Any firm that wants to offer crypto-asset services in the European Union, such as holding clients' crypto, running an exchange, executing orders or giving advice, needs a licence under the Markets in Crypto-Assets Regulation (MiCA). The regulation lists what the application must contain. It says far less about how to get a business ready to meet those requirements, and that preparation is where most applications succeed or stall.

With the transitional period now closed across the Union, national authorities are working through a large queue of applications, and the first wave of authorizations has produced real practical experience. This article draws four lessons from it.

Lesson One: Define the Licence Before Building the Application

Every other part of a MiCA application depends on one question: which crypto-asset services, exactly, will the firm provide? MiCA defines ten distinct services.1 Each comes with its own conduct rules, and together they determine how much capital the firm must hold. That question has to be answered first, and answered precisely.

The answer is rarely obvious from a product description. A product that a business team calls "a wallet with a swap feature" may involve several regulated services at once. The quickest way to find out is to walk through each feature and ask a few direct questions:

  • Who controls the private keys? If the firm holds or controls clients' crypto-assets or the keys to them, that is custody and administration on behalf of clients.
  • Does the client trade with the firm itself? If the firm buys from or sells to the client using its own capital, that is exchange of crypto-assets for funds (euro or other money) or for other crypto-assets.
  • Does the firm match many buyers and sellers? Running a venue where third parties' orders meet is operation of a trading platform.
  • Does the firm pass orders on or carry them out? Forwarding a client's order to another venue is reception and transmission of orders; carrying it out on the client's behalf is execution of orders.
  • Does the firm move crypto between addresses for clients? That is transfer services.
  • Does the firm recommend or decide? Personal recommendations are advice; making investment decisions for a client under a mandate is portfolio management. Marketing crypto-assets for an issuer to investors is placing.

The service list drives the capital requirement. MiCA sorts crypto-asset service providers (CASPs) into three classes with minimum capital of EUR 50,000, EUR 125,000 or EUR 150,000.2 Advice, order handling, placing, transfers and portfolio management sit in the lowest class. Adding custody or exchange moves a firm into the middle class. Operating a trading platform puts it in the highest. In every case the firm must hold the higher of that minimum and one quarter of its previous year's fixed overheads.

It also matters what falls outside MiCA. Crypto-assets that qualify as financial instruments, for example tokens that carry the rights of a share or a bond, are regulated under the Markets in Financial Instruments Directive (MiFID II) instead. And certain firms that already hold a financial licence, such as banks and investment firms, can add crypto-asset services through a simpler notification under Article 60 rather than applying for a full CASP licence.3

For an operations team, the service list is the blueprint for everything that follows: the policies to write, the roles to fill, the systems to build and the controls to test. The application itself must include a programme of operations explaining, service by service, how each one will be provided.4 If the list is too narrow, the firm may discover after authorization that its product needs a service it does not hold, and must apply again to extend its licence. If the list is too broad, it takes on capital, staff and compliance obligations it does not need, and invites questions about services it cannot yet show working. Settle the service map before any other drafting begins.

Lesson Two: The Regulator Is a Counterpart, Not a Mailbox

Firms new to regulation sometimes treat the competent authority as a filing destination: the application goes in, questions come back, answers go out. That approach wastes the most useful resource in the process. Authorities exercise real judgement under MiCA. They decide whether an application is complete, how requirements apply to a firm of a particular size, what evidence is sufficient, and whether an unusual structure can work within the rules.

Much of that judgement can be understood before it is exercised, through early contact. Most authorities are willing to meet prospective applicants; it is worth asking how a particular authority prefers to handle it.

Where the rules leave room for flexibility, the authority is the one who grants it. MiCA expects requirements to be applied in proportion to the size and complexity of the firm, and an authority may accept, for example, a phased approach to certain hires or an outsourced internal audit function for a small firm. A firm that has explained its business clearly and early is in a much better position to ask for that than one raising the point in reply to a deficiency letter.

