CMS Expert Guide to Crypto Regulation in Sweden

Crypto-assets in the EU are regulated under Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCAR), which establishes a harmonised framework for the issuance, offering, and trading of crypto-assets across EU Member States. MiCAR applies to crypto-assets that are not covered by existing EU financial services legislation, such as MiFID II and the Prospectus Regulation, and introduces specific regimes for:

Asset-referenced tokens (ARTs); E-money tokens (EMTs); and

Other crypto-assets, including utility tokens. 

MiCAR also sets out conduct of business rules, governance standards, asset segregation requirements and prudential requirements for crypto-asset service providers (CASPs), which include services such as custody, trading, exchange, advising, transfer and operation of trading platforms. As of 30 December 2024, CASPs must have a licence issued by the national competent authority to offer their services in the EU. Regulated financial entities such as credit institutions, investment firms, market operators, and electronic money institutions can offer crypto-asset services upon notification. 

MiCAR entered into force on 29 June 2023, with the main provisions applying from 30 December 2024, while rules relating to ARTs and EMTs applied from 30 June 2024.

AML Regulation

Directive (EU) 2018/843, which amends Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, has been implemented into Swedish legislation through the Swedish Money Laundering and Terrorist Financing Prevention Act (2017:630) (the ”AML Act”).

Crypto-asset service providers, as defined in MiCAR, have been obligated to comply with the AML Act since 30 December 2024.

Further amendments have been made to the AML Act following the implementation of MiCAR, including specific requirements for crypto-asset service providers. For example, when entering into a correspondent relationship for crypto-asset services with a counterparty entity that is not established in the EEA, providers must verify whether the counterparty is licensed or registered to operate.

Furthermore, if a crypto-asset service provider offers its services from another EEA state without establishing a branch or subsidiary in Sweden, the Swedish Financial Supervisory Authority (“SFSA”) has the right to require the provider to appoint a central contact point in Sweden.

The CFO Act

Prior to the implementation of MiCAR, providers that offer services relating to the safeguarding of private cryptographic keys on behalf of customers, storage, and facilitating the holding and transfer of virtual currencies, and that maintain a physical presence, such as a branch office, in Sweden, were previously  obligated to register with SFSA under the Certain Financial Operations Act (1996:1006) (the “CFO Act”).

The scope of the CFO Act was amended as of 30 December 2024 to exclude the above-mentioned services as part of the implementation process of MiCAR.

Criminal Liability for Unauthorised Financial Activity

Since 1 March 2026, it is a criminal offence in Sweden to conduct financial activity without the required authorisation or registration from the SFSA. The new Act on Penalties for Unauthorised Financial Activity (Sw. Lag (2026:56) om straff för olovlig finansiell verksamhet) (the "Criminal Liability Act") applies to anyone who, intentionally or through gross negligence, carries out financial activity — including crypto-asset services — without the necessary authorisation or registration.

Criminal liability attaches to the natural persons responsible for the unauthorised activity, such as formal or de facto representatives of the entity conducting the business. The Criminal Liability Act also establishes a duty for the SFSA to report suspected offences to the public prosecutor.

For providers of crypto-asset services, this means that offering such services in Sweden without the required MiCAR authorisation now carries a risk of personal criminal liability for those individuals directing or controlling the activity.

Please see our answer below for the additional steps taken to adopt MiCAR in Sweden.

Under MiCAR, the following activities are regulated throughout the EU:

Direct sales of tokens by issuers:

• Regulated if the tokens fall within MiCAR’s scope (i.e., ARTs, EMTs, or other crypto-assets).
• Issuers must publish a white paper and may need authorisation, depending on the type of token, unless an exemption applies.

Exchange (buy/sell):

• Regulated as a crypto-asset service under MiCAR.
• CASPs offering exchange, broker and trading services in relation to crypto-assets must obtain a licence to provide their services in the EU.

Custody (hold):

• Regulated as a crypto-asset service under MiCAR.
• CASPs that provide safekeeping or control of crypto-assets on behalf of clients—such as custodial wallet services or the custody of private cryptographic keys granting access to such assets— must obtain a licence to provide their services in the EU.

Borrowing/lending:

• MiCAR does not explicitly regulate borrowing and lending as a crypto-asset service under MiCAR.
• MiCAR excludes lending and borrowing of crypto-assets, including e-money tokens, from its scope and does not affect applicable national laws governing such activities. As such, if these activities fall under other EU financial regulations (e.g., MiFID/CRD/CRR), they may be subject to additional rules at national level.

