MiCA explained for non-lawyers: a 2026 guide for EU businesses
For founders, operators, and finance leads. Plain language and primary sources.
MiCA is the EU's first single rulebook for crypto-assets. The regulation entered into force on 29 June 2023, has applied in full since 30 December 2024, and covers you if you issue, trade, exchange, custody, or transfer crypto for clients in the EU. The transitional period for existing crypto businesses ended on 1 July 2026. Since then, any firm providing crypto-asset services to EU clients without a MiCA authorisation is in breach of EU law and has to wind down.This explainer summarises MiCA in plain language. It is not legal advice. Talk to qualified counsel before making operational or compliance decisions.
The five-second summary: what is the Markets in Crypto-Assets Regulation (MiCA)?
MiCA is Regulation (EU) 2023/1114, the EU's single rulebook for crypto-assets. It applies to crypto-asset service providers (CASPs), stablecoin issuers, and any firm marketing crypto services to EU clients. The MiCA regulation was proposed by the European Commission in 2020 and adopted by the European Parliament and the Council in 2023. Stablecoin rules have applied since 30 June 2024, the main regime since 30 December 2024, and the transitional period for grandfathered firms ended on 1 July 2026.
What MiCA aims to achieve
The European Commission proposed MiCA as part of its 2020 Digital Finance Package to replace national regimes with one framework. Its stated aims are:- legal certainty for crypto-assets that aren't covered by existing financial services law
- investor protection and consumer protection, through authorisation, disclosure and custody rules
- market integrity, with rules against market manipulation and insider dealing
- financial stability, through reserve and liquidity requirements for stablecoins and direct EBA supervision of significant tokens
- support for innovation, by giving firms one licence for the whole EU
Does MiCA apply to my business?
The short answer is: if you provide crypto-asset services to anyone in the EU, or issue a stablecoin denominated in a fiat currency, almost certainly yes. The longer answer depends on what you do day to day. Four common profiles:
"I run a crypto exchange or wallet for EU users"
You're a CASP under MiCA. You need an authorisation from a national competent authority – in Finland, that's the FIN-FSA; in Germany, BaFin; in France, the AMF – in one EU member state, which then passports across the EEA. If you were operating under a pre-MiCA national VASP registration before 30 December 2024, your transitional cover ended on 1 July 2026 at the latest. In many member states it ended earlier, in 2025 or January 2026. Finland, Lithuania, Germany, the Netherlands, Ireland, Latvia, Hungary, and Austria all shortened their grandfathering windows. If your authorisation wasn't granted by your jurisdiction's deadline, you have to stop serving EU clients.
"I issue a stablecoin pegged to a fiat currency"
You're either an EMT or ART issuer. If your token references a single fiat currency – EUR, USD, GBP – it's an e-money token (EMT) and only an EMI or credit institution can issue it. If it references multiple currencies, commodities, or a basket of crypto-assets, it's an asset-referenced token (ART) and you need a separate ART authorisation under Title III. Both regimes have been live since 30 June 2024. Algorithmic stablecoins without a real reserve fall outside the ART and EMT definitions but typically can't be offered to the public in the EU at all.
"I accept stablecoin payments but don't custody crypto"
Probably not directly, but it depends on the flow. MiCA's CASP regime triggers on services provided to clients: custody, exchange, trading, transfer, execution, advice, portfolio management. If you accept a stablecoin payment and immediately convert it to fiat through a licensed third-party CASP or PSP, you're a merchant. Your provider's MiCA status is what matters. Check that whoever processes your crypto flows appears on ESMA's register of authorised CASPs and not on its list of non-compliant entities.
"I'm a non-crypto SaaS adding crypto features"
What changes depends on the feature. Adding a "pay with USDC" checkout that routes through a licensed CASP doesn't make you a CASP. Building your own custody, swap, or transfer service does. Holding stablecoins in treasury for operational use isn't a CASP service either, but it's worth a conversation with your auditor about how the holding is classified under IFRS or your local GAAP. The threshold question is whether you're providing the crypto service yourself or consuming someone else's.
