CyphrQ
Menu

MiCA Regulation Explained: What Applies to EU Crypto Firms and Stablecoins

MiCA is the EU's crypto rulebook. What applies since 2024, how CASP authorisation and the transition ended, the stablecoin rules, and what IT teams check.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

8 min read

MiCA is Regulation (EU) 2023/1114, the EU's single rulebook for crypto-assets. Stablecoin issuers have been covered since 30 June 2024. Crypto service providers have been covered since 30 December 2024. The last grandfathering window for existing firms ended on 1 July 2026. Not legal advice.

If you hold crypto, run a crypto business, or sit in a bank's third-party risk team, this is the plain-language version. The second half is for the people who have to prove it.

What is MiCA and what is in force?

MiCA stands for Markets in Crypto-Assets Regulation. It entered into force in June 2023, according to ESMA's MiCA page. A regulation applies directly in every EU member state, so it does not need to be copied into national law first.

It covers three groups of people:

  • Issuers of stablecoins. These come in two kinds: asset-referenced tokens (ARTs) and e-money tokens (EMTs). More on both below.
  • Issuers and offerors of other crypto-assets, who must publish a white paper (a disclosure document about the token).
  • Crypto-asset service providers (CASPs): exchanges, custodians and similar firms.

Two supervisors share the work. The EBA covers ART and EMT issuers, and ESMA covers the wider market and keeps the registers.

When did each part of MiCA start to apply?

Date What happened Source
June 2023 MiCA entered into force ESMA
30 June 2024 Rules for ART and EMT issuers and offerors apply EBA
30 December 2024 Rules for CASPs and the rest of the regime apply; reference date for transitional rules ESMA
23 December 2025 White paper formatting requirements, including iXBRL, apply ESMA
1 July 2026 Latest end of the CASP grandfathering period Article 143
31 December 2027 Trading platforms must have white papers for crypto-assets already listed before 30 December 2024 Article 143

The EBA also notes a separate item: a no-action letter on how the payment-services rules and MiCA interact had a transition period that "ends on 2 March 2026", per the EBA's MiCA page.

How does CASP authorisation work, and is the MiCA transition period over?

A CASP needs authorisation from a national regulator, and that authorisation works across the EU. The transition rules in Article 143 gave existing firms a bridge.

In practice, the rule reads like this. A firm that provided crypto services lawfully before 30 December 2024 could keep going until 1 July 2026, or until it was granted or refused MiCA authorisation, whichever came first. Member states could shorten that period or not apply it at all if their old national rules were less strict than MiCA. They had to tell the Commission and ESMA by 30 June 2024. Member states could also run a simplified authorisation procedure for firms already authorised under national law, for applications made between 30 December 2024 and 1 July 2026. All of this is in Article 143 on ESMA's rulebook.

So the answer to "is it over?" is yes. Since 1 July 2026, no grandfathering period remains in any member state. ESMA points to a separate list of grandfathering periods by country, but the PDF would not open as readable text for me, so I am not quoting individual country dates. Check the list ESMA links from its MiCA page for your country.

Regulators also said what an unauthorised firm should do at the deadline. The Central Bank of Ireland's summary of ESMA's June 2026 statement says such firms should stop onboarding new EU clients and stop marketing, and only do what is needed to close or move positions. Clients of an unauthorised firm do not get MiCA protections, including those for client assets.

How can I check whether a crypto firm is authorised under MiCA?

Use ESMA's interim MiCA register. ESMA publishes it as five CSV files, updated weekly, until it is integrated into ESMA's own systems (the page said mid-2026, so check whether that has happened). The files list authorised CASPs, ART issuers, EMT issuers, white papers, and non-compliant entities. ESMA adds two caveats: listed white papers "have not been reviewed or approved by any competent authority", and withdrawn authorisations stay in the register with the withdrawal date.

A name on a website is not evidence. A row in the CASP file, matched to the legal entity you are dealing with, is.

What are MiCA's stablecoin rules?

MiCA splits stablecoins into two kinds, and the EBA says issuers of both must be authorised to operate in the EU.

  • E-money tokens (EMTs) are stablecoins tied to one official currency. ESMA's rulebook text for Article 49 says they must be issued at par value when funds are received, and holders can ask for redemption at par at any time. Redemption conditions go in the white paper, and redemption carries no fee. Article 50 bans interest on EMTs, as the ESMA rulebook lays out in its Title IV list; see also Article 49.
  • Asset-referenced tokens (ARTs) are tokens that reference something else, such as a basket of assets.

