What Is MiCA? The EU Crypto Regulation Explained
Quick answer. MiCA is the EU's rulebook for crypto-assets, applying in full since December 30, 2024. It requires crypto-asset service providers to be authorized, stablecoin issuers to back and redeem their tokens, and other token offerors to publish white papers.
Video transcript
MiCA is the EU's rulebook for crypto-assets, applying in full since December 30, 2024. Firms providing crypto-asset services in the EU now need authorization or a notification route.
MiCA sorts its rules by who you are. Token offerors publish white papers, stablecoin issuers need a license and backing, and crypto-asset service providers, called CASPs, need authorization.
Some activity is out of scope: financial instruments, unique non-fungible assets, fully decentralised services with no intermediary, and services within your own corporate group.
One authorization covers the whole EU. Tell your home authority your plans, it forwards them within ten working days, and you can start by the fifteenth calendar day after filing.
E-money token issuers must hold at least 30 percent of reserves in bank accounts. Holders can redeem at par, at any time, with no fee, and interest is banned.
For security, MiCA sets the outcome and points to DORA for ICT. Custody also needs a policy against fraud, cyber threats and negligence, with client assets kept separate.
Stablecoin rules applied from June 30, 2024, and everything else from December 30, 2024. Transitional periods ended by July 1, 2026 at the latest.
Supervision is still moving. The Commission proposed that ESMA supervise all CASPs, but until a final text applies, national authorities remain the supervisors.
Guardian maps your activities to the MiCA provisions that reach them, with controls, evidence and gaps. Read the full guide, or talk to Guardian at guardian.security.
MiCA is the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. As a regulation, it applies directly in every member state (Article 149).
The last transitional periods ended by July 1, 2026. Firms providing crypto-asset services in the EU now need authorization or a notification route.
This page is the overview. Our detailed guides cover the security checklist, what a license costs and how MiCA works with DORA.
This article explains the technical and security side of MiCA (Regulation (EU) 2023/1114). It is not legal advice; confirm how it applies to you with counsel.
What MiCA Covers
MiCA covers issuing, offering and listing crypto-assets, and providing crypto-asset services, in the EU (Article 2(1)).
Its rules are sorted by who you are:
| Who | What MiCA requires | Where |
|---|---|---|
| Offerors of other tokens, such as utility tokens | Notify a white paper at least 20 working days before publishing; no approval | Title II |
| Asset-referenced token (ART) issuers | Authorization, a reserve of assets, own funds | Title III |
| E-money token (EMT) issuers | A bank or e-money license, plus a white paper | Title IV |
| Crypto-asset service providers (CASPs) | Authorization, conduct, custody and governance rules | Title V |
| Anyone dealing in traded tokens | Bans on insider dealing and market manipulation | Title VI |
An EMT references one official currency. An ART references any other value or right, or a mix of them (Article 3(1)).
What is out of scope
- Financial instruments, deposits, and funds unless they are EMTs (Article 2(4)).
- Unique, non-fungible crypto-assets, such as digital art and collectibles (Article 2(3)).
- Services provided "in a fully decentralised manner without any intermediary" (recital 22).
- Services provided only within your own corporate group (Article 2(2)).
Authorization and Passporting
No one may provide crypto-asset services in the EU without CASP authorization or a notification route (Article 59(1)).
MiCA lists ten services, from custody and trading platforms to exchange, transfers, advice and portfolio management (Article 3(1)).
Two routes in
| Route | For | Timing |
|---|---|---|
| Authorization (Article 63) | Firms with a registered office in a member state | 25 working days to check completeness, then 40 to decide |
| Notification (Article 60) | Banks, investment firms and certain other licensed firms | File at least 40 working days before starting |
An authorized CASP also needs its place of effective management in the EU and at least one EU-resident director (Article 59(2)).
How passporting works
One authorization covers the whole EU, through a branch or cross-border services. No physical presence is needed in host states (Article 59(7)).
- Tell your home authority the states, services, start date and any non-MiCA activities (Article 65(1)).
- Within 10 working days, it forwards that to the host states, ESMA and the EBA (Article 65(2)).
- Start once it confirms, or at the latest on the 15th calendar day after filing (Article 65(4)).
Firms outside the EU cannot passport. They may serve an EU client only at that client's own exclusive initiative, and soliciting EU clients rules that out (Article 61).
For fees and capital by service class, see what a MiCA license costs.
Stablecoin Rules
Only the issuer, or someone with its written consent, may offer a stablecoin to the public or seek its admission to trading (Articles 16 and 48).
| Rule | ART | EMT |
|---|---|---|
| Who may issue | An authorized EU legal person, or a bank | A credit or e-money institution |
| Backing | A reserve of assets at all times (Article 36) | At least 30% in bank accounts, the rest in safe, liquid assets (Article 54) |
| Redemption | At any time, at market value or in the assets (Article 39) | At any time, at par, with no fee (Article 49) |
| Interest | Banned for issuers and CASPs (Article 40) | Banned for issuers and CASPs (Article 50) |
ART issuers also need own funds: the highest of EUR 350,000, 2% of the reserve or a quarter of fixed overheads (Article 35).
