The transitional period for crypto-asset service providers under MiCA, the EU's Markets in Crypto-Assets Regulation, ended on 1 July 2026 at the latest, and earlier in Member States that shortened it. A business that provides crypto-asset services in the European Union now needs a MiCA authorisation, or must be one of the financial institutions that MiCA allows to provide those services after notifying its regulator. Here is what the rules say, and what they mean in practice.
What MiCA covers
MiCA is Regulation (EU) 2023/1114 of 31 May 2023 on markets in crypto-assets. It applies from 30 December 2024; its titles on asset-referenced tokens and e-money tokens applied earlier, from 30 June 2024 (Article 149).
Article 3(1), point (16), defines a crypto-asset service as any of these activities:
- Custody and administration of crypto-assets on behalf of clients
- Operating a trading platform for crypto-assets
- Exchanging crypto-assets for funds, or for other crypto-assets
- Executing orders for crypto-assets on behalf of clients
- Placing crypto-assets
- Receiving and transmitting orders for crypto-assets on behalf of clients
- Providing advice on crypto-assets, or portfolio management on crypto-assets
- Providing transfer services for crypto-assets on behalf of clients
What the transitional period was
MiCA gave businesses already operating under national rules time to move to the new regime. Under Article 143(3), crypto-asset service providers that provided their services in accordance with applicable law before 30 December 2024 could continue until 1 July 2026, or until they were granted or refused a MiCA authorisation, whichever came sooner.
Member States could decide not to apply this transitional regime, or to shorten it, where they considered their national rules before 30 December 2024 less strict than MiCA. They had to tell the European Commission and the European Securities and Markets Authority (ESMA) by 30 June 2024.
As ESMA noted in its statement of 17 December 2024, the result was transitional periods of different lengths in different Member States. ESMA published an overview of the period each Member State chose, linked from that statement.
Where things stand now
The latest possible end date, 1 July 2026, has passed, so the transitional period has ended in every Member State. Three things follow.
Authorisation is the rule
Article 59 is direct: no one may provide crypto-asset services within the Union unless they are authorised as a crypto-asset service provider (CASP) under Article 63, or are a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager allowed to provide crypto-asset services under Article 60. Article 60 lets those entities provide services that match their existing authorisation after notifying their home regulator.
The simplified procedure has closed
Article 143(6) allowed Member States to apply a simplified procedure to applications submitted between 30 December 2024 and 1 July 2026 by entities already authorised under national law to provide crypto-asset services. That window has closed. A business applying now goes through the standard procedure in Articles 62 and 63.
Under Article 62(4), a regulator may not ask again for information it already received under the EU authorisation procedures for electronic money, investment services or payment services, or under national crypto-asset rules that applied before 29 June 2023, as long as that information is still up to date.
Passporting needs a MiCA authorisation
A MiCA authorisation lets a CASP provide its services throughout the Union, through a branch or across borders, without a physical presence in each host Member State (Article 59(7)). To do so, it tells its home regulator which Member States, which services and from what date (Article 65). It may start once the regulator confirms it has passed the information on, or at the latest from the 15th calendar day after it submitted it.
What ESMA expected of businesses
ESMA's statement looked at businesses serving clients in more than one Member State. Its example: a CASP seeking authorisation in a Member State with a 12-month transitional period, while serving clients in another with a 6-month period, had to comply with the second Member State's law in the meantime. Otherwise it could spend up to six months without the authorisation it needed to serve those clients.
ESMA expected CASPs to make all possible effort to be compliant and to avoid detriment to their clients and the market, while keeping to their anti-money-laundering obligations. The transitional periods are over, but the lesson stands: know which Member States your clients are in, and make sure you are authorised to serve each of them.
What it means for your business
If you are authorised under MiCA
Check that your authorisation covers every service you provide: Article 59(6) requires it to specify them, and adding a service means asking your home regulator for an extension (Article 59(8)). Check that every Member State you serve has been notified under Article 65. The conditions of authorisation apply at all times (Article 59(4)), including the prudential safeguards of Article 67 and procedures for the orderly transfer of clients' crypto-assets and funds if an authorisation is withdrawn (Article 64(8)).
If you relied on the transitional period
A business that relied on the transitional period and was not authorised when it ended in its Member State is no longer covered by it. Confirm your position with the regulators concerned, and your legal advisers, before serving clients in the EU.
If you plan to enter the EU market
You need an authorisation, or an Article 60 notification if you are already one of the listed financial institutions. An authorised CASP must have its registered office in a Member State where it carries out at least part of its crypto-asset services, its place of effective management in the Union, and at least one director resident in the Union (Article 59(2)). Serving EU clients from outside the Union without authorisation is possible only when the client starts the service on its own exclusive initiative (Article 61). Soliciting EU clients removes that exception, whatever a contract or a disclaimer says.
What an application involves
Article 62(2) lists what an application must contain. It includes:
- A programme of operations: the services, and where and how they will be marketed
- Proof of the prudential safeguards required by Article 67
- The governance arrangements, and proof that the management body is of sufficiently good repute and has the knowledge, skills and experience to run the business
- The identity and good repute of shareholders with qualifying holdings
- Internal controls and risk procedures, including for money laundering and terrorist financing, and a business continuity plan
- Technical documentation of the IT systems and security arrangements
- How clients' crypto-assets and funds are kept separate, and how complaints are handled
- Policies for specific services, such as custody or order execution
Article 67 sets the prudential safeguards at the higher of a permanent minimum capital, which depends on the services provided (Annex IV), and one quarter of the previous year's fixed overheads. We confirm what applies to your services in the consultation.
Article 63 sets the regulator's deadlines. It acknowledges receipt within five working days, checks that the application is complete within 25 working days, and decides within 40 working days of receiving a complete application. It may pause that assessment, for up to 20 working days, while it waits for information it has asked for. These deadlines run from when the regulator receives the application. They do not include the time it takes to prepare it.
How Apexum can help
We help crypto businesses work out which of MiCA's services they provide, compare where to apply, and prepare the application with them. The regulator decides whether to grant the authorisation. We also plan the company and the accounts around it. See crypto licence and crypto industry page. This article is general information, not legal advice: we confirm the current position for your case in the consultation.
Sources
Topics
- Crypto licence
- MiCA
- EU regulation
