MiCA Regulation Tracker

The MiCA regulation defines its scope precisely. The distinction decides whether a business needs CASP authorization, token issuance authorization, or neither. Licensing depth lives on the MiCA license hub; this tracker keeps only the boundary lines.

In scope sit ART and EMT issuers under Titles III and IV, any legal entity providing one or more regulated crypto-asset services on a professional basis to EU clients, and issuers offering crypto-assets other than ARTs or EMTs to the public in the EU, who must publish a MiCA-compliant white paper under Title II.

Out of scope sit fully decentralized protocols with no identifiable legal entity providing services, unique and non-fungible assets that are genuinely not interchangeable, central bank digital currencies issued by EU central banks, and instruments that qualify as financial instruments, which stay under MiFID II. The edges need care: fractional NFT collections, large-batch issuances, and NFT platforms that also custody or exchange fungible tokens can fall partly in scope, and most DeFi protocols have enough centralized governance to require a legal analysis of their architecture.

Authorization is activity-specific. A CASP authorized for one service is not automatically authorized for others, and the scope must match the actual services provided. The MiCA regulation defines ten regulated services: custody and administration, operation of a trading platform, exchange of crypto-assets for funds, exchange of crypto-assets for other crypto-assets, execution of orders, placing of crypto-assets, reception and transmission of orders, advice, portfolio management, and transfer services.

Minimum own funds follow Annex IV by class, uniformly across the EU:

A firm authorized across classes holds capital for the highest tier. Article 67 adds an overhead-based test tied to a quarter of fixed overheads, so the class minimum is a floor. All ten service categories are passport-eligible: authorization in one member state covers the same services across all 27, subject to notification of the host authority. Transfer services and placing can overlap with payment services under PSD2, so firms moving fiat funds or holding client fiat balances may also need PSP or EMI authorization alongside the CASP.

A complete CASP file typically contains a legal opinion on business-model classification, minimum own funds for the service class, fit and proper documentation for managers and owners, an AML and counter-terrorist financing program with a reporting officer, client-asset safeguarding arrangements, an IT security framework aligned with DORA, and a business plan with three-year financial projections.

The detailed ten-part file structure sits on the CASP license guide. Ongoing duties after authorization include the compliance program and the EU entity footing covered under company registration.

Five errors repeat across refused and delayed files. An underspecified AML program that reads as a template rather than a model-specific control set draws questions first. Missing or vague client-asset safeguarding arrangements, especially segregation on the ledger and return procedures, stall custody and exchange applications. Vague business-model descriptions force the authority to guess the service scope, which usually ends in a reclassification to a higher capital class.

Mismatched capital and activity scope, where the file prices Class 1 capital against Class 2 or 3 activity, is the most expensive mistake because it restarts the capital planning. Inadequate fit and proper preparation for managers and qualifying holders delays otherwise complete files.