MiCA CASP licensing: what stablecoin issuers and exchanges must do before deadlines

No piece of regulation in the history of crypto has redrawn a market as completely as MiCA has redrawn the European one. The Markets in Crypto-Assets Regulation turned a patchwork of twenty-seven national approaches into a single rulebook, and it did so on a schedule that gave companies a runway measured in years — and then, in a way that caught many operators unprepared, ended the runway. Stablecoin rules took effect in mid-2024; the licensing regime for crypto-asset service providers followed at the end of that year; and the transitional grace periods that allowed unlicensed incumbents to keep operating ran out across the Union by mid-2026. For anyone reading this after that date, the situation is blunt: operating a crypto service in the EU without CASP authorization is no longer a compliance gap to fix at leisure — it is grounds for enforcement, service bans and, in practice, delisting by every bank and payment partner an exchange depends on. But the practical picture is more nuanced than the deadline itself, because what issuers and exchanges “must do” now splits into two very different work streams: the remediation stream, for firms that missed the window and need to either obtain authorization quickly or exit the market, and the ongoing stream, for firms that are licensed and now face the continuous obligations that make the license worth keeping. This article walks through both, starting with the rules themselves, because every requirement downstream — capital, reserves, whitepapers, passporting — traces back to how MiCA classifies what a company does.

The framework in one view: who is regulated and when

MiCA regulates two distinct populations, and confusing them is the most common analytical error in the space. The first population is stablecoin issuers — issuers of e-money tokens (EMTs, tokens pegged to a single currency) and asset-referenced tokens (ARTs, tokens pegged to a basket or to other assets). The second is crypto-asset service providers — the operators of exchanges, custody platforms, brokerages, transfer services, advisory services and portfolio managers. The two populations are regulated under different titles of the regulation, on different timelines, and by different logic: issuers are regulated like issuers of electronic money, with balance-sheet obligations; service providers are regulated like financial intermediaries, with conduct and prudential obligations.

The dates that define the entire compliance calendar are few:

Milestone	Date	What changed
Regulation entered into force	June 2023	Rulebook in place, most provisions not yet applicable
Stablecoin rules applicable	June 30, 2024	EMT and ART issuance, reserve and disclosure requirements became mandatory
CASP regime applicable	December 30, 2024	Authorization required for operating exchange, custody and other crypto services
End of transitional grandfathering	By June 30, 2026 at the latest	Unlicensed legacy operators required to hold CASP authorization or cease regulated activities
Continuous obligations	From authorization onward	Reporting, governance, prudential maintenance, DORA-aligned operational resilience

The transitional row deserves emphasis because it is where the market’s visible shakeout happened: member states could let grandfathered providers continue operating for up to eighteen months beyond the end of 2025, and several used the full extension, while others cut the period short. A firm that assumed the Union-wide maximum deadline and happened to operate in a member state that chose the shorter one discovered this the expensive way. By late 2026 the question for a significant share of operators is no longer “when must I apply” but “what does being licensed actually require me to do every month” — and the sections below cover both sides of that line.

Stablecoin issuers: the obligations that redefined the category

Issuing a euro- or dollar-pegged token in the EU after mid-2024 requires an authorization as a credit institution or as an electronic money institution — the same categories of license that power pre-paid cards and e-money services. The analogy is deliberate: MiCA treats stablecoins as a form of electronic money, and much of the regime imports the safety logic of the e-money world into crypto.

The obligations that define a compliant EMT issuer:

• Full backing, segregated and diversified. Reserves must match the tokens in circulation one to one, be segregated from the issuer’s own funds, and be held in a diversified mix of insured bank deposits, short-term instruments and similar liquid assets. The era of stablecoins backed partly by one’s own corporate paper, or by promises of future collateralization, is legislatively over in the EU.
• Redemption on demand at par. Holders have a legal right to redeem tokens at face value, within disclosed timelines and at par value, without conditions that erode the peg. Redemption policies must be published and actually honored — supervisory attention focuses here first.
• No interest to holders. MiCA prohibits paying interest on e-money tokens, a provision that reshaped the economics of yield-linked stablecoins and pushed yield products into separate structures. Marketing a compliant EMT as an interest-bearing instrument is itself a violation.
• A crypto-asset whitepaper, published and pre-notified. Issuers must publish a whitepaper meeting prescriptive content requirements and notify it to their competent authority at least twenty days before any offering or listing. The document is not marketing collateral; it is a regulated disclosure, and deficiencies in it are actionable.
• Ongoing disclosure and reporting. Issuers must publish reserve composition periodically, report to their authority, and — once a token crosses the “significant” thresholds set in the regulation, based on holders and usage — submit to enhanced supervision, including potential oversight involvement at the European level.

