Exchange and brokerage founders
Teams offering crypto-fiat, crypto-crypto conversion, order execution, order routing, OTC flow or platform-style matching.
EU Crypto Regulation Guide
A MiCA license is the market shorthand for CASP authorisation under Regulation (EU) 2023/1114. It allows a crypto-asset service provider to operate from one EU home state and use passporting across the EU and EEA, subject to notification. This page explains who needs a MiCA licence, which services fall in scope, what documents regulators expect, how MiCA, TFR, DORA and GDPR interact, and how to choose the right jurisdiction for your business model.
General information only. MiCA outcomes depend on token classification, service perimeter, home-state regulator practice, and adjacent obligations under AML, TFR, DORA and GDPR.
These are the main starting points for founders comparing MiCA authorisation routes by regulator posture, banking access, staffing reality, and long-term passporting value.
Europe
Europe
Europe
Europe
Europe
A MiCA license is not a separate pan-European certificate; it is the market term for authorisation as a Crypto-Asset Service Provider (CASP) under Regulation (EU) 2023/1114. If your company provides regulated crypto-asset services in or into the EU on a professional basis, you generally need home-state authorisation from a National Competent Authority (NCA) and then may passport the service into other EU states.
The regime became fully applicable to CASPs on 30 December 2024. That date did not mean every existing provider had to be licensed on the same day. Transitional regimes may still apply in some member states, but only within local limits and in any case not beyond 1 July 2026. If your business still relies on an older AML-only VASP registration, the strategic question is no longer whether MiCA matters, but whether your governance, safeguarding, outsourcing, complaints handling, prudential planning and ICT controls can survive MiCA scrutiny.
MiCA does not cover everything called “crypto”. Financial instruments remain outside MiCA and stay within the MiFID II perimeter. EMTs and ARTs have their own issuer rules. Certain genuinely decentralised arrangements, central bank-issued assets and some NFTs may fall outside or on the edge of scope, but those conclusions require case-by-case legal analysis. In practice, the first real gate is always token and service qualification.
Teams offering crypto-fiat, crypto-crypto conversion, order execution, order routing, OTC flow or platform-style matching.
Businesses safeguarding client crypto-assets or cryptographic keys and needing defensible segregation, reconciliation and key-management controls.
In-house teams preparing a MiCA dossier, mapping service perimeter, or upgrading from a legacy VASP registration.
Companies assessing white paper obligations, ART/EMT qualification, admission to trading, and issuer-side disclosure duties.
Old national AML registrations were often narrow and local. MiCA adds conduct, governance, prudential, safeguarding and passporting logic at EU level.
A properly structured CASP authorisation can support cross-border activity through notification instead of rebuilding licensing state by state.
NCAs test whether your company can actually control client assets, outsourcing chains, ICT incidents, complaints, and financial resilience after go-live.
A workable EU setup also requires alignment with Regulation (EU) 2023/1113 on the Travel Rule, DORA, AML/CFT controls, sanctions screening and GDPR.
The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, is the core EU rulebook for crypto-asset issuers and crypto-asset service providers.
Crypto-Asset Service Provider is the MiCA-regulated entity authorised to provide one or more crypto-asset services, with potential passporting across the EU and EEA.
National Competent Authority is the home-state regulator that receives and assesses the CASP application. MiCA authorisation is granted by the NCA, not by ESMA.
Asset-Referenced Token is a crypto-asset that seeks to maintain stable value by referencing another value, right, or combination of assets, excluding EMT logic.
E-Money Token is a crypto-asset that purports to maintain stable value by referencing the value of one official currency. EMT analysis often overlaps with e-money concepts and redemption-at-par logic.
Passporting is the right of a CASP authorised in one EU home state to provide services in other member states after notification, without a full relicensing process in each country.
A white paper is the mandatory disclosure document for certain crypto-asset offers and admissions to trading under MiCA. It is not a marketing deck; it is a regulated disclosure instrument.
A narrow exemption where a third-country firm provides a service at the exclusive initiative of the client. It cannot be used as a disguised EU acquisition strategy.
Exchange models fall within MiCA where the company exchanges crypto-assets for funds or for other crypto-assets, and may also trigger reception, transmission or execution of orders. The legal perimeter depends on whether the firm acts as principal, agent, broker or venue operator.
Crypto-fiat exchange, crypto-crypto conversion, retail brokerage, OTC execution support, order handling.
Operating a trading platform is the highest-intensity MiCA service model because the regulator will test venue logic, market integrity controls, listing governance, conflict management and operational resilience more deeply than in simple brokerage models.
