Skip to main content
Regulation

Markets in Crypto-Assets (MiCA)

MiCA is Regulation (EU) 2023/1114. Full application began on 30 December 2024 and the EU-wide transitional period expired on 1 July 2026, so there is now no grandfathering anywhere in the EEA. Around 325 crypto-asset service providers are authorised. Not one asset-referenced token issuer appears on ESMA's register.

Checked by Remmert
8 min read

Is MiCA fully in force?

Yes. MiCA is Regulation (EU) 2023/1114. Titles III and IV applied from 30 June 2024 and the rest from 30 December 2024. The EU-wide transitional period under Article 143(3) expired on 1 July 2026, so there is no grandfathering anywhere in the EEA. Around 325 crypto-asset service providers are authorised. Not one asset-referenced token issuer appears on ESMA's register.

This is a page about which firms are still lawfully operating and which are not. See the other regulations we track for the same treatment of DORA and the EU AI Act.

Last updated: 17 August 2026. Checked against ESMA's interim MiCA register of 12 August 2026 and the ESMA statements on the end of the transitional periods.

At a glance

Official title

Regulation (EU) 2023/1114 on markets in crypto-assets

CELEX

32023R1114 · OJ L 150, 9.6.2023, p. 40

In force

29 June 2023

Applies from

Titles III and IV (ARTs, EMTs): 30 June 2024 · everything else: 30 December 2024

Dutch implementation

Uitvoeringswet verordening cryptoactiva, Stb. 2024, 415, in force 4 February 2025 · Uitvoeringsbesluit MiCA en TFR, Stb. 2024, 404

Dutch transition ended

30 June 2025, the shortest window any Member State chose

EU transition ended

1 July 2026

Supervisors (NL)

AFM authorises CASPs and handles Article 60 notifications, and does conduct and integrity supervision. DNB does prudential supervision, qualifying holdings, and supervises ART and EMT issuers

Minimum capital

€50,000 / €125,000 / €150,000 by service class, or one quarter of the preceding year's fixed overheads, whichever is higher (Art. 67, Annex IV)

The transition is over. What does that mean today?

Article 143(3) let entities lawfully providing crypto-asset services under national law before 30 December 2024 continue until 1 July 2026, or until authorisation was granted or refused, whichever came sooner. Member States could shorten it. Six did, to six months. Seventeen used the full eighteen.

LengthMember StatesEnded

6 months

Latvia, Hungary, Netherlands, Poland, Slovenia, Finland

30 June 2025

9 months

Sweden

~30 September 2025

12 months

Germany, Ireland, Lithuania, Austria, Slovakia, Norway

30 December 2025

18 months (full)

Belgium, Bulgaria, Czechia, Denmark, Estonia, Greece, Spain, France, Croatia, Italy, Cyprus, Luxembourg, Malta, Portugal, Romania, Iceland, Liechtenstein

1 July 2026

The Dutch window closed on 30 June 2025: thirteen months before the EU backstop. Any Dutch-registered legacy provider operating without a licence has been unlawful since 1 July 2025, not since six weeks ago.

There is no bridge for a pending application. Article 143(3) grants cover only until the deadline. It does not extend for pendency.

ESMA's public statement of 23 June 2026 sets the expectation for anyone caught out. Unauthorised providers must immediately stop onboarding new EU clients and cease marketing. Permitted activity is limited to letting existing clients sell, transfer out or close positions, with temporary custody during an orderly wind-down. AML and CFT obligations (customer due diligence, transaction monitoring, sanctions screening) continue throughout. And ESMA is explicit that clients of unauthorised providers "do not benefit from MiCA safeguards, including protections for client assets."

National authorities have been blunter still. The AMF notes that unauthorised provision in France carries two years' imprisonment and a €30,000 fine, and that it may publish blacklists and block websites.

Who needs a licence, and who does not?

MiCA regulates ten services. Which route you take depends on what licence you already hold.

The ten crypto-asset services (Art. 3(1)(16), Annex I). Custody and administration, operation of a trading platform, exchange for funds, exchange for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management, transfer services.

The Article 60 notification route

Already-authorised entities do not need a fresh CASP authorisation. They notify.

