EU crypto regulation
Your MiCA licence: IT and security requirements
MiCA, the Markets in Crypto-Assets Regulation, is the EU crypto rulebook. It requires a crypto-asset service provider (CASP) licence for most firms offering crypto services. Token issuers have separate duties.
- Type
- EU regulation
- Service provider rules
- Applying since 30 December 2024
- Licence name
- CASP licence (crypto-asset service provider)
- Grace periods
- Ended EU-wide on 1 July 2026
Who it applies to
Crypto businesses with MiCA duties
- Crypto exchanges and trading platforms serving customers in the EU.
- Firms that hold crypto-assets for their clients.
- Issuers of some crypto tokens, such as stablecoins, with duties that depend on the token.
Your services, tokens and EU reach decide which rules apply. Your legal advisers confirm the licensing position.
Dates to plan for
When MiCA’s rules began to apply
29 June 2023
MiCA entered into force.
30 June 2024
Rules for stablecoin issuers began applying.
30 December 2024
Rules for crypto-asset service providers began applying.
1 July 2026
The last grace periods for firms already operating ended across the EU.
What it asks of you
Show the regulator how you will operate
-
Define services and responsibilities
Describe the activities you seek permission for and who will oversee IT and security.
-
Describe your actual systems
Show where client data moves, where systems run and how access is restricted.
-
Prepare for service interruptions
Document incident handling, backups, recovery and the tests supporting those plans.
-
Account for outsourced services
Record your technology providers, their responsibilities and how you will check their work.
-
Support the licence file
Make sure policies, system descriptions and test reports describe the same operation and meet the DORA rules that apply to you.
How we help
Specialist support through your licence application
We take responsibility for the agreed IT and security work, from operating arrangements and application documents to technical questions during the regulator’s review. We coordinate with your legal and compliance advisers throughout.
Common questions
Common questions
Related regulations and standards
- DORA
Once licensed, a crypto service provider counts as a financial firm under DORA. That EU law sets rules for IT risks, incident reporting, recovery testing and IT suppliers.
Free 30-minute call
Review your MiCA security requirements
Talk through your intended crypto services and licence file in a free 30-minute call with a senior specialist.