Order-book venue, multilateral matching, platform execution environment, listing and admission workflows.
Safekeeping or controlling client crypto-assets or the means of access to them is a core MiCA service. In practice, regulators focus on wallet architecture, key governance, segregation, reconciliation, liability allocation, incident response and outsourcing to custody technology providers.
Custodial wallets, institutional custody, key management, safekeeping, account administration.
A broker that receives, transmits or executes client orders without operating a full venue may still need multiple MiCA permissions. Founders often underestimate how quickly a light brokerage model becomes a broader CASP perimeter once execution, placement or advice is added.
Reception and transmission of orders, execution of orders, agency brokerage, smart routing, OTC intermediation.
MiCA includes advice on crypto-assets and portfolio management of crypto-assets. These services are often overlooked by content providers because they resemble MiFID concepts, but they are expressly regulated under MiCA for crypto-assets that are not financial instruments.
Crypto investment advice, managed crypto portfolios, discretionary allocation, strategy recommendations.
Issuer-side activity does not follow one single CASP route. The correct framework depends on whether the token is a non-ART/EMT crypto-asset, an ART, an EMT, or a financial instrument outside MiCA. Placement services and admission to trading can also create CASP obligations.
Public token offer, admission to trading, placement, utility token launch, issuer disclosure, stablecoin structuring.
Compare EU jurisdictions by regulator style, transition regime, banking access, language, local substance expectations, staffing needs, and practical launch conditions.
| Jurisdiction | Regulator | Price | Period | State fee | Annual fee | Capital | Staff | Office | Passporting | Audit |
|---|---|---|---|---|---|---|---|---|---|---|
| Austria | Austrian Financial Market Authority (FMA) | from EUR 27,900 | From 6 months | No | No | No | No | |||
| Cyprus | Cyprus Securities and Exchange Commission (CySEC) | from EUR 18,900 | From 6 months | 10,000 EUR | From 10000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Czech Republic | Czech National Bank (CNB) | from EUR 18,900 | From 6 months | CZK 20,000 (~€800) | Variable (based on AUM) | From €50,000 | Required | Required | Yes | Required |
| Estonia | Estonian Financial Supervision Authority (FIU) | From 6 months | 10000 EUR | 10000 EUR | From 50 000 EUR | Required | Required | Yes | Required | |
| Finland | Finanssivalvonta (FIN-FSA) | from EUR 21,500 | From 6 months | No | No | No | No | |||
| France | Autorité des Marchés Financiers (AMF) | from EUR 26,800 | From 6 months | No | No | No | No | |||
| Germany | Federal Financial Supervisory Authority (BaFin) | From 6 months | 10750 EUR | From 10000 EUR | From 50 000 EUR | Required | Required | Yes | Required | |
| Ireland | Central Bank of Ireland (CBI) | from EUR 23,900 | From 6 months | No | No annual fee | From 50 000 EUR | Required | Required | Yes | Required |
| Lithuania | Bank of Lithuania | from EUR 19,900 | From 6 months | 2,500 EUR | From 3000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Luxembourg | Commission de Surveillance du Secteur Financier (CSSF) | from EUR 34,900 | From 6 months | No | No | No | No | |||
| Malta | Malta Financial Services Authority (MFSA) | from EUR 23,900 | From 6 months | From 10,000 EUR | From 10000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Netherlands | Netherlands Authority for the Financial Markets (AFM) | from EUR 28,900 | From 6 months | No | No | No | No | |||
| Poland | Polish Financial Supervision Authority (KNF) | from EUR 18,900 | From 6 months | 4,500 EUR | No annual fee | From 50 000 EUR | Required | Required | Yes | Required |
| Slovakia | National Bank of Slovakia (NBS) | From 6 months | From 1000 EUR | No annual fee | From 50 000 EUR | Required | Required | Yes | Required | |
| Spain | Comisión Nacional del Mercado de Valores (CNMV) | from EUR 25,900 | From 6 months | No | No | No | No |
Non-EUR state and annual fees include approximate EUR equivalents based on reference rates used on March 11, 2026.
MiCA commonly uses €50,000, €125,000 and €150,000 thresholds depending on the service class. That is the legal floor, not the full prudential story.
A serious application requires perimeter analysis, token qualification, programme of operations, policy pack drafting, governance mapping, financial model support and regulator-facing responses. Generic templates are one of the fastest ways to trigger RFIs.
Budget for directors, compliance leadership, AML/MLRO function, local office logic where needed, and time commitment of senior management. Regulators increasingly challenge letterbox structures.