The significance thresholds deserve a note: tokens used by very large numbers of holders, or processed at very high volumes, are classified as significant and face an additional layer of capital, liquidity and oversight requirements. The largest euro- and dollar-denominated tokens in the EU sit in this category, and their issuers’ compliance function is correspondingly heavier — but the design principle is uniform across the category: the token is only as good as its reserves, its custodian arrangements and its redemption machinery, and the regulation demands that all three be demonstrable at all times.

A related consequence that reshaped the exchange landscape: trading venues and CASPs in the EU may offer EMTs only if they are issued by authorized issuers, and non-compliant tokens have been progressively delisted or restricted in European markets. Exchanges therefore became an enforcement arm of the stablecoin regime by design — which brings the discussion to the service-provider side.

CASP authorization: what the license actually requires

A crypto-asset service provider authorization covers a defined list of services: execution of orders, operation of a trading platform, custody of crypto assets, exchange services between crypto and fiat, advice, portfolio management and transfer services, among others. A firm must hold authorization for each service it actually performs — an exchange that also provides custody and transfer services needs those services within its authorization, not just its trading activity.

What an authorization application must demonstrate, and what the regulator examines:

1. A program of operations. The core document: what services the firm will provide, how, with what governance, to whom. Regulators expect specificity — vague descriptions of “providing crypto services” do not survive review.
2. Governance and fit of the management body. The management team’s composition, fitness and integrity checks, and the internal control architecture — three lines of defense, risk management, compliance function, internal audit — are examined directly, not through templates.
3. Prudential safeguards scaled to the business. Capital requirements are tiered according to services performed and funds held: firms that never touch client assets face a lower threshold; firms holding client funds or providing custody face materially higher ones, with the top tier applying to those managing very large volumes of client assets. The design is straightforward — the more client money the firm touches, the more balance sheet behind it.
4. Client asset protection. Custody rules require segregation of client assets from proprietary assets, defined bankruptcy-remote arrangements, and controls over private keys and recovery procedures. This is the provision most frequently found deficient in first-round applications, because it requires operational design, not policy documents.
5. ICT resilience and operational continuity. MiCA’s technology governance provisions sit alongside the EU’s digital operational resilience framework; regulators expect documented systems, incident procedures, security policies and — in practice — evidence, not intentions.
6. Conflicts, complaints and marketing compliance. Conflicts-of-interest policies, complaint-handling procedures and compliance with MiCA’s marketing rules — including prohibitions on misleading communications — round out the conduct layer.

The application process itself is demanding in schedule terms: the home-state authority must assess a complete application within a defined working-day period, with permissible pauses for information requests that, cumulatively, can extend the process substantially. In practice, first-time applicants in the post-deadline period report timelines of many months, driven less by the regulator’s statutory clock than by the quality of the application: firms that prepared complete, specific, evidence-backed files moved in months; firms that submitted template packages spent a year exchanging clarifications.

One further point about scope: authorization in one member state passesports across the entire Union. The single-license logic is the regime’s most valuable structural feature — a CASP licensed in, say, a well-regulated smaller member state can serve clients across the EU without twenty-six separate applications — but the passport does not immunize the firm from supervision in the states where it operates, and the home authority retains primary oversight.

The remediation path: what late movers must do now

For firms still operating without authorization — whether because their application is pending, because they missed the deadline, or because they discovered their activity falls within MiCA’s scope only recently — the options narrow to three, and each carries a different risk profile.

The decision framework for late movers:

1. Obtain authorization as quickly as possible. For firms with viable businesses, the only sustainable path. The strategy that works is preparation before submission: engaging advisors who know the regulator’s expectations, building the evidence pack (governance documentation, custody controls, ICT systems, financial projections) before filing rather than during review, and choosing a home jurisdiction deliberately, since the regulator’s depth and pace differ across the Union.
2. Restructure activities to fall outside regulated scope. Some businesses can be redesigned — for example, pure agency models that never touch client assets, or referral arrangements with licensed partners — reducing the services requiring authorization. This is a legitimate path when the underlying economics support it, and a tempting shortcut when they do not; regulators have shown little patience for scope engineering that is really scope evasion.
3. Exit or partner. Firms unwilling or unable to fund a full authorization — the realistic budget spans from low six figures for the simplest service sets to far more for custody-heavy operations, once advisors, capital, staffing and timelines are counted — face the choice of exiting the EU market or operating through a licensed partner’s infrastructure. Both are honorable outcomes; continuing to operate unlicensed is neither, and enforcement actions against operators who chose it have been public and consequential.

