MiCA explained: who needs authorisation, and what changed when grandfathering ended

Instrument

Regulation (EU) 2023/1114

Fully applicable since

30 December 2024

Transition closed

1 July 2026 — no cover remains anywhere in the EU or EEA

Who is in scope

Crypto-asset issuers and crypto-asset service providers

Supervisor

National authorities; ESMA maintains the public register

Sharpest sanction

Withdrawal of authorisation, which ends the business in the EU

The three issuer regimes

MiCA creates a single authorisation regime for crypto across the EU and splits obligations three ways.

• Ordinary crypto-assets. Issuers must publish a white paper with prescribed content, notify it to their competent authority, keep marketing fair and not misleading, and accept legal liability for what the white paper says.
• Asset-referenced tokens. Full authorisation, an approved white paper, a segregated reserve of assets, own funds and redemption rights.
• E-money tokens. Issuable only by credit institutions or electronic money institutions. Redeemable at par on demand, and cannot pay interest.

Tokens deemed significant by size or usage are pulled up to EBA supervision with heavier requirements.

Crypto-asset service providers

The third group is crypto-asset service providers: custody, trading platforms, exchange, order execution, placing, reception and transmission, advice, portfolio management and transfers. Each needs authorisation from a national regulator, which then passports across the EU.

The obligations look like MiFID adapted for crypto: prudential safeguards, fit-and-proper management, segregation and safekeeping of client assets, conflicts policies, outsourcing controls, complaints handling, and ICT resilience via DORA.

Market abuse and the travel rule

Title VI adds a market abuse regime with a positive duty to detect and report suspicious orders and transactions, and the Transfer of Funds Regulation layers the travel rule on top. Supervision sits with national authorities, with ESMA maintaining the public register of authorised firms.

Every transitional window is now shut

Article 143(3) let member states grant existing providers a transitional period of up to 18 months from 30 December 2024. States chose different lengths, and many attached an earlier filing deadline as a condition of benefiting at all. ESMA confirmed in April 2026 that there would be no extension, and the outer boundary of 1 July 2026 has now passed. There is no transitional cover anywhere in the EU or EEA. Serving EU clients requires a full authorisation, or passporting in from a firm that holds one.

The scale of the contraction is worth stating plainly. Estimates put the active pre-MiCA provider population at somewhere between 1,100 and 1,300 firms, against roughly 230 on ESMA's register in late June 2026. Grandfathering never conferred passporting rights, and market abuse and travel rule obligations applied from the start with no transition at all.

Transitional periods by member state

Historical now, but still material: whether a firm was lawfully trading during 2025 and early 2026 depends on which window its member state elected and whether the attached filing condition was met.

Sources differ on a small number of states, in particular whether Greece and Spain elected 12 or 18 months. ESMA's published list of grandfathering periods under Article 143(3) is the record to check, and it carries its own caveat that some notified periods were expectations rather than enacted law. Since every window has now closed, the distinction is historical for compliance purposes but still matters for assessing the lawfulness of activity conducted in 2025 and early 2026.