[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital
The Markets in Crypto-Assets Regulation (MiCA) now applies in full across the European Union. The transitional periods that let existing crypto firms keep operating under national registrations ended on 1 July 2026 at the latest, and earlier in member states that chose shorter periods. Since then, only firms authorised as crypto-asset service providers (CASPs) under MiCA may provide crypto-asset services to clients in the EU.
For a firm without authorisation, the choices are clear. It can apply for authorisation in one member state and passport across the EU, buy a firm that is already authorised, offer its services through an authorised CASP, or stop serving EU clients. This guide sets out what each route involves and how to choose. Our MiCA CASP authorisation page covers the application itself.
The European Securities and Markets Authority (ESMA) issued public statements in April and June 2026 reminding firms of the deadline and setting out what it expects from those not authorised by 1 July 2026. In summary:
National regulators supervise and enforce these expectations. Firms still serving EU clients without authorisation, or marketing to them, are exposed to enforcement action in each member state where those clients are.
| Route | What it involves | Best for |
|---|---|---|
| Apply for authorisation | A full MiCA application in one member state, then passporting to others | Firms that want EU clients over the long term |
| Acquire an authorised CASP | Buying a firm that already holds MiCA authorisation, with regulator approval of the new owner | Firms that need EU access sooner and can fund an acquisition |
| Serve clients through an authorised CASP | The authorised firm provides the regulated service under its own licence; the other firm supplies brand, technology or distribution | Firms with a strong product but no plan to hold a licence |
| Exit the EU | Orderly wind-down and transfer of EU clients | Firms for which the EU is not a core market |
A MiCA application is made to the national regulator in one member state. Once authorised, a CASP can passport its services to other member states by notification, without a second authorisation. The application covers the business plan, governance, the people running the firm, capital, safeguarding of client assets, ICT and cyber resilience, anti-money laundering controls, complaints handling and conflicts of interest, and, for some services, specific policies such as custody or order execution.
Capital depends on the services provided: EUR 50,000, EUR 125,000 or EUR 150,000, or a quarter of the previous year's fixed overheads if higher. The choice of member state matters, because regulators differ in how they review files and how long they take. Our comparison of the best EU countries for a MiCA licence covers Lithuania, Malta, Germany and Ireland.
Firms that withdrew from the EU on 1 July 2026 can still apply. A clean wind-down record, with clients treated fairly, is helpful evidence of governance in the application.
Buying a firm that already holds MiCA authorisation can give access sooner than a new application, but it is not a shortcut around regulation. Anyone acquiring a qualifying holding in a CASP must notify the regulator in advance, and the regulator assesses the buyer's reputation, financial soundness, the people who will run the business and the source of funds. The target's existing systems, policies and people must also fit the buyer's business model, or the buyer will need to change them and tell the regulator.
Due diligence should cover the target's authorisation conditions, the services it is authorised for, its passport notifications, supervisory correspondence, open findings, client asset arrangements and banking. Our marketplace lists licensed firms for sale, and our change of control service runs the regulator approval.
Some firms keep their brand and technology but have an authorised CASP provide the regulated services. This only works if the authorised firm genuinely provides the service under its own authorisation, controls the client relationship to the extent MiCA requires, and meets its own obligations on custody, anti-money laundering and client information. MiCA does not allow a CASP to outsource or delegate certain services, notably custody, to firms that are not themselves authorised.
The commercial terms need care. The authorised CASP carries the regulatory risk, so it will want control over onboarding, marketing and client communications. Firms that plan to apply for their own authorisation later should agree in advance how clients would move across.
Regulators look at the substance of these arrangements. If the unauthorised firm controls onboarding, pricing and the client relationship while the CASP only lends its name, the regulator may treat the arrangement as the unauthorised firm providing the service itself. The contract, the client terms and the way clients experience the service should all show that the authorised CASP is the provider.
For some firms, the EU is not worth the cost of authorisation. An orderly exit means telling clients clearly and early, offering transfers of their crypto-assets to another provider, closing positions on fair terms, returning fiat balances and stopping any marketing into the EU. Records of the wind-down should be kept, because regulators can ask for them, and because they matter if the firm later applies for authorisation.
A clean exit keeps the door open. Regulators remember how firms treated clients on the way out.
Where a firm applies matters as much as how. Regulators differ in the time they take, how they engage before submission, the local presence they expect and the depth of their questions on custody and ICT. Some prefer firms with senior staff based locally; others accept more of the team elsewhere if governance is strong. Language, the cost of local staff and access to banks also differ.
Firms should also think about where their clients are. Passporting gives access to the whole EU, but marketing in each country must still follow local rules on communications, and some regulators watch inbound passporting closely. A home regulator in a member state where the firm already has clients, staff or banking usually makes the application smoother.
Firms applying after 1 July 2026 should expect direct questions about the period around the deadline. Regulators will want to know whether the firm served EU clients after its transitional period ended, how it told clients about the change, how client assets were returned or transferred, and whether any complaints followed. A clear, documented answer helps. A vague one invites a closer review of the whole application.
The same applies to acquisitions. A buyer of an authorised CASP should check whether the target, or any business being merged into it, served EU clients without authorisation, because the regulator approving the change of control will ask.
MiCA treats stablecoins separately. An e-money token, a token referencing one official currency, can only be issued by a credit institution or an electronic money institution, and CASPs must check that tokens they offer are compliant. Firms whose business depends on non-compliant stablecoins have a second issue to resolve alongside authorisation. Our guide to issuing an EMT or ART under MiCA covers the issuer side.
Each route has a different cost profile. A new application needs regulatory capital, senior staff with the right experience, policies, ICT and security work, and advisers, followed by a review period that depends on the regulator's queue and the quality of the file. An acquisition needs the purchase price, due diligence, change of control approval and often remediation of the target's systems. Serving clients through an authorised CASP usually means a revenue share and less control. An exit has its own costs: returning assets, closing accounts and handling complaints.
Budget for the first year after authorisation as well. MiCA brings ongoing reporting, audits of client asset arrangements, ICT testing under DORA and anti-money laundering work that grows with the client base.
| Question | If yes |
|---|---|
| Are EU clients central to the business for the next five years? | Apply, or acquire if a suitable firm is available |
| Is speed to market worth more than the cost of an acquisition? | Acquire, with a realistic change of control timetable |
| Is the product strong but the regulated activity not the firm's core? | Serve clients through an authorised CASP |
| Is the EU a minor market? | Exit cleanly and revisit later |
Whichever route a firm takes, the decision should be made by the board and recorded, with the reasons. Regulators reviewing a later application will ask why the firm did not hold authorisation by 1 July 2026 and what it did about its EU clients.
We prepare MiCA applications in the member state that suits the business, run acquisitions of authorised CASPs including the change of control approval, and structure arrangements with authorised providers. For firms leaving the EU, we plan the client wind-down so it supports a later return.
No. The transitional periods ended on 1 July 2026 at the latest. Only authorised CASPs may provide crypto-asset services to EU clients.
Carry out an orderly wind-down, limit activity to returning or transferring client assets and closing positions, and keep custody only as long as strictly needed to exit.
Only where a client approaches the firm entirely on its own initiative. It is a narrow exemption and cannot support marketing or a client base in the EU.
It can be, but the regulator must approve the new owner first, and the firm must fit the buyer's business. A suitable target and a clean change of control are essential.
Yes. An orderly wind-down record helps show the governance the regulator will look for.
EUR 50,000, EUR 125,000 or EUR 150,000 depending on the services, or a quarter of the previous year's fixed overheads if that is higher.
Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital