MiCA Compliance Checklist 2026: What Crypto-Asset Service Providers Must Have in Place Now

The short answer: since 1 July 2026, any firm providing crypto-asset services to clients in the EU needs a MiCA authorisation, or (for certain already-regulated financial entities) a completed MiCA notification. The transitional period under Article 143(3) of Regulation (EU) 2023/1114 has ended in every member state, and there is no extension clause.

To stay compliant, a crypto-asset service provider (CASP) must meet the authorisation conditions in Title V of MiCA and keep meeting them. That means capital, governance, client protection, custody, complaints, conflicts, outsourcing, wind-down planning and market abuse controls, all evidenced and ready for supervisory review.

This guide sets out what that involves, article by article, written from an IT audit perspective. It is the checklist we would use if we were testing your MiCA programme ourselves.

What is MiCA and who does it apply to?

MiCA is the EU Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. It is a regulation, not a directive, so it applies directly in every member state without national transposition.

It became applicable in two stages:

• 30 June 2024: Titles III and IV, covering asset-referenced tokens (ARTs) and e-money tokens (EMTs).
• 30 December 2024: everything else, including the CASP regime in Title V.

MiCA covers three broad groups:

1. Issuers and offerors of crypto-assets, including ARTs and EMTs (Titles II to IV).
2. Crypto-asset service providers (Title V), the focus of this guide.
3. Anyone whose conduct touches the market, through the market abuse rules in Title VI.

Tokens that qualify as financial instruments under MiFID II sit outside MiCA (Article 2(4)). Classify each token before you decide which rulebook applies.

Is the MiCA transitional period over?

Yes. Article 143(3) allowed CASPs already providing services under national law before 30 December 2024 to continue until 1 July 2026, or until they were granted or refused MiCA authorisation, whichever came sooner.

Member states could shorten that window, and several did. But 1 July 2026 was the absolute outer limit.

ESMA set out its expectations in two statements:

• 17 April 2026: a statement on the end of the transitional periods, calling for credible, executable wind-down plans from firms not on track for authorisation.
• 23 June 2026: a public statement calling on unauthorised CASPs to wind down their EU activities in an orderly way while safeguarding clients.

What ESMA expects from unauthorised firms

Under the June statement, an unauthorised CASP must:

1. Immediately stop onboarding new EU clients and stop marketing and solicitation.
2. Limit services to what is needed to sell or transfer crypto-assets, reallocate assets or close positions.
3. Keep custody only for the period strictly necessary to complete an orderly exit.
4. Communicate clearly, promptly and repeatedly with clients, including a deadline after which residual positions close automatically.
5. Maintain full AML/CFT controls throughout the wind-down, including sanctions screening and travel rule obligations.

ESMA also reminded firms outside the EU that they cannot serve or solicit EU clients, including business-to-business, and that custody cannot be delegated to an entity that is not an authorised CASP.

⚠️ If you serve EU clients today without MiCA authorisation or a valid Article 60 notification, this is no longer a readiness question. It is a live regulatory breach.

Which crypto-asset services need authorisation?

MiCA defines ten crypto-asset services. Each has its own conduct article in Title V, Chapter 3:

1. Custody and administration of crypto-assets on behalf of clients (Article 75)
2. Operation of a trading platform for crypto-assets (Article 76)
3. Exchange of crypto-assets for funds (Article 77)
4. Exchange of crypto-assets for other crypto-assets (Article 77)
5. Execution of orders for crypto-assets on behalf of clients (Article 78)
6. Placing of crypto-assets (Article 79)
7. Reception and transmission of orders on behalf of clients (Article 80)
8. Providing advice on crypto-assets (Article 81)
9. Providing portfolio management on crypto-assets (Article 81)
10. Providing transfer services for crypto-assets on behalf of clients (Article 82)

Authorisation is granted per service. If you add a service later, you must extend your authorisation first.

Authorisation route: Article 59 or Article 60?

There are two ways into the regime, and choosing the wrong one wastes months.

Route 1: full CASP authorisation (Articles 59, 62 and 63). For firms not already authorised as one of the financial entities listed in Article 60. You apply to the competent authority in your home member state.

Route 2: notification for already-regulated entities (Article 60). Credit institutions, central securities depositories, investment firms, e-money institutions, UCITS management companies, AIFMs and market operators can provide certain crypto-asset services by notifying their home regulator at least 40 working days before starting.

