MiCA Explained: What EU Crypto Businesses Must Do

The EU's Markets in Crypto-Assets Regulation, known as MiCA, created a single rulebook for crypto across all EU member states. If you issue tokens or provide crypto services to people in the EU, it almost certainly affects you. Here's what it covers and what it means for your product.

This is a general overview for founders and product teams, not legal advice. Always confirm requirements with qualified EU legal counsel.

What is MiCA?

MiCA (Regulation (EU) 2023/1114) regulates crypto-assets that aren't already covered by existing financial services law. Its rules for stablecoins started applying in mid-2024, and the rest, including rules for crypto-asset service providers, applied from 30 December 2024. Transitional periods for existing providers have now ended across the EU.

Who does MiCA cover?

Issuers of crypto-assets offering tokens to the public in the EU or seeking admission to trading.
Issuers of stablecoins: asset-referenced tokens (ARTs) and e-money tokens (EMTs).
Crypto-asset service providers (CASPs): exchanges, brokers, custodians, wallet providers offering custody, portfolio managers, advisers and others.

Fully decentralised services without an identifiable provider, and most unique, non-fungible NFTs, are generally outside MiCA's scope, though the boundaries need careful legal analysis.

Requirements for token issuers

Publish a crypto-asset white paper with prescribed information about the issuer, project, rights, risks and technology.
Notify the relevant national authority before publication.
Follow rules on fair, clear marketing communications.
Take responsibility for the accuracy of the white paper.

Requirements for CASPs

Obtain authorisation from a national competent authority in one member state.
Use that authorisation to passport services across the EU.
Meet governance, capital and conduct requirements.
Safeguard client assets and segregate them from company funds.
Handle complaints, conflicts of interest and outsourcing properly.
Meet market abuse rules.

Stablecoins under MiCA

Stablecoin issuers face the strictest rules, including reserve requirements, redemption rights and authorisation. E-money tokens must be issued by authorised credit or e-money institutions. Platforms serving EU users have had to review which stablecoins they support as a result.

The Travel Rule

Alongside MiCA, the EU's Transfer of Funds Regulation requires CASPs to collect and share information about the sender and recipient of crypto transfers. This affects how wallets and exchanges handle transfers, especially to and from self-hosted wallets.

What MiCA means for your product

Onboarding: KYC and customer due diligence flows.
Custody: segregated client assets and clear records.
Transfers: Travel Rule data collection and exchange.
Disclosures: clear risk warnings and fee information in the app.
Data: GDPR-compliant handling of personal data alongside MiCA rules.
Reporting: audit trails and regulatory reporting.

A checklist for founders

Map exactly which activities you perform and which MiCA category applies.
Choose the member state where you'll seek authorisation.
Prepare your white paper if you issue tokens.
Build compliance features into the product early.
Review the stablecoins and tokens you support.
Plan for ongoing reporting and audits.

What goes into a MiCA white paper

For crypto-assets offered to the public or admitted to trading, the white paper must give investors the information they need to make decisions. It typically covers:

Information about the offeror or the person seeking admission to trading
The project, its purpose and the people involved
The rights and obligations attached to the crypto-asset
The underlying technology, including the protocol and consensus mechanism
Risks associated with the crypto-asset and the project
Information on principal adverse impacts on the climate and environment of the consensus mechanism

The white paper must be fair, clear and not misleading, and marketing communications must be consistent with it.

Passporting: one licence, many markets

One of MiCA's biggest benefits is passporting. A CASP authorised in one member state can provide services across the EU after notifying regulators, instead of applying separately in each country. This makes the choice of home member state an important strategic decision, based on factors such as regulator experience, language, timelines and where your team and customers are.

How MiCA affects non-EU companies

Companies outside the EU that actively solicit EU customers generally need MiCA authorisation. A narrow exemption exists for services provided at a client's own exclusive initiative, but it's interpreted strictly. If you market to EU users, assume MiCA applies and seek advice.

Product features MiCA tends to require

Onboarding and accounts

Risk-based customer due diligence, sanctions screening, and clear terms and fee disclosures before users trade.

Custody and records

Segregated client assets, accurate records of each client's holdings, and reconciliation processes.

Complaints and conflicts

A documented complaints process inside the product and policies to manage conflicts of interest, for example when a platform also trades on its own account.

Market integrity

Systems to detect and report potential market abuse, such as wash trading and price manipulation.

Common mistakes

Treating MiCA as a legal task only, when much of it must be built into the product
Underestimating the time needed for authorisation
Supporting stablecoins that aren't compliant for EU users
Ignoring the Travel Rule for transfers to self-hosted wallets
Forgetting that GDPR still applies alongside MiCA

Practical timeline for an EU launch

Legal scoping of your services and tokens.
Selection of the home member state and initial regulator contact.
Policies, governance and compliance team in place.
Product changes: onboarding, custody records, disclosures, Travel Rule.
Authorisation application and regulator questions.
Launch in the home market, then passport to other member states.

Authorisation can take many months, so building product features in parallel with the application saves time.

MiCA and the US and UAE: planning for several markets

Many crypto businesses serve the EU, the US and the UAE together. The rules differ: MiCA offers one EU licence with passporting, the US relies on a mix of federal and state rules, and the UAE has VARA in Dubai and the FSRA in ADGM. A common approach is to build one product with configurable compliance features, such as onboarding steps, supported assets and disclosures, that can be switched by region. This lets you meet each market's requirements without maintaining completely separate platforms.

Frequently asked questions

Does MiCA apply to NFTs?

Unique, non-fungible NFTs are generally outside MiCA. However, large collections or fractionalised NFTs can be treated as fungible crypto-assets, so each case needs legal review.

Does MiCA apply to DeFi?

Services provided in a fully decentralised way without an intermediary are generally excluded, but the EU is still assessing DeFi, and many projects have identifiable operators that may fall in scope.

What about stablecoins on my platform?

Platforms serving EU users should only offer stablecoins that comply with MiCA's rules for e-money tokens and asset-referenced tokens.

Key takeaways

MiCA sets one rulebook for crypto across the EU.
Issuers need compliant white papers; service providers need authorisation.
Much of MiCA must be built into the product, not just the paperwork.
Passporting makes the choice of home member state a strategic decision.

Building for the EU market

AnAInfo builds exchanges, wallets and token platforms with MiCA, Travel Rule and GDPR requirements in mind. Learn about our work for European businesses, or contact us.