The plain-English glossary
The regulation is dense. These are the terms that come up first, in plain language:- CASP Crypto-Asset Service Provider. A firm offering regulated crypto services in the EU, like exchanging, custodying, transferring, or trading crypto. Needs a MiCA authorisation from a national regulator.
- ART Asset-Referenced Token. A stablecoin that references more than one fiat currency, commodity, or a basket of assets. Strict reserve, governance, and disclosure rules apply.
- EMT E-Money Token. A stablecoin that references a single fiat currency (EUR, USD, GBP). Treated as e-money under EU law, so only EMIs and credit institutions can issue them. USDC and EURC are the obvious examples.
- White paper The mandatory disclosure document an issuer publishes before offering a crypto-asset to the public. Covers the issuer, the project, the risks, and the technology. Approved or notified depending on token type.
- Significant ART or EMT A stablecoin large enough to trigger direct EBA supervision. Thresholds are tied to user numbers, market cap, and daily transaction volume.
- Passport An authorisation in one EU member state lets a CASP or stablecoin issuer serve clients across all 27 by notifying each host regulator. No second licence needed.
- Reverse solicitation The narrow exemption that lets non-EU firms serve EU clients only if the client approached them first, unsolicited. ESMA's 2025 guidelines made this much harder to rely on in practice.
- NCA National Competent Authority. The regulator in each EU country that authorises CASPs and supervises them. Finland: FIN-FSA. Germany: BaFin. France: AMF. Ireland: Central Bank of Ireland, etc.
Key dates and what changes when
MiCA didn't switch on overnight. It rolled out in stages, and the most important date for most readers is the one closest to today.30 June 2024Titles III and IV (stablecoin rules) started to apply. ART and EMT issuers needed authorisation from this point.
30 December 2024Title V (the main CASP regime) started to apply. Crypto-asset service providers could apply for authorisation under the new framework.
2025 to January 2026Member states with shortened transitional periods closed their grandfathering windows. Finland, Lithuania, Germany, the Netherlands, Ireland, Latvia, Hungary, and Austria are in this group.
17 April 2026ESMA issued a statement on wind-down expectations for unauthorised CASPs and client migration expectations for authorised ones.
1 July 2026The EU-wide transitional period ended, with no extensions. Firms without a MiCA authorisation must stop providing crypto-asset services to EU clients and wind down in an orderly way.
What changed after 1 July 2026
The end of the transitional period moved MiCA from a deadline to day-to-day supervision. Three things follow for the crypto market:- Only authorised firms can serve EU clients. The Article 59 prohibition now applies in full. A firm needs a granted authorisation, not a pending application, and national regimes no longer give any cover.
- Unauthorised firms are winding down. ESMA asked firms without authorisation to prepare orderly wind-down plans that close client relationships and return or transfer client assets.
- Counterparty checks matter more. Banks, EMIs and payment providers working with crypto businesses check counterparties against ESMA's register of authorised CASPs as part of their customer due diligence. Transacting with an unauthorised firm carries legal and reputational risk.
What does MiCA actually require?
The regulation runs to several hundred pages, but the substantive obligations sit in a handful of areas.AuthorisationEvery CASP needs an authorisation from a national regulator before serving EU clients. The application covers governance, ownership, business plan, risk management, AML controls, IT security, capital, and client-asset safeguarding. Realistic timelines run from several months to over a year depending on jurisdiction and application quality. Operationally, this means anyone treating "we'll apply later" as a strategy is already late.
Capital requirementsInitial capital ranges from EUR 50,000 to EUR 150,000 depending on the service class, with ongoing own-funds requirements tied to fixed overheads. Class 1 (advice, reception and transmission, placing) sits at the low end. Class 3 (operating a trading platform) sits at the top. For firms also subject to PSD2 – including CASPs that custody or transfer EMTs – the EMI or PI capital floor stacks on top of the MiCA requirement. Translated: a CASP doing EMT custody pays for both regimes.