The Article 60 scope is limited to services equivalent to what each entity is already authorised for. For example, an e-money institution may only provide custody and transfer services for the e-money tokens it issues.

How long does MiCA authorisation take?

Article 63 sets the statutory clock:

• 5 working days: the authority acknowledges receipt.
• 25 working days: the authority checks the application is complete.
• 40 working days from a complete application: the authority assesses it and decides.
• The authority can pause the 40-day clock once, for up to 20 working days, to request more information.

In practice, preparation takes far longer than the review. The fastest applications are the ones where every policy is already evidenced, not just drafted.

The content of the application is specified in Commission Delegated Regulation (EU) 2025/305, and the forms and templates in Commission Implementing Regulation (EU) 2025/413. Use those, not a generic template.

The MiCA compliance checklist for CASPs

This is the core of the guide. Each item maps to an article in Title V, Chapter 2 (obligations for all CASPs) or Chapter 3 (service-specific obligations).

1. Registered office and substance (Article 59)

• A registered office in an EU member state where at least part of the crypto-asset services are carried out.
• Place of effective management in the EU.
• At least one director resident in the EU.

Regulators are testing substance, not letterheads. Expect questions about where decisions are really made and by whom.

2. Prudential safeguards (Article 67 and Annex IV)

Your prudential safeguards must at all times be at least the higher of:

• the permanent minimum capital in Annex IV, or
• one quarter of your fixed overheads for the preceding year, reviewed annually.

Safeguards can be own funds, a qualifying insurance policy, or a combination. If you use insurance, Article 67 sets minimum policy terms and the risks that must be covered, and the policy must be disclosed on your website.

• Capital class confirmed against your full service list.
• Fixed overhead calculation documented and reviewed annually.
• Insurance terms checked line by line against Article 67, if used.

3. Governance and fit and proper (Article 68)

• Management body members of sufficiently good repute, with the knowledge, skills and experience to do the job, and enough time to commit.
• Shareholders with qualifying holdings of sufficiently good repute.
• Policies and procedures effective enough to ensure compliance with MiCA.
• A business continuity policy, including ICT business continuity and disaster recovery plans.
• Record-keeping for all crypto-asset services, orders and transactions.

ESMA and EBA joint guidelines set out how regulators assess suitability of the management body and qualifying shareholders. Map every director against them before you submit.

4. Acting honestly and informing clients (Articles 66 and 69)

• Clear, fair and not misleading information to clients and in marketing.
• Warnings on the risks of crypto-asset transactions.
• Public disclosure of pricing, costs and fees.
• Disclosure of the principal adverse environmental and climate-related impacts of the consensus mechanisms behind the crypto-assets you serve.

5. Safekeeping of client assets and funds (Article 70)

• Arrangements to safeguard client ownership rights, especially in insolvency.
• No use of client crypto-assets for your own account.
• Client funds (other than EMTs) placed with a credit institution or central bank by the end of the next business day.
• Client funds held in accounts separately identifiable from your own.

6. Complaints handling (Article 71)

• Effective, transparent complaint procedures, published and free of charge.
• A complaint template for clients, and a record of every complaint and the action taken.
• Timely, fair investigation, with outcomes communicated within a reasonable period.

7. Conflicts of interest (Article 72)

• A policy to identify, prevent, manage and disclose conflicts.
• Prominent public disclosure of the general nature and sources of conflicts.
• Assessment and review of the policy at least annually.

8. Outsourcing (Article 73)

• You remain fully responsible for outsourced functions.
• Outsourcing does not change your relationship with or obligations to clients.
• A written agreement for each arrangement, with access and audit rights.

This is where MiCA overlaps heavily with DORA. See the DORA section below.

9. Orderly wind-down (Article 74)

• A wind-down plan appropriate to your business, covering continuity or recovery of critical activities.
• Evidence the plan can be executed without undue economic harm to clients.

After ESMA's 2026 statements, expect supervisors to test that your plan works in practice, not just that it exists. Triggers, owners and a client communication script are the minimum.

