On 22 October 2026 the Central Bank of Ireland announced a EUR 3,252,618 fine on Coinbase Ireland Limited for breaching the safeguarding and outsourcing rules of the Electronic Money Regulations 2011 from 1 November 2020 to 19 August 2025. That is EUR 4,646,597 less a 30 percent settlement discount, effective once the High Court confirms it. The release lists an underfunded safeguarding account, too little local expertise to oversee safeguarding work done by the group, and weak procedures for reporting material changes. It ties the case to the assurances given during authorization. MiCA holds a crypto firm to its authorization file in the same way.
What is MiCA compliance, and what does the regulation cover?
MiCA, Regulation (EU) 2023/1114, is the EU rulebook for issuers of crypto assets and stablecoins and for firms that provide crypto asset services. For a firm with clients beyond Europe it is one framework among the crypto regulations by country it has to meet.
For a crypto asset service provider (CASP), compliance means the right status for each service plus the conduct rules attached to it. There is no MiCA certification. A national authority grants the authorization, names each service on it and can withdraw it (Articles 59(6) and 64).
Coinbase shows where the two regimes part. The CASP file of the European Securities and Markets Authority (ESMA), dated 22 October 2026, lists Coinbase Luxembourg S.A., authorized by Luxembourg's CSSF on 20 June 2025 for seven services in 30 countries. The Irish fine concerned the group's electronic money institution.
When did MiCA come into effect, and which dates are left?
MiCA entered into force on 29 June 2023, twenty days after its publication in the Official Journal (Article 149). Its rules on asset referenced tokens (ARTs) and electronic money tokens (EMTs) apply from 30 June 2024 and the rest from 30 December 2024. So 30 June 2024 is a start date, not the entry into force.
Firms already serving clients under national law could carry on until 1 July 2026 at the latest (Article 143(3)). ESMA's list of grandfathering periods shows six states cutting that to six months, Sweden to nine, and Germany, Ireland, Lithuania, Austria and Slovakia to 12.
Still ahead: the Commission's report by 30 June 2027 (Article 140), the AML Regulation on 10 July 2027, and trading platforms' white papers for older listed tokens by 31 December 2027 (Article 143(2)(b)).
What happened under MiCA in 2026, month by month?
- 2 March. From this date the EBA advised authorities to require PSD2 authorization of CASPs that move or hold EMTs for clients (no action letter, 10 June 2025).
- 20 May to 30 September. The Commission's consultation on the MiCA review ran.
- 1 July. The transition for existing CASPs ran out in every member state (Article 143(3)).
- 24 September. The EBA's response called classification "a challenge" and asked for a review of the share of reserves held as deposits.
- 7 October. AMLA's response named five AML areas, unauthorized stablecoins among them.
- 22 October. ESMA updated its register, and its MiCA page says CASP onboarding to MiDAS, the MiCA Digital Assets Surveillance System, is open. Ireland's central bank announced the Coinbase Ireland fine.
- Pending. Moving significant CASPs to ESMA supervision, a Commission proposal ESMA welcomed on 4 December 2025.
How does a crypto firm get MiCA authorization, step by step?
A bank, investment firm or other licensed financial firm can notify its authority instead of applying. Every other firm goes through the authorization process in five steps.
Table 1. Two routes into MiCA (Regulation (EU) 2023/1114, as of October 2026).
| Route | Who | What is filed | The authority's clock | Capital | Result |
|---|---|---|---|---|---|
| Authorization (Articles 59(1)(a), 62 and 63) | A legal person with a registered office and effective management in the EU (Article 59(2)) | The Article 62(2) file, points (a) to (s) | 25 working days to check completeness, 40 to decide on a complete file | Article 67 and Annex IV | The named services, across the EU after an Article 65 notice |
| Notification (Article 60) | Credit institutions, CSDs, investment firms, market operators, UCITS managers, AIFMs; electronic money institutions for custody and transfer of their own EMTs only | The Article 60(7) information | Filed at least 40 working days before the first service; completeness checked within 20 (Article 60(8)) | The existing license's; Article 67 does not apply (Article 60(10)) | The services notified, on the same terms |
- List the services by letter. Article 3(1)(16) names ten services, from (a) custody to (j) transfer services, and the authorization will name each one (Article 59(6)). A service added later needs an extension (Article 59(8)).
- Build the Article 62(2) file. Points (a) to (d): identity, legal form, articles and program of operations; (e) proof of capital; (f) to (h) governance, the management body and qualifying holders; (i) internal controls, money laundering and terrorist financing risk included, and business continuity; (j) to (m) ICT, segregation of client assets, complaints and custody; (n) to (s) the service specific parts, from trading platform rules and market abuse detection to the token types served.
