MiCA Regulation

MiCA is EU Regulation 2023/1114, published in the Official Journal of the European Union on June 9, 2023 and fully applicable from December 30, 2024. It is the first comprehensive EU-level framework governing the issuance and trading of crypto-assets, the operation of crypto-asset service providers, and the public offering of asset-referenced and e-money tokens.

Before MiCA, crypto regulation in the EU was fragmented: national regimes varied widely in scope, authorization requirements, and enforcement intensity. Some member states operated VASP registration frameworks aligned with FATF standards; others had minimal dedicated crypto rules. MiCA replaced this patchwork with a single harmonized framework that operates directly in each member state without requiring national transposition.

The core outputs of MiCA authorization are passportability and credibility. A CASP authorization issued by one national competent authority (NCA) gives the holder the right to provide the authorized services across all 27 EU member states and the European Economic Area, without requiring separate authorization in each country. That single-authorization passport is the primary commercial reason most crypto businesses pursue MiCA licensing. See crypto licensing in Europe for a full jurisdictional overview.

The full MiCA text is available at EUR-Lex: EU Regulation 2023/1114.

MiCA was adopted by the European Parliament on April 20, 2023 and entered into force on June 29, 2023, twenty days after publication in the Official Journal. Application was phased:

June 30, 2024: Titles III and IV of MiCA took effect, covering asset-referenced token (ART) issuers and e-money token (EMT) issuers. Stablecoin issuers operating in the EU were required to comply with authorization, reserve, and disclosure requirements from this date.

December 30, 2024: The full MiCA framework became applicable, covering all crypto-asset service providers (CASPs) and crypto-asset issuers making public offerings. This is the date from which operating as a CASP in the EU without authorization became a regulatory infringement.

Grandfathering period: Member states were permitted to allow VASPs already registered under national law before December 30, 2024 to continue operating for up to 18 months from that date, subject to national discretion. The maximum grandfathering period runs to July 1, 2026. After that date, all CASPs operating in the EU must hold a valid MiCA authorization regardless of prior national registration status.

The grandfathering window has largely closed for planning purposes. Businesses that had not applied before mid-2025 face a narrow timeline to achieve authorization before enforcement becomes universal.

MiCA defines its scope precisely. The distinction between in-scope and out-of-scope matters because it determines whether a business requires CASP authorization, token issuance authorization, or neither.

In scope

• Stablecoin issuers: Issuers of asset-referenced tokens (ARTs), which maintain stable value by referencing a basket of assets, fiat currencies, or commodities, and issuers of e-money tokens (EMTs), which maintain stable value by referencing a single fiat currency. Both categories carry authorization and reserve requirements under MiCA Titles III and IV;
• CASP operators: Any legal entity providing one or more of the regulated crypto-asset services defined in MiCA Article 3(1)(16), operating on a professional basis in or to EU clients. The full CASP service categories are covered in the next section;
• Crypto-asset issuers making public offerings: Projects issuing crypto-assets other than ARTs or EMTs and offering them to the public in the EU must publish a MiCA-compliant whitepaper and comply with the disclosure obligations in MiCA Title II.

Out of scope

• Fully decentralized DeFi protocols: Where no identifiable legal entity controls the protocol or provides services on the basis of that protocol, MiCA does not apply. The decentralization threshold is not precisely defined in the regulation, and ESMA has acknowledged that most DeFi protocols have some degree of centralized governance that may bring them within scope. Each DeFi project requires legal analysis against its specific architecture;
• Most NFT platforms: MiCA excludes unique and non-fungible crypto-assets from its scope where they are not interchangeable. However, fractional NFT collections, large-batch NFT issuances, and NFT platforms that also custody or exchange fungible tokens may fall partially within scope;
• Central bank digital currencies (CBDCs): CBDCs issued by EU central banks are explicitly excluded;
• Financial instruments already regulated under MiFID II: Securities tokens and instruments that qualify as financial instruments under MiFID II are regulated under that framework, not MiCA. The boundaries between MiCA and MiFID II require careful analysis for tokenized securities and hybrid instruments.

MiCA authorization is activity-specific. A CASP holding authorization for one service category is not automatically authorized for others. A business operating across multiple categories must obtain authorization for each, and the authorization scope must match the actual services provided.

MiCA defines the following regulated CASP activities:

• Custody and administration of crypto-assets on behalf of clients;
• Operation of a trading platform for crypto-assets;
• Exchange of crypto-assets for fiat funds;
• Exchange of crypto-assets for other crypto-assets;
• Execution of orders for crypto-assets on behalf of clients;
• Placing of crypto-assets;
• Reception and transmission of orders for crypto-assets on behalf of clients;
• Providing advice on crypto-assets;
• Providing portfolio management of crypto-assets;
• Providing transfer services for crypto-assets to clients.

Passport-eligible activities: All ten CASP service categories are passport-eligible. Authorization in one EU member state covers provision of the same authorized services across all 27 member states and the EEA, subject to standard passporting notification to the host NCA.

Activities that may trigger dual licensing: Transfer services and the placing of crypto-assets can overlap with payment services regulated under PSD2. Businesses whose crypto transfer architecture involves the movement of fiat funds, the initiation of payment transactions, or the holding of client fiat balances may require an Electronic Money Institution (EMI) or Payment Institution (PI) authorization in addition to their CASP license. The dual-licensing question is business-model-specific and should be analyzed before application.

The table below reflects the implementation status and relative positioning of key member states as of early 2026. ESMA maintains the public register of authorized CASPs at esma.europa.eu.

Which EU member states have issued the most CASP authorizations

Lithuania has processed the highest volumes of CASP applications in the early phases of MiCA implementation, reflecting its established fintech licensing infrastructure and English-language regulatory engagement. Germany, France, and the Netherlands follow in terms of institutional application volumes. Malta and Cyprus attract mid-size operators with established legal service ecosystems. Czech Republic and Estonia are gaining ground among early-stage applicants for whom operational cost and regulatory accessibility are primary selection criteria.

The optimal jurisdiction for any specific applicant depends on business model, target markets, operational footprint, and banking requirements. LegalBison conducts jurisdiction assessments as the first step in every CASP engagement. See crypto licensing in Europe for full jurisdiction-by-jurisdiction analysis.