank of Ireland's own MiCA page describes an initial meeting, preceded by a presentation of the proposal submitted at least ten working days beforehand. VARA's own process similarly starts with an Initial Disclosure Questionnaire and an Approval to Incorporate, rather than jumping straight to a full licence application. Treat this stage as a real opportunity to surface problems early, not a formality to rush through.

Stage 2: core documentation

• A business plan describing the intended activities, target customers, and operating model in enough detail for a regulator to assess risk.
• Governance documentation: corporate structure, directors, senior management, and ownership.
• An AML/CFT programme and broader risk-management framework specific to the business's actual activities.
• Financial information: capital position, financial projections, and (where required) proof of minimum regulatory capital.
• Technology and security documentation, including custody arrangements if the business will hold client assets.

Stage 3: formal submission and completeness review

A formal application is typically reviewed first for completeness, not substance -- the Central Bank of Ireland's own page describes this specific stage as a reported 25-working-day review. An incomplete application is often simply not progressed to substantive assessment, rather than rejected outright; MiCA's own Article 63(3) specifically allows a competent authority to decline to review an incomplete application in the first place.

Stage 4: substantive assessment

This is where a regulator actually evaluates the business against its licensing criteria -- fit-and-proper checks on management and owners, adequacy of the compliance programme, financial soundness, and whatever activity-specific requirements apply (custody arrangements, trading-platform rules, and similar). Ireland's own process describes a reported 40-working-day assessment period, extendable by up to 20 more days if the regulator needs further information -- a reminder that a request for more information during this stage is routine, not a sign of a failing application.

Stage 5: decision and ongoing obligations

A licence or authorisation decision is usually communicated after the substantive assessment -- Ireland's own process describes this as a reported 5 working days after assessment concludes. Licensing isn't a one-time event: ongoing reporting, periodic reviews, and notification obligations for material changes to the business typically continue for as long as the licence is held, and several regimes (VARA's among them) require annual renewal.

Limitations and review information

Last verified: November 5, 2026. The specific timelines cited here are reported figures for Ireland and the UAE specifically, not a universal standard -- confirm the actual current process and timeline directly with your target jurisdiction's regulator. This is educational information only, not legal advice.