The questions we hear, answered.

Yes. The asset-referenced token (ART) and e-money token (EMT) titles went live on 30 June 2024. The CASP regime - everything in Titles V and VI - went live on 30 December 2024. We're now operating under it, not preparing for it.

MiCA Article 149 (application dates)

A Crypto-Asset Service Provider is any firm authorised under MiCA to provide one or more of the ten regulated crypto-asset services for clients in the EU. The list is exhaustive: custody, operating a trading platform, exchange of crypto for fiat or other crypto, executing orders, placing crypto-assets, reception and transmission of orders, advice, portfolio management, transfer services, and providing crypto-assets in exchange for funds or other crypto-assets.

MiCA Article 3(1)(15) and Article 59

Truly unique and non-fungible NFTs are out of scope (Recital 10). But an NFT collection where each token is functionally interchangeable, or NFTs that are fractionalised, or NFTs that behave like financial instruments, are very much in scope. The market's working assumption - "NFTs are exempt" - is wrong more often than it's right. ESMA's December 2024 guidance leaned heavily toward case-by-case substance over form.

MiCA Recital 10; ESMA Final Report ESMA75-453128700-1323

MiCA's recitals say "fully decentralised" protocols without an identifiable intermediary fall outside its scope. In practice this is narrower than the DeFi industry tends to read it. If there's a team, a treasury, an admin key, a frontend operator, or a profit-taking entity, regulators will look at that entity as the CASP. The European Commission's 18-month DeFi report (due Dec 2026 per Article 142) will tighten this further.

MiCA Recital 22; Article 142

Yes - but as ARTs (asset-referenced tokens) or EMTs (e-money tokens), governed by Titles III and IV, not the CASP regime. If you're issuing the stablecoin, you need ART or EMT authorisation. If you're trading or custodying it, you need CASP authorisation. Different doors. Both went live before the CASP regime did.

MiCA Titles III, IV

Custodial wallets (you hold the keys) are CASPs under the "custody and administration" service in Article 75. Pure non-custodial wallets - software that lets users hold their own keys - sit outside the regime, but the line gets blurry around "administration on behalf of clients", recovery services, and seed-phrase backup features. Most non-custodial providers are still pulled in via adjacent services (transfer, exchange) anyway.

MiCA Article 75; Article 3(1)(17)

An EMT references a single official currency and behaves like electronic money - a euro stablecoin is the classic case, governed by Title IV. An ART references anything else - a basket of currencies, commodities, or crypto-assets - and falls under Title III. The distinction drives who can issue it: EMTs may only be issued by a credit institution or an authorised e-money institution, while ARTs need specific MiCA authorisation under Title III (or issuance by a credit institution).

MiCA Articles 3, 16, 48; Titles III and IV

Yes. Under MiCA an EMT may only be issued by a credit institution or an authorised electronic money institution (EMI), and you must publish a crypto-asset white paper and notify your competent authority before offering it. A CASP authorisation does not let you issue an EMT - issuing a stablecoin and providing services on one are different doors. ARTs follow a separate authorisation track under Title III.

MiCA Article 48 (EMTs); Title III (ARTs)

Authorisation is triggered by providing any of the ten regulated services to clients in the EU on a professional basis: custody, operating a trading platform, exchange, execution of orders, placing, reception and transmission of orders, advice, portfolio management, transfer services, and providing crypto-assets in exchange for funds or other crypto-assets (Article 59). Non-custodial does not automatically mean out of scope - if you run an exchange, route orders, or provide transfer or advisory services you can be a CASP without ever holding keys. Genuinely decentralised software with no identifiable intermediary is the main carve-out, and it is read narrowly.

MiCA Article 59; Recital 22

No. MiCA regulates service providers, not individuals holding their own keys; nothing in it requires you to use a custodian or bans non-custodial wallets. The fear comes from confusing MiCA with the Transfer of Funds Regulation (the EU Travel Rule), which makes regulated CASPs collect and verify information for transfers to or from a self-hosted wallet above €1,000. That is an obligation on the CASP at the on-ramp, not a restriction on holding your own crypto.