Custody and segregation of client assetsClient crypto-assets have to be held separately from the CASP's own assets, recorded on a register, and reconciled daily. Private keys and means of access must be stored securely with documented procedures for recovery. If client assets are lost through operational failure, the CASP is liable. Operationally, this is the area where exchanges and custody providers spend the most engineering time, because pre-MiCA segregation practices were often weaker than the regulation requires.
Marketing and disclosureCommunications have to be fair, clear, and not misleading. Risk warnings are mandatory in client-facing copy. Sponsoring an influencer to promote your service to EU users counts as marketing under MiCA, with the same disclosure obligations. Practically, this is the area where startups get caught out fastest: a "buy crypto in three taps" ad without the risk warning is a finable offence from day one.
White paper requirementsIssuers of crypto-assets that aren't ARTs or EMTs (most utility tokens, for example) publish a white paper before offering to the public. The document is notified to the home-state regulator and accompanied by a summary in the language of each member state where the offer is made. ART white papers have to be approved before issuance; EMT white papers are notified. Translated: the white paper is a regulated disclosure, not marketing collateral.
The cross-border passportA MiCA authorisation in one EU member state covers all 27 once the home regulator has notified each host regulator the CASP plans to serve. There's no second licence to obtain and no second fee. The passport made the choice of home jurisdiction commercially important: a faster, well-resourced NCA gets you to market sooner, but the substantive rules are the same everywhere.
How does MiCA compare to MiFID II, AMLD, and TFR?
Four EU regimes overlap on crypto and founders confuse them routinely.MiCA vs MiFID IIMiFID II covers traditional financial instruments and tokenised versions of them. If your token is a tokenised share, bond, fund unit, or derivative, it falls under MiFID, not MiCA. Everything else – utility tokens, stablecoins, payment tokens, most NFTs – sits in MiCA. The split is straightforward in theory and contentious in practice for hybrid instruments. When in doubt, the test is whether the token confers traditional securities rights.
MiCA vs AMLD and the new EU AML PackageAnti-money laundering rules apply to all financial entities including CASPs and EMT issuers. They cover KYC, transaction monitoring, suspicious activity reporting, and beneficial ownership. The new EU AML Package (Regulation 2024/1624 and Directive 2024/1640) progressively replaces the older AMLDs through 2027. MiCA adds crypto-specific prudential and conduct rules on top of the AML framework. You can be, and usually are, in scope of both.
MiCA vs TFR (the Transfer of Funds Regulation)Regulation 2023/1113 implements the FATF Travel Rule for crypto. Every crypto transfer between CASPs has to carry originator and beneficiary information with the transaction. TFR is operational: who sent how much to whom. MiCA is structural: who's allowed to operate at all. If you're a CASP, both apply.
What MiCA means for working with Narvi
Narvi Payments is an EMI authorised by FIN-FSA (licence 3190214-6), not a CASP. We don't custody crypto-assets, we don't operate an exchange, and we're not registered as a virtual asset service provider in Finland. What we provide is the fiat side: dedicated IBAN accounts, SEPA and SEPA Instant rails, SWIFT, and multi-currency wallets – the EUR and FX infrastructure that licensed CASPs and crypto-native businesses use to run their operations.For crypto businesses, three things follow. A CASP authorisation doesn't include EUR rails, so most CASPs partner with one or more EMIs for SEPA and SWIFT. EMT issuance is restricted to EMIs and credit institutions under MiCA, so a CASP planning its own EMT needs EMI capacity in parallel, its own or a partner's. And when a prospect asks "are you MiCA-compliant?", the answer for Narvi is that the question doesn't apply: we're an EMI, not a CASP. What does apply is whether we can onboard a crypto business and process the volumes involved, which we handle through a thorough compliance review during onboarding.FAQ about MiCA
MiCA is the EU regulation that sets common rules for crypto-asset service providers, stablecoin issuers, and crypto-asset markets across all 27 EU member states. It replaces a patchwork of national rules with a single rulebook. The official name is Regulation (EU) 2023/1114. It applies wherever crypto-asset services are provided to EU clients, regardless of where the service provider is based.