Yield/staking services:

• Yielding/staking, which involves the process of immobilising crypto-assets to support the operations of proof-of-stake and proof-of-stake-like blockchain consensus mechanisms in exchange for the granting of validator privileges that can generate block rewards, is not explicitly regulated as a crypto-asset service under MiCAR.
• However, a provider that offers staking services on behalf of clients—by directly interacting on a proprietary basis with a distributed ledger protocol to stake assets for validator privileges and block rewards, or by committing assets to a liquidity pool in exchange for yield—typically holds clients’ crypto-assets in custody. As a result, such providers must be authorised under MiCAR to provide custody and administration services of crypto-assets on behalf of clients. 

Staking on proof of stake consensus mechanisms:

• Although staking under proof-of-stake consensus mechanisms is not explicitly classified as a regulated service under MiCAR, providers offering staking services on behalf of clients must obtain a licence to provide custody and administration services if they hold clients’ crypto-assets in custody.

NFTs:

• MiCAR generally excludes non-fungible tokens (NFTs) unless they are part of a larger fungible series or collection, in which case they might be treated as regulated crypto-assets.

Generally, it can be stated that Sweden has previously had minimal regulations concerning crypto-asset service-related activities. The introduction of MiCAR has therefore brought a significant change to the legal landscape of crypto regulation.

The listed activities are not specifically regulated in the new act of supplementary provisions and are thus subject to MiCAR, with some exceptions

In addition to the general MiCAR framework (covered in the new chapter LINK) it can be said in relation to lending or borrowing of crypto-assets, that under Swedish law, borrowing and lending of crypto-assets may technically be considered a transfer of title of the crypto-asset. It remains uncertain whether the SFSA considers services relating to such activities to fall within the scope of MiCAR. 

Active solicitation by offshore firms into the EU is not permitted under MiCAR unless the firm is authorised as a CASP within the EU. 

MiCAR permits reliance on reverse solicitation only under strict conditions. Offshore firms may in certain cases provide crypto-asset services to an EU client without a MiCAR licence, but only if the client has initiated the request entirely on their own initiative.

Reverse solicitation under MiCAR is only permitted under strict and narrowly interpreted conditions. ESMA emphasises that this exemption is exceptional and applies only when: (i) the EU client initiates the service request on their own exclusive initiative, without prior solicitation or marketing by the offshore firm; (ii) the exemption is limited to the specific crypto-asset service requested; and (iii) it cannot be used to expand into other services.

Please refer to individual chapters in this guide.

MiCAR sets out a harmonised process across the EU. Competent authorities are required to assess licence applications within 40 working days of receiving a complete application. During the assessment period and no later than on the 20th working day of that period, competent authorities may request further information. This will suspend the 40 working day period, but the suspension cannot exceed 20 working days.

The exact time to prepare an application and address any follow-up queries may vary by jurisdiction. In practice, obtaining a MiCAR licence will take several months.

The processing time with the SFSA for authorisation as a crypto-asset service provider is as follows:

• Within five working days, the SFSA must confirm in writing that it has received the application.
• Within a further 25 working days, the SFSA must inform the applicant whether the application is deemed complete. The SFSA may extend this period if additional information is required.
• Within a further 40 working days, the SFSA must assess the application. The SFSA may request additional information within the first 20 working days. If additional information is required, the assessment period will be paused until the applicant provides a response. 

Please refer to individual chapters in this guide.

MiCAR does not fix costs at EU level. Costs vary based on:

• National application or supervisory fees set by each Member State.
• Legal, compliance, and consulting fees for preparing the application.
• Prudential safeguards put in place by the CASP, which must equal the higher of: (i) the minimum capital requirement applicable under MiCAR (EUR 50,000 to EUR 150,000, depending on the services provided), or (ii) one quarter of the CASP’s fixed overheads for the preceding year.

The cost of obtaining licences under MiCAR varies depending on the type of licence and the complexity of both the application and the company. The current fee for obtaining authorisation as a crypto-asset service provider ranges between SEK 135,000 – 690,000, while the processing fee for obtaining a licence to issue asset-referenced tokens or seek the admission of trading of asset-referenced tokens ranges between SEK 525,000 – 13,500,000. 

All processing fees at the SFSA relating to MiCAR can be found at the link (in Swedish): LINK

The processing fees for authorisation to provide services related to virtual currency under the CFO Act were removed following the amendment to the scope of the CFO Act.

The SFSA charges an annual supervisory fee based on the balance sheet total, with a minimum of SEK 150,000 per year.

This cannot be determined, as decisions made by the SFSA are taken on a case-by-case basis.

As of 3 September 2026, the SFSA has received seven applications for authorisation to provide crypto-asset services. Only one of these applicants (Safello AB) has been granted a licence, while two applicants had their applications rejected due to deficiencies in their anti-money laundering procedures.