MiCA authorisation starts a compliance cycle that runs for as long as the firm holds its licence. A crypto-asset service provider (CASP) keeps meeting the governance, capital, client asset, conduct and service-specific rules of the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, alongside DORA, the EU Travel Rule, anti-money laundering law, sanctions and data protection.
The obligations differ by service. A custodian, an exchange, an adviser and a transfer service each carry their own rules, so the most useful tool is an obligations map built permission by permission, rather than one generic policy.
| Compliance area | Principal obligation | Main source |
|---|---|---|
| Conduct | Act honestly, fairly and professionally in clients' best interests; fair, clear marketing | MiCA Article 66 |
| Prudential safeguards | Hold the higher of the class minimum and one quarter of fixed overheads | MiCA Article 67 |
| Governance | Fit and proper board, sound controls, records kept at least five years | MiCA Article 68 |
| Client assets and funds | Segregate, record and protect client crypto-assets and money | MiCA Article 70 |
| Complaints | Free, prompt, fair and recorded complaints handling | MiCA Article 71 |
| Conflicts of interest | Identify, prevent, manage and disclose conflicts | MiCA Article 72 |
| Outsourcing | Written agreements, oversight and retained responsibility | MiCA Article 73 |
| Wind-down | An orderly wind-down plan for the relevant services | MiCA Article 74 |
| Service rules | Custody, trading platform, exchange, execution, placing, orders, advice, portfolio management, transfers | MiCA Articles 75 to 82 |
| Market abuse | Prevent, detect and report insider dealing and manipulation | MiCA Title VI |
| Operational resilience | ICT risk, incidents, testing and supplier oversight | DORA, Regulation (EU) 2022/2554 |
| Travel Rule | Originator and beneficiary information with every transfer | Regulation (EU) 2023/1113 |
| AML and sanctions | Risk-based due diligence, monitoring and reporting | EU AML law and national law |
| Staff competence | Qualified staff giving information or advice | ESMA knowledge and competence guidelines |
MiCA's transitional periods ended on 1 July 2026 at the latest in every member state. ESMA's statement of 17 April 2026 made clear that from that date any firm providing crypto-asset services to EU clients without authorisation acts in breach of EU law, and that firms without authorisation were expected to wind down in an orderly way. The market now consists of authorised CASPs and financial firms using the notification route.
The national regulator that granted the authorisation, called the national competent authority, supervises the CASP. ESMA writes the common technical standards and guidelines and works with national regulators so that supervision is consistent. Passporting lets a CASP serve clients across the EU, but host-state rules on marketing, consumer protection, tax and AML reporting still apply where the firm operates.
For firms still planning entry, our MiCA licence guide covers the authorisation itself. This guide covers what an authorised CASP does every day, month and year to keep its licence in good standing.
Article 66 requires a CASP to act honestly, fairly and professionally in the best interests of its clients. Marketing communications are fair, clear and not misleading, identified as marketing, and consistent with the crypto-asset white paper where one exists. Clients are warned of the risks of crypto-asset transactions before they deal.
A CASP publishes its prices, costs and fees on its website, and publishes information on the principal adverse environmental and climate impacts of the consensus mechanisms used by the crypto-assets it offers, using the sustainability indicators set in the technical standards. Every service runs on a client agreement that sets out the rights and obligations of both sides.
MiCA requires governance arrangements that ensure sound and prudent management, proportionate to the size and complexity of the business. Every board member must be of good repute and have the knowledge, skills and experience for the role, and shareholders with 10% or more must remain suitable. Changes to the board are notified to the regulator, and an acquisition of 10% or more, or an increase through 20%, 30% or 50%, needs the regulator's prior assessment.
New products, new tokens, new countries and new critical suppliers each need a documented regulatory impact assessment before launch. In a group, decisions affecting the regulated entity are taken by its own board; group functions can support it, but they do not replace its governance. Records of all services, activities, orders and transactions are kept for at least five years.
A CASP holds prudential safeguards at least equal to the higher of its permanent minimum capital and one quarter of its fixed overheads for the previous year, reviewed every year. The minimum is €50,000 for Class 1 services, €125,000 for Class 2 (which adds custody and exchange) and €150,000 for Class 3 (which adds a trading platform).
