MiCA — Crypto-Asset Service Provider Authorisation

By Data Engineering 2026-04-30 13 min read 2,636 words

Last reviewed: 2026-07-152,636 words13 min readBy DeFi Intel Research Desk

Executive summary

MiCA is the first large-economy crypto framework written from a clean sheet rather than retrofitted from securities law. Regulation (EU) 2023/1114 layers three regimes onto European crypto activity: an asset-referenced token regime under Title III, an electronic money token regime under Title IV, and a Crypto-Asset Service Provider conduct regime under Title V. Stablecoin rules went live 30 June 2024 and triggered the EU-wide delisting of USDT from major venues; CASP rules followed on 30 December 2024. By the end of Q1 2026 the regulation had produced 188 live CASP authorisations — 283 by the mid-2026 ESMA register snapshot — an Article 23 transaction-cap regime that throttles non-EUR stablecoins, a passport that lets one Maltese or Irish licence reach 27 markets, and a transition cliff for grandfathered national licences that hit on 1 July 2026, forcing unauthorised holdouts out of the EU market.

Statutory architecture

MiCA is structured as a single regulation of roughly 150 articles across nine titles, directly applicable in every EU member state without national transposition. Title I sets out scope and definitions. Title II governs offerings and admissions to trading of crypto-assets that are neither asset-referenced tokens nor e-money tokens, imposing a white-paper disclosure regime modelled on the Prospectus Regulation but materially lighter. Title III governs asset-referenced tokens (ARTs) — multi-asset or commodity-backed stablecoins — and reserves the most restrictive prudential requirements for any token deemed significant under Article 43 thresholds (over ten million holders, five billion euros in market capitalisation, or 2.5 million daily transactions averaging over 500 million euros). Title IV governs electronic money tokens (EMTs), which are single-fiat-pegged stablecoins and are dual-supervised under MiCA and the existing Electronic Money Directive. Title V is the conduct regime: ten enumerated services that any CASP must be authorised to provide, organised under Articles 59 through 74 and supplemented by ESMA Level 2 technical standards finalised in late 2024. Title VI imports a market-abuse regime modelled on the Market Abuse Regulation (MAR), with ESMA empowered to investigate cross-border manipulation. Title VII creates ESMA's central register of authorised firms, the public-facing index that exchanges and counterparties use to verify status. Title VIII covers EBA supervisory powers over significant ART and EMT issuers. Title IX is transitional. Recital 22 contains the famous decentralisation carve-out — fully decentralised protocols with no identifiable issuer or service provider fall outside scope — but ESMA's December 2024 guidance narrowed it sharply, requiring genuinely autonomous code with no upgradability, no governance token concentrated in a sponsor, and no legal entity benefiting from operations. Article 143 is the transition clause, granting up to eighteen months of grandfathered operation under pre-MiCA national regimes through 1 July 2026, with several member states adopting shorter windows (the Netherlands chose six months, ending 30 June 2025; Germany and Ireland closed theirs on 31 December 2025).

License tiers and categories

MiCA recognises three classes of CASP authorisation, distinguished by which of the ten Article 3(1)(16) services the firm provides. Class 1 covers reception and transmission of orders and provision of advice; minimum permanent capital is 50,000 euros. Class 2 covers custody and administration on behalf of clients, exchange of crypto for funds, exchange of crypto for crypto, execution of orders, transfer services, and placing of crypto-assets; minimum capital is 125,000 euros. Class 3 covers operation of a trading platform; minimum capital is 150,000 euros. Firms are authorised for the union of services they apply for; an exchange that custodies, executes, and operates a venue holds Class 3 capital and Class 2 conduct rules simultaneously. Beyond CASP authorisation the regulation creates two parallel regimes for issuance. EMT issuance under Title IV requires the issuer to be either a credit institution or an authorised electronic money institution under Directive 2009/110/EC, with a separate notification under MiCA Article 48. ART issuance under Title III requires a bespoke authorisation under Article 16, dual-supervised by the home NCA and EBA, with capital scaled to the higher of 350,000 euros, two percent of average reserve assets, or one quarter of the prior year's fixed overheads. Article 23 (extended to non-EU-currency EMTs via Title IV) imposes a 200 million euro daily cap on transactions used as a means of exchange within a single currency area, and an issuer that breaches the cap must cease new issuance and submit a remediation plan to the home NCA within forty business days. ESMA's December 2024 Q&A clarified that the cap applies on the basis of payments-related transactions rather than aggregate trading volume, but the line between the two has not been judicially tested.

