Digital-asset regulation
MiCAR Opened One Gate - and Closed the Side Doors
The passport widened the market for authorised firms while the authorisation standard reduced the number able to use it.
The post-transition European market has fewer regulated firms than the old national-register map suggested. Each successful authorisation, however, now carries much wider commercial reach.
A smaller market with wider reach
MiCAR replaced a collection of national registration systems with a Union authorisation regime. An authorised CASP can provide the services in its permission across Member States after the prescribed notification process, without collecting a separate licence in every host market.1
That reach is commercially valuable. It also explains why the authorisation test is deeper than the AML-focused registration regimes that preceded it. The regulator is assessing a financial business that intends to operate across borders, hold client relationships at scale and remain governable after growth.
By mid-July 2026, the authorised population was still modest compared with the long list of firms that had once appeared on national VASP registers. The comparison is imperfect because those registers counted different activities and included firms with very different levels of substance. The direction is clear enough: Europe exchanged a broad registration perimeter for a narrower authorisation perimeter.
The deadline arrived at different speeds
MiCAR applied to asset-referenced tokens and e-money tokens from 30 June 2024. The CASP provisions and the rest of the Regulation followed on 30 December 2024.1
Article 143 allowed existing providers to continue temporarily until 1 July 2026, or until their application was granted or refused. Member States could shorten the period. Germany used twelve months, the Netherlands six, while France and Cyprus used eighteen.2
A cross-border firm therefore had a country-by-country problem before it had a passport. A longer home-state period did not create a general right to solicit clients in a host market whose own window had already closed. ESMA stated in April 2026 that providers operating without authorisation after the applicable deadline had to cease and maintain an executable wind-down plan.3
Read the register carefully
The ESMA register is the primary public source for the authorised population. It records the legal entity, home authority, status and service scope, and it is updated weekly.4
A transparent parse of the file available on 20 July 2026 identified 297 authorisation records, 295 of them active, and about 292 unique active firms after deduplication by legal-entity identifier.5 Those numbers belong with a date because the underlying file moves.
One record does not equal one retail exchange. MiCAR lists ten crypto-asset services. A record may belong to a specialist custodian, bank, broker, market maker or transfer-service provider with a limited permission set. Brand recognition adds another source of error: the protection attaches to the contracting EU entity and the service it is authorised to provide.
Same logo. Different legal perimeter. Clients, counterparties and investors need to verify the entity before drawing conclusions from the brand.
What the authorisation file reveals
In authorisation files I review, the most revealing weakness is rarely a missing policy. It is a contradiction between documents: the financial model assumes one client-asset flow, the custody diagram shows another, and the outsourcing register assigns responsibility somewhere else.
MiCAR requires prudential safeguards equal to the higher of the permanent minimum capital requirement and one quarter of the previous year's fixed overheads. The permanent minimum is EUR 50,000, EUR 125,000 or EUR 150,000 according to service class.1 The number matters, but the regulator also needs to see how the firm will operate through an outage, a safeguarding break, a complaint spike or an orderly wind-down.
The application timetable is often misunderstood. Article 63 gives the authority twenty-five working days to assess completeness and forty working days to decide a complete application. Those clocks do not turn a partial file into a sixty-five-day authorisation. Completeness rounds, questions and design changes can extend the process considerably.1
A strong file has one operating model. The board, financial forecasts, vendors, control owners and technology architecture all point to it.
“The licence is valuable because the threshold is meaningful.”
The offshore route after 1 July 2026
Article 61 preserves a narrow route for a third-country firm where the EU client requests the service on the client's own exclusive initiative. ESMA's guidance treats the exception tightly. Disclaimers cannot manufacture client initiative after advertising, solicitation or affiliate activity has created the relationship.7
Global groups face a related design issue. The authorised EU entity must provide the regulated service in substance. Shared technology, order routing or group liquidity can support that entity, although they cannot leave the real service with an unauthorised offshore company while the EU entity supplies a name and contract. ESMA's Q&A on shared order books reflects that supervisory concern.8
My reading is that this will matter more as firms optimise group structures after authorisation. The temptation to centralise every commercially important function offshore remains strong; the supervisory test will focus on whether the EU entity can control the service for which it carries the licence.
A licence is not a shell
Authorised CASPs have strategic value, which has encouraged talk of buying a licence. The shorthand is risky. Control of the legal entity changes through the qualifying-holding process, and the proposed acquirer is assessed for reputation, financial soundness, future governance and financial-crime risk.9
The acquirer also inherits an operating history. Supervisory correspondence, control weaknesses, vendor dependencies, customer complaints and remediation commitments travel with the company. Due diligence has to examine the regulated business, not only the certificate.
The same principle applies after closing. A new owner cannot assume that a major change in products, custody, management or group infrastructure sits inside the old authorisation without analysis.
| Diligence Point | What To Verify |
|---|---|
| Legal entity | Exact authorised company, home authority and current status |
| Service scope | Permissions actually listed in the ESMA register |
| Control history | Open findings, remediation, complaints and incidents |
| Operating model | Custody, outsourcing, ICT, safeguarding and staffing in practice |
| Change of control | Assessment path, post-deal governance and capital plan |
Where the market goes from here
The passport favours firms that can spread fixed regulatory costs across a larger market, but size alone will not decide the outcome. A specialist custodian or broker with a narrow permission, clear economics and good controls can be more durable than a large platform whose EU entity depends on decisions it cannot influence.
The old side doors are harder to use. That leaves a more conventional question for the next phase: which authorised firms can turn regulatory access into a business that is profitable, technically dependable and credible with clients during a difficult week?
As at 22 July 2026, the register answers who has entered. It says much less about who will still matter three years later.
“INSIGHTS”