What Is MiCA? The EU Crypto Regulation Explained (2026)

MiCA is the European Union's Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. It is a single rulebook for crypto-assets that are not already covered by existing financial law: it sets rules for stablecoin issuers, requires a white paper for most token offers, licenses the businesses that hold, exchange or trade crypto for clients, and bans insider dealing and market manipulation in crypto markets. Its stablecoin titles have applied since 30 June 2024, the rest since 30 December 2024, and the last transitional window for existing firms closed on 1 July 2026.

This guide explains what MiCA covers, what it leaves out, how the licence and passport work, what the stablecoin and market-abuse rules say, how it fits with the EU's anti-money-laundering, cyber-resilience and tax rules, and what it all means for ordinary users. Legal references are to the text published in the Official Journal on 9 June 2023, checked on 5 October 2026.

What is MiCA?

MiCA was adopted by the European Parliament and the Council on 31 May 2023 and published in the Official Journal on 9 June 2023 (EUR-Lex). Because it is a regulation rather than a directive, it applies directly in every member state without being rewritten into national law. It also applies in the wider European Economic Area: the ESMA register lists authorised firms in Norway, Liechtenstein and Iceland alongside the 27 EU countries.

The regulation defines a crypto-asset broadly as "a digital representation of a value or of a right" that can be transferred and stored electronically using distributed ledger technology or something similar (Article 3(1)(5)). It then sorts crypto-assets into three groups, each with its own rules:

• Asset-referenced tokens (ARTs). Tokens that try to hold a stable value by referencing another value, right or basket, such as several currencies or a commodity.
• E-money tokens (EMTs). Tokens that try to hold a stable value by referencing a single official currency. A euro or dollar stablecoin redeemable at par is the typical case.
• Other crypto-assets. Everything else in scope, including most utility tokens and the large cryptocurrencies.

Crypto-assets that already qualify as financial instruments, deposits, funds (unless they are EMTs) or securitisation positions are excluded under Article 2(4), because other EU laws such as MiFID II already govern them.

The MiCA timeline

MiCA was phased in. Each date below comes from the regulation itself (Articles 143 and 149) unless a source says otherwise.

The transitional rule is in Article 143(3): firms that provided crypto services lawfully before 30 December 2024 could carry on until 1 July 2026 or until their MiCA application was decided, whichever came first. KPMG summarised the consequence on 25 June 2026: from 1 July 2026, firms serving EU clients need MiCA authorisation and "will no longer be able to rely on previous national regimes" (KPMG). Our CASP licence guide covers what that meant in practice.

Token offers and white papers

For crypto-assets other than ARTs and EMTs, MiCA's main tool is disclosure. Under Article 4, a person offering such a token to the public in the EU must be a legal person and must draw up, notify and publish a crypto-asset white paper, and keep marketing communications consistent with it. The white paper is notified to the national regulator, but regulators may not require prior approval before it is published (Article 8(3)). It is a disclosure document, not a stamp of quality.

Small and private offers are exempt from the white paper: offers to fewer than 150 people per member state, offers raising no more than EUR 1 million over 12 months, and offers only to qualified investors (Article 4(2)). Free tokens are outside the offer rules altogether (Article 4(3)). Retail buyers who purchase directly from an offeror get a 14-day right of withdrawal, unless the token was already admitted to trading before they bought it (Article 13).

Where a crypto-asset has no identifiable issuer, as with bitcoin, the issuer-side rules do not apply (recital 22), but trading venues still have duties. When a token is admitted to trading on the platform's own initiative and no white paper has been published, the platform operator has to meet the white paper requirements itself (Article 5(2)). ESMA's interim register held 1,028 notified white papers for other crypto-assets, filed by 183 distinct offerors, in the version we downloaded on 5 October 2026 (ESMA interim MiCA register, last updated 30 September 2026).

The stablecoin rules: ARTs and EMTs

Stablecoins were the first part of MiCA to apply, and the rules are the strictest. The main points:

• Authorisation. An ART issuer needs authorisation from its national regulator and an approved white paper. An EMT can only be issued by a credit institution or an electronic money institution.
• Redemption at par. EMT holders have a claim against the issuer, and the issuer must redeem "at any time and at par value" on request (Article 49).
• No interest. Issuers of ARTs and EMTs may not pay interest, and neither may CASPs when providing services related to them. Any benefit linked to how long you hold the token counts as interest (Articles 40 and 50).
• Usage caps. If an ART is used as a means of exchange for more than 1 million transactions and EUR 200 million a day on average within a single currency area, the issuer must stop issuing it and present a plan to bring usage down (Article 23).