Capital and operational requirements

Beyond minimum permanent capital, every CASP must maintain own funds equal to the higher of its capital floor or one quarter of the prior year's fixed overheads on a rolling basis under Article 67. Governance requirements under Article 68 demand a board majority of independent directors for systemically important platforms, a CISO reporting directly to the board, an MLRO reporting to the board on AML/CFT matters, and a complaints-handling function independent of front-office staff. Custody rules under Article 70 require client crypto to be held in segregated wallets — distinct on-chain addresses or sub-accounts attributable to individual clients — with a comprehensive disaster-recovery plan, insurance against operational losses, and a hard prohibition on rehypothecation absent explicit written client consent that may be revoked at any time. The Digital Operational Resilience Act (DORA), in force from 17 January 2025 and applicable to all CASPs, layers an extensive ICT-risk framework on top: third-party-risk register, ICT incident reporting within hours, threat-led penetration testing for significant firms, and oversight of critical ICT third-party providers. ART and EMT issuers face the strictest reserve rules in any G20 stablecoin regime: 1:1 reserves held in a bankruptcy-remote vehicle, weekly reserve attestations, daily redemption-at-par for retail holders, no commingling of reserves with operating capital, and EBA-supervised stress testing for any issuer designated significant. Marketing rules under Article 66 import the MiFID II fair-clear-not-misleading standard wholesale; every promotional asset must be reviewable on demand by the NCA, and influencer marketing falls within scope as soon as compensation flows from the CASP. The aggregate effect is a regulatory build comparable in cost to a small bank: an inaugural CASP filing typically runs 250,000 to 1.5 million euros in legal, audit, ICT, and biographical-investigation expense, with annual ongoing compliance overhead of 500,000 euros to two million euros for a mid-tier firm.

Notable licensees

ESMA's public MiCA register listed 283 fully-authorised CASPs by its mid-2026 snapshot — 188 of them authorised by the end of Q1 2026 — with Germany (59), France (31), the Netherlands (28), Malta (22), and Cyprus (21) the busiest home member states. Coinbase (Coinbase Luxembourg S.A.) was authorised by the Luxembourg CSSF in June 2025 and operates the firm's pan-EU retail and institutional businesses out of Luxembourg. Crypto.com and OKX both received MFSA authorisation in Malta on 27 January 2025, the first global exchange groups to land MiCA grants rather than the legacy VFA licences previously held there. Bitstamp (Bitstamp Europe S.A.) was authorised in Luxembourg by the CSSF in May 2025, shortly before Robinhood completed its acquisition of the exchange. BitGo Europe received full BaFin authorisation in Germany in May 2025. Kraken obtained Irish authorisation in June 2025. Bitpanda was authorised by Austria's FMA in April 2025. Gemini obtained an MFSA authorisation in Malta in August 2025. On the issuance side Société Générale-FORGE became the first major bank to issue a MiCA-compliant EMT — its EUR-denominated EURCV — via an e-money institution licence from France's ACPR effective 1 July 2024 (it added a French CASP authorisation in October 2025). Circle likewise obtained an ACPR e-money institution licence on 1 July 2024, making USDC and EURC MiCA-compliant and Circle the first global stablecoin issuer to comply with the regime; a French CASP authorisation followed in April 2026. Tether has not pursued any MiCA authorisation, and as a result major EU venues delisted or restricted USDT pairs between March 2024 and March 2025. Binance, after the withdrawal of BUSD from the EU well before MiCA went live, still had no CASP authorisation on ESMA's register as of the mid-2026 snapshot. Several smaller US issuers and brokers paused EU expansion altogether, citing the cost of dual MiCA-plus-DORA compliance against uncertain near-term EU revenue.

Enforcement actions to date

The first wave of MiCA enforcement focused on perimeter rather than misconduct. ESMA published its narrowing reverse-solicitation guidance in December 2024 specifically to chill non-EU exchanges that maintained EU-targeted marketing, and through 2025 multiple offshore venues quietly geoblocked EU IP ranges or pulled affiliate programmes after warnings from national NCAs. The most consequential market action was the cascade of USDT delistings and restrictions on EU-licensed venues between March 2024 and March 2025 — OKX pulled USDT pairs for EEA users in March 2024, Coinbase delisted USDT for European customers in December 2024, and Kraken and Binance moved EEA users to sell-only and delisted non-compliant stablecoin pairs by 31 March 2025 — driven not by formal enforcement but by the structural impossibility of distributing an unauthorised EMT after the 30 June 2024 effective date. Beyond the perimeter, no headline NCA fine against an authorised CASP or EMT issuer for MiCA misconduct had been verified by DeFi Intel as of this review; the enforcement record to date is one of gatekeeping — refused, delayed, and withdrawn applications — rather than sanctions. The Article 23 cap has not yet been publicly invoked against any non-euro EMT.