Travel Rule messaging, sanctions screening, blockchain analytics, case management, secure access control, logging and incident handling are operating requirements, not optional extras.
Many MiCA business models still fail operationally because banking is not arranged in parallel. Account opening, safeguarding arrangements and payment connectivity should be planned before approval, not after.
The correct comparison is not filing cost alone. The real metric is whether the chosen home state remains workable over three years for reporting, staffing, product expansion and counterparty acceptance.
Use the selector to narrow the field by business model, budget, banking needs, target countries, language, and tolerance for local substance and governance depth.
MiCA created the first unified EU framework for crypto-asset services, but it did not erase national supervisory differences or adjacent compliance obligations.
MiCA changed the legal baseline from local AML registration to full prudential-style authorisation. Under many pre-MiCA VASP regimes, the regulator mainly tested AML/CFT controls and beneficial ownership. Under MiCA, the NCA also reviews governance, safeguarding, complaints handling, conflicts of interest, outsourcing, ICT security, continuity planning, and whether the management body is genuinely capable of running the business.
The timeline matters. MiCA was published in the Official Journal on 9 June 2023, entered into force on 29 June 2023, applied to ARTs and EMTs from 30 June 2024, and applied to CASPs from 30 December 2024. Transitional regimes may still exist in some member states, but they are country-specific and cannot extend beyond 1 July 2026.
MiCA does not harmonise everything in practice. The rulebook is EU-wide, but supervisory style still differs between authorities such as BaFin, AMF/ACPR, CSSF, MFSA, Central Bank of Ireland, AFM/DNB, Banco de España and Lietuvos bankas. The same business model can face different questions on local directors, outsourcing depth, language of submission, pre-application meetings and evidence of banking readiness.
MiCA also has clear boundaries. It does not apply to crypto-assets that qualify as financial instruments under Directive 2014/65/EU (MiFID II). That boundary is commercially critical. A founder who files under MiCA with a token that is actually a financial instrument may lose months and still end up in the wrong regulatory perimeter.
Best for firms targeting EU users, institutional counterparties, payment integrations or long-term European expansion under a recognised regulatory framework.
Less suitable for founders seeking a low-substance offshore structure, relying on aggressive cross-border marketing from outside the EU, or operating a token that more likely falls under MiFID II or another non-MiCA regime.
Publication: 9 June 2023. Entry into force: 29 June 2023. ART/EMT application: 30 June 2024. CASP application: 30 December 2024. Transitional end-stop: 1 July 2026.
Old VASP regimes often focused on AML registration. MiCA requires a fuller operating model with governance, safeguarding, conduct and prudential controls.
The authorisation is granted by the home-state NCA. ESMA does not issue CASP licences directly, but ESMA remains central through registers, technical standards and supervisory convergence.
Grandfathering, pre-application expectations, language, office substance and review style still vary materially across member states.
Start with EU home states for MiCA, then compare non-EU alternatives where your strategy requires a different market-access or regulatory profile.
15 jurisdictions
A MiCA file is a structured authorisation dossier, not a bundle of templates. The regulator expects consistency between the business model, governance, financials, outsourcing map, and technical controls.
The core operational narrative of the application: services requested, target clients, geographic scope, onboarding flow, execution model, safeguarding logic, outsourcing structure and launch plan.
Constitutional documents, ownership chart, UBO evidence, CVs, criminal-record and integrity materials, time-commitment evidence, conflict disclosures and proof that the management body is fit and proper.
A three-year plan showing revenue model, cost base, capital adequacy, funding assumptions, fixed overhead resilience and realistic growth metrics. Regulators often challenge unrealistic customer-acquisition assumptions.
Customer due diligence, enhanced due diligence, transaction monitoring, suspicious activity escalation, sanctions screening, risk scoring and governance over high-risk customers and jurisdictions.
Operational procedures for originator and beneficiary data exchange under Regulation (EU) 2023/1113, including counterparty workflows, unhosted wallet controls, exception handling and data governance.
Segregation model, wallet structure, reconciliation process, client-asset records, access control, liability logic, incident handling and restrictions on use of client assets for own account.
A map of outsourced functions, critical providers, contractual controls, audit rights, concentration risk, exit planning and retained internal oversight. Weak outsourcing governance is one of the most common MiCA pain points.
System architecture, access management, logging, backup, recovery, vulnerability handling, incident classification, third-party ICT oversight, cloud dependencies and business continuity logic.