Regulation (EU) 2023/1113 (Travel Rule)

Check the ESMA public register of authorised CASPs and your national competent authority's register; a genuinely authorised exchange appears there with a named home member state. Confirm the exact legal entity name (for example Payward Europe for Kraken), not the brand, because the interim register has had data-entry errors. A firm still operating under a pre-existing national registration during the transitional window may not yet hold full MiCA authorisation. We track the register at Article 109 and list which major exchanges are MiCA-licensed.

MiCA Article 109 (register); Article 143 (transition)

Verify before assuming either way: check whether the specific EU entity appears on the ESMA register of authorised CASPs and on a national regulator's register, because exchange status has shifted repeatedly during the transition. An exchange can still be reachable under national transitional arrangements without yet holding full MiCA authorisation, which is not the same as being a confirmed authorised CASP. Status moves quickly, so treat the live ESMA register and your national regulator as the source of truth rather than any third-party list.

MiCA Article 109; Article 143

USDT is not banned and holding it is legal. What changed is that MiCA-authorised CASPs cannot offer a stablecoin to the EU public unless its issuer holds e-money token (EMT) authorisation, which Tether has not obtained. You can still self-custody USDT, transfer it on-chain, and use non-EU or decentralised venues; the restriction targets the regulated venue, not personal possession. More detail: USDT, MiCA, and EU users.

MiCA Article 48; Article 59

Fiat-referenced stablecoins like USDT are e-money tokens that may only be offered in the EU by an authorised issuer; because Tether has not obtained that authorisation, EEA platforms restricted or removed USDT pairs to stay compliant. This does not strand the coins you own: you can usually still hold or withdraw USDT and sell other assets through a compliant pair such as USDC or a euro pair. Delisting a USDT pair removes one exit route, not your ability to exit a position. See the full explainer.

MiCA Title IV; Article 48

Only stablecoins whose issuer holds MiCA EMT or ART authorisation can be offered to the EU public by licensed CASPs. As of 2026 commonly available authorised coins include Circle's USDC and EURC, Societe Generale's EURCV, Membrane's EUROe, and Banking Circle's EURI, while USDT and some others are not authorised and have been restricted on EU venues. The list changes as authorisations are granted, so confirm against your exchange and the issuer's current status.

MiCA Article 48; Article 16

Two clocks. The competent authority has 25 working days to do the completeness check (Article 63(1)) and then 40 working days to decide once the file is complete (Article 63(4)). In practice, getting the file to complete is the slow part - most teams spend three to nine months preparing it, depending on jurisdiction, prior compliance posture, and how clean their custody story is. France, Germany, and Ireland are running longer than the legal clock. Malta and Lithuania have been faster.

MiCA Article 63

Article 60 is the lighter "notification" route for firms already authorised in the EU - credit institutions, investment firms, e-money institutions, UCITS management companies, MiFID firms - that want to add crypto-asset services. They notify their existing regulator and can start providing services 40 working days later. Article 62 is the full authorisation route for everyone else. If you're not already an EU-regulated financial entity, Article 62 is your only path.

MiCA Articles 60, 62

Roughly 40 distinct documents. The core blocks are: applicant identity and shareholders; programme of operations; governance arrangements; description of internal controls; AML/CFT controls; prudential safeguards plan; business continuity; ICT and cyber; outsourcing register; complaints handling; conflicts policy; custody policy (if relevant); market abuse arrangements; and service-specific procedures for each of the ten activities you want authorised for. We have a cross-walked checklist for this.

MiCA Article 62; EBA RTS on authorisation

There's no honest universal answer. Each NCA has different posture, timelines, and informal expectations. Speed/rigour are inversely correlated. Malta (MFSA) and Lithuania have been faster but ask different questions. France (AMF) has a strong reputation and a heavy file. Germany (BaFin) is rigorous and slow. Ireland (CBI) is methodical. The Netherlands (AFM) is responsive. Choose where your business, board, and lawyers actually are - passporting handles the rest. Compare them side by side.

No. CASP authorisation passports across all 27 member states. You get authorised in your home member state and notify the others before providing services there. The notification covers which services and which member states, and the host state can object on certain grounds but mostly can't add gold-plating.