Existing licenceServices on notification

Credit institution

All ten

Investment firm (MiFID II)

Services equivalent to the investment services it is specifically authorised for

Electronic money institution

Custody and administration, and transfer services: only for the e-money tokens it itself issues

UCITS management company / AIFM

Reception and transmission of orders, advice, portfolio management

Market operator (MiFID II)

Operation of a trading platform for crypto-assets

Central securities depository

Custody and administration only

Lead time: notify at least 40 working days before providing the service for the first time. The authority has 20 working days to assess completeness. If incomplete it must inform you immediately and set a deadline of no more than 20 working days, during which the period is suspended. You may not start while the notification is incomplete.

For comparison, a full CASP authorisation runs 25 working days for the completeness check plus 40 working days for substantive assessment. The AFM's published expectation is at least five months in the best case, and typically longer.

What is outside MiCA

Article 2 excludes intragroup-only providers, liquidators and insolvency administrators, central banks acting as monetary authorities, and public international organisations. Article 2(3) excludes crypto-assets that are unique and not fungible with other crypto-assets. Article 2(4) excludes assets qualifying as MiFID II financial instruments, deposits, funds other than EMTs, securitisation positions, insurance and reinsurance contracts, pension products and social security schemes.

What does MiCA require?

Five obligation families. The first is the gate: since 1 July 2026 there is no grandfathering anywhere in the EEA, so the rest only apply to a firm that holds the licence.

  • Arts. 59, 63, 65

    CASP authorisation and passporting

    Who must hold a CASP licence, what the Article 63 clock actually runs to, and what a passport notification does and does not buy. The transitional period expired on 1 July 2026, so this is the gate everything else sits behind.

  • Art. 67, Annex IV

    Own funds and prudential floors

    Own funds are the higher of the Annex IV amount for your service class or one quarter of the preceding year's fixed overheads. For a scaled operation the overheads test is the binding one, and mixed classes take the highest single amount rather than the sum.

  • Art. 70

    Client funds and asset protection

    Client funds other than e-money tokens go to a credit institution or a central bank by the close of the business day following receipt, in an account separately identifiable from the firm's own. E-money institutions, payment institutions and credit institutions are exempt from those paragraphs.

  • Arts. 66 to 74

    Conduct, complaints and wind-down

    Acting honestly, fairly and professionally, plus complaints handling under Article 71, conflicts of interest under Article 72, and the orderly wind-down plan under Article 74 that the summer of 2026 turned into a live document.

  • Arts. 16, 17, 48

    Issuing an ART or an EMT

    An ART needs a dedicated authorisation under Article 16, except for credit institutions, which take the Article 17 white-paper route. An EMT may be issued only by a credit institution or an electronic money institution, and in the Netherlands the issuer notifies DNB under Article 48(6) before issuing.

The dates

2024

  1. 30 December 2024Passed

    MiCA fully applies; the Transfer of Funds Regulation travel rule applies to CASPs

2025

  1. 17 January 2025Passed

    DORA applies: CASPs and ART issuers are financial entities under Art. 2(1)(f) DORA

  2. 30 June 2025Passed

    Netherlands transitional period ends

  3. 23 December 2025Passed

    Machine-readable (iXBRL) white paper format mandatory

2026

  1. 2 March 2026Passed

    EBA no-action forbearance ends: authorities may enforce PSD2 authorisation on CASPs providing EMT transfer services

  2. 1 July 2026Passed

    EU-wide grandfathering backstop expires

  3. 31 August 2026Passed

    MiCA review consultation closes

2027

  1. 30 June 2027Upcoming

    Commission final report under Art. 140, covering DeFi, third-country equivalence, thresholds and consensus-mechanism environmental impact

  2. 10 July 2027Upcoming

    AMLR applies: CASPs become obliged entities under the single AML rulebook

  3. 31 December 2027Upcoming

    Art. 143(2): trading platform operators must ensure compliant white papers exist for legacy crypto-assets admitted to trading before 30 December 2024

Stablecoins: the numbers nobody quotes

Who may issue what. An EMT references the value of one official currency and may be issued only by a credit institution or an electronic money institution: there is no standalone stablecoin licence, and in the Netherlands the issuer must notify DNB under Article 48(6) before issuing. An ART references a basket or a non-currency value and requires a dedicated authorisation under Article 16, except for credit institutions, which take the Article 17 white-paper approval route.

Three thresholds for ART and EMT issuers

Each carries its own article and its own consequence for crossing it.

  • Art. 35

    Own funds for ART issuers

    The highest of €350,000, 2% of the average reserve of assets over the preceding six months, or 25% of the preceding year's fixed overheads. The authority may require up to 20% more on risk grounds, and 20% to 40% more following stress testing.

  • Art. 43 (ARTs), Art. 56 (EMTs)

    Significance

    Designation follows from meeting at least three of seven criteria. The headline three: more than 10 million holders, more than €5 billion in issued value, market capitalisation or reserve size, and more than 2.5 million transactions and €500 million per day. On the EBA's final classification decision, supervisory powers transfer from the national authority to the EBA within 20 working days.

  • Art. 23, applied to EMTs by Art. 58(3)

    The non-euro cap

    Where a token references a non-EU official currency and is used widely as a means of exchange, once the estimated quarterly average of daily transactions within a single currency area exceeds 1 million transactions and €200 million, the issuer must cease issuing and submit a remediation plan within 40 working days.

Differences by country

TopicNetherlandsGermanyFranceMalta

Transition ended

30 Jun 2025

30 Dec 2025

1 Jul 2026

1 Jul 2026

Authorising authority

AFM

BaFin

AMF

MFSA

Prudential authority

DNB

BaFin

ACPR/AMF

MFSA

Authorised CASPs (mid-Aug 2026)

~28-29

~70

~34

~22

Two Dutch specifics.

The twin-peaks split is carried straight over. The AFM handles CASP licence applications under Article 63 and Article 60 notifications, plus conduct and integrity supervision. That is what DNB itself calls the lion's share of regular supervision. DNB handles prudential supervision of CASPs, assessment of qualifying holdings, and supervision of ART and EMT issuers. Applications go through Cryptshare, the AFM acknowledges within 5 working days, missing-information requests give 5 to 20 working days, and there are usually one to three supervisory meetings.

Poland is the outlier worth knowing about. ESMA's list records Poland at six months, but Poland never enacted its Crypto-Asset Market Act (the President vetoed it a second time in February 2026), so no competent authority was designated and applications cannot be processed. Polish firms must license in another Member State and passport in.

What recently changed

23 June 2026: ESMA called on unauthorised providers to wind down, in a public statement relayed by national authorities including the MFSA and the CSSF. An earlier statement in April 2026 required authorities to verify wind-down plans and take action against unauthorised provision.

June 2026: the Commission opened the MiCA review consultation, with responses due 31 August 2026. Its scope is unusually wide: scope and definitions, crypto-asset classification, Title II transparency and issuer liability, ART and EMT prudential and reserve requirements, redemption rights, significance criteria, multi-issuance models, the CASP framework, and matters currently outside MiCA altogether: DeFi, staking, lending, NFTs, prediction markets and tokenised deposits.

4 December 2025: the Commission proposed moving CASP supervision to ESMA. The Market Integration and Supervision Package, COM(2025) 943, would transfer authorisation, ongoing supervision and enforcement of CASPs from national authorities to ESMA. For already-regulated entities, crypto-asset services count as the main activity where more than 50% of total turnover over two consecutive years comes from them. Crossing that threshold transfers supervision, with banks excepted. The ECB backed it in Opinion CON/2026/13 on 9 April 2026 and ESMA welcomed it. It remains in the ordinary legislative procedure with no adoption or application date fixed.

October 2025: the ESRB asked the Commission to declare third-country multi-issuer stablecoin schemes impermissible. Recommendation ESRB/2025/9 found that MiCA "does not explicitly envisage the joint issuance" of fungible stablecoins by an EU entity and a third-country partner with reserves split across jurisdictions. The Commission did not issue the clarification in the form requested. The question has instead been folded into the June 2026 review consultation. As at 17 August 2026 the legality of these schemes under MiCA remains formally unresolved.

