MiCA Explained: EU Crypto Licensing Guide

MiCA, or the Markets in Crypto-Assets Regulation, is the European Union's unified framework for crypto regulation. It replaces individual national rules with a single set of standards across all 27 EU member states. Here's what you need to know:

• Purpose: Protect investors, prevent fraud, ensure financial stability (especially for stablecoins), and create clear rules for crypto businesses.
• Key Features:
  • Passporting: A single MiCA license allows businesses to operate across the EU.
  • Who’s Covered: Crypto-asset service providers (CASPs) like exchanges, custodians, and token issuers.
  • Asset Categories: Covers stablecoins (E-Money Tokens and Asset-Referenced Tokens), utility tokens, and others.
• Deadlines:
  • June 30, 2024: Stablecoin rules take effect.
  • December 30, 2024: Full MiCA framework applies to CASPs.
  • July 1, 2026: Final transition deadline for existing businesses.
• Penalties: Non-compliance can lead to fines up to €5 million or 12.5% of annual turnover, license revocations, and bans.

MiCA simplifies operations for crypto firms while enforcing stricter compliance standards. Businesses must secure a license, meet capital requirements, and follow rules on transparency and risk management. Missing deadlines or failing to comply could mean losing access to the EU market.

Activities and Assets Regulated Under MiCA

MiCA establishes rules for the issuance, public offering, trading, custody, exchange, and portfolio management of crypto-assets. These regulations outline the types of assets and actors that fall under its jurisdiction.

To avoid conflicts with existing regulations, MiCA excludes certain asset types. For example, crypto-assets classified as financial instruments under MiFID II - like derivatives or securities - are not covered. Similarly, deposits and pension products remain outside MiCA's scope. However, NFTs issued in large quantities or resembling regulated financial assets may still be subject to MiCA.

Crypto Businesses Required to Comply

MiCA specifies which crypto businesses must adhere to its framework. Crypto-asset service providers (CASPs) are a key focus. These entities must be legally established within an EU member state, with their main management located in the EU. The regulated activities include:

• Custody and administration of crypto-assets
• Operating trading platforms
• Exchange services (crypto-to-fiat or crypto-to-crypto)
• Order execution for clients
• Placement of tokens with specific buyers
• Acting as brokers (receiving and transmitting orders)
• Providing advice and portfolio management
• Transfer services

In addition, issuers of crypto-assets, particularly those creating stablecoins, must meet specific authorization requirements. CASPs with 15 million or more annual active EU users are classified as "significant" and face stricter regulatory oversight.

Crypto Asset Categories Covered

MiCA also organizes crypto-assets into distinct categories based on how their value is stabilized.

• E-Money Tokens (EMTs): These tokens are tied to a single official currency, functioning similarly to electronic money. Only authorized credit or electronic money institutions can issue EMTs.
• Asset-Referenced Tokens (ARTs): These tokens derive their stability from a mix of currencies, commodities, or other assets. Issuers must maintain a reserve of assets and hold at least $380,000 (€350,000) or 2% of the average reserve assets as own funds.
• "Other" Crypto-assets: This catch-all category includes tokens that don’t fall under EMT or ART definitions, such as utility tokens providing access to specific goods or services.

In December 2023, Société Générale became the first major bank to list a stablecoin (EUR CoinVertible) under MiCA's framework on the Bitstamp exchange in Luxembourg.

Asset Category	Stabilization Mechanism	Key Requirement
E-Money Tokens (EMT)	Single official currency	Must be an authorized credit or e-money institution
Asset-Referenced Tokens (ART)	Basket of currencies, commodities, or other assets	Requires prior authorization and a reserve of assets
Utility Tokens	Provides access to specific goods or services	Must publish a white paper
Other Crypto-assets	Market-driven	General transparency and disclosure requirements

The European Banking Authority (EBA) oversees "significant" ARTs and EMTs - those exceeding thresholds for holders, market capitalization, or transaction volume. Meanwhile, smaller issuers are monitored by national authorities. Understanding these categories is crucial for navigating the licensing and capital requirements discussed later.

sbb-itb-0796ce6

MiCA Licensing Requirements and Process

This section breaks down the steps and criteria for firms aiming to comply with MiCA regulations.

To secure a MiCA license, companies must first establish a legal entity within the EU. This includes having a physical office and local management in place. Additionally, firms need to implement systems for AML/KYC compliance, cybersecurity aligned with DORA standards, and internal audits.

Once the application is complete - containing a business plan, financial forecasts, risk management policies, and evidence of management's qualifications - National Competent Authorities (NCAs) review it within 25 working days and make a decision within an additional 40 working days. However, in reality, the process often spans six to 12 months.