MiCA Article 65

Only via an EU subsidiary or branch with substance - a real office, real staff, real management. MiCA Article 59(2) requires the registered office to be in the EU and management to be effectively based there. A nameplate doesn't work. The Kraken, Bitstamp, Coinbase, OKX, Crypto.com playbook in 2024-2025 was to establish an Irish, Maltese, or French entity with real local presence.

MiCA Article 59(2)

Article 68 requires the management body to have collective knowledge of crypto-assets and to dedicate sufficient time. NCAs interpret this as at least one EU-resident director who is effectively involved in day-to-day decisions. Some NCAs (France in particular) have signalled that they expect the senior management to be EU-resident, not just one director on paper.

MiCA Article 68

Three cost layers, and the headline capital figure is the smallest one. Regulatory: minimum own funds of €50,000, €125,000, or €150,000 depending on your service class (Article 67), plus the NCA's application and annual supervisory fees, which vary widely by member state. Professional: legal, compliance, and audit support to build the Article 62 file - commonly six figures for a full custody or trading scope. Operational: a real EU office, fit-and-proper management, ICT, AML systems, and ongoing supervision. For anything beyond the lightest Class 1 scope, budget a realistic year-one total well into six figures, with the capital requirement on top of that.

MiCA Article 67 and Annex IV

Most are delays, not outright refusals - the file goes back and forth and the clock keeps resetting. The recurring causes: an incomplete or inconsistent Article 62 file that fails the 25-working-day completeness check; a weak custody and client-asset segregation story; thin AML/CFT controls; governance that does not show EU-resident, fit-and-proper management with real crypto knowledge; an under-stated fixed-overheads figure for the Article 67 calculation; and outsourcing or ICT arrangements where the applicant cannot show it stays in control. The application evidence pack is built around these failure points.

MiCA Articles 62, 63, 67, 68

MiCA only bites when you provide crypto-asset services to clients in the EU, so if you have no EU customers and do not market into the EU, you may not need it. The value of authorisation is access: one licence lets you serve and market to all 27 member states plus the EEA. If the EU is a growth market the passport is the payoff; if it is incidental, weigh the cost of an EU entity and ongoing supervision against the revenue at stake. Reverse solicitation is a narrow exemption, not a reliable EU market-entry strategy.

MiCA Articles 59, 61, 65

Usually the question is where your customers are, not which licence is easiest. MiCA's edge is a single authorisation that passports across all 27 EU member states plus the EEA, so it is the access route if Europe is a target market. The UK runs a separate FCA registration with its own emerging cryptoasset regime; the US is enforcement-led and split across federal and state lines; Dubai's VARA is a single-emirate licence. None of these substitutes for the others - a MiCA licence does not authorise you in the UK, US, or UAE, and vice versa. Compare them side by side.

MiCA Article 65 (passporting)

In the EU the answer is a MiCA Crypto-Asset Service Provider (CASP) authorisation, not a bespoke "exchange licence". Operating a trading platform is its own regulated service in the highest capital class (Class 3, €150,000), while a simpler buy/sell desk maps to "exchange of crypto-assets for funds or other crypto-assets" (Class 2, €125,000). You authorise for each of the services you actually provide, so most exchanges request a bundle on one application.

MiCA Article 59; Annex IV

A registered address or virtual office is not enough. Article 59(2) requires the registered office in the EU with effective management based there, and Article 68 requires a management body genuinely involved in day-to-day decisions. In practice that means at least one EU-resident director, key functions (compliance, risk, AML) staffed in the EU rather than fully outsourced, and a real office. A nameplate with all functions run from outside the EU is a standard ground for refusal.

MiCA Article 59(2); Article 68

Reverse solicitation only holds when an EU client deals with you on their own exclusive initiative. ESMA's 2025 guidance reads solicitation broadly: EU-targeted ads, referral and affiliate programmes, influencer or sponsorship deals, EU-language marketing or community management, push notifications, roadshows, and promoting any new service or asset class to an existing client all count. A site or app that EU residents can simply reach is passive and acceptable, but the burden is on you to prove the client came first. Treat it as a one-off exemption, not a marketing channel.