10 July 2025: ESMA's fast-track peer review of Malta. The MFSA was found to be fully meeting expectations on supervisory settings and resources, but only partially meeting expectations on the authorisation process itself: insufficient assessment of business growth plans, inadequate examination of conflicts of interest, weak governance and intragroup review, insufficient scrutiny of ICT infrastructure and custody risk, and material issues left unresolved at the point of authorisation, including pending enforcement cases. ESMA urged all national authorities to conduct forward-looking business-plan assessments and prioritise ICT security before authorising.

16 September 2025: the AFM's first MiCA enforcement entry. MEXC Global was placed on ESMA's non-compliant entities register for providing crypto-asset services in the Netherlands without a licence, with a public consumer warning on 24 September.

What can GenCompl.ai do for you?

Our pipeline tracks MiCA's Level 2 and Level 3 measures, ESMA's registers and the national authorisation positions, and derives which route a given entity actually needs (full authorisation under Article 63, notification under Article 60, or neither) from the licences it already holds and the services it wants to offer. Each conclusion carries its article, its source and the date it was last recalculated.

Book a working session

Questions and answers

Can a Dutch bank offer crypto custody without a separate CASP licence?

Yes. A credit institution authorised under Directive 2013/36/EU may provide all ten crypto-asset services, including custody and administration, on notification under Article 60(1): no separate CASP authorisation. The notification goes to the AFM at least 40 working days before you first provide the service. The AFM has 20 working days to assess completeness, and you may not start while the notification is incomplete. Form and content follow the RTS and ITS under Article 60(13) and (14), applying since 12 March 2025. The bank still falls within MiCA's Title V conduct rules for the services it provides, and DNB retains prudential supervision.

Can an e-money institution offer crypto custody on notification?

Only within a narrow box. Article 60(4) lets an EMI provide custody and administration and transfer services on notification, but only in relation to the e-money tokens it itself issues. Custody of bitcoin, ether or a third party's EMTs falls outside that box and needs a full CASP authorisation. This is the most common misreading of the Article 60 table.

What happened to firms that were still under the transitional regime on 1 July 2026?

Their cover ended, with no extension for a pending application. From 1 July 2026, providing crypto-asset services to EU clients without a MiCA licence breaches EU law. ESMA requires such firms to immediately stop onboarding new EU clients and stop marketing, and to limit activity to letting existing clients sell, transfer out or close positions, with temporary custody during an orderly wind-down and full AML and CFT compliance throughout. Their clients do not benefit from MiCA client-asset protections. In the Netherlands the position is older still: the Dutch window closed on 30 June 2025.

Who can issue a euro stablecoin in the EU?

Only a credit institution or an electronic money institution. An e-money token is defined in Article 3(1)(7) as referencing the value of one official currency, and Article 48 restricts issuance to those two. There is no standalone stablecoin licence. In the Netherlands the issuer must notify DNB before issuing under Article 48(6). An asset-referenced token, referencing a basket or a non-currency value, needs a dedicated authorisation under Article 16, and not a single ART issuer appears on ESMA's register as at 12 August 2026.

Do I need a MiCA licence to run a DeFi protocol?

Probably not if the service is genuinely provided in a fully decentralised manner without any intermediary, but state that carefully. The carve-out lives in recital 22, not in any operative article, and no paragraph of Article 2 mentions DeFi. A recital guides interpretation. It confers no exemption. In practice authorities look for an identifiable person exercising control: front-end operation, fee capture, admin keys, governance control, order matching. Anyone in that position will be treated as providing a crypto-asset service. DeFi is expressly on the table in the Commission's 2026 review consultation and in the Article 140 report due 30 June 2027.

Is my NFT project in scope?

Only if the tokens are not genuinely unique and non-fungible. Article 2(3) excludes crypto-assets that are unique and not fungible with other crypto-assets, and the test is substance-based. Large series issued as de facto interchangeable units, fractionalised NFTs, and NFTs conferring financial rights can fall inside MiCA, or outside MiCA and inside MiFID II, if they meet the financial-instrument criteria in ESMA's guidelines of 19 March 2025, which apply a substance-over-form test. Run that test before concluding you are out of scope.

