MiCA Regulation

MiCA defines its scope precisely. The distinction between in-scope and out-of-scope matters because it determines whether a business requires CASP authorization, token issuance authorization, or neither.

In scope

• Stablecoin issuers: Issuers of asset-referenced tokens (ARTs), which maintain stable value by referencing a basket of assets, fiat currencies, or commodities, and issuers of e-money tokens (EMTs), which maintain stable value by referencing a single fiat currency. Both categories carry authorization and reserve requirements under MiCA Titles III and IV;
• CASP operators****: Any legal entity providing one or more of the regulated crypto-asset services defined in MiCA Article 3(1)(16), operating on a professional basis in or to EU clients. The full CASP service categories are covered in the next section;
• Crypto-asset issuers making public offerings: Projects issuing crypto-assets other than ARTs or EMTs and offering them to the public in the EU must publish a MiCA-compliant whitepaper and comply with the disclosure obligations in MiCA Title II.

Out of scope

• Fully decentralized DeFi protocols: Where no identifiable legal entity controls the protocol or provides services on the basis of that protocol, MiCA does not apply. The decentralization threshold is not precisely defined in the regulation, and ESMA has acknowledged that most DeFi protocols have some degree of centralized governance that may bring them within scope. Each DeFi project requires legal analysis against its specific architecture;
• Most NFT platforms: MiCA excludes unique and non-fungible crypto-assets from its scope where they are not interchangeable. However, fractional NFT collections, large-batch NFT issuances, and NFT platforms that also custody or exchange fungible tokens may fall partially within scope;
• Central bank digital currencies (CBDCs): CBDCs issued by EU central banks are explicitly excluded;
• Financial instruments already regulated under MiFID II: Securities tokens and instruments that qualify as financial instruments under MiFID II are regulated under that framework, not MiCA. The boundaries between MiCA and MiFID II require careful analysis for tokenized securities and hybrid instruments.

MiCA authorization is activity-specific. A CASP holding authorization for one service category is not automatically authorized for others. A business operating across multiple categories must obtain authorization for each, and the authorization scope must match the actual services provided. MiCA defines the following regulated CASP activities:

• Custody and administration of crypto-assets on behalf of clients;
• Operation of a trading platform for crypto-assets;
• Exchange of crypto-assets for fiat funds;
• Exchange of crypto-assets for other crypto-assets;
• Execution of orders for crypto-assets on behalf of clients;
• Placing of crypto-assets;
• Reception and transmission of orders for crypto-assets on behalf of clients;
• Providing advice on crypto-assets;
• Providing portfolio management of crypto-assets;
• Providing transfer services for crypto-assets to clients.

Passport-eligible activities: All ten CASP service categories are passport-eligible. Authorization in one EU member state covers provision of the same authorized services across all 27 member states and the EEA, subject to standard passporting notification to the host NCA. Activities that may trigger dual licensing: Transfer services and the placing of crypto-assets can overlap with payment services regulated under PSD2. Businesses whose crypto transfer architecture involves the movement of fiat funds, the initiation of payment transactions, or the holding of client fiat balances may require an Electronic Money Institution (EMI) or Payment Institution (PI) authorization in addition to their CASP license. The dual-licensing question is business-model-specific and should be analyzed before application.

The table below reflects the implementation status and relative positioning of key member states as of early 2026. ESMA maintains the public register of authorized CASPs at esma.europa.eu.

Which EU member states have issued the most CASP authorizations

Lithuania has processed the highest volumes of CASP applications in the early phases of MiCA implementation, reflecting its established fintech licensing infrastructure and English-language regulatory engagement. Germany, France, and the Netherlands follow in terms of institutional application volumes. Malta and Cyprus attract mid-size operators with established legal service ecosystems. Czech Republic and Estonia are gaining ground among early-stage applicants for whom operational cost and regulatory accessibility are primary selection criteria.