The second-order effects of missing the window extend beyond enforcement: banking partners, payment processors and white-label technology providers now run their own MiCA checks, and an unlicensed status creates friction across the entire commercial chain. In many cases the market, before the regulator, has already priced in the gap.

Life after the license: the obligations that never pause

Authorization is a starting line, not a finish line, and the ongoing obligations are what turn MiCA from a one-time project into a permanent compliance function. Firms that treated licensing as the project and underestimated the after-care are the ones now accumulating findings in supervisory reviews.

The continuous obligations that dominate the post-licensing calendar:

• Prudential maintenance. Own funds must stay above thresholds as the business grows; custody volumes push firms into higher tiers; capital planning becomes a live activity rather than a filing exercise.
• Regular reporting and register upkeep. Periodic reporting to the home authority, updated information in the public register, and notification of material changes — business model shifts, new services, key personnel changes — keep the authorization accurate. Letting the register go stale is a common and entirely avoidable finding.
• Operational resilience under DORA. The EU’s digital operational resilience framework applies to CASPs in parallel with MiCA, with its own incident reporting, testing and third-party risk requirements; the two regimes reinforce each other and share the same root expectation: that the firm can survive its own technology failing.
• AML alignment. The EU’s anti-money-laundering package, including the transfer-of-funds rules that bring the “travel rule” to crypto transfers, imposes correspondent obligations on CASPs alongside the traditional AML duties; a single market-wide anti-money-laundering authority adds a supranational layer of supervision for the largest firms.
• Whitepaper and marketing discipline for issuers. Issuers’ obligations do not end with issuance: reserve disclosures, reporting, and the accuracy of any ongoing marketing material remain continuously supervised.

The financial weight of this layer is worth stating plainly for planning purposes: annual compliance costs for a licensed mid-sized CASP — regulatory staff, audit, technology, reporting — typically run well into six figures, and the cost scales with the ambition of the service set. This is by design: MiCA prices out casual operators, and the firms that remain are those for which the EU market justifies the fixed cost of being in it properly.

Common failure patterns — and how to avoid them

Across the waves of applications and enforcement that the transition produced, the same handful of mistakes accounts for most of the failures. They are worth naming because every one of them was avoidable:

• Treating the application as a document exercise. Firms that assembled policies without building operations behind them — custody controls that exist on paper only, governance without working meetings, risk frameworks without data — passed neither scrutiny nor reality.
• Underestimating the prudential tier. Firms that classified themselves by their current size rather than their business model discovered that growth into custody changed their capital requirements mid-journey; prudential planning must anticipate the model, not just the moment.
• Choosing the home state by cost alone. The cheapest jurisdiction is not the fastest to authorize, and a license obtained in a regulator with limited capacity does not passport faster than a rigorous one; timeline risk dominates cost differences in the realistic planning horizon.
• Ignoring the issuer-service-provider split. Stablecoin issuers who assumed their issuance authorization covered exchange activity — and exchanges who assumed their authorization covered issuing — learned that MiCA regulates the two populations separately, and that the activities are not interchangeable.

Each pattern reduces to the same root cause: treating MiCA as a filing obligation rather than an operating model. The firms that navigated the transition without drama were those that rebuilt their operating model around the regulation early — and the cost of doing so, in almost every observed case, was lower than the cost of the alternatives.

Conclusion

MiCA did not merely set deadlines; it sorted the European crypto market. Stablecoin issuers now operate under balance-sheet rules that make the token’s safety a matter of demonstrable reserves, legal redemption rights and regulated authorization, and exchanges and other service providers operate under a single EU-wide license whose conditions — governance, prudence, custody, resilience — are examined before launch and supervised after it. The transitional grace periods that once softened this reality ended by mid-2026, and the market’s structure has settled accordingly: licensed incumbents, licensed newcomers, and a thinning population of operators whose unlicensed status is now both legally exposed and commercially penalized.

For the work that remains, the division is clean. Late movers need a remediation decision — authorize quickly with a complete, evidence-based application, restructure genuinely outside scope, or exit through partnership or withdrawal — and the window for choosing is narrower than the desire to wait for clarity would suggest. Licensed firms need the unglamorous discipline of ongoing compliance: capital maintenance, reporting, resilience, AML and the continuous accuracy of everything they disclosed to obtain their license in the first place. Neither stream rewards improvisation. The firms that treat MiCA the way traditional finance treats its rulebooks — as the permanent operating environment rather than a project with an end date — are the ones positioned to keep the single market they invested so heavily to enter. The deadlines made the market; the obligations keep it; and in both respects, the regulation is doing exactly what its drafters intended.