"A MiCA license is the formal authorization issued under the EU's Markets in Crypto-Assets Regulation... It is a single, harmonized license across Europe. Instead of requiring separate approvals in each country, a single MiCA authorization covers the entire EU market."
– AMLBot

Operating without a MiCA license can result in fines of up to $5.4M (≈€5M) or 12.5% of annual turnover. Over 1,200 Virtual Asset Service Providers in the EU are expected to transition to the new CASP framework. Importantly, policies must reflect actual business operations rather than relying on generic templates.

Who Needs a MiCA License

Understanding who needs a MiCA license is just as crucial as knowing the application process.

Any company offering crypto-asset services to clients in the EU must obtain a MiCA license. This applies to businesses engaged in activities like custody and administration, operating trading platforms, providing exchange services (crypto-to-fiat or crypto-to-crypto), executing orders, token placement, brokerage, advisory services, portfolio management, and transfer services. The key factor is whether your business activities fall under MiCA Article 3 and actively target EU clients.

Providers already registered under national AML regulations may have a transitional "grandfathering" period until July 1, 2026, depending on their member state. After this date, a full MiCA license will be required for cross-border operations. Small CASPs with annual revenue below $163,000 (≈€150,000) from crypto-asset services face geographic restrictions and cannot use EU passporting rights.

Capital Requirements

The capital requirements for MiCA licensing are based on the type of services offered. These minimum amounts are divided into three tiers:

• $54,000 (≈€50,000) for advisory services like portfolio management and order transmission.
• $136,000 (≈€125,000) for operating a trading platform.
• $163,000 (≈€150,000) for higher-risk services such as custody, exchange operations, and order execution.

Service Type	Minimum Capital Requirement
Advisory and Order Transmission	$54,000 (≈€50,000)
Operating a Trading Platform	$136,000 (≈€125,000)
Custody and Exchange Services	$163,000 (≈€150,000)

These amounts represent the greater of either the permanent minimum capital requirement or one-quarter of the firm’s fixed overheads from the previous year. Companies must maintain this capital continuously, using equity, retained earnings, or high-quality capital instruments. If a firm offers multiple services, it must meet the highest applicable capital threshold.

EU Passporting Rights

A MiCA license provides passporting rights across all 27 EU member states. This allows firms to operate within a unified market without needing separate national licenses. With this single authorization, businesses gain access to a market of over 450 million people, replacing the fragmented system of national registrations.

"A single license passports you across the EU, replacing the costly maze of local approvals."
– BeVerified

Once authorized by its home-state regulator, the firm is listed in ESMA's central register, making it easier for other member states to recognize the license. ESMA maintains an interim MiCA register, updated weekly, which will be fully integrated into its systems by mid-2026.

Choosing the right "home" member state is critical, as this regulator will handle the passporting process. Firms should avoid relying on "reverse solicitation" as a workaround, as this narrow exception prohibits active marketing or EU-language websites without proper licensing.

These licensing and passporting provisions aim to streamline operations and ensure consistent compliance under MiCA regulations.

Compliance and Operational Obligations

Once CASPs secure their MiCA license, they face rigorous operational standards aimed at maintaining transparency and accountability. These obligations cover areas like protecting client assets, meeting disclosure requirements, and managing internal risks. It’s not just about getting licensed - it’s about running a compliant and trustworthy operation every day.

White Paper Disclosure Requirements

Issuers of crypto-assets must publish a white paper detailing crucial information such as issuer credentials, project specifics, underlying technology, associated risks, and the environmental footprint of the consensus mechanism used . Starting December 23, 2025, all white papers must adhere to the iXBRL standard for machine-readability and better market comparison. Additionally, issuers are required to notify the relevant National Competent Authority at least 20 working days before publication .

Accountability is key - issuers and their management are legally responsible for any inaccuracies, misleading claims, or unfair information in the white paper. For certain crypto-assets, these documents must also include a disclaimer clarifying that no EU authority has approved the content and that the issuer is solely responsible for it.

Customer Protection and Transparency

CASPs are obligated to act with integrity, fairness, and professionalism, always prioritizing their clients' interests. A major part of this is ensuring that client funds are kept entirely separate from the provider's own assets. The use of client assets for any provider-related purposes is strictly forbidden.

Transparency is also a cornerstone of these rules. CASPs must clearly display all costs, fees, and pricing policies on their websites, along with clear warnings about the risks associated with crypto-asset transactions. Additionally, they are required to disclose the environmental and climate impact of the consensus mechanisms they use. For retail clients, a withdrawal period is typically available after purchases, and providers are required to establish fair and efficient processes for handling client complaints .