Which Dutch regulator authorises a CASP?

The AFM. It handles licence applications under Article 63, Article 60 notifications, and conduct and integrity supervision. DNB handles prudential supervision of CASPs, assessment of qualifying holdings in CASPs, and supervision of ART and EMT issuers. Applications go through Cryptshare and take at least five months in the best case.

Is a MiCA licence all I need, or does DORA apply too?

DORA applies too, and has since 17 January 2025. CASPs authorised under MiCA and issuers of asset-referenced tokens are financial entities under Article 2(1)(f) of Regulation (EU) 2022/2554, so ICT risk management, incident reporting, resilience testing and third-party contractual requirements all bite. Separately, the Transfer of Funds Regulation (EU) 2023/1113 travel rule has applied to CASPs since 30 December 2024, and the AMLR brings CASPs into the single AML rulebook from 10 July 2027. See DORA for the same treatment of that regime.

Can I still rely on reverse solicitation to serve EU clients from outside the EU?

Barely. ESMA's guidelines of 26 February 2025 read Article 61 as a narrow, exceptional carve-out that cannot be used to circumvent MiCA. Any solicitation, advertising or promotion aimed at EU clients, including through websites, influencers, sponsorships or app-store targeting, destroys it. And the exemption covers only the specific crypto-asset or service the client initiated, not the relationship as a whole.

Will ESMA take over supervising my CASP licence?

It is proposed but not law. The Commission's Market Integration and Supervision Package of 4 December 2025 would move authorisation, ongoing supervision and enforcement of CASPs from national authorities to ESMA, with a test of more than 50% of turnover over two consecutive years determining when crypto is an already-regulated entity's main activity, banks excepted, plus a transitional period covering existing licences and pending applications. The ECB backed it in April 2026 and ESMA welcomed it. It remains in the ordinary legislative procedure with no adoption or application date.

Glossary

  • Credit institution (MiCA)

    A credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 and authorised under Directive 2013/36/EU. The AMLR defines the same term differently.

  • Competent authority (MiCA)

    One or more competent authorities designated by a Member State in accordance with Article 93 of Regulation (EU) 2023/1114; the European Central Bank (ECB) when acting in accordance with Council Regulation (EU) No 1024/2013; or the national competent authority appointed under sectoral legislation where applicable. DORA defines the same term differently.

  • Management body (MiCA)

    The body or bodies of an issuer, of an offeror or person seeking admission to trading, or of a crypto-asset service provider, which are appointed in accordance with national law, which are empowered to set the entity’s strategy, objectives and overall direction, and which oversee and monitor management decision-making, and include the persons who effectively direct the business of the entity. The AMLR defines the same term differently.

  • Crypto-asset service provider (MiCA)

    A legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59 of Regulation (EU) 2023/1114. The AMLR defines the same term differently.

  • Crypto-asset

    A digital representation of a value or of a right that is able to be transferred and stored electronically, using distributed ledger technology or similar technology. The AMLR defines the same term differently.

  • Execution of orders for crypto-assets on behalf of clients

    The conclusion of agreements to buy or to sell one or more crypto-assets or to subscribe for one or more crypto-assets on behalf of clients and includes the conclusion of contracts to sell crypto-assets at the moment of their offer to the public or admission to trading.

  • Exchange of crypto-assets for other crypto-assets

    The conclusion of purchase or sale contracts concerning crypto-assets with clients for other crypto-assets by using proprietary capital.

  • Exchange of crypto-assets for funds

    The conclusion of purchase or sale contracts concerning crypto-assets with clients for funds by using proprietary capital.

  • Operation of a trading platform for crypto-assets

    The management of one or more multilateral systems, which bring together or facilitate the bringing together of multiple third-party buying and selling interests in crypto-assets, in the system and in accordance with its rules, in a way that results in a contract, either by exchanging crypto-assets for funds or by the exchange of crypto-assets for other crypto-assets.

  • Providing custody and administration of crypto-assets on behalf of clients

    The safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys.