Netherlands Crypto Licence Requirements in 2026

A Netherlands crypto (CASP) licence requires a Dutch company (typically a B.V.) with genuine local substance, meaning a registered office and a real operating presence, plus the class-based MiCA capital (€50,000–€150,000). The Netherlands is one of the EU’s most credible crypto bases, and the requirements file behind a CASP authorisation reflects it. This is not the light-touch registration some jurisdictions offered before MiCA. The Dutch enforced the regime early, cutting their transition deadline to 30 June 2025, and the AFM now asks for a real business: a Dutch company with substance, funded capital, vetted people and working AML and ICT-resilience programmes.

This is the checklist our team works from on live applications. It covers exactly what the 2026 Netherlands CASP regime demands (a company with genuine local presence, initial capital by service class, fit-and-proper management assessed by the AFM under a twin-peaks model, an MLRO and a DORA-compliant ICT framework), so you can price the licence on what it actually takes. A Dutch licence carries real weight precisely because the regime is known to be strict, and we scope it as the full EU financial-services credential it is.

The company and local substance Netherlands requires

Everything starts with a Dutch company. The AFM licenses a Dutch legal entity, in practice a B.V., with genuine substance behind it. There is no remote-only route: the applicant is incorporated in the Netherlands, keeps a registered office there, and runs a real operating presence there; a virtual address does not count. This is the first hard difference from an offshore VASP registration, and it is the requirement operators most often underestimate.

Substance is assessed in the round. The regulator wants to see that the business is directed and administered from the Netherlands, with the right people performing the core functions locally. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the test — and in a regime that markets itself on strictness, that scrutiny is deliberate. For the full picture of what a Dutch CASP authorisation buys and how it sits within MiCA, our flagship Netherlands crypto licence overview maps the regime end to end.

Capital by service class in the Netherlands

This is the requirement that catches operators pricing the Netherlands on the state fee alone. MiCA sets a minimum capital floor by the service class you run, and the Netherlands applies it directly. The file has to prove the safeguards are in place, and after authorisation you keep them at the higher of the class minimum or a quarter of the previous year’s fixed overheads, through own funds, an insurance policy or both.

These figures are identical in every EU member state because they come from MiCA rather than national law, so the capital tier is not something you optimise by choosing the Netherlands over another EU jurisdiction. What the Netherlands offers is a high-trust credential and a mature, crypto-aware financial ecosystem around the same requirement. Costs sit outside scope here; for the full year-one build, the state fee and running costs, see the Netherlands crypto licence cost guide, and for the capital rules across all three classes our CASP capital requirements primer breaks each one down.

People, governance and the twin-peaks model

Under MiCA the people behind the company are assessed as rigorously as the business itself, and in the Netherlands the vetting runs through a twin-peaks structure. The AFM issues the CASP licence and supervises conduct; the central bank DNB handles prudential matters for e-money-token and asset-referenced-token issuers. For a straightforward exchange or custody model the AFM is the lead authority, but if your model issues tokens, DNB prudential scrutiny comes into scope too — so map which authority owns which part of your file before you build it.

Fit-and-proper management. The people running the CASP are assessed for competence, integrity and relevant experience. The AFM expects a board and senior management with genuine financial-services or crypto backgrounds, and a founder team with no regulated-industry track record falls short of that. Directors must demonstrate they can actually run a licensed EU financial-services business.

A dedicated MLRO and governance structure. A money-laundering reporting officer is a condition of the licence, backed by a clear governance structure with defined responsibilities and board-level compliance oversight. The MLRO is accountable for the AML programme, transaction monitoring and reporting, and must be a real, appointable person who does the job.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. The AFM checks the origin of the money and how each beneficial owner came by their wealth. As an early enforcer it is quick to pause a file where that story is thin or undocumented. Because these checks take the longest to assemble, especially source-of-funds evidence spanning multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme Netherlands asks for

Alongside people and capital, the AFM reviews a defined set of documents and policies. Filing with any of these missing, or written for a different business model, is what turns a five-month statutory review into a much longer one. The core pack is:

Three elements deserve emphasis. The AML/CFT policies must be operable documents aligned to the EU’s anti-money-laundering directives and the Travel Rule (the EU Transfer of Funds Regulation obligation to attach originator and beneficiary data to crypto transfers), because the MLRO is expected to actually run them. The DORA ICT framework covers ICT risk management, incident reporting, resilience testing and third-party ICT oversight, and it applies to every CASP. And where you issue or admit tokens to trading, a MiCA white paper meeting the regulation’s disclosure standard is required on top of the service authorisation — this is also the point where DNB prudential rules for e-money and asset-referenced tokens come into play. Custody, safeguarding and complaints-handling policies round out the pack, with strict client-asset segregation for any class that touches custody.

Transition, passporting and the early-enforcer edge

Two facts frame the requirements. First, the transition: rather than take the full MiCA window, the Netherlands cut its deadline to 30 June 2025, retiring the old DNB VASP AML registration in favour of the AFM CASP licence ahead of most of the EU. That cutoff has already passed, so the Netherlands is now in full enforcement — new entrants apply directly for CASP authorisation, and there is no VASP shortcut left. If you hold or held an old Dutch registration, our VASP-to-CASP transition guide walks through the upgrade path and what the early cutoff means in practice.

Second, the reward for meeting the full requirements: passporting. Once the AFM grants the CASP licence, it lets you offer crypto services across all 27 EU member states on a notification basis under MiCA Article 65 — one licence, the whole single market, without applying jurisdiction by jurisdiction. Because the Netherlands enforced early and is regarded as a strict, serious regulator, that credential does more than open markets: it signals a well-run operation to banks, PSPs and institutional partners.

Assembling the Netherlands file in the right order

To avoid rework, fix your CASP service classes and the matching capital tier first, and scope whether your model brings DNB prudential rules into play. Then incorporate the Dutch B.V., arrange the own funds or insurance cover and stand up the local office and roles. Assemble every UBO and management fit-and-proper file in parallel, because they take the longest. Draft the programme of operations, AML/CFT and DORA policies against your actual operating model. Only then does the AFM application go in, opening the statutory clock of roughly five months.

The CASP regime asks for a real Dutch company, real capital, vetted people and operable AML and ICT programmes, and in exchange gives you a full EU credential that passports across 27 markets and carries unusual weight with banks and partners. Gaps in the file are what push the review beyond the roughly five-month statutory clock.

Ready to assemble your CASP requirements pack, or want a second opinion on a file you have already started? Our team handles the full Dutch substance, fit-and-proper, AML and DORA build end to end and will review any application against the AFM’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.