When the Markets in Crypto-Assets Regulation took full effect, it carried an unusually ambitious promise: a single, harmonized rulebook for crypto-assets across the European Union, and — for service providers — a passport. Authorize once with a national competent authority, and operate across all twenty-seven member states. For an industry that had spent a decade navigating a patchwork of incompatible national regimes, this was the headline attraction.

A year and a half into application, the promise is being tested. The passport works only if every national authority that can issue one applies the same standards — and the first year has shown how hard that is to guarantee. Meanwhile, the transitional arrangements that have allowed many existing firms to keep operating are running out. For crypto-asset firms and their advisers, 2026 is the year MiCA stops being a project and becomes a hard constraint. This article examines the two pressures now converging: the authorization cliff, and the supervisory-convergence problem beneath it.

The MiCA Bargain: A Single Rulebook and a Passport

MiCA — Regulation (EU) 2023/11141 — was built on a straightforward bargain. In exchange for a demanding set of authorization, governance, prudential, conduct, and disclosure requirements, a crypto-asset service provider (CASP) gains something genuinely valuable: market access across the entire bloc on a single license. The regulation applied in phases. Its rules for asset-referenced and e-money tokens — the stablecoin titles — became applicable in mid-2024; the broader regime governing CASPs and public offers of other crypto-assets followed at the end of December 2024.2

The passport is the centerpiece. But a passport issued in one member state and valid in all of them places enormous weight on the authorization decision. The national competent authority that grants a license is not merely admitting a firm to its own market; it is admitting that firm to the markets of every other member state. That gatekeeping role is the structural pressure point of the whole framework.

The Authorization Cliff

The most immediate issue is timing. MiCA's transitional regime allowed member states to let firms that were already operating legally under national rules before 30 December 2024 continue to do so — without full MiCA authorization — for a grandfathering period of up to eighteen months, with an absolute EU-wide long-stop of 1 July 2026.3 Crucially, member states could choose a shorter window, and many did.

The result is a staggered series of deadlines rather than a single one. The Netherlands ran a six-month window — one of the shortest, alongside Lithuania, Latvia, Hungary, Poland and Slovenia — and the AFM has been enforcing since 1 July 2025.4 For firms relying on grandfathering, this is a hard wall, not a soft target. A CASP that has not secured authorization — or at least a pending application — by the relevant national deadline must cease providing services in that market. After 1 July 2026, the transitional route disappears entirely.

Authorization, meanwhile, is not quick. It is a substantial process touching governance, capital, custody arrangements, conflicts management, ICT and operational resilience, and conduct. With more than 100 CASP authorizations on ESMA's MiCA register by mid-December 20255 and many more applications in the queue, firms that delayed face a genuine bottleneck — competing for finite supervisory attention against a fixed deadline. The practical risk is not only refusal; it is a firm running out of runway before a decision is reached.

A Passport Is Only as Strong as the Gatekeeper Who Issued It

The deeper issue is consistency. If the passport is to mean anything, the authorization standard behind it must be the same in Valletta as in Amsterdam. The first year suggests that cannot yet be assumed.

In April 2025, ESMA's Board of Supervisors took the notable step of launching a peer review into the authorization and early supervision of a single CASP by one national authority — the Malta Financial Services Authority.6 ESMA published an executive summary of that review in July 2025. Its conclusions were carefully balanced: ESMA found that MFSA had built a good level of expertise in the sector and had sufficient supervisory resources for CASP authorisations and supervision. But on the specific authorization examined, it was found only to have "partially met expectations."7 The review urged the authority to revisit material issues that had been pending, or inadequately considered, at the point of authorization.

The significance is not the verdict on one regulator. It is what the exercise signals. ESMA was explicit that, although the review targeted one authority, its purpose was to foster convergence across all of them — at a moment when consistency in authorization standards is, in ESMA's words, key. Behind that lies a concern the industry has discussed openly: that divergent national speed and rigor create regulatory arbitrage, an incentive for firms to seek out the most accommodating gatekeeper. A passport obtained through the path of least resistance is a passport that invites later scrutiny.

What the Peer Review Tells Applicants

For firms preparing applications, the peer review is best read as free guidance. ESMA pointed CASPs toward particular areas of risk that authorities should probe hard and applicants should therefore be ready to address: business growth, conflicts of interest, governance arrangements, intragroup structures, ICT architecture, and Web3 and decentralised products (including the promotion of unregulated services).8

The practical inference is twofold. First, a thin or rushed application is now more likely to be tested — and an authorization granted on a thin file is more likely to be revisited. Second, a MiCA license should not be treated as a settled asset. ESMA's willingness to look behind an individual authorization means that firms, and acquirers conducting diligence on licensed targets, should satisfy themselves that the authorization rests on substance, not on the speed of the issuing authority.

The Perimeter and the Gaps

Two further features shape the 2026 picture. The first concerns reach. Third-country firms cannot serve EU clients on the strength of a non-EU registration; they must establish an EU entity and obtain MiCA authorization. The narrow "reverse solicitation" exemption — where a client approaches the firm entirely on its own initiative — is exactly that: narrow, and the subject of ESMA guidance designed to keep it so.9 It is not a workable basis for an ongoing EU business.