On October 8, 2026, ESMA said CASPs should stop serving EU clients in non-compliant stablecoins. See ESMA's opinion on non-MiCA compliant stablecoins.
Security and ICT Rules
MiCA sets the outcome. For ICT, it points to DORA.
- Application: "technical documentation of the ICT systems and security arrangements" (Article 62(2)(j)).
- Continuity: "resilient and secure ICT systems as required by" DORA (Article 68(7)).
- Custody: a policy against "fraud, cyber threats or negligence", and client assets kept separate on the ledger (Article 75).
DORA itself covers MiCA-authorized CASPs and ART issuers (DORA Article 2(1)(f)).
Go deeper: the MiCA compliance checklist lists each control, and DORA for crypto companies covers DORA pillar by pillar.
Key Dates
| Date | What applies | Source |
|---|---|---|
| June 29, 2023 | MiCA enters into force | Article 149(1) |
| June 30, 2024 | ART and EMT rules (Titles III and IV) | Article 149(3) |
| December 30, 2024 | Everything else, including CASP authorization | Article 149(2) |
| July 1, 2026 | Latest end of transitional periods for existing CASPs | Article 143(3) |
| June 30, 2027 | Commission's review report due | Article 140(1) |
| December 31, 2027 | Trading platforms must have white papers for other tokens admitted before December 30, 2024 | Article 143(2)(b) |
Member states could shorten or skip the transitional period (Article 143(3)). ESMA publishes each state's choice.
ESMA also keeps an interim register of authorized CASPs, white papers and stablecoin issuers, updated weekly. Check it before you rely on a counterparty's license.
What Is Still Being Finalized
The text is in force. Two things are still moving.
Who supervises CASPs
On December 4, 2025, the Commission proposed that ESMA authorize and supervise all CASPs, in place of national authorities.
On October 9, 2026, EU finance ministers agreed key elements of the Council's position. Norton Rose Fulbright reports that it limits ESMA supervision to the most significant CASPs.
Parliament's position and negotiations come next. Until a final text is adopted and applies, national authorities remain the supervisors.
The 2027 review
By June 30, 2027, the Commission must report on how MiCA is working, with a legislative proposal where appropriate (Article 140(1)).
The report must assess decentralized finance, whether the service scope is right and whether CASP prudential rules fit (Article 140(2)).
How Guardian Helps
Guardian's Regulatory & Compliance assessments start by mapping your activities, entities and customer locations to the MiCA provisions that reach them.
Each technology, security, custody and resilience provision gets the control that meets it, the evidence that proves it and any gap.
Guardian writes the ICT, security, custody and continuity sections of an authorization file from the system as built. Your counsel owns the legal reading.
Frequently Asked Questions
When did MiCA take effect?
Its stablecoin titles applied from June 30, 2024, and the rest from December 30, 2024. Transitional periods for existing CASPs ended by July 1, 2026 at the latest.
Does MiCA apply to companies outside the EU?
It applies to services provided in the EU. A CASP needs an EU registered office, EU management and an EU-resident director. The narrow exception is a client acting on its own exclusive initiative (Article 61).
Does MiCA cover NFTs and DeFi?
Not unique, non-fungible crypto-assets (Article 2(3)), and not services that are fully decentralized, with no intermediary (recital 22). Partly decentralized services stay in scope.
What is the difference between an ART and an EMT?
An e-money token references one official currency and is issued by a bank or e-money institution. An asset-referenced token references another value, right or basket, and its issuer needs MiCA authorization unless it is a bank.
Sources
- Publications Office of the EU: Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), Official Journal (June 9, 2023)
- Publications Office of the EU: Regulation (EU) 2022/2554, Digital Operational Resilience Act (DORA), Official Journal (December 27, 2022)
- ESMA: Markets in Crypto-Assets Regulation (MiCA) and the interim MiCA register (register updated November 5, 2026)
- ESMA: ESMA sets out supervisory expectations on services related to unauthorised stablecoins (October 8, 2026)
- European Commission: Commission launches major package to fully integrate EU financial markets (December 4, 2025)
- European Commission: Questions and answers on the market integration package (December 4, 2025)
- Regulation Tomorrow (Norton Rose Fulbright): Council adopts key elements of negotiating position on MISP (October 9, 2026)
- Guardian: Regulatory & Compliance Assessments
Map your business to MiCA, one citation at a time
Guardian maps your activities to the MiCA provisions that reach them, then shows the control, evidence and gap behind each one.