The practical result is visible on exchanges. ESMA's register listed 25 authorised EMT issuers and zero ART issuers in the version downloaded on 5 October 2026. Circle's European entity and Paxos's EU entity are among the EMT issuers; Tether is not (ESMA, last updated 30 September 2026). Our guide to MiCA-compliant stablecoins in 2026 goes through which tokens qualify and what delistings followed.

CASP authorisation and the passport

A crypto-asset service provider (CASP) is a business that provides one or more of ten listed services to clients: custody and administration, operating a trading platform, exchanging crypto for money, exchanging crypto for other crypto, executing orders, placing crypto-assets, receiving and transmitting orders, giving advice, portfolio management, and transfer services (Article 3(1)(16)). Article 59 says no one may provide these services in the EU without authorisation, either as a CASP or as an already-regulated firm such as a bank or investment firm that notifies its regulator under Article 60.

An authorised CASP must have its registered office in a member state, effective management in the EU and at least one EU-resident director. It must hold minimum capital of EUR 50,000, 125,000 or 150,000 depending on its services (Annex IV), keep client assets segregated, publish its fees and warn clients of risks. Once authorised in one country, it can serve the rest of the EEA through a passport: it tells its home regulator which countries it wants to serve, and it can start there from the date the regulator confirms it has forwarded the notice, or at the latest 15 calendar days after submitting it (Article 65).

Firms outside the EU cannot passport in. The only route for them is "reverse solicitation", where an EU client approaches the firm entirely on its own initiative. Article 61 makes this narrow: any solicitation in the EU, by any means, cancels the exception, and a contract clause saying otherwise does not help.

How many CASPs are there? In the ESMA interim register file we downloaded on 5 October 2026 (last updated 30 September 2026) there were 364 authorised CASP entries covering 359 distinct legal entities, two of them marked as no longer authorised. Germany had the most entries (99), followed by France (36), the Netherlands (29), Cyprus (25) and Malta (23). ESMA's separate list of non-compliant entities, firms that national regulators have flagged for offering crypto services without authorisation, had 173 entries (ESMA interim MiCA register). For costs, timelines and where firms apply, see CASP licence cost in 2026 and CASP licence jurisdictions compared; to check a specific platform, use how to verify a MiCA-compliant platform.

MiCA itself is about authorisation and conduct, but CASPs are also obliged entities under EU anti-money-laundering law, so every authorised CASP has to identify and verify its customers. Most use specialist identity verification vendors, such as iDenfy, for document, biometric and screening checks; our explainer on what KYC means in crypto describes how those checks work.

Market-abuse rules

Title VI of MiCA brings a version of the EU's market-abuse regime to crypto for the first time. It applies to any crypto-asset admitted to trading, or for which admission has been requested, and it covers behaviour both on and off trading platforms, in the EU and outside it (Article 86). In short:

• issuers and those seeking admission must publish inside information as soon as possible (Article 88);
• insider dealing, and recommending it to others, is prohibited (Article 89);
• unlawful disclosure of inside information is prohibited (Article 90);
• market manipulation, including attempts, is prohibited (Article 91);
• anyone professionally arranging or executing crypto transactions must have systems to detect market abuse and report suspicions to their regulator (Article 92).

Before MiCA, pump-and-dump schemes and front-running of token listings were largely outside financial law in most EU countries. Now they are offences that national regulators can sanction.

What MiCA does not cover: DeFi and NFTs

Two exclusions get the most attention, and both come with conditions.

DeFi. Recital 22 says that where crypto-asset services "are provided in a fully decentralised manner without any intermediary", they should not fall within MiCA. The same recital says MiCA does apply to people and firms that provide or control services "directly or indirectly", including when part of the activity is decentralised. So a protocol with an identifiable company running the front end, controlling upgrades or collecting fees may not be treated as fully decentralised. There is no bright line in the text. Article 142 asked the Commission to report on decentralised finance, crypto lending and borrowing, and NFTs, and to propose legislation where appropriate. MiCA itself contains no DeFi licensing regime. Our explainer on KYC in DeFi covers how compliance questions play out in practice.

NFTs. Article 2(3) excludes crypto-assets that are "unique and not fungible". Recitals 10 and 11 narrow that: fractions of an NFT are not unique, issuing NFTs in a large series or collection is "an indicator of their fungibility", and simply giving a token a unique identifier is not enough. Regulators are told to look at substance over form. A one-off digital artwork is out of scope; a 10,000-item collection sold like a fungible token may not be.

Other things MiCA does not do: it does not regulate crypto taxation, it does not license self-custody wallet software that never holds client assets, and it does not cover tokenised securities, which remain under existing securities law.

