MiCA Decoded is a 12-article weekly collection for Bitcoin.com Information, co-authored by LegalBison’s Co-Founding and Managing Administrators: Aaron Glauberman, Viktor Juskin and Sabir Alijev. LegalBison advises crypto and FinTech corporations on MiCA licensing, CASP and VASP purposes, and regulatory structuring throughout Europe and past.
This week’s entry has been written by Krystian Lapka, Lawyer at LegalBison. Krystian makes a speciality of cross-border company and industrial transactions, alongside strategic threat administration on the intersection of civil and customary legislation.
Most founders approaching their first CASP utility perceive, at the very least abstractly, that MiCA requires an actual EU presence. What they underestimate is how the regulator defines “actual.”
The standard early-stage setup seems coherent on paper: a registered workplace in a good EU jurisdiction, a director named within the governance paperwork, ICT methods both cloud-hosted or managed from the group’s world infrastructure, and paid-in capital sitting in a newly opened checking account.
From the within, this looks like an EU firm. From a Nationwide Competent Authority’s perspective, it could seem like a letterbox with a director connected.
This text maps what MiCA’s substance necessities truly demand throughout personnel, expertise, and monetary resilience, and explains why regulators deal with every class as a practical check somewhat than a documentation train.
The priority driving all of it’s the identical: stopping letterbox corporations, entities that exist on paper in a good jurisdiction however lack any significant financial exercise, human capital, or operational capability inside it.
The Delusion: Presence Equals Substance
The regulatory logic right here is older than MiCA. Within the landmark Cadbury Schweppes ruling (Case C-196/04), the Court docket of Justice of the European Union established that the liberty of multinational can’t be used to create “wholly synthetic preparations” that lack real financial exercise. MiCA codifies that precept immediately into crypto-asset regulation.
Article 59(2) of MiCA states that approved CASPs should have their registered workplace in a Member State the place they perform at the very least a part of their crypto-asset companies, should have their place of efficient administration throughout the Union, and should have at the very least one director resident within the Union. The availability is transient. What sits behind it’s significantly extra demanding.
ESMA’s Supervisory Briefing on Authorization of CASPs, whereas non-binding, indicators clearly how NCAs are anticipated to interpret these necessities in observe.
The hole between the statutory textual content and the supervisory expectation is the place many purposes encounter friction.
Personnel: Who Is Really Operating This Entity
The minimal threshold beneath MiCA is one EU-resident director. Supervisory steerage raises that bar.
ESMA’s briefing anticipates at the very least two senior executives collectively overseeing every day operations. The rationale is easy: a single govt creates focus threat and removes the inner checks {that a} functioning governance construction requires. Two executives with outlined, overlapping duties is the anticipated baseline.
Residency shouldn’t be enough by itself. The steerage signifies that the place a administration physique member shouldn’t be resident within the NCA’s jurisdiction, that particular person needs to be able to attending in-person conferences on the authority’s request inside two enterprise days.
For jurisdictions the place bodily proximity to the supervisor issues operationally, this can be a sensible constraint on how removed from the house jurisdiction a director can successfully be positioned.
Time dedication is handled with related seriousness. ESMA’s place, as articulated in its Supervisory Briefing on Authorization of CASPs, is that govt administration board members ought to typically dedicate 100% of their skilled time to the CASP function. Double-hatting, the place the identical particular person serves in govt capability at a number of entities, is permitted solely in restricted circumstances. An govt who splits their consideration between the CASP and one other group firm is more likely to appeal to scrutiny through the fit-and-proper evaluation.
Reporting traces matter as a lot as particular person profiles. The administration physique should display that strategic and operational management sits throughout the EU entity, not with a mother or father firm in a 3rd nation that makes the actual choices and points directions downward.
An EU subsidiary whose executives functionally function implementation brokers for a non-EU headquarters shouldn’t be, within the supervisory sense, an entity with real EU administration.
The AML dimension reinforces this. The person accountable for submitting suspicious exercise stories (the MLRO) should be bodily current, maintain real authority throughout the entity, and be capable to work together immediately with the native Monetary Intelligence Unit. This requirement displays a broader world pattern: the FATF and OECD’s Crypto-Asset Reporting Framework (CARF) operates on the identical logic, extending substance and transparency necessities past the EU.
MiCA’s personnel necessities and CARF will not be unrelated developments; they mirror a converging worldwide customary for what a regulated crypto entity should seem like from the within.
The collective suitability customary from Article 68(1) requires the administration physique to own applicable information, expertise and expertise each individually and collectively. As lined within the earlier installment of this collection, that customary spans conventional monetary markets regulation, DLT infrastructure and cybersecurity, and organizational governance. Every of these domains must be represented within the room.
A crew drawn completely from crypto-native backgrounds with no regulated monetary companies expertise, or one with deep TradFi expertise and no capability to evaluate on-chain threat, carries structural gaps that the evaluation course of will floor.
Expertise: Management, Not Simply Internet hosting
DORA (Regulation (EU) 2022/2554) applies on to CASPs and units the framework for ICT resilience necessities. The query regulators ask about expertise shouldn’t be what infrastructure a agency makes use of. The query is who controls it.
Cloud infrastructure hosted by AWS, Azure, or related suppliers is suitable beneath present supervisory observe. The problem arises when the entity approved within the EU lacks significant administrative management over the methods it is determined by.
