The questions we hear, answered.

Yes. The asset-referenced token (ART) and e-money token (EMT) titles went live on 30 June 2024. The CASP regime - everything in Titles V and VI - went live on 30 December 2024. We're now operating under it, not preparing for it.

MiCA Article 149 (application dates)

A Crypto-Asset Service Provider is any firm authorised under MiCA to provide one or more of the ten regulated crypto-asset services for clients in the EU. The list is exhaustive: custody, operating a trading platform, exchange of crypto for fiat or other crypto, executing orders, placing crypto-assets, reception and transmission of orders, advice, portfolio management, transfer services, and providing crypto-assets in exchange for funds or other crypto-assets.

MiCA Article 3(1)(15) and Article 59

Truly unique and non-fungible NFTs are out of scope (Recital 10). But an NFT collection where each token is functionally interchangeable, or NFTs that are fractionalised, or NFTs that behave like financial instruments, are very much in scope. The market's working assumption - "NFTs are exempt" - is wrong more often than it's right. ESMA's December 2024 guidance leaned heavily toward case-by-case substance over form.

MiCA Recital 10; ESMA Final Report ESMA75-453128700-1323

MiCA's recitals say "fully decentralised" protocols without an identifiable intermediary fall outside its scope. In practice this is narrower than the DeFi industry tends to read it. If there's a team, a treasury, an admin key, a frontend operator, or a profit-taking entity, regulators will look at that entity as the CASP. The European Commission's 18-month DeFi report (due Dec 2026 per Article 142) will tighten this further.

MiCA Recital 22; Article 142

Yes - but as ARTs (asset-referenced tokens) or EMTs (e-money tokens), governed by Titles III and IV, not the CASP regime. If you're issuing the stablecoin, you need ART or EMT authorisation. If you're trading or custodying it, you need CASP authorisation. Different doors. Both went live before the CASP regime did.

MiCA Titles III, IV

Custodial wallets (you hold the keys) are CASPs under the "custody and administration" service in Article 75. Pure non-custodial wallets - software that lets users hold their own keys - sit outside the regime, but the line gets blurry around "administration on behalf of clients", recovery services, and seed-phrase backup features. Most non-custodial providers are still pulled in via adjacent services (transfer, exchange) anyway.

MiCA Article 75; Article 3(1)(17)

Two clocks. The competent authority has 25 working days to do the completeness check (Article 63(1)) and then 40 working days to decide once the file is complete (Article 63(4)). In practice, getting the file to complete is the slow part - most teams spend three to nine months preparing it, depending on jurisdiction, prior compliance posture, and how clean their custody story is. France, Germany, and Ireland are running longer than the legal clock. Malta and Lithuania have been faster.

MiCA Article 63

Article 60 is the lighter "notification" route for firms already authorised in the EU - credit institutions, investment firms, e-money institutions, UCITS management companies, MiFID firms - that want to add crypto-asset services. They notify their existing regulator and can start providing services 40 working days later. Article 62 is the full authorisation route for everyone else. If you're not already an EU-regulated financial entity, Article 62 is your only path.

MiCA Articles 60, 62

Roughly 40 distinct documents. The core blocks are: applicant identity and shareholders; programme of operations; governance arrangements; description of internal controls; AML/CFT controls; prudential safeguards plan; business continuity; ICT and cyber; outsourcing register; complaints handling; conflicts policy; custody policy (if relevant); market abuse arrangements; and service-specific procedures for each of the ten activities you want authorised for. We have a cross-walked checklist for this.

MiCA Article 62; EBA RTS on authorisation

There's no honest universal answer. Each NCA has different posture, timelines, and informal expectations. Speed/rigour are inversely correlated. Malta (MFSA) and Lithuania have been faster but ask different questions. France (AMF) has a strong reputation and a heavy file. Germany (BaFin) is rigorous and slow. Ireland (CBI) is methodical. The Netherlands (AFM) is responsive. Choose where your business, board, and lawyers actually are - passporting handles the rest.

No. CASP authorisation passports across all 27 member states. You get authorised in your home member state and notify the others before providing services there. The notification covers which services and which member states, and the host state can object on certain grounds but mostly can't add gold-plating.

MiCA Article 65

Only via an EU subsidiary or branch with substance - a real office, real staff, real management. MiCA Article 59(2) requires the registered office to be in the EU and management to be effectively based there. A nameplate doesn't work. The Kraken, Bitstamp, Coinbase, OKX, Crypto.com playbook in 2024-2025 was to establish an Irish, Maltese, or French entity with real local presence.

MiCA Article 59(2)

Article 68 requires the management body to have collective knowledge of crypto-assets and to dedicate sufficient time. NCAs interpret this as at least one EU-resident director who is effectively involved in day-to-day decisions. Some NCAs (France in particular) have signalled that they expect the senior management to be EU-resident, not just one director on paper.

MiCA Article 68

It depends on which services you're authorised for. There are three classes, and the requirement is the higher of the class minimum or one quarter of the previous year's fixed overheads.

Class 1 (€50,000): reception/transmission, advice, portfolio management, transfer services.
Class 2 (€125,000): Class 1 services + custody, exchange of crypto for fiat or other crypto, execution of orders, placing.
Class 3 (€150,000): Class 2 + operating a trading platform.