A MiCA licence solves the authorisation question, not the operating-model question. The sustainable compliance stack combines MiCA conduct rules with AML/CFT, TFR, DORA, sanctions controls, outsourcing governance and GDPR data discipline.
MiCA expects a real EU establishment, an effective management body and defensible control over the licensed activity. In practice, regulators test whether directors understand the business model, challenge outsourcing, and can evidence time commitment rather than merely lend names to the file.
Client assets must be identifiable, segregated and controlled through a reliable operating model. For custody-heavy firms, regulators increasingly ask how private keys are governed, whether HSM or MPC architecture is used, how hot and cold wallet thresholds are set, and how reconciliation breaks are escalated.
Under Regulation (EU) 2023/1113, CASPs must implement originator and beneficiary data collection and transmission for relevant crypto transfers. That usually means workflow design with Travel Rule vendors, use of standards such as IVMS101, counterparty due diligence and controls for transfers involving unhosted wallets.
Regulation (EU) 2022/2554 (DORA) made ICT governance, incident reporting, resilience testing and third-party ICT oversight central to financial-sector operations. Even where the exact firm-level application needs careful analysis, MiCA regulators increasingly expect DORA-style maturity in access control, logging, backup, recovery and cloud outsourcing oversight.
CASPs must act honestly, fairly and professionally in the best interests of clients. Marketing communications must be fair, clear and not misleading. Complaint handling, conflict management and disclosure discipline are not peripheral; they are core conduct requirements.
The most common delay drivers are weak token qualification, generic policy packs, unclear outsourcing, unrealistic financial forecasts, no real safeguarding proof, incomplete fit-and-proper files, poor Travel Rule readiness and an overreliance on reverse solicitation for non-EU strategy.
MiCA is an EU regulation, but the authorisation process is still home-state based. The practical supervisory environment therefore combines EU institutions, technical standard setters and national regulators.
MiCA was adopted through the EU legislative process, not created by a single supervisory agency. The European Commission, European Parliament and Council of the European Union form the legal backbone of the regime.
The European Securities and Markets Authority drives supervisory convergence, maintains relevant registers and develops level-2 measures and guidance that shape how MiCA works in practice for CASPs and market participants.
The European Banking Authority is particularly important for stablecoin-related areas, prudential expectations and technical standards. The European Central Bank becomes relevant especially where EMTs, payment-system implications or significant token issues intersect with monetary and financial stability concerns.
The home-state NCA receives the file, runs the completeness check, conducts the substantive review, asks RFIs and grants or refuses authorisation. Examples include BaFin, AMF/ACPR, CSSF, MFSA, Central Bank of Ireland, AFM/DNB, CNMV/Banco de España and Lietuvos bankas.
MiCA firms also operate under adjacent frameworks including TFR, AML/CFT supervision, sanctions enforcement, data protection authorities under GDPR, and potentially payment or securities regulators where the product crosses into EMT, e-money or MiFID II territory.
For many CASPs, banking is the real launch bottleneck. A MiCA authorisation improves credibility, but it does not automatically solve account opening, safeguarding arrangements or payment connectivity.
Parallel work on banking, safeguarding and payment rails usually saves months. Waiting until after authorisation often delays real go-live more than the regulator review itself.
Banks and EMIs typically ask for the same fundamentals the regulator tests: business model clarity, UBO transparency, AML controls, sanctions governance, target markets and realistic transaction flows.
Where the CASP safeguards client assets or handles fiat interfaces, counterparties often ask for deeper evidence on wallet governance, reconciliation, source-of-funds controls and client-money logic.
Some crypto-fiat models create overlap with EMI, PI or payment-services questions. A MiCA licence is not a substitute for every fiat-facing permission that may be required.
A jurisdiction that looks fast on paper can become expensive if local or cross-border banking remains weak. In practice, bankability is often one of the decisive factors in home-state selection.
The real MiCA process starts before filing. Most delays come from weak perimeter analysis, incomplete governance design, poor outsourcing logic, or a dossier that looks assembled rather than operationally coherent.
Define exactly which MiCA services are triggered, whether any token may be a financial instrument under MiFID II, whether issuer rules also apply, and whether the model includes custody, platform operation, advice, placement or transfer services.
Choose the home state based on regulator style, language, banking access, staffing reality, transition status and target-market fit. In many cases, a pre-application discussion materially improves the filing strategy.
Incorporate the legal entity, define shareholder and UBO structure, appoint directors and control functions, and establish the governance map the regulator will expect to see in practice.