Risk Management and Governance

MiCA demands robust governance structures from CASPs, including well-defined organizational hierarchies and clear responsibilities. Management teams must pass "fit and proper" assessments, include at least one director residing in the EU, and operate under a dual-management structure.

Risk management and compliance functions must be independent and supported by a staffing plan that avoids overburdening any single individual with multiple critical roles. Shareholders holding 10% or more of the company are also subject to background checks to confirm their financial stability and good character.

CASPs are expected to develop internal policies tailored to their specific operations, covering areas like AML/CFT, conflict of interest management, ICT security, and complaint handling - generic templates won’t cut it. They must also maintain a plan for orderly wind-downs and align their ICT risk management practices with the Digital Operational Resilience Act (DORA), which came into effect in early 2025 .

"MiCA is Europe's RSVP to crypto companies: 'Bring capital, controls and clarity - or stay home.'"
– BeVerified

MiCA Implementation Timeline and Transitional Rules

MiCA is rolling out in phases, giving businesses time to adjust. For crypto service providers operating in or aiming to enter the EU market, keeping track of these deadlines is crucial. Missing a key date could mean losing the legal right to operate.

Implementation Phases

MiCA officially came into force in June 2023, but its requirements are being introduced gradually. The first major date was June 30, 2024, when regulations for stablecoins - specifically Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs) - took effect. The next significant milestone is December 30, 2024, when the full framework for Crypto-Asset Service Providers (CASPs) and other crypto assets becomes applicable.

Additional technical standards will continue to roll out over time. For instance, by December 23, 2025, token issuers must submit white papers formatted in iXBRL, ensuring machine-readability. Trading platforms will need to provide order book data in a standardized JSON format starting in May 2026, six months after the technical specifications are finalized. Further ahead, the European Single Access Point (ESAP) will require MiCA-related public information submissions beginning January 10, 2030.

Date	Milestone	Affected Entities
June 30, 2024	Stablecoin rules apply	ART and EMT issuers
December 30, 2024	Full MiCA application	All CASPs and token issuers
December 23, 2025	White paper iXBRL format required	All token issuers
May 2026	JSON order book data requests begin	Trading platforms
July 1, 2026	Final transition deadline	All CASPs (end of grandfathering)

These milestones are accompanied by transitional rules to guide existing providers through the shift to MiCA compliance.

Transitional Arrangements

To ease the transition from national to EU-wide regulations, MiCA includes specific transitional measures. Providers already operating before December 30, 2024, can continue their services under a "grandfathering" clause for up to 18 months, ending on July 1, 2026. During this period, they must secure MiCA authorization to continue operating. If authorization is denied, the grace period ends immediately.

Some countries have set shorter transitional deadlines. For instance:

• The Netherlands: by July 1, 2025
• Germany and Austria: by December 31, 2025
• Italy: by December 30, 2025

Meanwhile, countries like France, Malta, Luxembourg, and Estonia allow the full 18-month period, extending to July 1, 2026.

However, the grandfathering clause comes with limitations - providers operating under national rules cannot offer services across the EU. To gain EU-wide passporting rights and serve all 27 member states, firms must achieve full MiCA authorization.

Some member states offer a simplified authorization process for businesses already licensed under national laws. This streamlined approach, available between December 30, 2024, and July 1, 2026, aims to reduce the administrative workload for companies transitioning to MiCA compliance. However, not all member states have adopted this option.

Penalties for Non-Compliance

Operating in the EU without a MiCA license comes with steep financial and operational consequences. Providers who fail to meet MiCA's strict compliance and operational requirements face significant repercussions. By November 2025, total MiCA-related penalties had already reached approximately $540 million, with projections suggesting this figure could surpass $1.2 billion by the end of the year.

The financial penalties alone are daunting. Companies can be fined a minimum of $5,000,000 or 3% to 12.5% of their annual turnover, depending on the severity of the violation. In cases involving market abuse, fines can climb to as much as three times the illicit profit. Individual executives are not exempt, facing personal fines ranging from $700,000 to $1,000,000.

But the penalties don’t stop at monetary fines. Regulators have the authority to revoke licenses, issue public cease-and-desist orders, ban individuals from holding management roles, or even impose complete service bans. By February 2025, over 50 crypto firms had their licenses revoked, primarily due to failures in meeting reserve requirements or adhering to AML/KYC standards. To add to the pressure, ESMA maintains a public register of non-compliant entities, updated weekly, which serves as a warning to consumers and business partners alike.

