Markets in Crypto-Assets Regulation

The Markets in Crypto-Assets Regulation (MiCA) is the European Union’s single rulebook for crypto-asset service providers and issuers, live since December 2023. It requires exchanges, custodians, and other middlemen to be licensed, imposes whitelisting for stablecoin issuers, and mandates standardised disclosures and risk controls across the EU. MiCA is the first jurisdiction-wide crypto-asset regulation of its scale; it will reshape how global crypto companies operate in Europe.

MiCA treats crypto as a financial asset class. It does not ban crypto or impose heavy taxes; instead, it applies principles from traditional securities and banking law to crypto rails—licensing, disclosure, conflict-of-interest controls, safeguarding of customer assets, and reserve requirements for stablecoin issuers. The regulation has no carve-outs for decentralised platforms or pseudonymous services. Crypto companies that want EU access must comply or exit.

The three tiers of MiCA

MiCA creates different obligations for three categories: issuers of crypto assets, issuers of stablecoins (a special case), and crypto-asset service providers.

Crypto-asset issuers must disclose a whitepaper—analogous to a prospectus—that covers the asset’s purpose, tokenomics, governance, use of proceeds, and risk factors. The whitepaper must be written in clear, intelligible language and made available to investors. For projects below a market-cap threshold (roughly EUR 40 million), full regulatory approval is not required, but the whitepaper must still meet form and content standards.

Stablecoin issuers face stricter rules. A stablecoin is a crypto asset designed to maintain a stable value, typically pegged to a fiat currency or basket. MiCA requires stablecoin issuers to be licensed, maintain reserves equal to the stablecoin’s circulation (usually in cash or low-risk securities), and submit reserve audits. Only issuers authorised by an EU member state regulator may issue stablecoins for circulation in the EU. The rule aims to prevent bank runs on stablecoins by ensuring full backing and transparent management.

Crypto-asset service providers (CASPs)—exchanges, custodians, wallet operators, and staking platforms—must obtain a license to operate in the EU. To qualify, a CASP must pass fit-and-proper tests, maintain minimum capital, implement governance and risk controls, segregate customer assets, maintain cyber-security standards, and comply with AML and sanctions rules. The licensing regime is supervised by member-state regulators and coordinated by the European Securities and Markets Authority (ESMA).

What changed for crypto companies

Before MiCA, an exchange could operate in the EU with minimal compliance; MiCA forced a choice: license and comply, or exit the EU market. Major exchanges (Coinbase, Kraken, Crypto.com) obtained MiCA licenses within the EU’s transition period (2023–2024). Smaller platforms and unregistered wallet providers either licensed themselves, moved operations outside the EU, or shut down EU access.

For stablecoin issuers, MiCA is a barrier to entry. USDC (Circle) and USDT (Tether) pursued licensing and now hold EU authorisation. Most other stablecoins—particularly those without significant fiat backing—never licensed and became inaccessible in the EU. This has concentrated stablecoin liquidity among a few large, compliant issuers.

For users, MiCA’s mandate for segregated customer assets and cybersecurity standards means exchanges must carry insurance and meet specific technical controls. A CASP cannot commingle customer crypto with its operating capital. Wallet providers that do not hold crypto for customers (only manage private keys) occupy a grey zone and have largely been exempted from licensing, though ESMA guidance remains evolving.

Licensing process and the regulatory timeline

The transition was not smooth. ESMA published regulatory technical standards (RTS) in August 2023, but member states took months to establish competent authorities and issue the first licenses. Some regulators, like France’s AMF and Spain’s CNMV, moved quickly; others were slower. This created a period of regulatory uncertainty where some CASPs operated under temporary equivalences or applications pending final decision.

A CASP’s license application typically requires proof of capital, governance policies, AML/KYC systems, custody safeguards, business continuity plans, and fit-and-proper certification for key executives. Processing time ranges from three to nine months. Once licensed, a CASP can passport its license across the EU—operate in any member state without re-licensing—a valuable efficiency for multi-country platforms.

The stablecoin windfall and restrictions

MiCA’s stablecoin regime has two paradoxical effects. First, it raised barriers to issuing new stablecoins, protecting the existing issuers (Circle, Tether) by requiring deep pockets, legal expertise, and regulatory patience. Second, it created a whitelisted market: only licensed stablecoins are legal to issue in the EU. This is a form of regulatory moat—new projects cannot easily compete.

“Significant stablecoins” (those with very large circulation) face additional rules: governance requirements, redemption guarantees, restrictions on use of proceeds, and the possibility of restrictions on sales and transfers if a stablecoin is deemed to pose systemic risk. The regulation does not name any current stablecoin “significant,” but Circle’s USDC and Tether’s USDT are the likely candidates if circulation grows further.

Custody and operational rules

MiCAUnderson requires CASPs to segregate customer assets and hold them in cold storage (offline vaults), with insurance coverage. Custody arrangements must be independently verified. A CASP cannot lend out customer assets without explicit customer consent. For NFTs and exotic digital assets outside the scope of “crypto assets” (securities, commodities, derivatives), rules are lighter.

CASPs must also implement transaction monitoring, suspicious activity reporting (SAR), and sanctions screening consistent with EU AML and anti-terrorism financing standards. These requirements align MiCA with the Travel Rule for Crypto, which mandates originator and beneficiary data on large transfers.

Market impact and exit strategies

MiCA’s impact on the EU crypto market is real but measured. Licensing costs and compliance overhead pushed smaller exchanges out of the market. Retail participation in EU member states dipped initially as customers moved to offshore platforms. But major exchanges have absorbed the cost and gained legitimacy—licensing is now a selling point for mainstream adoption.

Decentralised exchanges (DEXs) and unhosted wallets remain largely outside MiCA’s scope—the regulation targets institutions, not protocols. However, if a DEX interface is hosted by an EU company or if that company provides liquidity or custody services, portions of MiCA apply. This creates pressure on blockchain projects to decentralise governance and avoid embedding themselves in EU jurisdictions.

See also