It cuts both ways. MiCA gives the crypto market legal certainty: one licence that passports across the EU, clear rules for stablecoins, and investor protection and consumer protection measures that make it easier for banks, payment providers and institutional investors to work with crypto firms.The cost is compliance. Capital requirements, custody rules, white papers and market manipulation controls are expensive, and some smaller firms and stablecoins left the EU market rather than apply. Rules against insider dealing and market manipulation (Title VI) and reserve rules for stablecoins also aim to protect financial stability as the crypto sector grows.
Title III covers asset-referenced tokens (ARTs): stablecoins that reference several currencies, commodities or other assets. Title IV covers e-money tokens (EMTs): stablecoins that reference a single fiat currency, such as USDC and EURC. Both titles have applied since 30 June 2024.
Operating a trading platform is a crypto-asset service under MiCA, so every exchange serving EU clients needs a CASP authorisation. Since 1 July 2026 that applies without exception. Exchanges must publish operating rules, segregate client assets, meet the highest capital tier (EUR 150,000) and have systems to detect and report market manipulation and insider dealing.
ART issuers need authorisation from their national competent authority, an approved white paper, a reserve of assets that covers every token in issue, and governance, liquidity and disclosure rules. The European Banking Authority writes most of the technical standards and directly supervises ARTs that are classed as significant.
An e-money token is a crypto-asset that keeps a stable value by referencing one official currency, such as the euro or the US dollar. Under MiCA, EMTs are treated as electronic money, so only an e-money institution or a credit institution can issue them. Holders have the right to redeem their tokens at par at any time, and issuers can't pay interest on them.
MiCA replaced 27 national regimes with one rulebook. Firms that used to need a registration in each country now get one authorisation and passport it. At the end of June 2026, ESMA's interim register listed 213 authorised CASPs across 23 member states. Firms that didn't get authorised by 1 July 2026 have had to wind down their EU business.
MiCA provides a licensing regime for crypto-asset service providers (CASPs) and crypto-asset issuers. CASPs are new or existing businesses that offer certain crypto-asset services to clients on a professional basis.
Any firm providing one of the ten crypto-asset services listed in MiCA to EU clients needs an authorisation:
- custody and administration of crypto-assets on behalf of clients
- operating a trading platform
- exchanging crypto-assets for funds
- exchanging crypto-assets for other crypto-assets
- executing orders on behalf of clients
- placing crypto-assets
- receiving and transmitting orders
- giving advice on crypto-assets
- portfolio management
- transfer services on behalf of clients
MiCA entered into force on 29 June 2023. Stablecoin rules (Titles III and IV) have applied since 30 June 2024 and the CASP regime (Title V) since 30 December 2024. The transitional period for existing providers ended on 1 July 2026 across the EU, and many member states, including Finland, Germany, the Netherlands and Lithuania, closed their national windows earlier.
No. A CASP licence granted by one EU national competent authority passports across all 27 member states. The home regulator notifies each host regulator the CASP plans to serve. There is no second authorisation and no second fee. At the end of June 2026, ESMA's interim register listed 213 authorised CASPs across 23 member states, led by Germany (55), the Netherlands (26), France (19) and Malta (15), according to Elliptic's count of 29 June 2026.
An EMT (e-money token) is a stablecoin that references a single fiat currency – USDC referencing the US dollar, EURC referencing the euro. Only EMIs and credit institutions can issue them. An ART (asset-referenced token) references more than one fiat currency, a basket of commodities, or a combination of assets. ART issuance requires a separate authorisation under MiCA Title III. EMT rules are stricter on issuance; ART rules are stricter on reserves and governance.
Two things. First, the CASP providing the crypto rails (custody, transfer, exchange) needs a MiCA authorisation. Since 1 July 2026, paying or being paid via an unauthorised CASP exposes both parties to legal and operational risk. Second, the stablecoin used in the payment has to be a regulated EMT or ART. USDC and EURC qualify; some other stablecoins withdrew from the EU market rather than apply. Merchants who accept crypto don't themselves become CASPs as long as they don't custody or transfer crypto for other parties.
