MiCA's transitional period for crypto-asset service providers, at most 18 months, ended on 1 July 2026. ESMA's position is that a firm serving EU clients without MiCA authorisation is now in breach of EU law. For issuers, the decision is which of three token regimes you sit in. That choice sets your disclosure, licensing and liability for the life of the token.
Who decides this
General counsel owns MiCA compliance and answers to the board for it. The board cannot delegate this. Under Regulation (EU) 2023/1114, management body members are liable to holders for a misleading white paper, and a contract cannot exclude that liability. General counsel decides how the token is classified, which disclosures go out, which licences the group needs, and what evidence goes on file to support each decision.
Which MiCA regime does our token fall into?
Classification comes first, because MiCA has three regimes with very different weight. A token that references an official currency is an e-money token (EMT). A token that references a basket of assets, currencies or commodities is an asset-referenced token (ART). Everything else falls under Title II as an "other crypto-asset", unless it is excluded from MiCA altogether.
The trade-off is cost against certainty. Title II requires a notified white paper, not an authorisation. ARTs and EMTs require an authorised issuer. Titles III and IV, which govern ARTs and EMTs, have applied since 30 June 2024. The rest of the Regulation has applied since 30 December 2024.
| Token type | Core obligation | Who may issue or offer | Competent authority |
|---|---|---|---|
| Other crypto-asset (Title II) | Draw up, notify and publish a white paper; marketing rules in Article 7 | Any legal person | Home Member State authority receives the notification and cannot require prior approval |
| Asset-referenced token (Title III) | Issuer authorisation and an approved white paper, unless exempt | An EU legal person authorised under Article 21, or a credit institution under Article 17 | Home authority; EBA has rules for transferring supervision of significant tokens |
| E-money token (Title IV) | Notify and publish a white paper under Article 51 | Only a credit institution or an electronic money institution | Home authority that licensed the issuer; EBA has rules for transferring supervision of significant tokens |
| Crypto-asset service (Title V) | CASP authorisation before providing any service | An authorised CASP, or a financial entity permitted under Article 60 | Home Member State authority; passport notified to host states |
Our view: write the classification memo before you write the white paper. Article 8 requires a Title II notification to explain why the token is not an EMT, not an ART and not excluded. If you cannot write that explanation in one page, you are not ready to notify.
Do we need a MiCA white paper, or does an exemption apply?
A public offer of an "other crypto-asset" in the EU needs a MiCA white paper unless an Article 4 exemption fits. The three exemptions cover offers to fewer than 150 persons per Member State, offers raising no more than EUR 1,000,000 over 12 months, and offers made only to qualified investors who alone can hold the token. Title II also does not apply at all to tokens given away free, mining or validation rewards, and some utility tokens for a good or service that already exists.
The exemptions are narrower than they look. The EUR 1,000,000 figure is total consideration across the whole EU, counted from the start of the offer. The qualified-investor exemption holds only if qualified investors alone can hold the token. Pick an exemption only if you can prove every condition from your own records.
If you do publish, the content is prescribed. Article 6 lists ten areas, set out in detail in Annex I, from the issuer and project to risks and the climate impact of the consensus mechanism. The first page must state that no EU competent authority approved the document. The management body must sign a statement that the content is fair, clear and not misleading. The paper may not predict the token's future value.
Timing matters. The white paper goes to the home authority at least 20 working days before publication. No authority approves it. That speed helps the issuer, but it also puts the whole risk of the content on the issuer and its directors.
Retail buyers who buy directly from the offeror get 14 calendar days to withdraw without giving a reason. That right does not apply if the token was already admitted to trading before the purchase. Treasury should plan for refunds during that window.
What changes if our token references a currency or a basket?
If the token references a single official currency, only a credit institution or an electronic money institution can offer it in the EU. Others may offer it only with the issuer's written consent. The only exemptions track narrow carve-outs in the E-Money Directive. Anyone planning a euro or dollar token without one of those licences needs a licensed partner, not a workaround.
ARTs need an authorised issuer and a white paper approved by the competent authority. Article 16 has two narrow exemptions. One covers tokens whose average outstanding value stays at or below EUR 5,000,000 over 12 months, where the issuer is not part of a network of exempt issuers. The other covers offers made only to qualified investors. Even exempt ART issuers must still draw up and notify a white paper.