Authorities are also under pressure to be thorough. In January 2025, the European Securities and Markets Authority (ESMA) issued a supervisory briefing asking national authorities to treat no CASP as inherently low-risk, to check that key functions are genuinely carried out in the EU rather than run from elsewhere, and to test whether business plans are realistic, including a scenario in which revenue falls well short of projections.5 An authority working to that standard forms a view of an applicant from the first contact. Early dialogue gives the firm the chance to shape that view with accurate information, and to agree a working solution that meets the regulatory objective without forcing the business into a structure that does not fit it.

Lesson Three: Some Provisions Cannot Be Read Mechanically

Much of MiCA is precise. Some of it is not, and the imprecise parts tend to concern the people behind the firm. The clearest example is the suitability assessment of shareholders. Article 68 requires every shareholder with a qualifying holding (a direct or indirect stake of 10% or more, or one giving significant influence), whether held directly or through other companies, to be of sufficiently good repute, and allows the authority to refuse where their influence could be harmful to sound and prudent management of the firm.6

In plain terms, the authority wants to be satisfied that the people who own and control the firm are honest, financially sound and acquired their money legitimately. Applying that to a real ownership structure raises questions the regulation does not answer on its face. Consider a typical case: an EU operating company owned 60% by a holding company in another country, which is in turn owned by a trust set up for the founder's family. The authority will ask, at each layer, who owns it, who controls it, and where the money came from.

The joint guidelines of ESMA and the European Banking Authority (EBA) on suitability, published in June 2024, give useful direction on indirect holdings, acting in concert and significant influence.7 A separate delegated regulation sets out the information that must be provided about proposed holders.8 But neither can anticipate every structure, and both leave the final judgement to the authority.

The practical consequence is that these questions need a case-by-case assessment and an individual approach. A generic questionnaire completed mechanically tends to produce follow-up requests, and follow-up requests use up time the process does not have. The better course is to map the ownership structure early, identify the points on which the authority could reasonably take more than one view, prepare a reasoned position and supporting evidence on each, and raise the harder ones with the authority before filing. The same applies, to a lesser degree, to the members of the management body, whose knowledge, skills and experience must fit the services and scale of the business.

Lesson Four: Be Operationally Ready Before Filing

The single most common mistake is to treat the application as the start of preparation, on the assumption that gaps can be filled while the authority reviews the file. MiCA's procedure does not allow for that. The timetable is fixed by the regulation and runs like this:9

  • Within 5 working days of receiving the application, the authority acknowledges receipt.
  • Within 25 working days of receipt, it decides whether the application is complete. If documents are missing, it sets a deadline for the firm to provide them.
  • Within 40 working days of a complete application, it must reach a fully reasoned decision to grant or refuse.
  • During those 40 days, it may request further information. The clock stops while the firm answers, but only once and for no more than 20 working days.

Put together, a smooth application takes around four months from filing to decision. That timetable is set by law, not negotiated with the applicant, and it cannot be extended to suit a firm that is not ready. An applicant that cannot answer a request in full within the 20-day window, or that answers by describing arrangements still being built, gives the authority grounds to refuse. A refusal is more than a delay. It is a matter of record that the next authority, and future banking partners and counterparties, may ask about. ESMA's review of a CASP authorization in Malta also showed that an authorization granted while material issues remain open can be revisited later.10

Operational readiness means that on the day of filing, the business described in the application already exists. A practical way to test it is to go function by function:

  • People. The management body is appointed and its members are prepared for assessment. The firm has its place of effective management in the EU and at least one director resident there.11 Key staff are hired, not merely identified.
  • Governance and control functions. Compliance, risk management and internal audit are designed, staffed or contracted, with clear reporting lines to the board.
  • Information and communication technology (ICT) and security. Systems are built and documented to the standard of the Digital Operational Resilience Act (DORA), which applies to authorized CASPs: ICT risk management, incident reporting, resilience testing and oversight of technology suppliers.12
  • Anti-money laundering. Client onboarding and monitoring are working, including the "travel rule" for crypto transfers, which requires information on the sender and recipient to accompany each transfer.13
  • Client assets. Custody arrangements and the segregation of client assets from the firm's own are in place and tested.
  • Contracts and policies. Outsourcing agreements, complaints handling, conflicts of interest and business continuity policies are signed and approved, not drafts awaiting signature.
  • Business plan. Three-year projections are credible and include a downside scenario, with capital to cover it.

