Start a conversation

Insights

MiCA Regulation: What It Covers, Who It Skips, What to Do Next

MiCA regulation is the EU's Markets in Crypto-Assets Regulation (EU) 2023/1114. It is a single rulebook for issuing crypto-assets and providing crypto services in all 27 member states, and it has applied in full since December 30, 2024. The distinction that matters most is this: MiCA regulates businesses that issue tokens or handle other people's crypto. It does not regulate crypto itself. If you only accept crypto for your own goods and hold your own keys, most of MiCA never applies to you.

TL;DR:

  • MiCA (Regulation (EU) 2023/1114) has applied in full since December 30, 2024. Stablecoin rules started earlier, on June 30, 2024, and national transition periods end no later than July 1, 2026.
  • It covers three token types: e-money tokens, asset-referenced tokens and everything else. Crypto that already counts as a financial instrument, unique NFTs and genuinely decentralized protocols are mostly outside its scope.
  • A non-euro stablecoin that tops 1 million transactions and €200 million a day as a means of exchange in a single currency area must stop issuing. That is a hard ceiling on dollar-coin payments.
  • Minimum capital for a crypto-asset service provider is €50,000, €125,000 or €150,000 depending on the services. The real cost is governance and staffing, not the capital.
  • Merchants who accept crypto for their own goods and keep their own keys are usually not crypto-asset service providers. Many owners overestimate how much MiCA applies to them.
ACTUPON

Not sure where MiCA leaves you?

ActUpon’s crypto and blockchain advisory helps you work out whether MiCA applies to your business and what to do next.

Visit →

Table of Contents

What MiCA Regulation Covers, and the Large Areas It Leaves Out

A hand placing a small stack of coins on a wooden desk next to a closed leather wallet.

The primary goal of MiCA is to replace 27 different national crypto regimes with one EU-wide rulebook. That single rulebook serves four aims: protecting consumers, keeping markets honest, protecting financial stability, and giving firms enough legal certainty to build. Before MiCA, a crypto exchange in France and one in Germany could run under completely different rules. Neither could rely on its home license to serve the other country's customers.

MiCA is now the EU's main regulation for crypto-assets, and it works with two companion laws. The first is the Transfer of Funds Regulation (EU) 2023/1113, which applies the "travel rule" to crypto transfers. The second is DAC8, the tax-reporting directive that requires crypto providers to report customer transactions from January 1, 2026. Together they cover licensing, anti-money-laundering data and tax.

MiCA divides crypto-assets into three categories. Each carries a different level of obligation:

Category What it is Who can issue Key obligation
E-money token (EMT) Stable value referencing one official currency (for example, a euro stablecoin) Credit institutions or e-money institutions only Redemption at par, at any time; no interest paid to holders
Asset-referenced token (ART) Stable value referencing a basket, commodity, or several currencies Authorized issuers (or credit institutions) Reserve of assets, own-funds requirements, approved white paper
Other crypto-assets Everything else, including utility tokens and most altcoins Any legal person meeting white-paper rules Publish and notify a white paper; marketing must be fair and clear

The exclusions matter just as much as the categories:

  • Financial instruments. A token that already counts as a security falls under MiFID II, not MiCA.
  • Unique NFTs. Unique, non-fungible tokens are mostly outside scope. A "collection" of 10,000 interchangeable pieces may not qualify for that exclusion.
  • Fully decentralized services. Protocols with no identifiable provider are excluded. Very few projects that call themselves decentralized pass this test once a regulator looks at who controls the front end and the admin keys.
  • Lending and staking. Crypto lending and borrowing are largely outside MiCA. The Commission is required to report on whether to regulate them later.

The Three Dates That Decide Your Exposure: June 2024, December 2024, July 2026

A café owner passing a paper bag across the counter to a customer holding a phone.

MiCA entered into force on June 29, 2023, but businesses felt its effects in three stages.

  • June 30, 2024. The stablecoin rules (Titles III and IV, covering ARTs and EMTs) began to apply. Stablecoin issuers serving EU users needed authorization from this date.
  • December 30, 2024. Everything else applied, including the licensing rules for crypto-asset service providers (CASPs). The travel rule for crypto transfers took effect on the same day.
  • July 1, 2026. This is the latest possible end of the "grandfathering" period. Firms that were already operating under national law could keep going while they applied for MiCA authorization. Each member state chose its own length, up to 18 months, and several chose much less.

The third date is the one most often misread. Grandfathering is not a guaranteed 18 months. If your firm was registered in a country that chose six months, its transition period has already ended. Check the national competent authority's announcement for your country, not a generic summary.