The second concerns gaps. MiCA's promise of harmonization depends on every member state building the national infrastructure to implement it. Where that has stalled — Poland, where the President first vetoed the national MiCA-implementing legislation on 1 December 2025 (the Sejm re-passing it on 19 December 2025, with further veto activity reported in early 2026) — firms can find themselves in a regulatory vacuum despite the regulation being directly applicable.10 And MiCA's scope itself has edges: crypto-assets that qualify as financial instruments under MiFID II fall outside it, as, in large part, do genuinely unique and non-fungible assets.11 Characterization questions at those boundaries remain live legal risk.

What This Means for Choosing a Jurisdiction

MiCA was intended to make the choice of where to authorize unimportant — a single market should mean the door is the same everywhere. In practice, for now, the choice matters, and it is a legal-strategic decision rather than an administrative one. The fastest or most accommodating jurisdiction is not necessarily the safest: an authorization that attracts convergence scrutiny, or that rests on issues a peer review would flag, carries a downstream cost that can outweigh a quicker grant. The better question is not "where can we be authorized soonest?" but "where will our authorization still look robust in three years?"

Practical Priorities for Crypto-Asset Firms

  • Treat the transitional deadline as fixed. Identify the exact national grandfathering date that applies to each market you operate in, and work back from it; do not plan around the 1 July 2026 long-stop if your member state chose a shorter window.
  • Build the application on substance. Anticipate close scrutiny of business growth, conflicts of interest, governance, intragroup arrangements, ICT architecture, and Web3/decentralised offerings — the areas ESMA has flagged — and document them properly.
  • Choose the authorizing jurisdiction strategically. Weigh the durability of an authorization, not just the speed of the grant; a license that invites later reassessment is a poor bargain.
  • Do not rely on reverse solicitation. For any ongoing EU-facing business, treat establishment and authorization as the only viable route.
  • Map your perimeter. Confirm whether each token or service falls inside MiCA, outside it as a MiFID instrument, or into a national gap, and resolve characterization questions before they become enforcement questions.
  • Diligence licensed targets carefully. On any acquisition of an authorized CASP, test whether the authorization rests on a sound file — a passport is only as strong as the review behind it.

Conclusion

MiCA's single market is real in law, but in its first year and a half it has been uneven in practice. Two forces now meet in 2026: a transitional cliff that removes the grandfathering route, and a supervisory-convergence effort, signaled clearly by ESMA's first peer review, that is steadily raising the bar behind every authorization. For crypto-asset firms, the implication is the same on both fronts — the authorization is the moment that matters, and it rewards substance over speed. The firms that come through 2026 in the strongest position will be those that treated their MiCA license not as a hurdle to clear quickly, but as a credential that has to withstand scrutiny long after it is granted.

References

  1. Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (MiCA), OJ L 150, 9 June 2023, p. 40.
  2. MiCA (n 1), Titles III and IV (asset-referenced tokens and e-money tokens, applicable from 30 June 2024) and the provisions governing crypto-asset service providers and public offers of other crypto-assets (applicable from 30 December 2024); see Dechert, "Application of the Second Part of MiCA — Regulation of CASPs and Other Public Offering of Crypto-Assets" (8 January 2025).
  3. MiCA (n 1), Article 143 (transitional measures); see also Hogan Lovells, "MICA CASP authorisations: ESMA recommendations in peer review report" (21 July 2025), on the eighteen-month grandfathering period and Member States' discretion to adopt a shorter window.
  4. ESMA, List of grandfathering periods under Article 143(3) of MiCA; AFM press release announcing supervision of CASPs from 1 July 2025.
  5. ESMA, MiCA register of authorised CASPs (as at mid-December 2025).
  6. European Securities and Markets Authority, "ESMA identifies opportunities to strengthen MiCA authorisations" (press release, 10 July 2025); and ESMA, Fast-track peer review on [a CASP] authorisation and supervision in Malta (ESMA42-2004696504-8164, 10 July 2025).
  7. ESMA, Fast-track peer review (n 6); see also Hogan Lovells, "MICA CASP authorisations" (n 3).
  8. ESMA, Fast-track peer review (n 6), identifying areas of risk warranting particular attention in CASP authorisation and supervision, including business growth, conflicts of interest, governance, intragroup arrangements, ICT architecture, and Web3 and decentralised products (including the promotion of unregulated services).
  9. MiCA (n 1), provisions on the authorisation of crypto-asset service providers and the limited "reverse solicitation" exemption; see ESMA, Final Report on Guidelines on reverse solicitation under MiCA (ESMA35-1872330276-1899, 17 December 2024), and the Guidelines themselves (ESMA35-1872330276-2030).
  10. Polish Sejm record on the Crypto-Assets Market Act; reporting in Notes from Poland, "Polish president vetoes law regulating crypto-assets market" (1 December 2025); CoinDesk, "Poland's Lower House Approves Crypto Law Again, Sends Vetoed Bill Back to Senate" (19 December 2025).
  11. MiCA (n 1), Article 2 (scope), which excludes from its scope crypto-assets qualifying as financial instruments under MiFID II and, in large part, crypto-assets that are unique and not fungible.

This article is provided for general information and does not constitute legal advice. Sources cited were current as at the date of writing; readers should verify the latest position before relying on it.