- Size the capital. See the calculation below.
- Run the clock. The authority acknowledges receipt within five working days and checks completeness within 25 (Article 63(1) and (2)). It decides within 40 working days of a complete file and notifies the decision within five more (Article 63(9)). One request for more information, made by day 20, can stop the clock for up to 20 working days (Article 63(12)).
- Notify before crossing a border. The authorization covers the whole Union (Article 59(7)). Under Article 65 the CASP lists the member states and services, and the home authority passes them on within 10 working days. Service may start once the CASP hears that the list went out, or at the latest on the 15th calendar day after filing.
How much capital does a CASP need?
Article 67 sets the higher of two amounts: the Annex IV floor for the CASP's class, or a quarter of last year's fixed overheads, reviewed every year. Class 1 services carry EUR 50,000, class 2 (custody or exchange) EUR 125,000 and class 3 (a trading platform) EUR 150,000.
Picture an exchange (illustrative) authorized for custody and exchange for funds, with EUR 900,000 of fixed overheads. A quarter, EUR 225,000, beats the EUR 125,000 floor and is the amount held. A firm in its first year uses the overheads projected in its application (Article 67(2)), and the safeguards can be own funds, an insurance policy or both (Article 67(4)).
What does a CASP have to keep doing after authorization?
An authorized CASP must meet its authorization's conditions "at all times" (Article 59(4)). If it stops meeting them and does not fix the gap in the time the authority sets, it loses the authorization (Article 64(1)(e)). These duties keep the file true:
- Capital, every year. The overheads test is reviewed annually, so growth raises the requirement (Article 67(1)).
- Fees in public. Pricing, cost and fee policies sit in a prominent place on the website (Article 66(4)).
- Records for five years. Every service, order and transaction is kept five years, or up to seven if the authority asks before the five run out (Article 68(9)). ESMA's MiDAS takes in order and transaction data and generates alerts on potentially suspicious trading.
- Client money set apart. Funds other than EMTs go to a credit institution or central bank by the end of the next business day, in a separate account (Article 70(3)).
- Outsourcing kept in hand. The CASP stays fully responsible and keeps the expertise to supervise outsourced work (Article 73(1)(e)). The Irish case exposed that gap under the electronic money rules.
- Clean listings. A trading platform keeps out tokens built to anonymize their holders unless it can identify the holders and their transaction history (Article 76(3)).
- Suspicion to the authority. A reasonable suspicion of market abuse in an order or transaction goes "without delay" to the competent authority (Article 92(1)). That report is separate from the suspicious transaction report to the FIU under AML law.
complead, formerly Sanction Scanner, lists regulatory reporting for MiCA conduct and FIU filings in its AML for crypto firms, next to wallet and name screening on one entity record.
What happens when a firm breaches MiCA?
Article 111 makes member states give their authorities maximum fines of at least EUR 5,000,000 or 5 percent of annual turnover for a legal person that breaches the CASP rules (Articles 59, 60 and 64 to 83). For market abuse under Articles 89 to 92 the floor rises to EUR 15,000,000 or 15 percent, and the authorization can be withdrawn or suspended (Article 111(5)). Member states may go higher (Article 111(6)).
What are the AML requirements under MiCA?
Most of them sit outside MiCA. A CASP's anti money laundering (AML) and know your customer (KYC) duties come from three other acts. MiCA makes AML controls a condition of authorization (Articles 62(2)(i) and 68(8)) and adds its own market abuse report.
AML requirements for CASPs
A CASP became an obliged entity under Directive (EU) 2015/849 on 30 December 2024, when the transfer of funds regulation added it to the directive's list (Article 38). It runs customer due diligence at onboarding and know your transaction monitoring on each relationship, and it reports suspicion to the FIU.
Regulation (EU) 2023/1113 also carries the travel rule, the EU form of FATF Recommendation 16. Originator and beneficiary data go with every crypto transfer a CASP sends, at any amount (Article 14(1) and (2)), and Article 14(4) has the data sent securely and in line with the GDPR, the EU's data protection law. Picture a customer (illustrative) withdrawing EUR 1,500 in crypto to their own wallet. The exchange obtains and holds the data and, as the amount exceeds EUR 1,000, assesses whether the customer owns or controls that self hosted address (Article 14(5)).