If encryption key administration sits with a mother or father firm’s world IT crew, if entry rights to consumer information are administered from exterior the EU, or if the catastrophe restoration plan is determined by approvals from a third-country headquarters, the EU entity can’t display real operational independence.
ESMA’s place, as mirrored in its session supplies, is that the EU administration crew should maintain precise management over the ICT infrastructure related to the CASP’s operations. The enterprise continuity coverage and catastrophe restoration plans required beneath Article 68(7) should be owned and executable by the EU entity, not depending on a worldwide operate that will or could not reply in a disaster.
The sensible check is pointed: if the mother or father firm’s world IT crew grew to become unavailable in a single day, might the EU entity proceed to function, entry consumer funds, and return belongings to purchasers? If the reply is not any, or not with out important escalation to non-EU personnel, the substance query has not been resolved.
GDPR compliance and information governance necessities layer on high of the DORA framework. Knowledge processing preparations, controller-processor relationships, and information residency issues all kind a part of the technical structure that regulators will look at.
Monetary: Capital That Really Works
Article 67 units the minimal prudential safeguards. The capital tiers are outlined by service class:
The minimal capital determine is the start line, not the ceiling. Prudential safeguards should equal the upper of both the everlasting minimal capital or one-quarter of the previous yr’s fastened overheads.
As a CASP grows and its fastened overheads improve, this second limb turns into the binding constraint. When overheads exceed 4 occasions the preliminary paid-in capital, the agency should transition to the overheads-based framework. That inflection level arrives sooner than many operators anticipate, and regulators anticipate proactive monitoring somewhat than reactive adjustment.
A structural level price noting: capital should be paid into an account held with a proper credit score establishment.
An EMI or fee service supplier account doesn’t fulfill this requirement. Establishing a banking relationship as a crypto enterprise takes time and isn’t assured. Starting that course of early, earlier than the applying is formally filed, shouldn’t be optionally available. It’s a sequencing constraint that impacts the complete authorization timeline.
The requirement that monetary statements used within the fastened overheads calculation be duly audited or validated by nationwide regulatory authorities provides an additional administrative dimension. Newly integrated entities projecting their first twelve months of overheads should embrace these projections of their authorization utility, with the methodology clearly documented.
Outsourcing and the Substance Threshold
Article 73 permits CASPs to outsource operational features to 3rd events. The constraint is that outsourcing can’t hole out the approved entity. Accountability stays with the CASP; delegation doesn’t switch accountability.
ESMA’s Supervisory Briefing on Authorization of CASPs identifies the share of complete prices attributable to features positioned exterior the EU as a sensible indicator of whether or not outsourcing has gone too far. A CASP whose majority of operational expenditure flows to non-EU service suppliers, even well-run and respected ones, could face questions on whether or not the EU entity has enough inside capability to qualify as a real service supplier somewhat than a conduit.
The excellence the regulator attracts is between CASPs that outsource particular features whereas retaining management and CASPs that outsource all the things substantive whereas retaining solely the authorized kind. The latter is a shell, no matter how the association is described within the utility.
Jurisdictional Variation: Identical Regulation, Completely different Follow
MiCA is immediately relevant throughout all EU member states. The substantive necessities are uniform. Supervisory observe shouldn’t be.
Cyprus, by CySEC, has explicitly required that almost all of a CASP’s board of administrators be bodily residents of Cyprus. For a board of two govt and two non-executive administrators, meaning a minimal of three Cyprus-resident administrators. This goes past what MiCA’s textual content requires and displays nationwide AML directives layered on high of the harmonized EU framework.
Estonia presents a special dynamic. Below the earlier VASP registration regime administered by the Monetary Intelligence Unit, Estonia grew to become one in all Europe’s most accessible licensing jurisdictions. The transition to MiCA shifted supervisory accountability to the Estonian Monetary Supervision and Decision Authority, which brings a special institutional strategy to evaluate and ongoing oversight.
Poland’s legislative scenario, lined in earlier installments of this collection, has produced a structural hole the place the home MiCA implementation legislation has not but been enacted, leaving the KNF with out formal designation because the competent authority and VASP holders with out a viable home CASP utility pathway.
These variations will not be loopholes or administrative quirks. They mirror the fact {that a} harmonized authorized framework nonetheless operates by nationwide supervisory cultures, staffing constraints, and institutional histories. Choosing a jurisdiction for CASP authorization means choosing a regulator, with all the sensible implications that entails.
What ‘Real Institution’ Really Requires
Taken collectively, the substance necessities beneath MiCA mirror a supervisory philosophy somewhat than a guidelines. The regulator needs to be glad that, if one thing goes unsuitable, it has significant recourse.
Which means govt management is bodily reachable and legally accountable beneath EU legislation. It means ICT methods controllable by the EU entity with out dependency on non-EU authorization chains. It means capital that’s genuinely out there and sized towards precise operational threat.
And it means governance the place the EU entity makes actual choices somewhat than implementing directions issued from elsewhere.
Companies that strategy this as a documentation train have a tendency to seek out the method more durable than anticipated. Companies that construct the substance first and doc what they’ve constructed have a tendency to seek out it extra simple. The appliance doesn’t create the group. It describes one that ought to already largely exist.
Sources:
This text relies on a examine carried out by LegalBison in Could 2026. The content material is for informational functions solely and doesn’t represent authorized recommendation.