France has been particularly aggressive in enforcing MiCA. In November 2025, its financial regulator fined a single crypto exchange $62 million for failing to meet transparency and security requirements. Together, France and Germany accounted for more than 60% of all MiCA compliance penalties issued by mid-2025. Even firms operating under transitional grandfathering rules were given strict 90-day deadlines to achieve compliance or face immediate operational bans.

"The ability to impose monetary sanctions as a multiple of the profits gained or losses avoided has the potential for very large fines, as does the potential for fines up to 12.5% or 15% of annual turnover."

– KPMG Law LLP

As MiCA enforcement ramps up, understanding these penalties is crucial for firms navigating this highly regulated environment.

Conclusion

MiCA brings together 27 national frameworks into a single, unified rulebook, offering a one-license system that grants access to a market of 450 million consumers. For crypto-asset service providers, authorization in any EU member state now unlocks passporting rights across the entire Union. These sweeping changes make immediate compliance not just advisable but necessary.

MiCA isn't just about opening doors to the EU market; it also sets a regulatory foundation that demands attention. As Laura Hinds aptly put it:

"MiCA sets a regulatory baseline that cannot be ignored. With full enforcement underway since December 2024 and over €540 million in penalties already issued, understanding your obligations isn't optional. It's essential for survival".

The stakes couldn’t be higher. Losing access to the EU market means forfeiting a projected €1.8 trillion opportunity.

To stay ahead, businesses need to act now. Start by conducting a gap analysis to measure your current operations against MiCA’s requirements for capital, governance, and transparency. Firms operating under national grandfathering provisions must ensure their MiCA license applications are submitted well before the July 1, 2026 deadline to avoid operational disruptions. Compliance also means updating white papers, segregating assets, and meeting all disclosure standards. Taking these steps now is crucial for maintaining operations in an environment where regulations are becoming stricter.

Regulators are clear: meet MiCA’s standards or risk being shut out of the EU market. As the BeVerified Editorial Team succinctly noted:

"MiCA is Europe's RSVP to crypto companies: 'Bring capital, controls and clarity - or stay home'".

Failing to comply doesn’t just mean fines - it jeopardizes a firm's ability to operate in one of the most lucrative crypto markets in the world.

Understanding MiCA is more than just avoiding penalties. It’s about positioning your business for long-term success in a regulatory landscape that increasingly resembles traditional finance. By aligning with MiCA’s standards, companies not only avoid risks but also set themselves up for growth in a unified market. The firms that adapt now will be the ones that flourish.

FAQs

Does MiCA apply to non-EU crypto companies serving EU users?

Yes, MiCA is mainly focused on regulating crypto companies based in the EU. However, it also extends to non-EU companies that offer services to EU residents. These businesses may need to meet certain licensing and transparency requirements if they engage with users within the EU. This approach helps create uniform regulatory standards for all entities interacting with the EU market.

How do I choose the best EU country to apply for a MiCA license?

When deciding on the best EU country for obtaining a MiCA license, it's important to weigh several factors. Start by looking at regulatory clarity, as some countries have more straightforward processes than others. Licensing costs can also vary widely, so understanding the financial requirements upfront is key. Additionally, the reputation of the regulatory authority plays a role in ensuring smooth interactions and trustworthiness.

Countries like Germany, Malta, and Spain are known for their well-established licensing frameworks. Beyond regulations, think about the local workforce's expertise in blockchain and crypto, as this can support your operations. Check for crypto-friendly policies and evaluate whether the jurisdiction aligns with your broader business goals, including access to EU passporting rights, which allow you to operate across the EU once licensed.

Ultimately, choosing a country with clear and efficient regulations can make the licensing and compliance process much more manageable.

What does MiCA mean for crypto payment providers in the EU?

MiCA, or Markets in Crypto-Assets Regulation, establishes a standardized regulatory framework for crypto payment providers within the EU. This regulation requires providers to obtain licenses, adhere to transparency guidelines, and comply with risk disclosure rules. These measures are designed to safeguard consumers and uphold market integrity.

Under MiCA, providers must meet stringent AML (Anti-Money Laundering) and data protection requirements. Non-compliance can result in supervision and penalties, ensuring accountability across the industry. Set to take effect in December 2024, MiCA's goal is to create a safer and more transparent crypto environment throughout the EU.

Related Blog Posts

• Gemini & Coinbase gear up for EU-wide MiCA licenses - What it means
• New MiCA Regulations 2025 - How They Affect Crypto Purchases
• 5 Key Points About EU Crypto Regulations
• EU Crypto Regulations: Impact on Cross-Border Payments