For tokens that grow large, supervision can move to the European Banking Authority. The EBA has published a decision on how ARTs and EMTs are classified as significant and how supervision transfers. Reserve, custody and redemption design for these tokens is a separate decision, covered in our stablecoin issuance guide, linked below.
Do we need CASP authorisation, and where should we apply?
You need CASP authorisation if you provide any MiCA crypto-asset service to EU clients. That covers custody, exchange, trading platforms, transfers, advice and similar services. Article 59 allows only two kinds of firm to do this: an authorised CASP or a financial entity already permitted under Article 60.
The choice of home state is a real decision. The applicant needs a registered office in a Member State where it provides at least part of its services. Effective management must be in the EU, with at least one director resident there. Once authorised, the CASP can serve the whole Union without an office in each host state.
The statutory clock is short on paper. The authority has 25 working days to confirm the application is complete. It then has 40 working days to decide on a complete file. It can pause that clock once, for up to 20 working days, to ask for more information. In practice, the completeness stage is where files stall.
Passporting is a notification, not a second licence. The CASP tells its home authority which states and services it plans to cover. It may start in a host state once it receives confirmation, or at the latest on the 15th calendar day after it submitted the notice.
Group structure is part of this decision. ESMA has stressed that MiCA protection attaches only to the authorised EU entity, not to the wider group. Where the foundation, labs company and service entity sit should follow from this, as set out in our foundation structure guide, linked below.
What changed when the transition ended on 1 July 2026?
From 1 July 2026, the grandfathering route in Article 143(3) closed. Firms that served clients under national law before 30 December 2024 could continue at most until that date, or until their application was decided; some Member States set shorter periods. In its April 2026 statement, ESMA said unauthorised firms must stop and should have a wind-down plan that can be put into effect at once.
Three points from that statement matter to boards today. Non-EU firms may not serve or solicit EU clients, business clients included, apart from a narrow reverse-solicitation exception. A CASP must not outsource custody to an unauthorised entity. Clients should check the ESMA Interim MiCA Register before they transfer funds.
One deadline is still open. For other crypto-assets admitted to trading before 30 December 2024, trading platforms must ensure a compliant white paper exists by 31 December 2027. Issuers of older tokens should expect platforms to ask for one.
Marketing rules also bite now. Where a white paper is required, no marketing may go out before it is published. Each communication must be clearly identifiable, fair, consistent with the white paper and carry the statement that no authority has reviewed it. The authority of each state where the material circulates may check it, not only the home authority.
The sanctions are material. For Title II breaches, Member States must allow maximum fines of at least EUR 5,000,000 or 3% of annual turnover for legal persons. For CASP breaches, the turnover figure rises to 5%.
What goes wrong: the question you could not answer
The usual MiCA failure is not a missing licence. It is a regulator's question, asked eighteen months later, that the company cannot answer from its own records. Why did you treat this token as Title II rather than an ART? Which Article 4 exemption did the 2025 private round rely on, and how did you count the 150 persons per Member State? Which version of the white paper did retail buyers see, and when did the marketing campaign start?
Each of those answers existed once, in someone's head or a deleted chat thread. Nobody wrote it down when the decision was made. The team that made it has since changed. The directors who signed the management body statement now carry personal liability for a document they cannot reconstruct.
The fix is cheap if done early. Keep a dated decision log for classification, each exemption, each white paper version and every marketing release. Keep the evidence that supports each entry. Treat it as a board record, not a legal team folder.
How Alcyone approaches it
Authorisation filings are EU counsel's work. Alcyone's role is upstream: making sure the token model, the distribution plan and the launch calendar match the regime counsel has chosen, and that every decision has a named owner and a record. That work sits inside Alcyone's strategy and tokenomics advisory services, which begin with a fixed-scope, fixed-fee assessment credited against any further work. The partners who run it built and operate Team Finance, the TrustSwap Launchpad, The Crypto App and Panthea.
Custody is often the first outsourcing question a CASP gets, and ESMA's statement narrows the answer: a CASP may not delegate custody to an entity that is not an authorised CASP. For institutions outside that rule, Panthea's institutional custody and security model works this way: Panthea provides the technology and product layer, and custody is held by Blockfort AG, a Swiss-regulated financial intermediary, in segregated accounts it describes as bankruptcy-remote. KYC/KYB, AML, sanctions screening and travel-rule checks run inside that regulated flow. An EU CASP should take counsel's view on that rule before it relies on any custodian that is not itself MiCA-authorised.