Digital asset regulation and tokenization in Norway

A business providing crypto-asset services in Norway must check the framework incorporated into the European Economic Area and its domestic application. MiCA has applied since July 2025 and continuity for former registered providers has ended, so the plan needs current entitlement.

For tokenized issuance, the initial question remains what right the investor receives and who records, holds or settles it. Norges Bank’s tokenization research helps explain infrastructure; commercial permission and validity of the right need separate assessment.

When MiCA entered the Norwegian framework

Norway belongs to the European Economic Area, EEA, but not the European Union. Its Cryptoassets Act implemented MiCA from 1 July 2025. The framework covers issuance, offerings, services and market abuse within its scope. An EU regulation's application date should not automatically be transferred to Norwegian law.

The extension adopted on 18 December 2025 allowed certain registered providers to continue until 30 June 2026, unless authorisation or refusal came earlier. It is neither a pending proposal nor an available entry route. Wind-down instructions require unauthorised providers to stop new onboarding and restrict activity to an orderly exit protecting clients.

Finanstilsynet supervision and Norges Bank research

Finanstilsynet processes CASP authorisations and notifications from eligible financial entities. Permissions require analysis by service and legal entity. The supervisor does not itself adjudicate individual disputes between firms and clients; those belong to available dispute mechanisms and courts. Reporting a supervisory concern does not itself secure asset restitution.

Norges Bank acts through its monetary and financial infrastructure responsibilities. Its 2026 infrastructure report continues research into tokenization and central bank digital currency, without considering Norwegian CBDC issuance warranted at that time. Technical testing or central bank cooperation does not replace authorisation for commercial services.

Documenting an application through Altinn

The CASP process uses Altinn, form KRT-3060 and evidence supporting each requirement. Finanstilsynet requests precise documentary references and updates when application information changes. Fitness assessment covers the management body and relevant control functions; incorporation of the company alone is insufficient.

Article 63 authorisation and Article 60 notification are distinct routes. Entities using notification must remain within the services permitted for their category and provide complete information before starting. MiCA also requires cross-border procedures: membership of an authorised group in another country does not automatically authorise every subsidiary.

The right represented by a tokenized asset

Norges Bank's study distinguishes digitally representing an existing asset from issuing a new asset on a network. That distinction matters when documenting enforceable rights and settlement arrangements. The report examines infrastructure opportunities and risks; it does not create a civil-law rule under which transferring any token transfers its referenced asset.

Financial instruments remain outside MiCA. Assessing tokenized securities requires identification of issuance, ownership, legally relevant registers and intermediary duties. Settlement failure and the relationship between technical records and investor rights also need to be addressed. A CASP licence does not determine those matters.

Applying transfer and resilience rules in Norway

Norway implemented TFR II and associated anti-money laundering changes from July 2025. Requirements cover in-scope transfers and party information; not every transfer between individuals is treated identically. Operational systems must support data checks, incident detection and measures appropriate to each provider's role.

The Norwegian DORA Act also took effect on 1 July 2025. For covered entities, the supervisor publishes incident and ICT agreement notification procedures. It additionally maintains an inventory of implemented MiCA technical measures. Each act's Norwegian status requires checking rather than assuming that European publication alone establishes domestic application.

Preparing to operate or issue in Norway

The application should link every Finanstilsynet requirement to concrete evidence: management, control functions, resources, service documentation and technology dependencies. Keep that information current during assessment and verify the technical measures implemented in Norway.

Asset design must establish ownership, records and settlement before selecting a network. Migration from an unauthorised provider must respect orderly wind-down and client protection; a pending application or central bank technology test does not replace the required permission.

To understand how this framework applies to your project, discuss your case with our team.