The fixed-overhead test trips up well-funded operators more than the class minimum does.

MiCA Article 67(1) and Annex IV

Yes - Article 67 lets you meet the requirement with own funds, a qualifying insurance policy, a comparable guarantee, or any combination. Most teams pick a mix because pure insurance asks underwriting to take a hard look at your governance, custody and controls, which slows the conversation.

MiCA Article 67(2)

Minimum 12-month term. At least 90 days' cancellation notice. Cover for the Union territory where you provide services. Written by a third-party insurer authorised under Union or national law. Public disclosure of the policy on your website. Coverage for the specific risk categories named in Article 67(5): loss of documents, misrepresentations, errors or omissions breaching legal duties, conflicts-of-interest failures, business disruption, gross negligence in safeguarding client assets, and CASP liability under Article 75(8).

MiCA Article 67(4)-(5)

ESMA's February 2026 Q&A (no. 2349) clarified this. You start from total overheads - fixed and variable - using your applicable accounting framework. Then you can subtract only the items listed in Article 67(3)(a)-(d): fully discretionary staff bonuses, fully discretionary employee profit shares, other variable remuneration to the extent fully discretionary, and shared commissions/fees payable directly related to commissions and fees received. Most teams' first draft of this number is too low.

ESMA Q&A 2349 on MiCA Article 67

Technically yes, but the door is much narrower than firms assume. Article 61 lets a third-country firm serve EU clients only at the client's own exclusive initiative. You can't market, you can't solicit, you can't offer new services or asset classes once the relationship exists, and you have to keep records proving client initiative. ESMA's December 2024 statement signalled that aggressive use of reverse solicitation will be policed - they explicitly warned against treating it as a backdoor.

MiCA Article 61; ESMA statement of 17 December 2024

Plain on-chain staking-as-a-service for a yield doesn't neatly fit any of the ten services. But where you pool funds, manage on a discretionary basis, or hold customer assets to stake on their behalf, custody (Article 75) and portfolio management (Article 81) are both in play. ESMA's late-2025 statements signalled NCAs should treat retail-facing staking products as in scope by analogy, and several NCAs have followed suit. Expect this to harden.

MiCA Articles 75, 81; ESMA statement of November 2025

Only if you're offering a crypto-asset to the public or seeking admission to trading on an EU platform (Articles 5-10 for crypto-assets other than ARTs/EMTs). Pure service providers - exchanges, custodians, brokers - don't publish white papers; the issuers do. There's an exemption for offerings under €1m over 12 months and for small-circle private placements.

MiCA Articles 4-10

Under Article 83, a direct or indirect holding of 10% or more of a CASP's capital or voting rights, or any holding that enables significant influence. Crossing 10%, 20%, 30%, or 50% triggers a prior notification to the competent authority, which has 60 working days to assess and can object. This catches a lot of cap-table moves that founders don't expect to be regulated.

MiCA Articles 83-84

If you hold client crypto-assets or the means to access them (private keys, seed phrases, signing authority), Article 75 applies. The core obligations: a custody policy, a written agreement with each client, asset segregation, accurate records and reconciliation, return on request without undue delay, no use of client assets for own account, and liability for loss up to the market value of the lost asset. The liability is strict - only "events outside the CASP's control" excuse it.

MiCA Article 75

Article 143 gives a transitional regime: firms providing crypto services under national law before 30 December 2024 can continue under that national framework until they get MiCA authorisation, up to 1 July 2026. Member states could shorten this - France went to 30 June 2026, Germany also shortened. Lithuania chose the full 18 months. You should already have an authorisation plan and a target NCA. If you don't, time is short.

MiCA Article 143

Yes. Article 60 covers credit institutions, investment firms (MiFID), e-money institutions, UCITS managers, AIFMs, market operators, and central securities depositories. You notify your existing competent authority of which crypto-asset services you'll provide and start 40 working days later. The notification still needs governance, custody, complaints, and conflicts evidence - it's lighter than Article 62 but not light.

MiCA Article 60

ESMA maintains a public non-compliant entities register under Article 110 - being on it is reputational damage that does not wash off. Penalties under Articles 111 and 112 can reach the higher of €5 million or 3% of annual turnover for individuals, and €15 million or 5% of annual turnover for legal persons (3-12.5% depending on the breach class). Some NCAs (BaFin, AMF) have also used criminal pathways where the breach was wilful.

MiCA Articles 110, 111, 112

Yes. Article 103 gives ESMA temporary intervention powers for crypto-asset services and Article 105 lets NCAs do product intervention. ESMA can prohibit or restrict marketing, distribution, or sale of a crypto-asset or a type of activity for up to three months at a time. This is the EU-wide kill-switch, and ESMA has signalled it will use it for clearly harmful retail products.

MiCA Articles 103, 105

Article 109 requires ESMA to publish a central register of all authorised CASPs, with LEI, competent authority, services authorised, host member states, and start dates. It's the source of truth - if you're not on it (or your competent authority hasn't notified ESMA yet) you can't operate. We track ours here.

MiCA Article 109