Growth raises the requirement. As staff, technology and premises costs rise, one quarter of fixed overheads often overtakes the class minimum within the first two years. Losses reduce available own funds at the same time, so finance and compliance should track headroom monthly and set early-warning triggers well above the minimum.
The safeguards can be own funds, an insurance policy or a comparable guarantee, or a combination. The insurance must meet MiCA's conditions on cover, term and the risks covered; ordinary commercial liability cover does not qualify. The capital plan should be consistent with the business plan and with the wind-down plan, so that the firm can always fund an orderly exit.
A CASP holding client crypto-assets, or the means of access to them, protects clients' ownership rights and does not use client assets for its own account. Records must show each client's position at any time and reconcile to the wallets and accounts the firm controls. Client assets are held separately from the firm's own, so that they are protected if the firm becomes insolvent.
Client money other than e-money tokens is placed with a credit institution or a central bank by the end of the business day after it is received, in accounts identifiable separately from the firm's own. Due diligence on every bank and institution in the chain should be documented and refreshed. Key management, multi-signature or MPC (multi-party computation, where several parties each hold part of a key) arrangements, wallet allocation and recovery need access controls and segregation of duties.
Custody and administration carries specific rules in Article 75. The CASP has a custody agreement with each client, a custody policy available on request, and a register of positions. It sends each client a statement of their positions at least once every three months and whenever the client asks. It is liable for the loss of client crypto-assets caused by an incident attributable to it, up to the market value at the time of the loss.
A custody incident is usually a client asset event and an ICT incident at the same time, so the MiCA custody procedures and the DORA incident process should run as one.
Operators of a crypto trading platform meet additional rules on operating rules, admission of crypto-assets, access, order handling, transparency and market integrity. The operating rules are clear and non-discriminatory, and the systems are resilient enough to handle peak volumes. The operator may not deal on its own account on the platform it runs, and it initiates final settlement on the blockchain within 24 hours of a trade on the platform.
ESMA's Q&A of 20 June 2025 on shared order books confirmed that an arrangement in which an EU platform's order book is combined with that of a non-EU platform breaches the MiCA authorisation requirements. Global groups should document which legal entity runs each order book and where liquidity comes from. Order and trade records must be complete enough to reconstruct any order for surveillance or a regulator's request.
Exchanging crypto-assets for money or for other crypto-assets, executing orders and receiving and transmitting orders each create conduct duties. An exchange service has a non-discriminatory commercial policy and publishes firm quotes or its pricing method. A firm executing client orders takes all sufficient steps to obtain the best possible result, and keeps an execution policy that clients receive.
Client disclosures must match the service actually provided. Venue selection, spreads, liquidity sources and payments from group companies all affect client outcomes, so each needs a documented rationale and periodic review. Automated execution and routing logic needs governance, testing before changes, and monitoring after release.
Firms giving advice on crypto-assets or managing portfolios assess suitability: the client's knowledge, experience, financial situation and objectives. Records explain why each recommendation or portfolio decision suits the client, and portfolio clients receive periodic statements.
ESMA issued its guidelines on the knowledge and competence of staff giving information or advice on crypto-assets on 28 January 2026. They apply six months after ESMA publishes them in all EU languages.
| Role | Minimum standard (one route shown) | Ongoing training |
|---|---|---|
| Staff giving information | A qualification of at least 80 hours plus 6 months' supervised experience, or 1 year's supervised experience | Annual training, for example 10 hours for the simplest offerings |
| Staff giving advice | A qualification of at least 160 hours plus 1 year's supervised experience, or other routes in the guidelines | Annual training, for example 20 hours for simpler offerings |
Firms should list every role that gives information or advice, including customer support, account managers and social media teams. Educational content can become regulated advice when it is personalised or presented as a recommendation, so marketing, influencer arrangements and staff communications need approval and monitoring.
MiCA requires effective and transparent procedures for handling complaints promptly, fairly and consistently, free of charge to the client, with the procedure published. Each complaint is recorded with the steps taken and the outcome.
The practical step is classification. Support tickets that express dissatisfaction with a regulated service are complaints, and the firm's ticketing system should flag them so they enter the regulated process. Complaints data then feeds board reporting and product review, with root-cause analysis across cases. A CASP serving several countries handles complaints in the languages it markets in.
A CASP identifies, prevents, manages and discloses conflicts of interest, and discloses the general nature and sources of its conflicts, and the steps taken to limit them, in a prominent place on its website. Crypto business models create structural conflicts between the firm, group companies, token issuers, market makers, staff and clients.
The conflicts register records each material conflict, the control in place and the owner. Controls include separation of functions, independent decisions, restrictions and monitoring; disclosure is the last line, used only where a conflict cannot be prevented or managed.
A CASP may outsource functions, including important ones, under MiCA and DORA, but it remains fully responsible for them. It keeps the expertise to supervise the provider and the right to access its data and premises. Contracts cover the service, information and audit rights, security, sub-outsourcing, continuity and exit.
The heaviest dependencies in crypto are custody technology, cloud hosting, blockchain analytics, identity verification, Travel Rule messaging and trading systems. Firms should map these dependencies and the concentration risk across them, monitor providers on a risk basis (financial condition, security, jurisdiction and regulatory status), and keep tested exit plans that protect clients during any transition.
The Digital Operational Resilience Act has applied to CASPs since 17 January 2025. It requires a board-approved ICT risk framework, incident management and reporting, resilience testing, management of ICT suppliers and a register of all ICT supplier arrangements, kept up to date and provided to the regulator.
| Major ICT incident report | Deadline | Source |
|---|---|---|
| Initial notification | Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it | Delegated Regulation (EU) 2025/301, Article 5 |
| Intermediate report | Within 72 hours of the initial notification | Delegated Regulation (EU) 2025/301, Article 5 |
| Final report | Within one month of the latest intermediate report | Delegated Regulation (EU) 2025/301, Article 5 |
Critical systems should be mapped to the services they support: exchange engines, custody platforms, blockchain nodes, cloud, identity systems and APIs. Scenario tests should include crypto-specific events such as key compromise, chain halts and bridge exploits, and board reporting should focus on what remains to be fixed. Our article on DORA and digital operational resilience explains the framework in more detail.
The Travel Rule comes from the Transfer of Funds Regulation, Regulation (EU) 2023/1113, which has applied to crypto-asset transfers since 30 December 2024. A CASP sends information on the originator and beneficiary with every transfer, with no minimum amount, and checks the information it receives. Where information is missing or incomplete, the CASP has a risk-based procedure to request it, hold, reject or return the transfer.
For a transfer above €1,000 to or from a self-hosted wallet (one the client controls directly), the CASP verifies that the wallet is owned or controlled by its client. The Travel Rule data should connect to AML and sanctions monitoring, and compliance should test its accuracy and completeness regularly, with privacy and data security controls built in.
MiCA does not replace EU anti-money laundering law; a CASP is an obliged entity under it. It carries out risk-based customer due diligence, identifies beneficial owners, applies enhanced checks to higher-risk clients and countries, monitors transactions and reports suspicious activity to its national financial intelligence unit. The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027 and sets these rules directly across the EU, with the new EU Anti-Money Laundering Authority supervising selected high-risk cross-border groups directly from 2028.
The firm's financial crime service supports CASPs with risk assessments, monitoring calibration and MLRO reporting.
Title VI of MiCA sets a market abuse regime for crypto-assets admitted to trading: it prohibits insider dealing, unlawful disclosure of inside information and market manipulation. Any firm that arranges or executes transactions has systems to detect suspicious orders and transactions and reports them to its regulator without delay.
Crypto markets trade around the clock, with liquidity spread across venues and on-chain activity, so surveillance built for traditional markets needs adapting. Firms control access to inside information such as listing decisions, partnerships and protocol events, govern staff dealing, and calibrate and test surveillance, tracking alert quality and reports filed.