From 10 July 2027 the AML Regulation, Regulation (EU) 2024/1624, applies (Article 90). It needs no national law. It brings due diligence on a CASP's occasional transactions from EUR 1,000, identification below it (Article 19(3)), and a ban on anonymous crypto asset accounts and anonymity enhancing coins (Article 79(1)). EUR 10,000, sometimes given as the enhanced due diligence (EDD) trigger, is the general threshold for due diligence on occasional transactions (Article 19(1)(b)).
AML requirements for issuers
An EMT issuer must be a credit or electronic money institution (Article 48(1)), and both are already obliged entities under the AML Directive. Offerors of other crypto assets need no authorization, only a notified white paper, and small offers not even that (Article 4(2): fewer than 150 persons per member state, EUR 1,000,000 over 12 months, or qualified investors only). Some ART issuers are not obliged entities at all, one of five points AMLA asked the Commission to review on 7 October 2026.
Which stablecoins can a CASP offer under MiCA?
Table 2. Stablecoins on a CASP's platform (Regulation (EU) 2023/1114, as of October 2026).
| Token | Who may offer it to the public | Backing | Significant tokens supervised by | What the CASP checks |
|---|---|---|---|---|
| EMT (one official currency) | Its issuer, a credit or electronic money institution with a notified white paper, or others with its written consent (Article 48(1)) | At least 30% of funds received kept in separate accounts at credit institutions (Article 54) | EBA (Article 117) | The issuer's status and the white paper in ESMA's file |
| ART (other values or a basket) | Its issuer, authorized under Article 21 or a credit institution under Article 17, or others with its written consent (Article 16(1)) | A reserve of assets, legally segregated (Article 36) | EBA (Article 117) | The issuer's authorization and the approved white paper |
| A token whose issuer has neither status | No one, as a rule (Articles 16(1) and 48(1)) | Nothing MiCA recognizes | None | Not offered, not admitted to trading |
The third row answers a frequent question: an EU exchange cannot offer or list a stablecoin whose issuer has no MiCA status, however widely it trades elsewhere. ESMA's file of 22 October 2026 holds 50 EMT white paper rows, two of them for Circle Internet Financial Europe SAS under France's ACPR. Its ART issuer file, last changed in February 2025, lists none.
Holding or moving EMTs for clients can bring a second license. The EBA's no action letter of 10 June 2025 advises authorities to treat EMT transfers and EMT custody for clients as payment services, and a custodial wallet that sends and receives EMTs as a payment account, and to require PSD2 authorization only from 2 March 2026. Exchanging crypto for funds or for other crypto is not a payment service in that letter.
What is the impact of MiCA, and what should a firm check in 2026?
MiCA's implications for the market show in ESMA's interim MiCA register. Its CASP file of 22 October 2026 lists 384 authorized or notified firms by distinct legal entity identifier (387 rows), from 27 home states, each with its services and searchable by name or LEI. A second file names 178 entities found serving clients in breach of MiCA's authorization rules, 169 of them filed by Italy's Consob. With the CASP transition over, no grace period covers a firm missing from the first file.
Your checks for the rest of 2026, and why:
- The register entry matches the business: every service offered carries its letter on the authorization (Article 59(6)).
- The file is still true. Owners, managers and controls match what the authority approved (Article 59(4)).
- Capital is recalculated, because last year's audited overheads set this year's quarter (Article 67).
- Each new country has an Article 65 notice. Service there starts only after the communication or 15 calendar days.
- Both suspicion lines work: market abuse reports reach the authority and STRs reach the FIU, with order and trade records in the JSON format ESMA published on 28 November 2025.
- Travel rule data goes with every transfer, and the self hosted address check runs above EUR 1,000.
- The AML Regulation is in the plan. From 10 July 2027 due diligence starts at EUR 1,000 for occasional transactions, and anonymity enhancing coins go.
- Older tokens have white papers, which trading platforms need by 31 December 2027 (Article 143(2)(b)).
Coinbase Ireland's fine came almost six years after the breaches began, and the Central Bank linked it to what the firm had told it when it was authorized. A MiCA authorization rests on the same kind of record. The Article 62 file is what the authority checks, and Article 59(4) keeps it the measure for as long as the authorization lasts.
How this guide was checked. On 30 October 2026 each article, date and amount was compared with Regulations (EU) 2023/1114, 2023/1113 and 2024/1624 in the Official Journal, ESMA's MiCA page, register files and grandfathering list, the EBA, AMLA and Commission pages linked above and the Central Bank of Ireland release. Register counts use distinct LEIs; the exchange and the customer are illustrative. Written by Minhac Celik, Marketing Advisor; fact checked by Ufuk Gürdaş, Compliance Specialist. Last reviewed: 30 October 2026.
