Legal Q&A · Compliance, Registers & Licences

We hold a CASP authorisation in Slovakia. How do we start providing crypto-asset services in Czechia?

Law as at 12 September 2026

Short answer

You do not need a new authorisation from the Czech National Bank. A CASP authorisation granted by the National Bank of Slovakia permits you to provide services throughout the Union, but before starting services in Czechia you must notify NBS of the list of Member States, the services, the intended start date and your other activities. NBS forwards the information to the Czech single point of contact within 10 working days, and you may start on the day it notifies you of that transmission, and at the latest on the 15th calendar day after submitting the notification. You may provide only the services covered by your authorisation.

One of the principal advantages of Regulation (EU) 2023/1114 (MiCA) is that an authorisation as a crypto-asset service provider (CASP) granted in one Member State is valid throughout the Union. For a Slovak provider wishing to serve Czech clients as well, and for a Czech provider looking to Slovakia, that means a straightforward procedure, which nevertheless must not be skipped and which does not widen the scope of the authorisation.

One authorisation for the whole Union

Crypto-asset service providers may provide services throughout the Union under the right of establishment, including through a branch, or under the freedom to provide services, and cross-border provision may not be made subject to a physical presence in the host State (Article 59(7)). The home Member State is the State of the provider’s registered office (Article 3(1)(33)(f)), and in Slovakia the National Bank of Slovakia grants the authorisation and exercises supervision (Section 7(1) of Act No. 248/2024 Coll.). Czechia is the host Member State in this case (Article 3(1)(34)), and the Czech competent authority is the Czech National Bank (Section 9 of Act No. 31/2025 Sb., on the digitalisation of the financial market).

The procedure under Article 65

Before starting services in another State, the provider submits to the competent authority of the home State the list of Member States in which it intends to operate, the services it intends to provide there, the intended start date and a list of other activities to which MiCA does not apply (Article 65(1)). Within 10 working days, the home authority communicates that information to the single points of contact of the host States and to ESMA and EBA (Article 65(2)), and notifies the provider of it without delay (Article 65(3)). When you may start is governed by paragraph 4:

A crypto-asset service provider may start to provide crypto-asset services in a Member State other than its home Member State from the date of receipt of the communication referred to in paragraph 3 or at the latest from the 15th calendar day after having submitted the information referred to in paragraph 1.

— Article 65(4) of Regulation (EU) 2023/1114

A Czech company authorised by the CNB that wishes to operate in Slovakia proceeds in the same way; it submits the notification to the CNB, which forwards it to Slovakia.

What passporting does not solve

Cross-border provision covers only the services listed in the authorisation (Article 59(6)). If you wish to offer a service in Czechia that your authorisation does not cover, you must first ask NBS to extend it (Article 59(8)); a notification under Article 65 does not suffice for that. The authorisation also presupposes a genuine link with the home State: the provider must have its registered office in a State in which it carries out at least part of its business, its place of effective management in the Union, and at least one director resident in the Union (Article 59(2)). A company with nothing but a registered office in Slovakia, running its entire operation from Czechia, would not meet that condition. Whether the activity in the host State triggers duties outside MiCA, for instance in tax or consumer protection, must be assessed separately.

A third-country provider without an authorisation in the Union cannot rely on passporting. The exemption for a service provided at the client’s exclusive initiative is narrow: it does not apply where the firm solicits clients in the Union in any way, and it does not permit new types of crypto-assets or services to be offered to the client (Article 61(1) and (2)). The transitional periods for providers operating under the former national rules ended in Slovakia on 30 December 2025 (Section 12 of Act No. 248/2024 Coll.) and in Czechia on 1 July 2026, that is, on the latest date permitted by Article 143(3) MiCA.

How to proceed

Before notifying, check that the services planned for Czechia are covered by the authorisation, and prepare the list of other activities together with a realistic start date. We prepare the notification to NBS or the CNB, any extension of the authorisation and the cross-border operating arrangements through our MiCA licence for crypto-asset services service. If you are still applying for the authorisation, we set out the contents of the application in CASP authorisation under MiCA.

This answer provides general information on the law as at 12 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.

More legal questions

All questions and answers
  1. Our company has been hit by a cyberattack. To whom and by when must we report it? If you are an essential service operator, you report a serious cybersecurity incident to the National Security Authority through the unified cybersecurity information system. The early warning must be sent within 24 hours of detection, the notification with an initial assessment within 72 hours, and the final report no later than one month after the notification. Alongside reporting, you must address the incident, secure evidence, and report to the police or law enforcement authorities any criminal offence of which you credibly learn.
  2. Must we undergo a cybersecurity audit, or is a self-assessment enough? An essential service operator must verify the effectiveness of its security measures by a cybersecurity audit within two years of the date of entry in the register; the audit is carried out by a certified auditor and the final report must be submitted to the authority within 30 days. Apart from the transitional rules running until the end of 2026, only an operator that does not operate a critical essential service may replace the audit with a self-assessment through the unified information system, and even that operator must undergo an audit within five years of registration. The audit is also repeated after every change with a significant effect on the security measures.
  3. We no longer do business with the State. Should we be removed from the RPVS, or is ending the arrangement with our authorised person enough? If you are no longer a public sector partner and are no longer receiving performance under any contract, the correct route is removal from the register, applied for by your authorised person while they are still registered. Were the authorised person to apply for their own removal only, you would remain in the register and would have to secure a new authorised person within 30 days of that removal. Voluntary removal does not in itself trigger the two-year bar on fresh registration, but it does not end proceedings already commenced on the verification of beneficial owner data.
  4. Can our regular lawyer or auditor act as our RPVS authorised person? Yes. An ordinary relationship with a lawyer, notary, auditor, tax adviser or bank that arose in the performance of their profession does not, under the Act, call the authorised person's impartiality into question. Excluded, however, is anyone who is themselves the partner or beneficial owner in the matter, who shares a beneficial owner with the company, or who is personally or through ownership connected with the company or members of its bodies. A breach of the prohibition is punishable by a fine imposed on the authorised person, the company and its statutory representative alike.

Cannot find your question? Ask your own question

Facing this situation?

Tell us what you need help with.

Describe your situation. We will review it and usually tell you within 24 hours whether and how we can help, including an indicative fee.

  1. 1Send your enquiry via this form
  2. 2Usually within 24 h you get a price confirmation and plan
  3. 3We start work only after your approval
Mgr. Patrik Tulinský, LL.M. Czech and Slovak attorney · SAK 300422 · ČAK 19654

Not keen on calls or email? Message us on WhatsApp →
Prefer to book a time right away? Book a consultation →
Or email us about this matter.

PDF, Word, images, ZIP… max 10 MB per file, 30 MB total.

Submitting this form does not create an engagement or attorney-client relationship. Before taking on a matter we run a conflict-of-interest check, so please do not send sensitive originals until we confirm the matter together.

Contact a lawyer