ESMA's interim MiCA register listed 384 crypto asset service providers (CASPs) from 27 home states in its CASP file of 22 October 2026, read on 29 October 2026. That number now carries weight: since the transitional period for CASPs ended on 1 July 2026, a provider outside the file has no cover left under MiCA.
What is MiCA?
MiCA is Regulation (EU) 2023/1114, done at Brussels on 31 May 2023. The MiCA regulation applies directly in every member state, while national competent authorities, such as Germany's BaFin and France's AMF, authorize and supervise firms. Three dates on its timeline have passed:
- 30 June 2024. Titles III and IV, on asset referenced tokens and electronic money tokens, applied.
- 30 December 2024. The rest of the regulation applied, including CASP authorization (Article 149).
- 1 July 2026. The CASP transition ended. Providers working under earlier national law could continue "until 1 July 2026" or until their authorization was granted or refused (Article 143(3)), and member states could shorten that window.
The FATF calls these firms virtual asset service providers; MiCA's term is CASP.
What does MiCA cover, and what does it leave out?
MiCA sorts crypto assets into three types, by what they reference (Article 3):
- Asset referenced tokens (ARTs) reference "another value or right or a combination thereof, including one or more official currencies".
- Electronic money tokens (EMTs) reference "the value of one official currency".
- Other crypto assets, including utility tokens, which are "only intended to provide access to a good or a service supplied by its issuer".
It leaves out crypto assets that are "unique and not fungible" (Article 2(3)), the NFTs of everyday usage, those that qualify as financial instruments under MiFID II (Article 2(4)(a)), and deposits. Services provided "in a fully decentralised manner without any intermediary" fall outside it (recital 22), and it does not address lending and borrowing of crypto assets (recital 94). Transfers of EMTs that are payment services need a payment services license under PSD2 (recital 93).
Picture a game studio (illustrative) that sells tokens redeemable only for its own in game items. Those are utility tokens. They fall under "other crypto assets", so the studio needs no authorization as an issuer, but an offer to the public needs a white paper notified to its national authority (Articles 4 and 8).
Who needs to comply with MiCA?
Table 1. MiCA's four roles, stage by stage (Regulation (EU) 2023/1114, as of October 2026).
| Role | Trigger | What the firm files | What it gets | Who decides |
|---|---|---|---|---|
| Offeror or issuer of other crypto assets | An offer to the public or admission to trading | A white paper, notified (Articles 4 and 8) | The right to offer to the public | No approval; the authority receives the notice |
| ART issuer | Issuing an asset referenced token | An application for authorization (Articles 16 and 21) | Authorization; a reserve of assets to hold (Article 36) | The national authority; the EBA for significant tokens (Article 117) |
| EMT issuer | Issuing an electronic money token | A white paper; the issuer must be a credit or electronic money institution (Article 48) | The right to offer the token | The authority that licensed the institution; the EBA for significant tokens |
| CASP | Providing crypto asset services, such as custody or exchange | An application for authorization (Articles 59 and 62; granted under Article 63) | Authorization, then a notice to serve other member states (Article 65) | The national authority of the home state |
Every row runs through a national authority, and only the CASP row asks for an authorization that then works across the EU. Stablecoin issuers sit in the ART and EMT rows.
The rules also reach firms outside the EU. Picture an exchange incorporated outside the EU (illustrative) that wants EU retail clients without a license. Article 61 exempts only services a client in the EU starts "at its own exclusive initiative", and ESMA's guidelines on reverse solicitation of 17 December 2024 say the exemption is "very narrowly framed" and "cannot be assumed, nor exploited to circumvent MiCA". The guidelines count invitations to events, affiliation campaigns and sponsorship deals among the means of soliciting clients, so the exchange needs authorization in a member state.
Is MiCA an AML law?
No. A CASP's AML and CFT duties come from four other places, each for its own reason:
- Directive (EU) 2015/849, as amended. Customer checks and the suspicious transaction report to the FIU; Regulation (EU) 2023/1113 added CASPs to the directive's financial institutions from 30 December 2024.
- Regulation (EU) 2023/1113 itself. The travel rule: originator and beneficiary data on each crypto transfer.
- Regulation (EU) 2024/1624. The EU's directly applicable AML Regulation takes over the directive's checks from 10 July 2027.
- MiCA Article 92. A report of "any reasonable suspicion regarding an order or transaction" that may be market abuse, sent to the competent authority.
MiCA compliance is about authorization and conduct, and AML compliance rests on the other three acts: the customer checks, the travel rule data and the STR. Article 92 adds a different report, of suspected market abuse in orders and trades, to a different authority. A CASP therefore runs two suspicion reporting lines.
For AML for crypto firms, complead, formerly Sanction Scanner, joins the wallet address and the identity behind it into one entity record, and its regulatory reporting covers MiCA conduct and FIU filings, the two reporting lines above.
What did 2026 change under MiCA?
- 1 July. The Article 143(3) transition for CASPs ended, so every CASP now needs its own authorization.
- 22 October. ESMA updated its register page and CASP file, the source of the 384 count above.
- Pending. On 4 December 2025, ESMA welcomed a Commission proposal to transfer direct supervision of certain significant CASPs to the EU level; it remains a proposal.
The one decision MiCA leaves with each firm is which of the four roles it plays. That choice sets whether it notifies, applies or needs a bank license, and which AML acts arrive with it.
Related terms
- Travel rule. Originator and beneficiary data that travels with each crypto transfer.
- Know your transaction. Monitoring transactions, including crypto transfers, for risk.
- Anti money laundering. The EU and national rules that CASPs follow for customer checks and suspicion reports.
- CASP. A crypto asset service provider authorized under MiCA.
- VASP. The FATF's term for a virtual asset service provider.
- Market manipulation. Orders or trades that give false signals about a crypto asset's price, one form of market abuse.
How this entry was checked. Every article and date was compared on 29 October 2026 with Regulation (EU) 2023/1114, ESMA's interim MiCA register page and its CASP file (updated 22 October 2026), ESMA's final report on reverse solicitation guidelines of 17 December 2024, Regulation (EU) 2023/1113, Regulation (EU) 2024/1624 and ESMA's release of 4 December 2025. The register count is the figure the CASP file showed on that date, counted by distinct legal entity identifier; the game studio and the exchange are illustrative. After the author, Minhac Celik (Marketing Advisor at complead), drafted the entry, the reviewer, Ufuk Gürdaş, Compliance Specialist, matched each article and date to the Official Journal. Last reviewed: 30 October 2026.