MiCA Article 61; ESMA guidelines 2025

No. MiCA has no equivalence framework and no third-country passport, so a non-EU firm cannot serve EU clients on the strength of its home-country authorisation. The only route to authorised EU access is to establish an entity in the EU, with its registered office and effective management there, and obtain CASP authorisation. Reverse solicitation is a narrow exemption for genuinely client-initiated business, not a substitute.

MiCA Article 59; Article 61

It depends on which services you're authorised for. There are three classes, and the requirement is the higher of the class minimum or one quarter of the previous year's fixed overheads.

Class 1 (€50,000): reception/transmission, advice, portfolio management, transfer services.
Class 2 (€125,000): Class 1 services + custody, exchange of crypto for fiat or other crypto, execution of orders, placing.
Class 3 (€150,000): Class 2 + operating a trading platform.

The fixed-overhead test trips up well-funded operators more than the class minimum does.

MiCA Article 67(1) and Annex IV

Yes - Article 67 lets you meet the requirement with own funds, a qualifying insurance policy, a comparable guarantee, or any combination. Most teams pick a mix because pure insurance asks underwriting to take a hard look at your governance, custody and controls, which slows the conversation.

MiCA Article 67(2)

Minimum 12-month term. At least 90 days' cancellation notice. Cover for the Union territory where you provide services. Written by a third-party insurer authorised under Union or national law. Public disclosure of the policy on your website. Coverage for the specific risk categories named in Article 67(5): loss of documents, misrepresentations, errors or omissions breaching legal duties, conflicts-of-interest failures, business disruption, gross negligence in safeguarding client assets, and CASP liability under Article 75(8).

MiCA Article 67(4)-(5)

Do not start with a generic quote request. Prepare a short evidence pack: authorised or planned MiCA services, Article 67 safeguard route, fixed-overhead calculation, custody model, client-asset segregation, outsourcing dependencies, incident history, complaints process, and the Article 75 loss/liability scenarios that could reach the policy. The useful output is a broker-ready diligence packet, not a coverage, placement, or regulatory-acceptance assurance. Start with the CASP insurance evidence pack and the Article 75 custody liability checklist.

MiCA Articles 67 and 75

ESMA's February 2026 Q&A (no. 2349) clarified this. You start from total overheads - fixed and variable - using your applicable accounting framework. Then you can subtract only the items listed in Article 67(3)(a)-(d): fully discretionary staff bonuses, fully discretionary employee profit shares, other variable remuneration to the extent fully discretionary, and shared commissions/fees payable directly related to commissions and fees received. Most teams' first draft of this number is too low.

ESMA Q&A 2349 on MiCA Article 67

Capacity is specialist but real. Most CASP placements run through brokers who publish crypto and MiCA work - the directory tracks the ones doing so under insurance brokers. Before approaching one, assemble the Article 67 evidence pack so the conversation starts from facts rather than a blank quote request. The directory lists firms for research; it is not a broker and does not place cover.

MiCA Articles 67 and 75

Usually not. A standard cyber policy responds to data breaches, network interruption, and liability for compromised personal data; theft of crypto-assets and private keys is typically excluded or sub-limited to almost nothing. The cover that responds to stolen keys or lost client assets is crime, specie, or custody-liability insurance from specialist carriers. Those are the lines that map to your Article 75 loss liability and the Article 67 prudential safeguard, not a generic cyber wording. Start with the CASP insurance evidence pack.

MiCA Article 67; Article 75

There is no standard premium; specialist underwriters price each CASP individually. The main drivers are your service mix and custody exposure, assets held in custody, your control and security posture, claims and incident history, the limits and retentions you choose, and which lines you buy (professional indemnity, crime, specie, custody liability, cyber). Because capacity is specialist, the useful first step is an evidence pack that lets a broker scope the risk, not a blind quote request. See the CASP insurance evidence pack.

