MSTR Cat

Crypto Law/Level III · Tokens and securities law/3.3 Europe and beyond/Lesson 2

Service providers under MiCA

Which crypto businesses need a MiCA authorisation, how the application, capital and passport rules work, and what happened to unlicensed firms when the transitional period ended on 1 July 2026.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Cheapest route: avoid being a CASP. Non-custodial software that never controls clients’ assets or private keys is not custody under Article 3(1)(17), and fully decentralised services fall outside MiCA (Recital 22); partly decentralised services remain covered.
  2. Banks, investment firms and e-money institutions can add crypto services by notification under Article 60, generally 40 working days ahead, instead of a fresh authorisation; this is the cheapest route only for firms already holding such a licence.
  3. If authorisation is needed, choose only the services required: Annex IV minimum capital is EUR 50,000 for advice, order handling, placing, transfers or portfolio management, versus EUR 125,000 with custody or exchange and EUR 150,000 for a trading platform.
  4. One authorisation passports across the EU under Article 59(7) after notification, avoiding 27 national licences; the catch is EU registered office, effective management and an EU-resident director, and since 1 July 2026 unlicensed service to EU clients is a breach.

MaterialsMiCA Title V (Articles 59 to 85) and Annex IV on minimum capital, on EUR-LexESMA’s Interim MiCA Register file of authorised crypto-asset service providers (CASPS.csv)ESMA’s Statement on the End of Transitional Periods under MiCA, 17 April 2026ESMA’s list of grandfathering periods chosen by member states under Article 143(3)

Wonder

  1. Does running a website, app or wallet make a business a crypto-asset service provider?
  2. How long does a MiCA authorisation take, and how much capital is needed?
  3. What happened to crypto firms serving EU customers without a licence after 1 July 2026?

Explore

  1. MiCA lists ten crypto-asset services in Article 3(1)(16): custody and administration for clients, operating a trading platform, exchanging crypto-assets for funds, exchanging them for other crypto-assets, executing orders, placing, receiving and transmitting orders, advice, portfolio management, and transfer services. A crypto-asset service provider, or CASP, is a legal person or other undertaking that provides one or more of these to clients on a professional basis. Article 59 says nobody may provide them in the EU unless authorised under Article 63, or unless it is a bank, investment firm, e-money institution or other listed financial entity that notifies its regulator under Article 60, generally 40 working days in advance.
  2. Where a business sits on this list depends on what it actually does. Custody is defined in Article 3(1)(17) as safekeeping or controlling crypto-assets, or the means of access to them such as private keys, on behalf of clients, so control is the test. Recital 22 keeps services provided in a fully decentralised manner without any intermediary outside MiCA, but it covers activities only partly performed in a decentralised way. An authorised CASP must have its registered office in a member state where it carries on part of its services, its place of effective management in the EU, and at least one director resident in the EU (Article 59(2)).
  3. The application goes to the authority of the home member state (Article 62). Under Article 63, the authority acknowledges receipt within five working days, checks completeness within 25 working days, and must decide within 40 working days of a complete application; requests for missing information can pause that clock for up to 20 working days. Capital under Article 67 is the higher of a fixed minimum in Annex IV or one quarter of the previous year’s fixed overheads. Annex IV sets EUR 50,000 for advice, order handling, placing, transfers and portfolio management; EUR 125,000 if custody or exchange services are added; and EUR 150,000 for operating a trading platform.
  4. Licensed firms take on conduct rules. Article 66 requires them to act honestly, fairly and professionally in clients’ best interests, warn of risks and publish their fees. Article 70 requires client funds to be placed with a credit institution or central bank by the end of the next business day, separate from the firm’s own money. Under Article 75 a custodian is liable for losses of client crypto-assets caused by incidents attributable to it, capped at the market value at the time of loss. Article 76 bars a trading platform from dealing on its own account on its own venue and requires on-chain settlement to start within 24 hours of a trade.
  5. Authorisation works as a passport. Under Article 59(7), an authorised CASP may serve clients throughout the EU without a physical presence in each country, after notifying its home authority of the states and services involved (Article 65); it may start there once informed that the notice was passed on, or at the latest on the 15th calendar day after notifying (lesson 3.3.7). Firms already operating under national law before 30 December 2024 could continue until 1 July 2026 at the latest under Article 143(3). Member states could shorten that period: ESMA’s list shows six months for the Netherlands and Poland and twelve months for Germany and Ireland.
  6. On 17 April 2026, ESMA said that after 1 July 2026 any entity providing crypto-asset services to EU clients without a MiCA licence is in breach of EU law and must stop, with wind-down plans already in place. ESMA also warned that MiCA protections attach only to the specific authorised legal entity, not to group companies under the same brand. In mid-October 2026 ESMA’s interim register held about 380 entries, mixing Article 63 authorisations and Article 60 notifications; Coinbase Luxembourg S.A. appears with a CSSF authorisation dated 20 June 2025. Binance withdrew its Greek application in June 2026. A practical check: match the legal entity named in your terms of service against the register.

Key facts

  • MiCA Article 3(1)(16) lists ten crypto-asset services, including custody, operating a trading platform, exchange, order execution, advice and transfer services.
  • Under Article 63, an authority must decide on a complete CASP application within 40 working days.
  • Annex IV sets minimum capital of EUR 50,000, EUR 125,000 or EUR 150,000 depending on the services a CASP provides.
  • Article 76(5) forbids a crypto-asset trading platform from dealing on its own account on the platform it operates.
  • Article 143(3) let existing providers continue under national law until 1 July 2026 at the latest, and member states could shorten that period.
  • ESMA stated on 17 April 2026 that after 1 July 2026 providing crypto-asset services to EU clients without a MiCA licence is a breach of EU law.

Exercise nine, six, three, one

9CollectList up to 9 functions in a crypto product you know, such as holding keys, matching orders, quoting prices, sending transfers, giving tips or running a front end.
6ClusterSort them into 6 categories: custody, trading platform, exchange against funds or crypto, order handling, advice or portfolio management, and functions that may fall outside the ten services.
3DistillReduce the 6 categories to 3 groups: clearly a MiCA service, clearly outside, and depending on control or decentralisation facts.
1CrystallizeWrite 1 sentence explaining why the legal entity named in a crypto platform’s terms of service matters to a customer in the EU after 1 July 2026.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS