, the EU's Markets in Crypto-Assets Regulation, is now fully in force. It reaches well beyond exchanges. It changes how tokens, treasuries, market-makers and custody have to be organised across the EU. If you hold crypto as a founder or family office, this briefing covers what has to change and what doesn't.

What's the situation in 2026?

The rules came in stages, and the grace period for existing operators closes during 2025 and 2026. Licensing offices across the EU are now busy with applications.

MiCA started applying from mid-2024 for stablecoins, and from end-2024 for (crypto-asset service providers, meaning firms that offer crypto services to clients). Regulators in Germany (BaFin), France (AMF), Ireland (CBI), Malta (MFSA) and Cyprus (CySEC) are now processing licence applications in volume. Passporting works: a licence in one EU state gives access to all 27.

Two other sets of rules sit alongside MiCA:

  • The Transfer of Funds Regulation (TFR) extends the FATF Travel Rule to crypto transfers within the EU. That's the rule that says information about who's sending and receiving money must travel with the payment.
  • brings crypto asset reporting into the same framework as , the system where tax authorities swap information about people's overseas accounts. It applies from 2026.

Who needs a MiCA licence?

If you offer crypto services to clients in the EU as a business, you almost certainly do. The definition of a CASP is broad.

It covers exchanges, brokers, custodians (firms that hold crypto for others), portfolio managers, advisers and placement agents. It also covers anyone providing these services "to clients in the Union" on a professional basis.

There's a narrow exception called reverse solicitation, where the client approaches you without any marketing from you. In practice, most operators can't rely on it.

Stablecoin issuance (ART/EMT) is a separate authorisation. Reserve, redemption and disclosure requirements are modelled on banking law. Utility tokens have a lighter regime but still need a whitepaper published to ESMA's rules.

What doesn't need a MiCA licence?

Less than you might hope, but more than nothing. MiCA regulates services provided to clients, not what you do with your own assets.

  • Pure protocol development where no service is provided to end-users (though the edges of this are being tested).
  • NFT projects where the NFTs are genuinely non-fungible and non-financial in character.
  • Family-office self-custody of the family's own assets. A family holding its own portfolio isn't providing a service to clients.
  • DeFi protocols with no identifiable operator, although ESMA is consulting on where the line falls.

Where are the grey areas?

Several of the "no licence needed" categories depend on lines that regulators are still drawing. You can use them, but you should know which way the lines could move.

The grey areas
What isn't settled, how strong each position is, and what it could mean for you.
  • Protocol development with no service to end-usersarguable

    Why it's greythe exemption depends on no service being provided, and the edges of that perimeter are being tested

    What it could meanyou could be treated as providing a regulated service and need a licence

  • DeFi protocols with no identifiable operatorarguable

    Why it's greyESMA is consulting on where the line falls, so the position isn't settled

    What it could meanrules could change or a regulator could decide someone is the operator

  • Relying on reverse solicitation to serve EU clientsaggressive

    Why it's greythe exception is narrow and most operators will fail to rely on it in practice

    What it could meanmarketing or serving EU clients without a licence could breach MiCA

Settled = widely accepted · Arguable = defensible, but could be challenged · Aggressive = likely to be challenged.General information, not financial, tax or legal advice. A grey area isn't off-limits — plenty of people use these positions. Go in knowing the risk, keep your paperwork, and have it checked against your own facts.
Not sure where you'd sit on this scale?

Grey areas turn on the details: where you live, how the money moves and what paperwork you keep. On a free 30-minute call we look at your own situation and tell you plainly how strong your position would be, before you commit to anything.

Apply now Book a free call

What does this mean for how I structure things?

It depends on what you do. Here is how it plays out in four common situations.

Which situation sounds like you?
Likely to suit you if
  • You run an EU-facing exchange or broker: you need a MiCA licence in a chosen state, plus a passport for the rest.
  • You're a non-EU operator: you can get a MiCA licence, exit EU marketing entirely, or restructure via a Swiss, UK or UAE licensed entity with limited EU exposure.
  • You're issuing a token: plan the whitepaper, marketing and reserve requirements well before launch, because retrofitting is painful.
  • Your company holds crypto in its treasury: self-custody is still permitted, but using an unlicensed EU provider is not.

For exchanges and brokers, Ireland, France, Germany and Malta are the most-used routes. Each has different processing times and interpretive nuances.

Are the UAE and Switzerland real alternatives?

Yes. If you want to serve global markets from a friendly base, they're a cleaner fit than squeezing a non-EU operator into MiCA's rules for third countries.

VARA (Dubai) and ADGM (Abu Dhabi) offer credible crypto licensing regimes that most EU counterparties will accept. FINMA in Switzerland continues to license under the DLT Act.

Choosing where to license
  1. 1
    Step 1
    Map what you do
    check your existing activity against MiCA's perimeter
  2. 2
    Step 2
    Decide where to license
    inside the EU, or outside it via VARA, ADGM or FINMA
  3. 3
    Step 3
    Structure the entities
    holding, treasury and operating companies set up to fit that choice

How do we approach this at Sovereign Signal?

We help crypto-native founders and family offices map their existing activity against MiCA's perimeter. Then we decide whether to license inside or outside the EU, and structure holding, treasury and operating entities to fit.

We work with specialist regulatory counsel in each licensing jurisdiction. Our role is the overall structure. The licence application itself is the counsel's job. Where the answer is "you don't need to be in the EU at all", we say so.

Worked example

Here's a case we handled. A crypto brokerage with EU customers and a Cayman parent asked us to help with a MiCA application in Germany.

On analysis, only 12% of revenue came from the EU, and the compliance cost of a BaFin licence would consume that. We restructured to a VARA-licensed UAE brokerage serving global (including permitted EU reverse-solicitation) clients and closed the EU-marketed channel.

Revenue held up, compliance cost fell by 70%, and the group kept its Cayman investor structure intact.

FAQs

Does MiCA apply to my DAO?

It depends on whether the DAO provides regulated services to EU users. Pure protocol governance may fall outside MiCA. A DAO that operates an exchange or issues a stablecoin is inside it.

Can I still use a Cayman entity for a token issuance?

Yes, as issuer of record. Marketing to EU users also triggers MiCA obligations for whoever conducts that marketing.

How long does a MiCA licence take?

Six to twelve months in the faster jurisdictions, and longer in others. Plan for that.

Is stablecoin issuance realistic for a small team?

No. Reserve, capital and governance requirements are substantial. Most small-team projects should partner with an authorised issuer rather than seek their own licence.