Overview
MiCA's crypto-asset service provider regime has applied since 30 December 2024. Article 143(3) allowed Member States to let firms already operating under national law continue until 1 July 2026 at the latest, and many states chose shorter windows: Latvia ended its period on 30 June 2025 and Germany on 31 December 2025, while Spain, Malta, Estonia and Portugal ran theirs to the end of June or 1 July 2026. Some states also offered a simplified procedure for existing licensees, but that route has now closed everywhere.
Regulators have been explicit about the consequences. Supervisors in Malta, Estonia and Spain told unauthorised firms to stop onboarding and marketing, limit activity to closing positions and returning assets, and wind down with priority given to client protection. For a business that has not yet secured authorisation, adaptation today means a full MiCA application, an Article 60 notification if the group already holds a qualifying EU licence, the acquisition of an already authorised CASP with regulatory approval, or a carefully managed exit from EU clients.
The gap between a national AML registration and a MiCA authorisation is substantial. MiCA adds prudential capital, fit-and-proper governance, a physical presence and effective management in the EU, client-asset segregation, conduct-of-business duties, conflict-of-interest and complaints regimes, outsourcing controls and a credible wind-down plan. CASPs are also in scope of DORA for ICT risk management and incident reporting, and of the Transfer of Funds Regulation, which applies the Travel Rule to crypto transfers without a minimum threshold.
Our adaptation service turns those requirements into a project plan: a structured gap analysis, choice of home Member State and licensing route, remediation of policies and systems, and preparation of an application that regulators can assess efficiently. For authorised firms, we also support ongoing alignment with ESMA and EBA technical standards and guidelines as they are updated.
Key benefits
- Clear view of the distance between current operations and MiCA standards
- Choice of home Member State based on regulatory fit, language and substance
- Lawful access to all EU/EEA markets through a single authorisation
- Stronger standing with banks, payment partners and institutional clients
- Orderly client communication and asset protection where activity must pause
- Governance and compliance foundations that support future growth or sale
Requirements
- Registered office and place of effective management in the EU, with at least one EU-resident director
- Prudential safeguards per MiCA Article 67 (own funds, insurance or a combination)
- Management body of sufficiently good repute, knowledge and experience; vetted qualifying shareholders
- Segregation of client crypto-assets and funds, with a custody policy where relevant
- Conduct rules: fair information, conflicts of interest, complaints handling and marketing standards
- Outsourcing controls and an orderly wind-down plan
- ICT risk management and incident reporting under DORA
- AML/CFT programme including Travel Rule data for every crypto transfer
- Market abuse prevention and suspicious order reporting where trading services are offered
Licence options & capital
Full CASP authorisation
From EUR 50,000 capital
A new application to the chosen home regulator under Articles 59 and 62-63 MiCA. The standard route for legacy VASPs without another EU licence.
Article 60 notification
For credit institutions, investment firms, e-money institutions, central securities depositories, market operators, UCITS management companies and AIFMs, covering crypto services equivalent to their existing permissions.
Acquisition of an authorised CASP
Buying a qualifying holding in an existing CASP, subject to prior assessment and approval by its home regulator under MiCA's change-of-control rules.
Restructure or orderly exit
Where authorisation is not achievable in time, restricting EU activity, transferring clients to an authorised provider and closing positions in line with regulator expectations.
Step-by-step process
- 1
Diagnostic
Map current services, clients, entities and flows against MiCA service definitions and identify the applicable class and route.
- 2
Gap analysis
Assess governance, capital, policies, systems, custody and AML against MiCA, DORA and the Travel Rule, and grade each gap by severity.
- 3
Jurisdiction and structure
Select the home Member State and group structure, considering language, regulator approach, substance and banking access.
- 4
Remediation
Build or upgrade policies, appoint key function holders, implement segregation, Travel Rule tooling and ICT controls.
- 5
Application or notification
Prepare and file the authorisation or Article 60 notification and manage regulator questions to decision.
- 6
Post-authorisation
Embed reporting, monitoring, audit and passporting notifications, and keep pace with new technical standards.
Typical documents
- Existing national registration or licence and supervisory correspondence
- Group structure chart and ultimate beneficial owner records
- Current AML/CFT manual and business-wide risk assessment
- Client terms, fee schedules and marketing materials
- Custody architecture, wallet management and key control documentation
- ICT, information security and outsourcing contracts
- Financial statements and capital planning
- Board minutes, organisational chart and CVs of key personnel
How Legal Wealth helps
Legal Wealth runs MiCA adaptation as a confidential, partner-led project. We begin with an honest assessment of whether and where authorisation is realistic, coordinate remediation across legal, compliance and technology workstreams, and prepare applications built on MiCA's technical standards. Where activity must pause, we help protect clients and the shareholders' reputation through an orderly plan, while keeping the group's long-term wealth and succession structure in view.
Enquire with Legal WealthFrequently asked questions
Has every MiCA transitional period ended?
Yes. MiCA capped national grandfathering at 1 July 2026, and all Member State periods have now expired. Firms without authorisation or a valid Article 60 notification may not provide crypto-asset services in the EU.
Can I keep serving EU clients while my application is pending?
No. Without authorisation, regulators expect you to stop onboarding and marketing and limit activity to protecting existing clients until a decision is made.
Is reverse solicitation a workable alternative?
Only in very narrow circumstances. MiCA's reverse solicitation exemption applies when the client initiates the service on its own exclusive initiative, and supervisors interpret it restrictively. It is not a basis for a business model.
Does DORA apply to crypto-asset service providers?
Yes. CASPs are financial entities under DORA, which has applied since 17 January 2025, so ICT risk management, incident reporting and third-party oversight must be in place.
How long does adaptation take?
The statutory review is short, but preparation is not. For a legacy VASP, the diagnostic, remediation and filing stages typically take several months before the regulator's own timetable begins.
Which country should we choose?
It depends on language, the regulator's approach, the team's location and banking relationships. We compare Member States such as Germany, Spain, Malta, Lithuania, Latvia, Cyprus and Portugal against your model before any filing.
Last reviewed: 2026-10. Requirements, fees and timelines change. Information is general, reviewed on the date shown, and is not legal or tax advice.
Sources
- BaFin – MiCAR: crypto-asset services authorisation and notification
- MFSA/FIAU – Dear CEO Letter on transition to CASP (June 2026)
- Financial Intelligence Unit Estonia – Transitional period for crypto asset service providers ending
- CMS – Understanding MiCAR's transitional regimes
- ESMA – Interactive Single Rulebook, MiCA minimum capital requirements