Credit institutions don't need a separate CASP authorisation. Under Article 60, a bank can provide crypto-asset services after notifying its national competent authority at least 40 working days before it starts, and it can issue e-money tokens under its banking licence. It still has to meet MiCA's conduct, custody and disclosure rules.
Yes, if they serve clients in the EU. A non-EU firm needs an EU authorisation, usually through an EU subsidiary. The reverse solicitation exemption only covers clients who approached the firm entirely on their own initiative, and ESMA reads it narrowly: any marketing aimed at the EU breaks it.
Since 1 July 2026, providing crypto-asset services to EU clients without authorisation is prohibited. A pending application doesn't count. ESMA has asked these firms to prepare orderly wind-down plans: closing client relationships and transferring or returning client assets.
No. MiCA regulates the firms that provide crypto-asset services, not individuals holding crypto in a self-hosted wallet. The Transfer of Funds Regulation does apply to transfers between CASPs and self-hosted wallets: for transfers above EUR 1,000, the CASP must check that the self-hosted address belongs to its own client.
No. Narvi Payments is an authorised e-money institution regulated by the FIN-FSA in Finland (licence number 3190214-6), with EEA-wide passporting. Narvi does not custody crypto-assets, operate an exchange, or provide any of the regulated crypto-asset services that require a CASP authorisation under MiCA. Narvi provides the fiat infrastructure – IBAN accounts, SEPA, SEPA Instant, SWIFT, multi-currency – that licensed CASPs and crypto-native businesses use for EUR and FX flows.
Start your journey with Narvi: explore what we offer for MiCA-regulated entities and book a demo call:Get to know Narvi
Updated October 30, 2026.Sources:
- Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), full text on EUR-Lex.
- ESMA, Markets in Crypto-Assets Regulation (MiCA), hub page and interim register.
- ESMA, statement on the end of MiCA transitional periods, 17 April 2026.
- Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (TFR).
- European Banking Authority, asset-referenced and e-money tokens under MiCA (technical standards hub).
- FIN-FSA, crypto-asset activities in Finland (authorisation and supervision).
- European Commission, Digital finance package, policy overview.
- Elliptic, What the end of MiCA's transitional period means for crypto businesses, 29 June 2026
- Consob and Bank of Italy, end of the MiCA transitional period, 30 June 2026
Read next:
Banking for Alternative Investment Funds [whitepaper]
A deep dive into alternative investment funds' (AIFs) market growth, regulatory updates, and the discussion of banking and payment needs.
Banking for Family Offices [whitepaper]
Access a 2025 overview of family funds as an industry, their unique banking and payments needs, and how EMIs like Narvi can support them.
Navigating AIFMD II
A 2025 update on the new legislation and implications for EU alternative fund managers.
Navigating the financial segment as an AML entity
Onboarding a business to a banking service demands a profound understanding of its nature and operations. Read the most common questions about AML here.
Ratkaisut
IBAN-tilit yrityksellesi
Aloita täältä
Ajankohtaista (EN)
Family Offices [whitepaper]Shipping Industry [whitepaper]How to Open a Business Account in FinlandNarvi vs. Wise, Revolut, N26, and other alternativesNarvi vs. Stable.comNarvi vs. payabl.Narvi vs. ConnectPayNarvi vs. IBAN4UNarvi vs. GenomeNarvi vs. PaxumNarvi vs. BilderlingsNarvi vs. NetellerNarvi vs. KontistBlogiPayments Glossary
Narvi Payments Oy Ab on valtuutettu sähköisen rahan laitos (EMI). Narvin EMI-toimiluvan myöntää Finanssivalvonta, jonka rekisterinumero on 3190214-6. Narvin toimilupa on voimassa kaikissa Euroopan unionin maissa.
Rakennettu ja säännelty Suomessa© 2026 Narvi. All Rights Reserved.
v1.332.0