How MiCA fits with AMLR, the TFR, DORA and DAC8

MiCA is one piece of a larger EU package. A CASP has to comply with all of these at once:

• Transfer of Funds Regulation (TFR). Regulation (EU) 2023/1113 has applied since 30 December 2024. It is the EU's version of the Travel Rule: CASPs must send and receive originator and beneficiary information with crypto transfers, regardless of amount. For transfers above EUR 1,000 to or from a self-hosted address, the CASP should verify that the address is owned or controlled by its own client. See the crypto Travel Rule explained.
• Anti-Money Laundering Regulation (AMLR). Regulation (EU) 2024/1624 applies from 10 July 2027. It replaces national AML rules with one rulebook, requires customer due diligence on occasional crypto transactions of EUR 1,000 or more, and prohibits CASPs from keeping anonymous accounts or accounts that use anonymity-enhancing coins (Article 79).
• DORA. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025 and lists MiCA-authorised CASPs among the financial entities that must manage ICT risk, report major incidents and oversee critical tech suppliers. See DORA compliance for crypto and where MiCA and DORA overlap.
• DAC8. The tax-reporting directive, Council Directive (EU) 2023/2226, has applied since 1 January 2026. It makes CASPs report their users' identities, tax numbers and transaction totals to tax authorities. Our DAC8 explainer covers it in detail.

What MiCA means for users

For someone buying or holding crypto through a European platform, MiCA changes several things:

• You can check who is licensed. The ESMA register and national registers show which legal entity is authorised, by which regulator, for which services. A platform's marketing is not proof.
• Client assets must be segregated. A CASP holding your crypto must keep it separate from its own holdings, including on-chain, and it must be legally ring-fenced so the firm's creditors have no recourse to it if the firm becomes insolvent (Article 75(7)).
• Stablecoin choice is narrower but clearer. An e-money token can only be offered to the public or admitted to trading in the EU by an authorised issuer (Article 48), and holders of those tokens have a legal right to redemption at par.
• Expect identity checks. MiCA plus AML law means every authorised exchange will verify who you are, and after DAC8 will also ask for your tax residence and tax number.
• Self-custody and DeFi are outside the licence system. That brings freedom from intermediaries, but also no authorised firm standing behind your funds and no regulator to complain to. Our self-custody guide covers the trade-offs.

Where JewelSwap fits: JewelSwap is non-custodial DeFi software on MultiversX, Sui and Radix. It is not an authorised CASP and is not regulated under MiCA, and its money markets are currently paused. Whether any given DeFi protocol is "fully decentralised" in MiCA's sense is a legal question the regulation does not settle with a test. For a view of how different blockchains position themselves in Europe, see top blockchains for Europe under MiCA.

Frequently asked questions

What is MiCA in simple terms?

MiCA is the EU's Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. It sets one set of rules across the EU for stablecoin issuers, token white papers, licensed crypto service providers such as exchanges and custodians, and market abuse in crypto markets.

When did MiCA come into effect?

MiCA entered into force on 29 June 2023. Its stablecoin rules applied from 30 June 2024 and the rest from 30 December 2024. The transitional period for firms already operating under national law ended on 1 July 2026 at the latest.

Does MiCA apply to DeFi?

Not where services are provided in a fully decentralised manner without any intermediary, according to recital 22. But MiCA does apply to people and firms that provide or control services directly or indirectly, even if part of the activity is decentralised, so the exclusion is narrower than it sounds.

Are NFTs covered by MiCA?

Unique, non-fungible crypto-assets are excluded. Fractions of NFTs, and NFTs issued in large series or collections, may be treated as fungible and fall within MiCA. Regulators look at the substance of the token, not its label.

How many crypto firms are authorised under MiCA?

ESMA's interim register, last updated on 30 September 2026, listed 364 authorised CASP entries covering 359 legal entities when downloaded on 5 October 2026. It also listed 25 authorised e-money token issuers and no asset-referenced token issuers.

Is MiCA the same as DAC8?

No. MiCA licenses and supervises crypto businesses and stablecoin issuers. DAC8, Council Directive (EU) 2023/2226, is a tax directive that requires those businesses to report user and transaction data to tax authorities from 1 January 2026.

Keep reading

• CASP licence under MiCA explained
• MiCA-compliant crypto platforms: how to verify
• MiCA-compliant stablecoins in 2026
• DAC8 crypto reporting explained
• What is KYC in crypto?

This article is educational and is not legal or financial advice. Article references are to Regulation (EU) 2023/1114 as published on 9 June 2023. Register counts come from ESMA's interim MiCA register files downloaded on 5 October 2026 (last updated 30 September 2026) and will change weekly. Other sources are linked inline, including EUR-Lex and KPMG.