Each of these will be tested, and each takes longer to put in place than the 20 working days the process allows for an answer.

Practical Priorities for Applicants

  • Map the product to the rules first. Go feature by feature to determine which crypto-asset services the business provides, whether any activity falls under MiFID II or another regime, and whether the Article 60 notification route is available, before drafting any part of the application.
  • Build the business before filing. Treat the application as a description of an operating firm, not a plan for one. Appoint people, sign contracts, document systems and run the controls before the clock starts.
  • Plan for the information request. Assume at least one substantive request will arrive, name an owner for each part of the file, and organise the project so that any answer can be produced in full well inside 20 working days.
  • Write the business plan for the downside. Prepare credible projections, intermediate milestones and a scenario in which revenue falls well short, as authorities have been asked to expect.

Conclusion

MiCA's authorization process is demanding, but it is predictable once its logic is understood. It rewards work done in the right order: first the services, then an open dialogue with the authority, then careful preparation of the judgements the text leaves open, and only then the application, filed by a business that is ready to operate on the day it goes in. Firms that work this way do not avoid scrutiny. They are simply ready for it, and they reach a decision on the timetable the regulation sets, rather than a refusal or a second attempt.

References

  1. Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (MiCA), OJ L 150, 9 June 2023, p. 40, Article 3(1)(16) (definition of crypto-asset services).
  2. MiCA (n 1), Article 67 and Annex IV (minimum capital requirements by class of crypto-asset service).
  3. MiCA (n 1), Article 2(4) (exclusion of crypto-assets qualifying as financial instruments) and Article 60 (provision of crypto-asset services by certain financial entities).
  4. Commission Delegated Regulation (EU) 2025/305 of 31 October 2024 supplementing Regulation (EU) 2023/1114 with regard to regulatory technical standards specifying the information to be included in an application for authorisation as a crypto-asset service provider, OJ L, 2025/305, 31 March 2025; and Commission Implementing Regulation (EU) 2025/306 laying down standard forms, templates and procedures for such applications.
  5. ESMA, Supervisory Briefing on the authorisation of crypto-asset service providers under MiCA (ESMA75-453128700-1263, 31 January 2025).
  6. MiCA (n 1), Article 68 (governance arrangements), in particular paragraphs (2) and (3) on shareholders and members with qualifying holdings.
  7. Joint EBA and ESMA Guidelines on the suitability assessment of shareholders and members, whether direct or indirect, with qualifying holdings in issuers of asset-referenced tokens and in crypto-asset service providers, and on the suitability of members of the management body (published 27 June 2024), issued under Article 21(3) and Article 63(11) MiCA.
  8. Commission Delegated Regulation (EU) 2025/414 supplementing Regulation (EU) 2023/1114 with regard to regulatory technical standards specifying the detailed content of information necessary to carry out the assessment of a proposed acquisition of a qualifying holding in a crypto-asset service provider.
  9. MiCA (n 1), Article 63 (assessment of the application for authorisation and granting or refusal of authorisation).
  10. ESMA, "ESMA identifies opportunities to strengthen MiCA authorisations" (press release, 10 July 2025); ESMA, Fast-track peer review on [a CASP] authorisation and supervision in Malta (ESMA42-2004696504-8164, 10 July 2025).
  11. MiCA (n 1), Article 59(2).
  12. Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector (DORA), Article 2(1)(f).
  13. Regulation (EU) 2023/1113 of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets.

This article is provided for general information and does not constitute legal advice. Sources cited were current as at the date of writing; readers should verify the latest position before relying on it.