MiCA Regulation: What Every Crypto Business Must Do Before It's Too Late

The Markets in Crypto-Assets Regulation Is Now Fully in Force

Regulation (EU) 2023/1114 on Markets in Crypto-Assets — universally known as MiCA — became fully applicable on 30 December 2024, following the earlier application of its stablecoin provisions on 30 June 2024. MiCA is the world's first comprehensive, cross-border regulatory framework for crypto-assets and the businesses that provide services related to them.

For any business that issues, trades, custodies, or provides advice relating to crypto-assets, and that serves EU customers or operates from within the EU, compliance with MiCA is no longer optional. The transitional periods are expiring, and enforcement is now a live consideration.

Who MiCA Captures

MiCA applies to three broad categories of market participant:

Crypto-Asset Service Providers (CASPs) CASPs are firms that provide one or more of the following services on a professional basis:

• Custody and administration of crypto-assets on behalf of clients
• Operation of a trading platform for crypto-assets
• Exchange of crypto-assets for funds or other crypto-assets
• Execution of orders for crypto-assets on behalf of clients
• Placing of crypto-assets
• Reception and transmission of orders for crypto-assets on behalf of clients
• Providing advice on crypto-assets
• Providing portfolio management of crypto-assets
• Providing transfer services for crypto-assets on behalf of clients

E-Money Token (EMT) Issuers An EMT is a crypto-asset that purports to maintain a stable value by reference to a single official currency. EMT issuers must be authorised as either a credit institution or an electronic money institution under EMD2. Tether's USDT and Circle's USDC, to the extent they reference the euro, fall within this category.

Asset-Referenced Token (ART) Issuers An ART is a crypto-asset that purports to maintain a stable value by reference to any other value or combination of values, including one or more official currencies. ART issuers require specific MiCA authorisation and must maintain a reserve of assets backing the token.

The Authorisation Requirement

Under Article 59 of MiCA, no person may provide crypto-asset services within the EU unless they are:

• A legal person or undertaking authorised as a CASP by the competent authority of their home member state, or
• A credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company, or alternative investment fund manager that has notified the relevant competent authority of its intention to provide crypto-asset services

The authorisation process requires:

• Establishment as a legal entity in an EU member state with a registered office and effective management in that state
• Minimum prudential safeguards, including own funds requirements ranging from €50,000 to €150,000 depending on the services provided
• A detailed programme of operations
• Fit-and-proper assessment of management body members and qualifying shareholders
• Comprehensive AML/CFT arrangements compliant with Directive (EU) 2015/849 (AMLD5)
• Robust ICT security and operational resilience measures
• A complaints handling procedure and conflicts of interest policy

Transitional Provisions and Grandfathering

MiCA provides transitional arrangements for businesses that were already operating under national regulatory frameworks before 30 December 2024. Under Article 143, member states may allow CASPs that were providing services under national law to continue doing so for up to 18 months after MiCA's full application, i.e., until 1 July 2026.

However, the transitional provisions vary significantly by member state:

• Germany: BaFin has provided a 12-month transitional period (until 31 December 2025) for firms registered under the previous national crypto custody and trading framework
• France: The AMF allows PSAN-registered firms to continue operating until 1 July 2026
• Ireland: The Central Bank of Ireland has adopted the full 18-month transitional period
• Lithuania: The Bank of Lithuania has adopted a shorter transitional period

Businesses relying on transitional provisions must submit their MiCA authorisation applications well in advance of the expiry date. Firms that have not applied by the transitional deadline will be required to cease operations.

Impact on Non-EU Businesses

MiCA does not provide a third-country equivalence regime for CASPs. This means that a non-EU business cannot obtain MiCA authorisation without establishing a legal entity in an EU member state with genuine management presence.