How to apply

A MiCA CASP application is filed with the National Competent Authority of the member state where the firm proposes to maintain its head office and substantive senior management. The choice of NCA is strategic — Malta's MFSA, Ireland's Central Bank, Cyprus's CySEC, France's AMF, Germany's BaFin, and the Netherlands' AFM differ materially in interpretive posture, queue length, and tolerance for novel business models. Pre-application engagement is effectively mandatory: most NCAs expect two to four months of informal scoping before they will accept a formal Article 62 submission. The substantive filing comprises a programme of operations describing each Article 3(1)(16) service the applicant intends to provide, a three-year financial projection, a governance dossier including biographical and fingerprint material on every officer and director, a DORA-aligned ICT-risk framework, an AML/CFT manual aligned with the EU's Sixth AML Directive, a custody architecture document, a conflict-of-interest register, and the white papers for any tokens the firm proposes to admit to trading. Decision timelines under Article 63 are forty working days for completeness review and a further forty working days for substantive decision, but the clock stops on every information request and most applications run nine to twelve months in practice. All-in cost runs 250,000 euros to 1.5 million euros depending on complexity and choice of NCA. The Article 65 passport activates by simple notification to ESMA and the host NCA once authorisation is granted. Common rejection reasons include inadequate substance — a paper headquarters with senior management actually located outside the EU — gaps in the ICT framework relative to DORA, inability to demonstrate effective conflict-of-interest controls in vertically-integrated exchanges, and unsatisfactory client-asset segregation evidence.

Comparison to peer frameworks

Against the New York BitLicense, MiCA is materially easier and roughly one tenth the all-in cost, and it grants 27-state passport rights instead of single-state permission. Against VARA's Dubai regime, MiCA's stablecoin rules are markedly tighter — the Article 23 cap and EBA significance regime have no Dubai equivalent — but VARA's seven-category licence framework is more granular on the conduct side. Against Singapore's MAS Payment Services Act, MiCA has stricter capital floors at the lowest tiers but lighter ongoing supervision than the MAS Major Payment Institution regime; MAS's deeper integration with traditional banking AML and its more aggressive personal-conduct enforcement give Singapore a different risk profile. Against the United States' GENIUS Act stablecoin regime, MiCA's EMT framework is more prescriptive on reserve composition and redemption mechanics but lacks GENIUS's federal preemption architecture. Against the United Kingdom's FCA cryptoasset registration regime, MiCA is a full conduct regulation while the FCA register remains primarily an AML/CFT permission; a MiCA CASP cannot legally serve UK retail without separately satisfying FCA financial-promotion and forthcoming UK regulated-activity rules. Against an NYDFS limited-purpose trust charter, the two regimes do different things — MiCA authorises services, the trust charter authorises balance-sheet fiduciary custody — and many global firms hold both.

Open questions and pending changes

Three open questions dominate operator planning through 2026 and 2027. First, the Article 143 transition cliff hit on 1 July 2026, forcing every firm operating under a grandfathered pre-MiCA national licence to surface as either authorised or wound down; in France alone, press tallies as the deadline approached counted roughly a third of the ~117 registered PSANs — Binance among them — still without CASP authorisation, and the fallout from firms that missed the cut-off is still working through the market. Second, the reverse-solicitation perimeter remains contested: ESMA's December 2024 statement narrowed the carve-out aggressively but a non-EU exchange has yet to be sanctioned for breach, and the legal test for what constitutes targeted marketing has not been judicially examined. Third, EBA's significance-designation power under Article 56 has not yet been exercised against a major EMT issuer; the first designation will trigger enhanced supervision, additional capital surcharges, and the Article 23 cap regime, with material implications for the issuer's distribution economics. A MiCA review is mandated under Article 140 for completion by 30 June 2027 and is widely expected to address DeFi (currently outside scope under Recital 22), staking and lending services (excluded from the Article 3 service list), and the interaction with the upcoming PSD3 payments package. Operators should also watch ESMA's third-batch Level 2 technical standards covering market-abuse surveillance and the EBA's emerging stablecoin reserve-composition guidelines, both expected in finalised form during 2026.

Watch points

Fallout from the Article 143 transition cliff of 1 July 2026 — grandfathered firms that missed authorisation
First Article 23 cap enforcement against a non-EUR EMT
First reverse-solicitation enforcement action against a non-EU venue
EBA significance designation for major EMT issuers
Article 140 MiCA review by June 2027 — DeFi, staking, lending scope expansion
Big-bank entry — first ECB-supervised credit institution to passport for crypto custody

TL;DR

EU-wide passport regime that displaced 27 national crypto licences; stablecoin rules already broke USDT distribution in Europe, 283 CASPs were authorised by mid-2026, and the Article 143 transition cliff of 1 July 2026 has now forced grandfathered holdouts out.

Get DeFi Intel research in your inbox

Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.

Subscribe (free) DeFi Intel Pro →

Sources

Register counts are from ESMA's consolidated CASP register snapshot dated mid-2026; counts change as NCAs notify new authorisations.