1. The 2024 Milestone: MiCA Fully in Force
December 30, 2024 was the most consequential date in European crypto regulatory history. On this date, the CASP authorization provisions of MiCA Regulation (EU) 2023/1114 became fully applicable across all 27 EU member states — ending three years of regulatory uncertainty for the European crypto industry.
From December 30, 2024: all businesses providing crypto-asset services to EU clients on a professional basis are legally required to either (a) hold a valid CASP authorization from an EU national competent authority, or (b) operate under the MiCA Art. 143 transitional provisions, which allow legacy VASPs with existing national registrations to continue until July 1, 2026.
This was a genuine regulatory watershed. For the first time in the EU, crypto businesses operate under a unified, directly applicable regulation with consistent rules, equivalent capital requirements, harmonized AML obligations, and a common passporting mechanism — across all member states simultaneously.
MiCA creates ongoing behavioral obligations — not just an authorization requirement. CASPs must maintain adequate capital, implement AML/KYC programs, operate DORA-compliant ICT systems, publish white papers for token issuances, segregate client assets, handle client complaints, and report to NCAs. Our MiCA compliance service covers all ongoing obligations.
2. The 2025 Regulatory Calendar
3. July 1, 2026 — The Hard Deadline
July 1, 2026 is the most critical date for the European crypto industry in 2026. Under MiCA Art. 143(3), the 18-month VASP transitional period expires on this date. From July 1, 2026:
- All entities providing crypto-asset services to EU clients must hold a valid CASP authorization
- Transitional operation under pre-MiCA national VASP registrations is no longer permitted
- Non-compliant entities face NCA enforcement: cease-and-desist orders, fines, public warnings, and in some member states, criminal prosecution
- EU clients are no longer legally able to use services from unauthorized providers — creating liability risk for both sides
As of March 2026, only 4 months remain before the July 1, 2026 deadline. A complete CASP application takes 4–8 months from project start. Companies that have not yet begun their CASP process face a significant risk of an authorization gap. Contact us immediately for an expedited CASP application assessment.
4. Country-by-Country NCA Status
As of March 2026, the status of major EU NCAs processing MiCA CASP applications:
| Country | NCA | Application Status | Processing Time |
|---|---|---|---|
| 🇱🇹 Lithuania | Bank of Lithuania | Active — High Volume | 3–5 months |
| 🇧🇬 Bulgaria | FSC / KFN | Active — Fast Processing | 3–4 months |
| 🇪🇪 Estonia | FSA (Finantsinspektsioon) | Active — Selective | 5–7 months |
| 🇵🇱 Poland | KNF | Active | 3–5 months |
| 🇩🇪 Germany | BaFin | Active — Rigorous Review | 6–12 months |
| 🇲🇹 Malta | MFSA | Active | 4–6 months |
| 🇨🇾 Cyprus | CySEC | Active | 4–6 months |
| 🇮🇪 Ireland | Central Bank of Ireland | Active | 5–7 months |
| 🇫🇷 France | AMF | Active — Slower Ramp | 6–9 months |
| 🇳🇱 Netherlands | DNB / AFM | Active — High Standards | 6–10 months |
5. MiCA vs DORA — Dual Compliance Requirements
CASPs in 2025 and 2026 face two concurrent EU regulatory frameworks that must both be satisfied simultaneously: MiCA and DORA. These are complementary but distinct regimes:
- CASP authorization requirement
- Capital adequacy (€50K–€150K)
- AML/KYC compliance
- Client asset safeguarding
- White paper requirements
- EU passporting mechanism
- NCA supervision and reporting
- ICT risk management framework
- ICT incident reporting (4-hour window)
- Digital resilience testing
- TLPT for larger CASPs
- Third-party ICT risk management
- Information sharing arrangements
- Annual ICT risk assessments
DORA compliance documentation — specifically the ICT risk management framework, incident response procedures, and third-party provider register — is now required as part of every NCA CASP authorization application. NCAs increasingly view DORA compliance as a prerequisite to authorization, not just a post-authorization obligation.
6. What Changes for Businesses in 2025–2026
If you are already authorized as a CASP:
- Maintain ongoing MiCA compliance: capital adequacy monitoring, AML program updates, annual NCA reporting
- Implement DORA compliance: full ICT risk management framework if not already in place, annual penetration testing
- File passporting notifications before entering any new EU member state market
- Monitor ESMA/EBA technical standards as they are finalized — some require policy updates
If you are operating as a VASP under transitional provisions:
- Begin your CASP authorization application immediately — July 1, 2026 is 4 months away as of March 2026
- Verify whether your home member state has a shorter transitional period than the standard 18 months
- Start DORA gap analysis — DORA compliance will be required for your CASP application
- Review your AML program against MiCA's enhanced requirements
If you are a new entrant building a crypto business:
- Select an EU jurisdiction and begin the CASP application process before launching any EU-facing services
- Structure your business entity to satisfy substance requirements from the start
- Budget for both MiCA capital requirements (€50K–€150K) and ongoing compliance costs
- Consider a ready-made CASP company to accelerate market entry
7. Key Enforcement Actions Expected in 2026
Post-July 1, 2026, EU NCAs are expected to take coordinated enforcement action against unauthorized CASPs. ESMA has explicitly called for consistent enforcement across member states to prevent regulatory arbitrage — where businesses might try to operate without authorization by serving EU clients from outside the EU or through complex corporate structures.
Expected 2026 enforcement patterns include:
- Cease-and-desist orders against exchanges and custodians serving EU clients without CASP authorization
- Public warnings published on NCA websites identifying non-compliant crypto businesses — damaging reputationally even without financial sanctions
- Asset freezes in cases of large-scale unauthorized CASP operation
- Criminal referrals where member state law provides criminal penalties for unauthorized financial services provision
- Banking access restrictions — EU banks increasingly refusing to serve unauthorized crypto businesses, creating operational disruption even before formal NCA action
- Coordinated cross-border enforcement via ESMA's convergence tools — ensuring that firms attempting to exploit jurisdictional gaps face coordinated action across multiple NCAs
The regulatory risk of operating without authorization after July 1, 2026 is existential for EU-facing crypto businesses. This is not a compliance formality — it is a fundamental business license requirement.