Reporting and record-keeping requirements come from MiCA, its technical standards and national rules, and vary by service. Systems should produce complete, reproducible records of activity, orders, transactions, custody positions, complaints, conflicts, outsourcing and prudential monitoring, so that a regulator's request can be answered from the system rather than rebuilt by hand.
| Obligation | Frequency or deadline | Source |
|---|---|---|
| Prudential requirement recalculated | Annually, monitored throughout the year | MiCA Article 67 |
| Client statement of positions (custody) | At least every three months and on request | MiCA Article 75 |
| Trading platform settlement initiated | Within 24 hours of the trade | MiCA Article 76 |
| Record retention | At least five years | MiCA Article 68 |
| Major ICT incident: first notice | Within 4 hours of classification, 24 hours of awareness at the latest | DORA and Delegated Regulation (EU) 2025/301 |
| Passporting to a new member state | Start at the latest 15 calendar days after notifying | MiCA Article 65 |
| Significant CASP notification | Within two months of reaching 15 million active EU users on average | MiCA Article 85 |
| Tax reporting of client transactions | Annually, data collected from 1 January 2026 | DAC8, Directive (EU) 2023/2226 |
A regulator response process with named owners across compliance, legal, technology and operations, and version control on every submission, keeps answers consistent.
A CASP placing crypto-assets for an issuer or offeror tells the issuer, before the agreement, the type of placement, the fees and the timing, and manages the conflict that arises where it places tokens issued by itself or a group company. Agreements with the issuer record these terms, and the firm keeps evidence that the white paper and marketing match the offer.
A CASP providing transfer services agrees with each client the description of the service, the fees and the time it takes, and how the firm handles transfers that cannot be completed. Transfer services sit closest to payment services, so firms moving e-money tokens for clients check whether a payments authorisation is also needed under PSD2.
CASPs providing custody, operating a trading platform, exchanging crypto-assets, executing orders or placing crypto-assets keep a plan to support an orderly wind-down of their activities under applicable national law. The plan shows how critical activities continue or transfer, how client crypto-assets and money are returned, and how clients are told.
ESMA's statement of 17 April 2026 set the standard for these plans in practice: operational, credible and ready to execute at once. A plan that names the receiving custodian, the sequence of steps, the people responsible and the funding available meets that standard, and it should be tested at least annually and refreshed after any material change to the business.
Regulators watch newly authorised CASPs closely in their first year, and supervisory requests are most frequent as the firm grows into its business plan. A clear first-year plan keeps the firm aligned with what it told the regulator.
Any material departure from the business plan in the application, such as new services, new countries or a different client base, is discussed with the regulator before it happens rather than after.
The most effective programmes run in three layers.
Firms that hold a payments or e-money licence alongside MiCA authorisation run one programme across both, which matters where stablecoin flows are also payment services; our guide to the MiCA stablecoin licence explains where those regimes meet. The firm's regulatory compliance service provides gap assessments, monitoring and board reporting for authorised CASPs.
It keeps meeting MiCA's conduct, capital, governance, client asset, complaints, conflicts, outsourcing and service-specific rules, alongside DORA, the Travel Rule, AML and sanctions law. The exact programme depends on the services authorised.
The higher of €50,000, €125,000 or €150,000 by service class, and one quarter of the previous year's fixed overheads. As costs grow, the fixed-overheads figure usually becomes the binding one.
Yes. CASPs have been in scope since 17 January 2025 and must report major ICT incidents within 4 hours of classifying them as major, and no later than 24 hours after becoming aware of them.
It comes from Regulation (EU) 2023/1113, not MiCA itself. CASPs send originator and beneficiary information with every crypto transfer, with no minimum amount, and verify self-hosted wallets for transfers above €1,000.
At least once every three months, and whenever the client asks, under Article 75 of MiCA.
Yes. A CASP notifies its home regulator and can start in a host member state at the latest 15 calendar days after notifying; host-state marketing and consumer rules still apply.
Yes. The regulator withdraws authorisation if the firm has not used it within 12 months or has provided no crypto-asset services for nine consecutive months.
Buckingham Capital Consulting has obtained payments and e-money authorisations in the UK and the EU since 2013, including Central Bank of Ireland EMI authorisation for Own Solutions, and runs compliance programmes for regulated firms after authorisation. For authorised CASPs, the firm builds the MiCA obligations register, tests custody, Travel Rule and DORA controls, and prepares board reporting and regulator responses.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.