MiCA Article 60: Crypto Services for Banks, Investment Firms and EMIs

Fifty-two German cooperative banks are on the EU’s register of crypto-asset service providers. So is Deutsche Bank, in an entry dated 12 October 2026, and Piraeus Bank in Greece. None of them holds a CASP authorisation. They came in through the second door MiCA built for institutions that are already licensed: a notification to their own supervisor.

For a bank, investment firm, e-money institution or fund manager thinking about crypto, that door is usually the faster route. It is not a lighter rulebook. This guide sets out who can use it and for which services, what the notification must contain, how the timeline works, and what changes – and what does not – once you are on the register.

General information as of 12 October 2026, not individual legal advice. For how we work with financial institutions and founders, see crypto lawyer in Latvia.

In short

• Six kinds of institution can notify instead of applying: credit institutions, central securities depositories, investment firms, e-money institutions, UCITS management companies and alternative investment fund managers, and market operators (MiCA Article 60).
• The scope follows the licence you already hold. A bank may provide any crypto-asset service; the others only the crypto equivalents of what they are already authorised to do. An e-money institution, for example, may notify only custody and transfers of the e-money tokens it issues itself.
• Payment institutions are not on the list. For them – and for any service outside the notified scope – the route is a full CASP authorisation.
• Timing: notify at least 40 working days before you start. The supervisor checks completeness within 20 working days, and you cannot start while the notification is incomplete.
• What falls away: the authorisation procedure, MiCA’s own-funds requirement and MiCA’s change-of-control regime (Article 60(10)). Your existing licence and prudential regime already cover that ground.
• What stays: the full conduct rulebook for crypto-asset service providers – client information, safekeeping and segregation of client assets, complaints, conflicts of interest, outsourcing – alongside the anti-money-laundering rules, DORA and the travel rule.

Two doors to the same register

MiCA lets two kinds of entity provide crypto-asset services in the EU (Article 59(1)). The first is a company authorised as a crypto-asset service provider after a full application to its national regulator – the route crypto-native firms take, set out in our guide to the MiCA/CASP licence in Latvia. The second is a financial institution that already holds a licence under other EU legislation and has notified its supervisor under Article 60.

Both are crypto-asset service providers in MiCA’s sense: the definition covers anyone allowed to provide the services under Article 59 (Article 3(1)(15)). Both appear on ESMA’s register. Only the first holds a CASP authorisation under Article 63 – although supervisors, Latvijas Banka among them, often describe the outcome of an Article 60 notification as an authorisation too (more on that below). The distinction matters when you read the register: a bank on it has notified, not applied. The same goes for our searchable mirror of the register, which reproduces ESMA’s data.

Germany shows the mechanism at scale. At the end of 2025 DZ BANK obtained MiCA permission for meinKrypto, a crypto trading service inside the cooperative banks’ banking app, with custody by Boerse Stuttgart Digital. Each cooperative bank that offers it to its own customers has to notify BaFin itself – which is why the register lists them one by one, each for a single service: executing clients’ orders.

Who can notify, and for which services

Institution	What it may provide by notification
Credit institution	Any crypto-asset service (Art. 60(1))
Central securities depository	Custody and administration of crypto-assets only (Art. 60(2))
Investment firm	The crypto equivalents of the investment services and activities it is authorised for under MiFID II (Art. 60(3))
E-money institution	Custody and administration, and transfer services – only for the e-money tokens it issues itself (Art. 60(4))
UCITS management company or AIFM	The crypto equivalents of portfolio management and of its authorised non-core services: reception and transmission of orders, advice (Art. 60(5))
Market operator	Operation of a trading platform for crypto-assets (Art. 60(6))

Investment firms: the MiFID licence sets the limit. Article 60(3) maps each crypto-asset service onto a MiFID equivalent. Custody corresponds to the ancillary service of safekeeping and administration; operating a crypto trading platform to running an MTF or OTF; exchanging crypto-assets for funds or other crypto-assets to dealing on own account; execution, placing, reception and transmission of orders, advice and portfolio management to their MiFID namesakes. A broker licensed only to receive and transmit orders can notify crypto order transmission – but not exchange services, which correspond to dealing on own account. Widening the crypto scope means widening the MiFID licence first, or applying for a CASP authorisation.

E-money institutions: own tokens only. An EMI’s notification covers custody and transfers of the e-money tokens it issues (Article 60(4)) – what a stablecoin issuer needs to hold and move its own token for clients. It does not cover letting customers buy or sell bitcoin, or holding other issuers’ tokens. For that, an e-money institution needs a CASP authorisation. The licence itself is covered in our guide to the EMI licence in Latvia.

Payment institutions: not on the list. Article 60 does not mention payment institutions. A payment institution that wants to offer crypto-asset services applies for CASP authorisation like any other firm.

Two further qualifications come from ESMA’s Q&As. A bank may notify any crypto-asset service, but ESMA notes that a bank with no licence or experience for a type of service – custody, for example – may struggle to supply the information the notification requires, and national banking law on the scope of a bank’s licence still applies (Q&A 2088, MiCA recital 78). And only authorised fund managers qualify: registered, sub-threshold AIFMs cannot notify (Q&A 2397).

What the notification must contain

Article 60(7) lists the information to be notified:

• a programme of operations – which crypto-asset services, and where and how they will be marketed;
• the AML/CFT internal controls, the money-laundering and terrorist-financing risk-assessment framework, and the business continuity plan;
• technical documentation of the ICT systems and security arrangements, with a description in non-technical language;
• the procedure for segregating clients’ crypto-assets and funds;
• the custody and administration policy, if you will hold crypto-assets for clients;
• the operating rules and market-abuse detection systems, if you will run a trading platform;
• the commercial policy and pricing methodology, if you will exchange crypto-assets for funds or other crypto-assets;
• the execution policy, if you will execute client orders;
• evidence that the people giving advice or managing portfolios have the necessary knowledge and expertise;
• whether the services concern asset-referenced tokens, e-money tokens or other crypto-assets;
• how transfer services will be provided, if you offer them.

The detail sits in two Commission regulations, in force since 12 March 2025: Delegated Regulation (EU) 2025/303, which specifies the information, and Implementing Regulation (EU) 2025/304, which sets the standard forms and procedure. The delegated regulation goes well beyond the bare list. Among other things it asks for:

• a programme of operations for the three years following the notification, including how the crypto business fits the group and the target number of clients by geographical area;
• the resources dedicated to the services and where they are located, and an outsourcing policy adapted to crypto-asset services, intra-group arrangements included;
• a forecast accounting plan with stress scenarios, and any own-account activity – including through decentralised finance applications;
• a business continuity plan that covers the failure of third-party functions and the death of a key person;
• a crypto-specific money-laundering risk assessment;
• the arrangements for complying with DORA, including the ICT contracts that support critical functions;
• for custody, how client assets are segregated – and, where a third party holds them, that provider’s own status under MiCA Article 59 or 60.

Information you have already given your supervisor need not be submitted again if it is identical; you state that it is still up to date (Article 60(9)).

Three items deserve the most preparation. The ICT documentation has to fit the DORA framework the institution already runs, rather than describe a parallel one. The custody and segregation design has to work with the institution’s existing safeguarding and outsourcing arrangements – especially where a third-party custodian or technology provider sits behind the service. And the AML risk assessment has to address crypto-specific risks, such as transfers to and from self-hosted wallets, rather than restate the existing assessment.

How the timeline works

• At least 40 working days before you first provide the services, the notification must be with your home supervisor (Article 60(1)–(6)).
• Within five working days the supervisor acknowledges receipt (Implementing Regulation (EU) 2025/304, Article 3).
• Within 20 working days of receiving it, the supervisor assesses whether all the required information has been provided. If not, it sets a deadline of up to 20 working days for the missing information, and the 40-day period is suspended until that deadline. Further requests for completion or clarification are at its discretion and do not suspend the period (Article 60(8)).
• You cannot start while the notification is incomplete (Article 60(8)).
• Once the notification is complete, the supervisor passes the details to ESMA, which publishes them in its register by the intended start date (Article 60(12)). That is why a notified institution can appear on the register before it may start. The date shown on such entries is filled in differently by different supervisors – some use the notification date, others the date the file was complete – so read it with care.

Forty working days is roughly two calendar months. For most institutions, assembling the information pack – not the statutory clock – sets the pace.

What changes, and what does not

Falls away (Article 60(10)). A notifying institution is not subject to Articles 62 and 63 (the application and its assessment), Article 64 (withdrawal of authorisation), Article 67 (MiCA’s prudential requirements, including own funds) or Articles 83 and 84 (assessment of acquisitions of qualifying holdings). The sectoral licence already covers this ground: capital under the banking or investment-firm rules, change of control under the sectoral regime.

Stays. The obligations MiCA imposes on all crypto-asset service providers apply in full: acting honestly, fairly and professionally in clients’ best interests (Article 66), governance arrangements (68), safekeeping of clients’ crypto-assets and funds (70), complaints handling (71), conflicts of interest (72), outsourcing (73) and orderly wind-down planning (74), plus the service-specific rules – custody (75), trading platforms (76), exchange (77), execution (78), placing (79), reception and transmission of orders (80), advice and portfolio management (81) and transfers (82). The market-abuse rules in Title VI apply to anyone dealing in crypto-assets admitted to trading. Anti-money-laundering law, DORA and the travel rule for crypto transfers apply as well.

Tied to the parent licence. The right to provide crypto-asset services under Article 60 ends if the licence that enabled it is withdrawn (Article 60(11)).

