Markets in Crypto-Assets Regulation (MiCA)

Markets in Crypto-Assets Regulation (MiCA)

Have you ever wondered how your crypto-assets are protected within the borders of the European Union?

What is the Markets in Crypto-Assets Regulation (MiCA)?

Following an extensive preparation process carried out through the cooperation of various official institutions within the European Union, the Markets in Crypto-Assets Regulation (MiCA) entered into force, not only filling a significant legal gap in this field but also establishing a harmonized set of rules applicable to crypto-assets throughout the European Union.

There is a single criterion for determining the persons and/or entities subject to the obligations set out under MiCA, namely whether the asset qualifies as a financial instrument. MiCA aims to regulate all crypto-assets that do not fall within the definition of financial instruments and therefore remain outside the scope of existing financial regulations.

Financial instruments, bank deposits, investment funds, life insurance products, private pension schemes, non-fungible tokens (NFTs), and decentralized finance (DeFi) instruments are excluded from the scope of MiCA and are therefore not subject to the obligations imposed by the Regulation.

MiCA introduces some of the strictest reserve and issuance requirements in the world for stable crypto-assets (ARTs and EMTs) in order to limit the systemic risks they may pose to the global financial system.

For a stablecoin to be classified as systemic, it must meet at least three of the following criteria: reaching more than 10 million users across the EU, exceeding EUR 5 billion in total issued asset value, recording more than 2.5 million daily transactions on average, or surpassing EUR 500 million in daily transaction volume. Once a stablecoin becomes systemic, supervisory authority is transferred directly to the European Banking Authority (EBA). In addition, issuers become subject to enhanced liquidity management requirements, independent stress testing obligations, and fair access obligations towards Crypto-Asset Service Providers (CASPs).

The depeg crisis experienced by USD Coin (USDC) during the collapse of Silicon Valley Bank (SVB) in 2023 fundamentally changed regulators' perspective on reserve concentration risks. Consequently, MiCA limits the proportion of reserves held with a single banking institution to 10% and caps exposure to the same banking group at 30%, thereby reducing concentration risk.

MiCA also introduces a significant restriction on the use of stablecoins pegged to non-EU currencies, particularly the US Dollar, as a means of payment. Under the Regulation, if a stablecoin linked to a non-EU fiat currency exceeds either one million daily transactions or EUR 200 million in daily transaction volume, new issuance must be suspended and usage levels reduced below these thresholds. This strict limitation has been heavily criticized by industry participants on the grounds that it may restrict access to global liquidity and isolate European users.

Under MiCA, companies wishing to provide crypto-asset services on a professional or commercial basis must obtain authorization from the relevant National Competent Authority (NCA). Through the "European Passport" mechanism, this authorization enables service providers to operate across all EU Member States without obtaining additional approvals from local regulators.

Pursuant to Article 3(1)(16) of the Regulation, the following activities require authorization: custody and administration of crypto-assets, operation of trading platforms (exchanges), crypto-to-fiat exchange services, crypto-to-crypto exchange services, execution and transmission of orders on behalf of clients, placement of newly issued crypto-assets, reception and transmission of orders, investment advice, portfolio management, and transfer services.

Entities providing such services are legally required to continuously maintain minimum prudential capital levels corresponding to the degree of risk associated with their activities:

• Firms providing lower-risk services such as investment advice, portfolio management, or order transmission must maintain a minimum capital requirement of EUR 50,000.
• CASPs engaging in crypto-to-fiat or crypto-to-crypto exchange activities, dealing on their own account, or providing custody services are subject to a minimum capital requirement of EUR 125,000.
• Entities operating trading platforms and performing order matching functions must maintain a minimum capital requirement of EUR 150,000.

Operational and Cybersecurity Standards

Considering the potential impact of cyber risks on the financial system, all CASPs are required to comply with the standards established under the Digital Operational Resilience Act (DORA). Within this framework, companies must conduct penetration testing, establish cyber incident reporting mechanisms, and implement comprehensive business continuity and disaster recovery (BCP/DR) infrastructures.

Entry into Force

As part of MiCA's phased implementation schedule, Member States were granted the authority to establish transitional ("grandfathering") periods in order to preserve business continuity for existing crypto service providers already registered or supervised within their jurisdictions. However, this discretion has not been exercised uniformly, and transition periods vary depending on the maturity of individual markets.

Regardless of the transitional periods established by Member States, 1 July 2026 constitutes the final and non-extendable deadline under Article 143 of MiCA for the termination of all transitional rights across the European Union and the European Economic Area (EEA). As of 1 July 2026, no entity lacking a fully compliant MiCA CASP authorization will be permitted to provide crypto-asset services to EU residents.

Legal entities that continue operating without authorization after this date may face severe administrative penalties of up to 3% of annual turnover or EUR 5 million. Companies that are unable to complete the authorization process in time will be legally required, before 1 July 2026, either to migrate customer assets securely to another licensed CASP or to cease operations entirely and implement appropriate wind-down plans.

Conclusion

As of 1 July 2026, the rules governing crypto-asset activities within the European Union will be fundamentally reshaped for individuals and businesses currently engaged in, or planning to engage in, commercial crypto-asset activities.

To navigate this evolving regulatory landscape and mitigate the risk of significant administrative penalties, businesses may benefit from working with a specialized legal team and obtaining professional guidance from Legalifi throughout the compliance process.