MiCA Articles 67 and 75

Technically yes, but the door is much narrower than firms assume. Article 61 lets a third-country firm serve EU clients only at the client's own exclusive initiative. You can't market, you can't solicit, you can't offer new services or asset classes once the relationship exists, and you have to keep records proving client initiative. ESMA's December 2024 statement signalled that aggressive use of reverse solicitation will be policed - they explicitly warned against treating it as a backdoor.

MiCA Article 61; ESMA statement of 17 December 2024

Plain on-chain staking-as-a-service for a yield doesn't neatly fit any of the ten services. But where you pool funds, manage on a discretionary basis, or hold customer assets to stake on their behalf, custody (Article 75) and portfolio management (Article 81) are both in play. ESMA's late-2025 statements signalled NCAs should treat retail-facing staking products as in scope by analogy, and several NCAs have followed suit. Expect this to harden.

MiCA Articles 75, 81; ESMA statement of November 2025

Only if you're offering a crypto-asset to the public or seeking admission to trading on an EU platform (Articles 5-10 for crypto-assets other than ARTs/EMTs). Pure service providers - exchanges, custodians, brokers - don't publish white papers; the issuers do. There's an exemption for offerings under €1m over 12 months and for small-circle private placements.

MiCA Articles 4-10

Under Article 83, a direct or indirect holding of 10% or more of a CASP's capital or voting rights, or any holding that enables significant influence. Crossing 10%, 20%, 30%, or 50% triggers a prior notification to the competent authority, which has 60 working days to assess and can object. This catches a lot of cap-table moves that founders don't expect to be regulated.

MiCA Articles 83-84

If you hold client crypto-assets or the means to access them (private keys, seed phrases, signing authority), Article 75 applies. The core obligations: a custody policy, a written agreement with each client, asset segregation, accurate records and reconciliation, return on request without undue delay, no use of client assets for own account, and liability for loss up to the market value of the lost asset. The liability is strict - only "events outside the CASP's control" excuse it.

MiCA Article 75

Article 73 does not ban outsourcing, but it expects the CASP to remain fully responsible. Keep an outsourcing register, written agreements, provider due-diligence notes, operational-risk controls, access and audit rights, termination or exit plans, and evidence that outsourcing does not weaken internal controls, supervision, or client obligations. Treat critical ICT, custody, payments, complaints, and order-flow vendors as evidence-pack dependencies, not procurement footnotes.

MiCA Article 73

Article 74 expects CASPs to prepare for an orderly wind-down. A useful evidence pack should name the trigger owners, client-notification route, asset-return or transfer process, reconciliation records, vendor and custody dependencies, complaints handoffs, records-retention plan, and unresolved adviser or competent-authority questions. It is an exit-readiness file, not a promise that a wind-down will be accepted or painless. Start with the Article 74 wind-down checklist.

MiCA Article 74

Yes. Article 71 expects effective and transparent procedures for prompt, fair and consistent complaint handling, and Delegated Regulation (EU) 2025/294 adds procedure and template detail. Keep a complaint register, intake and acknowledgement records, investigation notes, final-response rationale, escalation routes, and management-information reviews. This is an evidence-pack discipline, not a substitute for local filing, redress, or adviser review.

MiCA Article 71; Delegated Regulation (EU) 2025/294

They are separate, stacked obligations - you need all of them, not one. MiCA authorises you as a CASP and governs conduct, custody, and prudential rules. The Transfer of Funds Regulation (EU) 2023/1113, the EU Travel Rule, requires originator and beneficiary information to travel with crypto transfers and applies to CASPs from 30 December 2024. On top of that, the EU AML framework (the AML Regulation and the new authority AMLA) sets customer due diligence and reporting duties. A compliant CASP holds MiCA authorisation, runs Travel Rule controls, and operates a full AML/CFT programme. See the travel rule and AML guide.

Regulation (EU) 2023/1113; MiCA Title V

For crypto transfers between CASPs the EU Travel Rule has no de minimis threshold - originator and beneficiary information must accompany the transfer regardless of amount. This is stricter than the fiat travel rule, which keeps a €1,000 threshold. For transfers to or from a self-hosted (unhosted) wallet, additional measures apply above €1,000, including verifying that your customer owns or controls the wallet. Below that amount the obligations are lighter, but you still apply your AML risk controls. See the travel rule and AML guide.