The implications are significant:

• Offshore crypto exchanges that have been serving EU customers remotely must either establish an EU entity and obtain CASP authorisation, or cease providing services to EU residents
• Reverse solicitation — where the EU client initiates contact with the non-EU provider — remains available under Article 61 but is narrowly defined and cannot be used as a systematic market access strategy
• Marketing into the EU by non-EU firms, including through social media, targeted advertising, or localised websites, will trigger the authorisation requirement

Stablecoin Provisions

MiCA's stablecoin provisions, which applied from 30 June 2024, impose particularly demanding requirements:

For EMT issuers:

• Must be authorised as a credit institution or EMI under EMD2
• Must publish a crypto-asset white paper and notify the competent authority
• Must redeem EMTs at par value at any time upon request of the holder
• Must maintain funds received in exchange for EMTs in secure, low-risk assets

For ART issuers:

• Must obtain specific MiCA authorisation from the home member state competent authority
• Must maintain a reserve of assets covering the value of all outstanding ARTs at all times
• Reserve assets must be segregated and entrusted to a credit institution or authorised crypto-asset service provider
• Must publish a white paper approved by the competent authority
• "Significant" ARTs (exceeding specified thresholds) are subject to enhanced requirements and direct EBA supervision

Compliance Obligations for Authorised CASPs

Once authorised, CASPs must comply with an extensive ongoing regulatory framework:

• Market abuse prevention: MiCA establishes a market abuse regime for crypto-assets analogous to the Market Abuse Regulation (EU) 596/2014, including prohibitions on insider dealing, market manipulation, and unlawful disclosure of inside information
• Client asset segregation: Client crypto-assets must be held separately from the CASP's own assets
• Disclosure and transparency: CASPs must provide clear, fair, and not misleading information to clients, including pre-contractual disclosures
• Prudential requirements: Ongoing own funds requirements and, for certain services, insurance or comparable guarantees
• Complaints handling: A formal complaints procedure accessible to all clients
• Outsourcing governance: CASPs that outsource operational functions must ensure appropriate oversight

Passporting Under MiCA

One of MiCA's most significant features is the introduction of an EU-wide passporting regime for CASPs. A CASP authorised in one member state may provide services across all EEA member states through freedom to provide services or freedom of establishment, following notification to the home state competent authority.

This replaces the patchwork of national registrations (such as France's PSAN, Germany's BaFin registration, or Poland's registration requirement) with a single authorisation that provides access to the entire EU market.

Practical Steps for Compliance

Businesses that have not yet commenced their MiCA compliance programme should take the following steps immediately:

1. Classify your activities: Determine which MiCA service categories apply to your business model
2. Select a home member state: Choose the EU jurisdiction where you will seek authorisation, considering regulatory processing times, substance requirements, and banking access
3. Establish EU presence: Incorporate or re-domicile an entity in the chosen member state with genuine local management
4. Prepare the application dossier: Engage legal counsel with MiCA experience to prepare the programme of operations, governance documentation, and compliance framework
5. Implement AML/CFT infrastructure: Ensure your AML framework meets AMLD5 requirements, including transaction monitoring, customer due diligence, and suspicious activity reporting
6. Submit the application: Allow at least six to nine months for the authorisation process
7. Plan for ongoing compliance: Budget for ongoing prudential reporting, compliance monitoring, and regulatory engagement

Key Takeaways

• MiCA is fully applicable as of 30 December 2024 and covers CASPs, EMT issuers, and ART issuers across the entire EU
• Transitional provisions allow existing nationally-registered firms to continue operating until mid-2026 at the latest, but MiCA authorisation applications must be submitted well before that deadline
• Non-EU businesses cannot obtain CASP authorisation without establishing a genuine EU entity — there is no third-country equivalence regime
• The stablecoin provisions impose specific requirements on EMT and ART issuers, including reserve maintenance and redemption obligations
• MiCA introduces EU-wide passporting for CASPs, replacing the previous patchwork of national registrations
• The authorisation process takes six to nine months, and firms should begin immediately if they have not already done so
• Total compliance costs for MiCA authorisation range from €200,000 to €500,000, depending on the jurisdiction and complexity of the business model