The EBA is writing the detail. Its page lists adopted technical standards on own funds adjustment and stress testing, on liquidity management policies, and on liquidity requirements for the reserve of assets. A decision dated 22 October 2024 sets how tokens are classified as "significant", which moves supervision to the EBA. The same day the EBA published reporting templates for ART and EMT issuers.

If you accept or hold a stablecoin in the EU, ask the issuer which kind it is, who authorised it, and where the redemption terms are published.

What does MiCA require for the security of crypto firms?

MiCA's best-known security rule is about safekeeping. Under Article 70, a CASP that holds clients' crypto-assets, or the means of access to them, must have "adequate arrangements to safeguard the ownership rights of clients", especially if the firm becomes insolvent. It must also stop the firm using those assets for its own account.

Client money is handled separately. A CASP holding client funds other than e-money tokens must place them with a credit institution or central bank "by the end of the business day following the day on which clients' funds" were received, in accounts separate from its own. That is from Article 70 on ESMA's rulebook. Firms that are already banks, payment institutions or e-money institutions are exempt from that funds rule.

For operational resilience, CASPs also fall under DORA, the EU's ICT risk regulation for financial firms. My explainer on DORA's ICT risk rules covers incident reporting and supplier registers.

The case for these rules is practical. When a platform fails or is breached, the question customers ask is whether their assets were theirs, or the firm's. My write-up of the 2025 Bybit hack shows how fast a single compromised signing process can turn into a loss at exchange scale.

Going deeper: for security and IT teams

This section assumes you already know what a hot wallet and a signing key are. I only list items I read at ESMA and the EBA. I could not open the full Regulation text on EUR-Lex, so check article numbers there before they go into a control framework.

Custody and "means of access". Article 70(1) protects clients' crypto-assets "or the means of access to them". My reading: private keys, key shares and wallet credentials are in scope, not just the assets on-chain. That makes your key custody design an evidence question. Be able to show, per client asset, who can sign, how many approvals are needed, and where keys and backups sit. Segregation from the firm's own holdings needs a reconciliation you can run on demand, not once a quarter.

Client funds. The Article 70(3) deadline is the end of the next business day for placing client funds, other than EMTs, at a credit institution or central bank. A treasury process that batches deposits weekly fails this by design. Test it with a sample of receipts and timestamps. Article 70(4) also allows payment services only through a firm authorised under Directive (EU) 2015/2366 (PSD2), so a payments partner needs verifying too.

ICT risk and DORA. Treat DORA as the control layer for everything above: ICT incident classification and reporting, the register of information on suppliers, and resilience testing. Cloud, custody and node providers belong on that register. Log detection time and classification time as separate timestamps.

White papers. Since 23 December 2025, white paper formatting rules, including iXBRL, apply. Listed white papers are not approved by any authority, so a white paper is a claim by the issuer, not a certification. Technical teams that vet tokens for listing should treat the document as a source to test, for example by comparing the stated smart-contract address and redemption terms with what is deployed.

Counterparty evidence. Pull the ESMA CASP and non-compliant-entity CSV files on a schedule, diff them, and alert on a counterparty moving, disappearing, or appearing in the non-compliant file. Keep the pull date and file hash as audit evidence.

EMT and ART exposure. If your treasury holds stablecoins, record the token type, the authorising authority and the redemption terms. Watch EBA announcements on "significant" classification.

What to ask a CASP:

  1. Which entity holds my assets, and what is its row in the ESMA register?
  2. Who controls the keys, and what happens to them in insolvency?
  3. Are client funds placed within one business day, and where?
  4. Which suppliers are on your DORA register for custody and signing?
  5. Where are the redemption terms for each stablecoin you list?

Which MiCA steps should you take now?

  • Check every EU crypto counterparty in the ESMA register by legal entity name.
  • For stablecoins, record the type (EMT or ART), the issuer and the redemption terms.
  • Ask custodians to show you how client assets and access keys are segregated.
  • Add crypto providers to your supplier register and incident plan.
  • Re-check dates with your national regulator. This post may lag a rule change.

Learn more

Key takeaways

  • MiCA applied to stablecoin issuers from 30 June 2024 and to CASPs from 30 December 2024.
  • The latest grandfathering end date was 1 July 2026. It is over.
  • An unauthorised firm should not be onboarding EU clients. Check the ESMA register.
  • EMTs are redeemable at par and cannot pay interest.
  • Article 70 protects client assets and the means of access to them, so key custody is a compliance topic.
  • DORA also applies to CASPs, so ICT risk is a legal duty, not a nice-to-have.

Sources