10. Service-specific obligations (Articles 75 to 82)

Only the articles for your authorised services apply. The heaviest are:

• Custody (Article 75): a client agreement, a custody policy, a register of positions per client, at least quarterly statements of position, segregation of client assets, and liability for losses from incidents attributable to you, capped at the market value of the assets lost.
• Trading platforms (Article 76): clear, non-discriminatory operating rules, pre and post-trade transparency, market abuse surveillance, and no dealing on own account on the platform you operate.
• Exchange (Article 77): a non-discriminatory commercial policy and published firm quotes or pricing methodology.
• Execution (Article 78): a best execution policy and the steps to deliver it.
• Advice and portfolio management (Article 81): a suitability assessment, competent staff, and periodic client reports.
• Transfer services (Article 82): a client agreement setting out how transfers work, fees and conditions.

Market abuse controls (Title VI)

Title VI applies to crypto-assets admitted, or requested to be admitted, to trading on a trading platform. Anyone professionally arranging or executing transactions must have effective arrangements to prevent and detect market abuse (Article 92).

• Surveillance systems to detect insider dealing and market manipulation.
• A process to report suspicious orders and transactions to the competent authority without delay.
• Controls over inside information, including insider lists where relevant.

MiCA does not stand alone: DORA, AML and the travel rule

A MiCA authorisation is necessary but not sufficient. Several adjacent regimes apply at the same time.

• DORA. MiCA-authorised CASPs are financial entities under the Digital Operational Resilience Act (Regulation (EU) 2022/2554). That brings ICT risk management, major incident reporting, resilience testing, third-party risk and the register of information. Our DORA guide covers each obligation.
• Anti-money laundering. CASPs are obliged entities under EU AML rules. Article 63 lets the authority consult AML supervisors before deciding, so weak AML controls can block authorisation outright.
• The travel rule. The recast Transfer of Funds Regulation (Regulation (EU) 2023/1113) has applied since 30 December 2024. Originator and beneficiary information must travel with crypto-asset transfers, with specific rules for self-hosted wallets.
• Data protection. KYC data, wallet addresses linked to individuals and transaction histories are personal data. See our GDPR compliance checklist.

Passporting across the EU (Article 65)

Once authorised, you can provide your authorised services in other member states. You notify your home authority of the member states and services concerned, and it forwards that to the host authorities and ESMA.

You may begin in the host state once the home authority has communicated the notification, or at the latest 15 calendar days after you submitted it. There is no separate host licence.

Reverse solicitation (Article 61) is narrow. It only covers services provided at the exclusive own initiative of an EU client, and ESMA's guidelines interpret it strictly. Do not build a business model on it.

Who will supervise you? The ESMA supervision proposal

Today, national competent authorities authorise and supervise CASPs. That may change.

• 4 December 2025: the Commission proposed a market integration and supervision package that would move authorisation and supervision of all CASPs to ESMA.
• 9 October 2026: the Council agreed key elements of its position. Only the most significant cross-border CASPs would immediately become subject to ESMA supervision, replacing the Commission's blanket approach, with a two-year transition for transferring supervisory tasks.

Nothing is law yet. The Council position still has to be negotiated with the European Parliament, and the significance criteria have not been published.

The practical takeaway: build your controls and evidence so they survive a change of supervisor. Contracts and policies should refer to "the competent authority", not a named national regulator.

Significant CASPs today (Article 85)

Under the current text, a CASP is significant if it has at least 15 million active users in the EU on average over a calendar year.

• Monitor your active user count against the threshold.
• Notify your competent authority within two months of reaching it.

MiCA penalties: what is at stake?

Article 111 sets minimum maximums. Member states can go higher, and many have. For legal persons:

Authorities can also fine at least twice the profit gained or loss avoided, issue public statements, order the conduct to stop, and ban members of the management body from management functions.

Decisions are generally published, so the reputational cost often exceeds the fine.

Common MiCA compliance pitfalls

These are the findings we would expect to raise in a MiCA audit:

1. Policies without evidence. A conflicts policy never reviewed, or a complaints log with no entries, tells a supervisor the control is not operating.
2. Wrong capital class. Adding custody or a swap feature moves you from Class 1 to Class 2, and many firms miss it.
3. Treating DORA as a separate project. MiCA's continuity and outsourcing rules and DORA's ICT obligations are tested together. Duplicated, inconsistent documents are a red flag.
4. Paper substance. A nominee director and a mailbox office will not survive the Article 59 substance test.
5. Wind-down plans that cannot be executed. No triggers, no owners and no client script means the plan is not operational.
6. Relying on reverse solicitation. Any marketing aimed at EU clients undermines it.
7. Unauthorised custody partners. Delegating custody to a firm that is not an authorised CASP is not permitted.
8. Stale authorisation scope. Launching a new service before extending your authorisation is a breach from day one.