Stablecoins Under MiCA: Why Your Dollar Coin Might Disappear From an EU Exchange

Two people in conversation at a small window-side table, coffee cups between them.

Stablecoins are where MiCA has had the most visible effect on the market. An exchange serving EU customers may only offer a stablecoin whose issuer is authorized under MiCA. When the largest dollar stablecoin by market capitalization had no MiCA authorization, several EU platforms restricted or delisted it for EEA users. Other dollar and euro stablecoins whose issuers had obtained e-money licenses stayed available.

The reserve rules are specific. EMT issuers must deposit at least 30% of the funds they receive with credit institutions. That rises to 60% for issuers designated as significant. The rest must sit in secure, low-risk assets in the same currency. Holders can redeem at par at any time. No issuer or CASP may pay interest on an EMT or ART, so a "yield-bearing stablecoin" sold to EU retail customers is not allowed under MiCA.

The European Banking Authority takes over direct supervision of tokens deemed "significant." The criteria include more than 10 million holders, more than €5 billion in value or reserves, or more than 2.5 million transactions and €500 million in transaction value per day.

A non-euro stablecoin used as a means of exchange in a single currency area must stop issuing once it exceeds 1 million transactions and €200 million per day.

That cap is how MiCA protects the euro's role in payments. It is also why any payments business built on dollar stablecoins for EU customers should model this ceiling before scaling, not after.

Crypto-Asset Service Providers: Capital Floors, Passporting, and the Home-State Trade-Off

If your business holds crypto for customers, runs a trading venue, exchanges crypto for cash, executes orders, advises on crypto, or transfers crypto on someone else's behalf, you are a CASP. You need authorization from a national competent authority. Once you have it, the license is valid across the whole EEA. This cross-border permission is called the "passport," and it is the main commercial reward MiCA offers.

The minimum capital requirements are lower than most founders expect:

Service class Examples Minimum permanent capital
Class 1 Order reception and transmission, advice, execution, placing, transfer services, portfolio management €50,000
Class 2 Custody, exchange of crypto for funds or other crypto, plus Class 1 services €125,000
Class 3 Operating a trading platform, plus Class 2 services €150,000

The capital is the easy part. The real cost is everything else: suitably qualified management based in the EU, documented conflicts-of-interest and complaints procedures, segregated client assets, an outsourcing framework, and anti-money-laundering controls that comply with the travel rule. Under the EU travel rule, there is no minimum transfer amount below which the rule stops applying. Every transfer between CASPs must carry originator and beneficiary data. For transfers above €1,000 to or from a self-hosted wallet, the CASP must check that the customer owns that wallet.

Pro Tip: Do not choose your home state just because it promises the fastest authorization. The European Securities and Markets Authority has signaled that it is watching for uneven supervision between member states. A license from a regulator seen as lenient attracts closer questions from banks, payment partners and, in time, other regulators. If you plan to raise money or secure banking relationships, choose the regulator whose approval your counterparties will trust, even if it takes longer.

Firms outside the EU have very little room to operate without a license. MiCA's reverse-solicitation exemption covers only services provided at the client's own exclusive initiative. ESMA's guidelines interpret that narrowly. If you run EU-targeted advertising, offer a localized site or send outreach emails, you cannot rely on the exemption.

Minimum capital by CASP service class: Class 1 €50,000; Class 2 €125,000; Class 3 €150,000

Is Coinbase MiCA-Compliant? What an Authorization Actually Proves

Yes. Coinbase announced in June 2025 that it had obtained MiCA authorization from Luxembourg's financial regulator, the CSSF. It made Luxembourg its EU hub and can passport its services across the bloc. You can check any provider yourself on ESMA's interim MiCA register, which lists authorized CASPs, white papers and non-compliant entities.

Authorization does not mean every product a provider offers is MiCA-regulated. It covers the crypto-asset services listed in the license. Staking programs, lending products and services offered to non-EU customers can sit outside it. Before you rely on any platform's "MiCA-licensed" badge, check which entity holds the license, which services it covers and which entity is actually your contractual counterparty.

The Case Where the Obvious Answer Is Wrong: Merchants Accepting Crypto

Most business owners assume that accepting crypto puts them under MiCA. Usually it does not. If you sell your own goods or services and take bitcoin or a stablecoin as payment, you are not providing a crypto-asset service to a client. You are being paid. No CASP license is required for that.

The picture changes depending on how you take payment:

  • Self-custody acceptance. You run your own payment server and the funds go to wallets you control. You are a merchant, not a CASP. A self-hosted setup such as BTCPay Server fits this model.
  • Processor-mediated acceptance. A third party receives the crypto and settles in euros. The processor is providing a regulated service and must be authorized. Your job is to confirm that it is.
  • Holding crypto for others. You keep customer balances, offer "store credit" in crypto, or move crypto between users. You have probably become a CASP, whether you meant to or not.

