Crypto-asset service providers under MiCA

The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, is the first single licensing regime for crypto-asset businesses across a large economic area. It replaced a patchwork of national registration systems with one authorisation that can be used in every Member State. It also sets rules for anyone who offers crypto-assets to the public or issues stablecoins.

This guide explains who needs a licence, what the licence costs in capital, how the application is assessed and what changed when the transition ended. Stablecoin issuance is covered here only in outline; a separate guide on stablecoins and the GENIUS Act looks at it in more depth.

Scope: what MiCA covers and what it leaves out

Article 3(1)(5) MiCA defines a crypto-asset as a digital representation of a value or a right that can be transferred and stored electronically using distributed ledger technology or similar technology. Within that, MiCA separates three categories, each with its own rules.

Category	Definition in MiCA	Who may issue or offer
E-money token (EMT)	Purports to keep a stable value by referencing one official currency (Art. 3(1)(7))	Credit institutions and electronic money institutions only (Art. 48)
Asset-referenced token (ART)	Purports to keep a stable value by referencing another value or right, or a combination, including several currencies (Art. 3(1)(6))	An EU legal person authorised under Art. 21, or a credit institution (Art. 16)
Other crypto-assets	Everything else in scope, including utility tokens	Any legal person that publishes a compliant white paper (Art. 4)

Some instruments stay outside MiCA because other EU law already covers them. Article 2(4) excludes crypto-assets that qualify as financial instruments, deposits, funds (unless they are EMTs), securitisation positions, insurance and pension products. A tokenised share, for example, is regulated under MiFID II, not MiCA. Article 2(3) also excludes crypto-assets that are unique and not fungible with other crypto-assets.

The ten crypto-asset services

A crypto-asset service provider (CASP) is any firm that provides one or more of the services listed in Article 3(1)(16) MiCA:

1. Custody and administration of crypto-assets on behalf of clients.
2. Operation of a trading platform for crypto-assets.
3. Exchange of crypto-assets for funds.
4. Exchange of crypto-assets for other crypto-assets.
5. Execution of orders for crypto-assets on behalf of clients.
6. Placing of crypto-assets.
7. Reception and transmission of orders for crypto-assets on behalf of clients.
8. Providing advice on crypto-assets.
9. Providing portfolio management on crypto-assets.
10. Providing transfer services for crypto-assets on behalf of clients.

The list deliberately mirrors MiFID II investment services.

Two routes in: authorisation or notification

Article 59 allows only two kinds of firm to provide crypto-asset services in the EU. The first is a legal person authorised as a CASP under Article 63. The second is an existing regulated firm that uses the notification procedure in Article 60.

Under Article 60, a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager can add crypto services without a new licence. A credit institution must notify its home regulator at least 40 working days before it starts. An investment firm may provide only the crypto services equivalent to the investment services it is already authorised for, and an electronic money institution only custody and transfer services for the e-money tokens it issues.

A newly authorised CASP must have its registered office in a Member State where it carries out at least part of its services. Article 59(2) also requires its place of effective management to be in the Union and at least one director to be resident in the Union. A letterbox entity does not meet these conditions.

Capital requirements: the three classes

Article 67 requires a CASP to hold prudential safeguards equal to the higher of two amounts: the permanent minimum capital in Annex IV, or one quarter of the previous year’s fixed overheads, reviewed annually. A new firm uses the projected overheads in its business plan for its first year.

Class	Services (cumulative)	Minimum capital (Annex IV)
Class 1	Execution of orders, placing, transfer services, reception and transmission of orders, advice, portfolio management	EUR 50,000
Class 2	Any Class 1 service plus custody and administration, exchange for funds, or exchange for other crypto-assets	EUR 125,000
Class 3	Any Class 2 service plus operation of a trading platform	EUR 150,000

The safeguards can be own funds in the form of Common Equity Tier 1, an insurance policy covering the Member States where services are provided, or a combination of both. In practice, the overheads test often produces the higher figure for any firm with a real operating team, so the Annex IV amount is a floor rather than a budget.

The application and assessment timetable

Article 62 lists what an application must contain. The main items are:

• a programme of operations, including where and how services will be marketed;
• proof of prudential safeguards under Article 67;
• governance arrangements and evidence that the management body is of sufficiently good repute and has the right knowledge, skills and experience;
• the identity of every direct or indirect holder of a qualifying holding, with proof of their good repute;
• internal controls, risk management, AML/CFT procedures and a business continuity plan;
• technical documentation of ICT systems and security arrangements;
• procedures for segregating client crypto-assets and funds, complaints handling and, where relevant, a custody policy.

Article 63 sets the statutory clock. The regulator acknowledges receipt within five working days and checks completeness within 25 working days. Once the file is complete, it has 40 working days to grant or refuse authorisation, and must notify the decision within five working days after that.

The 40-day period runs only from a complete file. Article 63(10) lists grounds for refusal, including a management body that threatens sound and prudent management or exposes the firm to a serious money laundering risk, and shareholders who fail the good repute test.