A realistic MiCA timeline

For a firm starting from a reasonable base, a workable plan looks like this:

1. Weeks 1 to 4: scoping. Confirm services, capital class, home member state and route (Article 59 or 60). Run a gap assessment against Title V.
2. Weeks 5 to 16: build. Draft and approve every policy, the programme of operations, ICT documentation, the AML framework and the wind-down plan. Assemble fit and proper files.
3. Weeks 17 to 20: evidence and dry run. Test that controls operate. Run an internal audit or mock review of the full application pack.
4. Submission onwards: statutory review. Up to 25 working days for completeness, then up to 40 working days for the decision, plus any clock stop.

Costs vary widely with business model and member state. The main drivers are regulatory capital or insurance, legal and advisory fees, key hires in compliance, risk and AML, and the tooling to keep evidence current after authorisation.

📌 Authorisation is the start, not the finish. Every policy you submit becomes a control your supervisor can test.

How RegentComply helps

RegentComply runs MiCA readiness as a structured project. Each Title V obligation becomes a tracked task with an owner, a due date and attached evidence, and recurring rules handle annual conflicts reviews, overhead recalculations and policy refreshes so nothing silently lapses.

Because DORA, NIS2, ISO 27001 and GDPR live in the same workspace, you evidence overlapping controls once and map them across frameworks.

👉 See how it works for your MiCA programme: Request a demo

MiCA FAQ

Do I need a MiCA licence to serve EU customers?

Yes, if you provide any of the ten crypto-asset services to clients in the EU. Since 1 July 2026 you need either MiCA authorisation under Article 59 or, if you are an eligible regulated entity, a completed Article 60 notification.

When did the MiCA transitional period end?

The outer limit was 1 July 2026 under Article 143(3). Some member states set shorter periods, so certain firms lost grandfathering earlier.

What happens to crypto firms that missed the MiCA deadline?

ESMA expects them to stop onboarding EU clients and marketing immediately, limit services to an orderly exit, and keep clients informed with clear deadlines. National authorities can take coordinated enforcement action.

How much capital does a CASP need under MiCA?

At least the higher of the Annex IV minimum (EUR 50,000, EUR 125,000 or EUR 150,000 depending on services) and one quarter of the previous year's fixed overheads.

How long does it take to get MiCA authorisation?

The statutory review is up to 25 working days for completeness and 40 working days for the decision, with one possible pause of up to 20 working days. Preparation usually takes several months before that.

Can a MiCA licence be passported?

Yes. Under Article 65 an authorised CASP can provide its authorised services across the EU after notifying its home authority. Services can start once the notification is communicated, or at the latest 15 calendar days after submission.

Will ESMA supervise crypto firms directly?

Possibly, for the largest. The Commission proposed ESMA supervision of all CASPs, but the Council's October 2026 position limits immediate ESMA supervision to the most significant cross-border CASPs. The final scope depends on negotiations with the European Parliament.

Does DORA apply to crypto-asset service providers?

Yes. MiCA-authorised CASPs are financial entities under DORA, so ICT risk management, incident reporting, resilience testing and third-party risk rules apply alongside MiCA.

What are the penalties for breaching MiCA?

For legal persons breaching CASP obligations, maximum fines must be at least EUR 5 million or 5% of total annual turnover. Market abuse infringements carry at least EUR 15 million or 15%. Member states may set higher amounts.

Official sources

• Regulation (EU) 2023/1114 (MiCA), EUR-Lex
• ESMA: MiCA hub and interim register
• ESMA statement on the end of transitional periods (17 April 2026)
• ESMA public statement on orderly wind-down of unauthorised CASPs (June 2026), via AMF
• Council of the EU press release, 9 October 2026
• Commission Delegated Regulation (EU) 2025/305

This guide is general information, not legal advice. Confirm national implementation details, including penalty levels and any additional requirements, with your competent authority.