How you settle matters too. Our breakdown of choosing business payment rails by finality explains why the settlement design you pick has consequences beyond regulation.

Accepting crypto for your own goods is not a crypto-asset service. Holding crypto on behalf of your customers almost certainly is.

How the US Compares: The GENIUS Act and the Unfinished Market-Structure Fight

The current US approach is narrower than MiCA. In July 2025, the GENIUS Act became law. It created a federal framework for payment stablecoins that requires full one-to-one reserves in cash and high-quality short-term assets such as Treasury bills, with regular public disclosure of what those reserves contain. It covers stablecoins, not crypto markets as a whole.

The broader question of which tokens are securities and which are commodities is still unsettled. That question also determines whether the SEC or the CFTC supervises a given token. A market-structure bill passed the House in 2025, but check its current status before you plan around it. Until Congress acts, US crypto businesses operate under a mix of federal agency interpretations and state licensing regimes such as New York's BitLicense.

The practical difference for your business is that the EU offers one license and one passport, while the US still involves agency-by-agency and state-by-state work. If you serve both markets, plan for MiCA first. It is the more complete and more predictable rulebook, and much of the governance it requires will also satisfy US counterparties.

What to Do This Quarter if You Have EU Customers

  • Map your activities against the CASP list. Write down each crypto activity your business performs and mark whether it involves your own assets or clients' assets. That single distinction answers most scoping questions.
  • Check your providers on ESMA's register. Confirm that every exchange, custodian and processor you depend on is authorized, or is still within a transition period that has not yet expired.
  • Audit your stablecoin exposure. If treasury or payment flows depend on a stablecoin without a MiCA-authorized issuer, have a replacement ready before an exchange delists it.
  • Prepare for DAC8. Your CASPs will report your transactions to tax authorities, so make sure your own records match.
  • Get qualified help. If you need outside support, our guide to spotting a real crypto consultant covers the questions to ask.

Most of the expensive MiCA mistakes we see happen before any lawyer is involved. Some businesses apply for a license they did not need. Others drift into holding customer funds without noticing, or build a product on a stablecoin that is about to lose its EU listing. ActUpon's crypto and blockchain consulting begins with a map of your actual activities against MiCA's service categories. We then help you restructure where that removes the obligation entirely, for example by moving to self-custody payment acceptance through our sister service, Myntli hosted BTCPay Server.

Our engagements can be performance-based, with fees tied to agreed, measurable results rather than hours billed, so the incentive is to keep your scope small rather than to grow it. Here is the honest limit: ActUpon is not a law firm. If you need a CASP authorization, the filing itself needs licensed counsel in your chosen home state. What we offer is making sure you only pay for the legal work you actually need.

Frequently Asked Questions

What is the primary goal of MiCA?

MiCA's main goal is to replace the EU's patchwork of national crypto rules with one harmonized framework. That framework is designed to protect consumers, keep markets honest and protect financial stability. It also gives compliant firms a single license that works across all EEA member states.

When did MiCA take full effect?

The stablecoin rules applied from June 30, 2024, and the rest of MiCA, including licensing for crypto-asset service providers, applied from December 30, 2024. Firms already operating under national regimes may have a transition period, which ends no later than July 1, 2026, depending on the member state.

Do I need a MiCA license to accept crypto payments in my business?

Usually not, if you accept crypto for your own goods or services and control the wallets yourself. A license becomes relevant when you hold crypto for customers, exchange it for others, or transfer it on their behalf. If a payment processor handles the crypto for you, the processor needs authorization, not you.

Is Coinbase MiCA-compliant?

Yes. Coinbase announced in June 2025 that it had received MiCA authorization from Luxembourg's CSSF, which allows it to passport services across the EU. The authorization covers the specific services listed in the license, so check that the product you use falls within them.

What is the current US legislation on cryptocurrency?

The GENIUS Act, signed in July 2025, sets federal rules for payment stablecoins, including full one-to-one reserves. Broader crypto market-structure legislation has not yet been enacted, so SEC and CFTC interpretations and state licenses such as New York's BitLicense still govern much of the market.

Does MiCA regulate NFTs and DeFi?

Unique, non-fungible tokens and fully decentralized services without an identifiable provider are mostly outside MiCA. Large collections of similar NFTs and "decentralized" projects with a controlling team may still fall within scope. The European Commission is required to report on whether these areas need dedicated rules.

Sources

ActUpon

Want a number moved, not a report written?

We agree one measurable target with you, do the work, and get paid when the number moves. Not before.

Start a conversation

What we do