Operating rules after authorisation

Several ongoing obligations shape the business model:

• Client asset protection. Article 70 requires arrangements that protect client ownership rights in an insolvency and prevent the use of client assets for the firm’s own account. Client funds other than EMTs must be placed with a credit institution or central bank by the end of the next business day, in a separately identifiable account.
• Custody. Article 75 requires a written custody agreement and a register of positions opened in each client’s name.
• No interest on stablecoins. Articles 40 and 50 prohibit CASPs from granting interest, or any benefit linked to holding time, in connection with ARTs and EMTs.
• Outsourcing. Article 73 leaves the CASP fully responsible for outsourced functions. ESMA has stressed that custody cannot be delegated to entities that are not authorised CASPs.

White papers for other crypto-assets

A person offering a crypto-asset other than an ART or EMT to the public, or seeking its admission to trading, must draw up, notify and publish a white paper under Articles 4 to 9 MiCA. The white paper must be notified to the home regulator at least 20 working days before publication. Regulators do not approve it in advance, but the notification must explain why the token is not a financial instrument, an EMT or an ART.

Article 4(2) exempts some offers from the white paper duty: offers to fewer than 150 persons per Member State, offers with total consideration not above EUR 1,000,000 over 12 months, and offers addressed only to qualified investors. For tokens already trading before 30 December 2024, Article 143(2) gives trading platform operators until 31 December 2027 to make sure a compliant white paper exists.

Stablecoins in outline

Stablecoin issuers face bank-like requirements that go well beyond CASP rules. An ART issuer must hold own funds of at least the highest of EUR 350,000, 2% of the average reserve of assets, or a quarter of fixed overheads (Article 35). The reserve must be legally segregated from the issuer’s estate (Article 36).

EMTs are treated as electronic money. Holders have a claim on the issuer, tokens must be issued at par on receipt of funds, and redemption must be available at any time, at par and without a fee (Article 49). At least 30% of funds received must be held in separate accounts at credit institutions (Article 54). Tokens that become significant are supervised by the EBA and face higher requirements.

The transition is over

MiCA’s stablecoin titles applied from 30 June 2024 and the rest of the Regulation from 30 December 2024 (Article 149). Article 143(3) let firms already providing services under national law continue until 1 July 2026 or until their application was decided, whichever came first. Member States could shorten that period.

Many did. According to ESMA’s list of grandfathering periods, Latvia, Hungary, the Netherlands, Poland, Slovenia and Finland chose 6 months, Sweden 9 months, and Germany, Ireland, Lithuania, Austria and Slovakia 12 months. France, Luxembourg, Malta, Cyprus and most others used the full 18 months.

In its statement of 17 April 2026, ESMA confirmed that after 1 July 2026 any entity providing crypto-asset services to EU clients without a MiCA licence is in breach of EU law. Unauthorised CASPs were expected to have implemented orderly wind-down plans by that date. ESMA also told consumers to check the Interim MiCA Register and to confirm which legal entity in a group actually provides their service.

Cross-border services: the passport

A CASP authorised in one Member State can serve clients in all the others. Under Article 65, it sends its home regulator a list of target Member States, the services it plans to provide and a start date. The home regulator forwards the information to host authorities, ESMA and the EBA within 10 working days.

The firm may start in the host Member State once informed of that communication, or at the latest on the 15th calendar day after its submission. No local licence is needed. The choice of home regulator still matters, because supervisory approach and processing capacity differ between national authorities.

Reverse solicitation: a narrow exception

Article 61 allows a firm outside the EU to serve an EU client without authorisation only where the client initiates the service at its own exclusive initiative. The exception disappears as soon as the firm, or anyone acting on its behalf or with close links to it, solicits clients in the Union by any means of communication.

Contract clauses stating that a client came on its own initiative do not change this. Article 61(2) also bars the firm from marketing new types of crypto-assets or services to that client. ESMA published its final guidelines on 17 December 2024, describing the exemption as very narrowly framed and an exception, and its April 2026 statement confirms this applies in a business-to-business context too.

For international groups, the practical consequence is clear. Serving EU clients at scale requires an authorised EU entity, and client contracts should sit with that entity.

The travel rule: Regulation (EU) 2023/1113

Alongside MiCA, the recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, has applied since 30 December 2024. It extends the “travel rule” to crypto-asset transfers. Its recital 30 states that crypto transfers should be subject to the same requirements regardless of their amount and whether they are domestic or cross-border.

Article 14 requires the originator’s CASP to send, with or before each transfer:

• the originator’s name, distributed ledger address and account number where used;
• the originator’s address, official personal document number and customer identification number, or date and place of birth;
• the beneficiary’s name, distributed ledger address and account number where used;
• the LEI or equivalent identifier of either party, where available.

Transfers to self-hosted wallets carry an extra step. For any amount above EUR 1,000 to a self-hosted address, the CASP must take adequate measures to assess whether the address is owned or controlled by its own client.

How MiCA compares with other regimes

MiCA is a reference point for regulators elsewhere, but a MiCA licence gives no access to other markets. The UK runs its own regime, with FCA rules set to come into force on 25 October 2027. Hong Kong, Singapore and the UAE also license crypto activities under separate national frameworks, so a firm active in several regions should expect to hold several licences.

Practical points for applicants

• Map the services first. The Annex IV class follows the most demanding service, so adding custody or exchange later means a change of class.
• Plan for real substance. Effective management in the EU and an EU-resident director are conditions of authorisation.
• Prepare the owners. Every qualifying holder must prove good repute.
• Build the AML and travel rule stack before filing. Regulators assess these systems as part of the application.
• Budget for overheads-based capital. A quarter of fixed overheads frequently exceeds the Annex IV minimum.