Evidence the required capital, prepare the three-year financial forecast, explain revenue logic, stress assumptions and fixed overhead resilience, and align the funding plan with the actual launch model.
Prepare the programme of operations, business plan, AML/CFT framework, safeguarding model, outsourcing policy, ICT security package, complaints process, conflict controls, continuity planning and all shareholder and management files.
Submit the dossier to the home-state NCA. The authority first tests completeness. Under MiCA, the completeness check is generally up to 25 working days, but an incomplete file can reset momentum quickly.
The substantive assessment is generally around 40 working days, with possible extensions and practical delays where the NCA sends requests for information, asks for policy rewrites, interviews management or challenges outsourcing and safeguarding assumptions.
After authorisation, the firm can move to passporting notification and operational launch. Approval is not the same as readiness: banking, Travel Rule workflows, incident reporting and client-asset controls must still be live before onboarding customers.
Regulated United Europe OÜ (RUE) is a European legal consulting firm specializing in financial licensing, company formation, and regulatory compliance. Since 2016, we have helped hundreds of businesses obtain crypto, gambling, forex, and EMI/PSP licenses across 35+ jurisdictions.
With offices in four EU countries and a team of experienced lawyers, we provide end-to-end support — from initial consultation and company registration to license acquisition and ongoing compliance management.
500+
Clients Served
35+
Jurisdictions
Since 2016
Years in Business
4
EU Offices
Fully registered and regulated EU company with partnerships across major financial centers.
Our experts speak English, German, Russian, Chinese, and 12+ other languages for global client support.
From company registration to license acquisition and compliance — we handle the entire process end-to-end.
Personal consultant assigned to each client. Direct communication channels, no call centers.
MiCA jurisdiction choice should never be made on tax alone. For crypto businesses, tax outcome, management location, local office logic, transfer pricing, VAT exposure and banking reality must be assessed together.
A low-tax or low-cost structure without defensible management and operational substance can fail under both regulatory and tax scrutiny. For MiCA businesses, substance is not only a tax issue; it is also a licensing credibility issue.
A lower headline tax rate may look attractive, but it can be outweighed by higher staffing costs, slower regulator interaction, weaker bankability or heavier local operating requirements.
If strategic decisions are taken outside the claimed home state, the tax and regulatory narrative can diverge. MiCA filings should be aligned with where the business is genuinely directed and controlled.
Some business models create VAT, payment-services or e-money questions alongside MiCA. Tax planning should therefore be coordinated with product qualification, not done afterwards.
Where a MiCA entity sits inside a wider group, regulators and tax authorities may both ask what functions are really performed locally and what is outsourced to affiliates.
A MiCA business should plan accounting, recordkeeping and auditability from day one. Weak finance infrastructure often becomes visible during prudential review and later during supervisory reporting.
The right comparison is the three-year operating outcome across tax, staffing, compliance, banking and expansion cost, not the cheapest incorporation package.
MiCA applies where a legal or natural person provides regulated crypto-asset services professionally in the EU. Typical in-scope firms include exchanges, brokers, custodians, trading platforms, order-routing businesses, transfer service providers, crypto advisers and crypto portfolio managers. One company often needs authorisation for multiple services because the commercial model combines exchange, custody, order execution and transfer functions.
MiCA does not apply to everything labelled “crypto”. Crypto-assets that qualify as financial instruments remain outside MiCA and inside the MiFID II perimeter. Central bank-issued assets are outside MiCA. Some NFTs may fall outside where they are genuinely unique and non-fungible, but fractionalisation, series issuance or economic standardisation can move them back toward regulation. DeFi is not automatically exempt either: where there is an identifiable operator, front-end control, governance concentration or fee-taking intermediary layer, regulators may still find a regulated person in the structure.
The practical test is not branding but function. If your platform controls private keys, executes client instructions, routes orders, matches buyers and sellers, or markets crypto-asset services into the EU, you should assume a perimeter analysis is required. RUE usually treats token qualification and service mapping as the first workstream before any home-state filing strategy is chosen.
Related reading: MiCA regulation for crypto asset service provider (CASP), MiCA regulation for Tokens, MiCA regulation for Non-Fungible Token (NFT), MiCA regulation for Decentralised Finance.
RUE helps crypto businesses structure MiCA authorisation from perimeter analysis to filing, regulator Q&A, banking coordination and post-approval compliance design. We work across licensing, AML/CFT, GDPR, corporate setup, accounting and high-risk banking support in Europe.
Our specialists will analyze your specific case, recommend the optimal jurisdiction and license type, and provide a detailed roadmap with timeline and costs.