Regulation (EU) 2023/1113 (EU Travel Rule)

It is not MiCA; it comes from the EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624). From 10 July 2027 the AMLR prohibits credit institutions, financial institutions, and CASPs from keeping anonymous accounts and from providing or safekeeping anonymity-enhancing crypto-assets such as privacy coins. It does not stop individuals holding privacy coins in self-custody; it stops regulated EU providers from offering anonymous accounts or handling those assets for clients. More in the travel rule and AML guide.

Regulation (EU) 2024/1624 (AMLR)

Yes, DORA applies to CASPs in parallel with MiCA and has since 17 January 2025. MiCA Article 68 already requires ICT and business-continuity arrangements; DORA (Regulation (EU) 2022/2554) adds detailed ICT risk management, incident reporting, resilience testing, and oversight of critical third-party providers. The obligations are additive: meeting DORA generally satisfies MiCA's ICT expectations, but a bare MiCA file will not satisfy DORA. Build the ICT evidence once, to the DORA standard.

MiCA Article 68; Regulation (EU) 2022/2554 (DORA)

Article 143 gives a transitional regime: firms providing crypto services under national law before 30 December 2024 can continue under that national framework until they get MiCA authorisation, up to 1 July 2026. Member states could shorten this - France went to 30 June 2026, Germany also shortened. Lithuania chose the full 18 months. You should already have an authorisation plan and a target NCA. If you don't, time is short.

MiCA Article 143

Yes. Article 60 covers credit institutions, investment firms (MiFID), e-money institutions, UCITS managers, AIFMs, market operators, and central securities depositories. You notify your existing competent authority of which crypto-asset services you'll provide and start 40 working days later. The notification still needs governance, custody, complaints, and conflicts evidence - it's lighter than Article 62 but not light.

MiCA Article 60

No. Article 143 sets a maximum grandfathering window of 18 months ending 1 July 2026, but member states were allowed to shorten it, and several did. Your real deadline depends on the member state where you operated under national law before 30 December 2024, not the EU-wide maximum. Check your specific NCA's transitional date rather than assuming July 2026; see the per-country deadlines.

MiCA Article 143

Only inside your member state's transitional window, and only for services you already provided under national law before 30 December 2024. Article 143 lets you continue under the old national framework until you are authorised or the window closes, whichever comes first. It is not an indefinite bridge: once the deadline passes without authorisation you must stop. Filing late in the window is risky, because authorisation routinely takes longer than the time left.

MiCA Article 143

No. MiCA regulates the conduct, licensing, and supervision of crypto-asset service providers; it is silent on tax. Taxation stays a national competence, so each EU member state applies its own rates and rules. The EU-wide layer people confuse with MiCA is DAC8 (Council Directive (EU) 2023/2226), a separate tax-reporting directive that applies from 1 January 2026. See MiCA, DAC8, and crypto tax reporting.

Council Directive (EU) 2023/2226 (DAC8)

Article 110 requires ESMA to maintain a public, non-exhaustive register of entities providing crypto-asset services in violation of Article 59 or 61, including at least the commercial name or website and the competent authority that submitted the information. Articles 111 and 112 cover administrative penalties and how competent authorities should exercise supervisory and penalty powers, so unauthorised activity should be treated as a supervisory, reputational, and remediation risk rather than a paperwork issue.

MiCA Articles 59, 61, 110, 111, 112

Yes. Article 103 gives ESMA temporary intervention powers for crypto-asset services and Article 105 lets NCAs do product intervention. ESMA can prohibit or restrict marketing, distribution, or sale of a crypto-asset or a type of activity for up to three months at a time. This is the EU-wide kill-switch, and ESMA has signalled it will use it for clearly harmful retail products.

MiCA Articles 103, 105

Article 109 requires ESMA to publish a central register of all authorised CASPs, with LEI, competent authority, services authorised, host member states, and start dates. It's the source of truth - if you're not on it (or your competent authority hasn't notified ESMA yet) you can't operate. We track ours here.

MiCA Article 109