The optimal jurisdiction for any specific applicant depends on business model, target markets, operational footprint, and banking requirements. LegalBison conducts jurisdiction assessments as the first step in every CASP engagement. See crypto licensing in Europe for full jurisdiction-by-jurisdiction analysis.

Legal opinion on business model classification

Required before the NCA can assess which CASP categories apply. The opinion must map the applicant’s specific technical and commercial model, including token types, custody arrangements, and client-facing flows, to the MiCA activity definitions. Generic whitepapers do not satisfy this requirement. NCAs return applications that lack a precise classification analysis.

Minimum own funds by activity category

Capital must be fully paid up and maintained on an ongoing basis. For businesses operating across multiple categories, the highest applicable threshold applies.

Fit and Proper assessment for key function holders

Directors, the MLRO, and beneficial owners holding more than 10% of the applicant must each be individually assessed and documented against the Fit and Proper criteria in MiCA Article 31. The assessment covers professional qualifications, regulatory history, criminal record, and reputational standing. NCAs verify these individually and any gap in the Fit and Proper package triggers a request for information that pauses the review.

AML/CFT program tailored to the business model

The AML/CFT program must map to the applicant’s specific user flows, product architecture, and risk profile. A generic AML policy template does not satisfy ESMA’s technical standards. The program must address customer risk categorization, transaction monitoring thresholds, Travel Rule implementation, and the MLRO’s escalation procedures in the context of the applicant’s actual service.

Client asset safeguarding arrangements

CASPs that hold crypto-assets or fiat funds on behalf of clients must demonstrate segregation arrangements before authorization is granted. This includes custody agreements, sub-custody arrangements where applicable, and documented client fund reconciliation procedures. Many first-time applicants attempt to address this requirement after submission; NCAs expect it to be resolved before the application is filed.

IT security framework and DORA alignment

From January 17, 2025, the Digital Operational Resilience Act (DORA) applies to all regulated financial entities in the EU, including licensed CASPs. The MiCA application must address ICT risk management, incident reporting procedures, third-party provider oversight, and operational resilience testing.

Business plan and three-year financial projections

The business plan must demonstrate a credible path to regulatory capital maintenance, describe the governance structure in detail, and project financial performance over three years. Projections that assume unrealistic growth curves or revenue trajectories are flagged during review.

Underspecified AML/CFT program

A generic AML policy template does not satisfy ESMA’s Level 2 technical standards. The program must map directly to the applicant’s specific user flows and risk profile. An exchange serving retail clients across 15 countries with on-ramp services has a materially different risk profile from an OTC desk serving institutional counterparties. The AML documentation must reflect that difference. Submissions that arrive with the same generic framework used for a different jurisdiction or a different business type are returned.

Missing client asset safeguarding arrangements

CASPs that hold client assets must demonstrate segregation arrangements before authorization. Many first-time applicants treat this as a post-authorization operational matter. NCAs treat it as a pre-authorization documentation requirement. The result is a request for information that pauses the review clock at the point when the applicant expected approval.

Vague business model descriptions

The NCA cannot assess the scope without a precise technical description of the service. An application that describes the business as a crypto exchange without specifying token types, custody model, order book architecture, and client-facing fund flows gives the NCA nothing to assess against the MiCA activity definitions. The model must be described with enough precision that the authorization scope can be drawn exactly.

Mismatched capital and activity scope

Applicants sometimes underestimate their capital requirement by excluding service categories from their activity description. If the operational reality includes custodying client assets (EUR 150,000 threshold), but the application describes the business as a simple exchange (EUR 125,000 threshold), the NCA will identify the discrepancy during review and require a revised application and capital plan.

Inadequate Fit and Proper preparation

Beneficial owners, directors, and MLROs who have not prepared their Fit and Proper documentation in advance create the most common single-point delay in MiCA applications. NCA requests for Fit and Proper supplementary information are among the slowest to resolve because they depend on individuals gathering personal documentation, sometimes across multiple jurisdictions.