Cross-border. MiCA has no separate passport for notified institutions, and ESMA has not addressed the point in its Q&As. Because they are crypto-asset service providers in MiCA’s sense, the general cross-border procedure in Article 65 is the natural route – and the register already lists notified institutions for other member states: Clearstream, which notified in Luxembourg, is listed for all EEA countries.

Notify, or set up a separately authorised CASP?

Notification is faster and builds on the licence, capital and controls the institution already has. A CASP authorisation can still be the better fit – and it does not always need a separate company: the European Commission has confirmed that institutions covered by Article 60(2)–(6) may apply for authorisation for crypto-asset services outside their equivalence, unless their sectoral rules forbid those activities (ESMA Q&A 2125). Authorisation, in the same entity or a subsidiary, makes sense:

• when the crypto business needs a scope the existing licence does not reach – an e-money institution that wants trading, a payment institution, a broker licensed only for order transmission that wants exchange services;
• when outside investors are to hold equity in the crypto business only;
• when the group wants crypto risk ring-fenced in its own entity, with its own capital and management.

The notified route ties the crypto business to the parent licence, including its fate if that licence is withdrawn. The authorised route gives it a licence of its own – at the cost of a full application, MiCA’s own-funds requirement and the substance tests that come with it.

In Latvia

For banks, investment firms, e-money institutions and fund managers in Latvia, the supervisor is Latvijas Banka, which sets out the process on its page for existing financial market participants. Four points are specific to Latvia.

• The vocabulary. Latvian law and Latvijas Banka describe the outcome as an authorisation: the Crypto-Asset Services Law refers to an institution that has received an atļauja (authorisation) under Article 60 of MiCA, while the standard form is titled a notice of intention to provide crypto-asset services. The mechanics are MiCA’s either way – 40 working days, a completeness check, and no Articles 62–64, 67, 83 or 84.
• Filing in Latvian. The form is published in Latvian only, and documents are filed in Latvian; anything in another language needs a translation. Latvijas Banka’s usual channels apply – the e-address system, e-signed email or post.
• Fees. An institution Latvijas Banka already supervises pays no application fee: the €2,500 fee applies only to applicants that are not supervised financial market participants (Crypto-Asset Services Law, Section 6(1)). For annual supervision, e-money institutions, management companies and fund managers that add crypto-asset services pay up to 0.6% of their gross revenue from those services, with no minimum; credit institutions, investment firms, central securities depositories and regulated-market operators are outside that fee (Section 6(5)).
• Precedent. The first existing Latvian market participant to take this route was the investment firm TWINO Investments, which obtained the right to provide crypto-asset services in June 2026 on the basis of its investment-firm licence. It is so far the only Latvian entry on the register to come in this way. The other eleven hold CASP authorisations – and six of them are payment institutions, which have no access to Article 60.

Frequently asked questions

Do banks need a CASP licence to provide crypto services under MiCA? No CASP authorisation is needed. Under MiCA Article 60, a credit institution may provide any crypto-asset service after notifying its home supervisor at least 40 working days before it starts, with the information listed in Article 60(7). It is not subject to the authorisation procedure, MiCA’s own-funds requirement or MiCA’s rules on acquisitions of qualifying holdings – but the conduct rules for crypto-asset service providers apply in full.

Can an e-money institution offer crypto trading under Article 60? No. An e-money institution may notify only custody and administration and transfer services, and only for the e-money tokens it issues itself. Exchanging, executing orders in or holding other crypto-assets for clients requires a CASP authorisation.

Can a payment institution use the Article 60 notification route? No. Article 60 covers credit institutions, central securities depositories, investment firms, e-money institutions, UCITS management companies, alternative investment fund managers and market operators. Payment institutions are not on the list and need a CASP authorisation to provide crypto-asset services.

How long does an Article 60 notification take? The notification must be made at least 40 working days before the services start. The supervisor checks completeness within 20 working days; if information is missing, it sets a deadline of up to 20 working days and the 40-day period is suspended until then. Services cannot start while the notification is incomplete.

Do notified institutions appear on the ESMA register? Yes. Once the notification is complete, the supervisor passes the details to ESMA, which publishes them in its MiCA register by the intended start date. That is why a notified bank can appear on the register weeks before it may start providing services.

When to talk to a lawyer

The questions that decide an Article 60 project are scoping questions: which services your existing licence actually reaches, whether the custody model works with your safeguarding and outsourcing arrangements, and whether a notification or a separately authorised entity fits the business plan better. If you are a bank, investment firm, e-money institution or fund manager weighing crypto-asset services, get in touch. Related reading: the MiCA/CASP licence in Latvia, the EMI licence in Latvia and our register of MiCA crypto-asset service providers.

---

Updated: 12 October 2026. General information only, not individual legal advice. Based on Regulation (EU) 2023/1114 (MiCA) as published; supervisory practice and technical standards evolve – confirm the current requirements with your supervisor before notifying.