MiCA Regulation Explained: What EU Crypto Rules Mean in 2026

Key takeaways

• MiCA, Regulation (EU) 2023/1114, has applied in full across the EU since 30 December 2024. The transitional period for existing providers ended on 1 July 2026.
• Only credit and e-money institutions can issue e-money tokens. Asset-referenced tokens need an authorized issuer or a credit institution, plus a reserve. Other crypto-assets, including utility tokens, need a notified white paper.
• Crypto-asset service providers need a MiCA authorization, or a notification if already regulated, and can passport it across the EU.
• Tokenized securities stay under MiFID II and, on DLT market infrastructure, the DLT Pilot Regime.

Providers already operating under national law had up to 18 months to obtain a MiCA authorization. That window has now shut in every Member State, and the European Securities and Markets Authority (ESMA) has told unauthorized firms to wind down their EU business. What MiCA requires depends on the token and the service.

What is MiCA?

MiCA is Regulation (EU) 2023/1114 on markets in crypto-assets. It entered into force in June 2023 and, as an EU regulation, it is directly applicable in all Member States. In place of a mix of national regimes, it gives Europe one set of rules on disclosure, authorization, supervision and market abuse for crypto-assets.

The regulation defines a crypto-asset as "a digital representation of a value or of a right" that can be transferred and stored electronically using distributed ledger technology or similar technology (Article 3). Its obligations fall on people and firms. Article 2 applies MiCA to those who issue crypto-assets, offer them to the public, seek their admission to trading or provide crypto-asset services in the Union.

A blockchain network is the infrastructure those firms use, so whether and how MiCA applies depends on the token, the entity and the service. Our earlier coverage includes MiCA is Now in Full Force from July 2025 and a 2023 overview of crypto regulations around the world.

Which crypto-assets does MiCA cover?

MiCA sorts crypto-assets into three categories, each with its own route to market. Our introduction to the key terms in MiCA covers the vocabulary.

E-money tokens. An EMT "purports to maintain a stable value by referencing the value of one official currency", which describes most euro or dollar stablecoins. Only credit institutions and electronic money institutions may issue one, and other firms can offer it to the public only with the issuer's written consent. MiCA deems EMTs to be electronic money, so the e-money rules apply alongside it (Article 48). Neither issuers nor service providers may pay interest on them (Article 50).

Asset-referenced tokens. An ART references another value or right, or a mix of them, such as a basket of currencies or a commodity. Unless it is a credit institution, its issuer needs authorization from its home competent authority, valid across the Union (Article 16), and must maintain a reserve of assets (Article 36). When an ART or EMT meets at least three significance criteria, such as more than 10 million holders or a value above EUR 5 billion (Article 43), the European Banking Authority (EBA) takes over direct supervision of a significant ART's issuer and supervises a significant EMT issued by an e-money institution jointly with the national authority. Our EMTs vs ARTs explainer has the background on the split.

Utility tokens and other crypto-assets. Everything else in scope falls under Title II, including utility tokens, which MiCA defines as crypto-assets "only intended to provide access to a good or a service supplied by its issuer". A public offer requires a legal person to draw up, notify and publish a crypto-asset white paper (Article 4). It goes to the competent authority at least 20 working days before publication, with no prior approval (Article 8), and the offeror and its management body are liable to holders for information in it that is incomplete, unfair, unclear or misleading (Article 15).

The white paper duties don't apply to offers to fewer than 150 persons per Member State, offers raising no more than EUR 1 million over 12 months, or offers made only to qualified investors. Title II doesn't apply at all when:

• the crypto-asset is offered for free
• it is created automatically as a reward for maintaining the ledger or validating transactions
• it is a utility token for a good or service that already exists or is in operation
• it can be used only within a limited network of merchants

These exemptions fall away once the offeror says it intends to seek admission to trading.

How do CASP authorization and passporting work?

A crypto-asset service provider, or CASP, is a firm whose business is providing crypto-asset services to clients on a professional basis. MiCA lists ten services in Article 3, which cover:

• custody and administration of crypto-assets for clients
• operating a trading platform for crypto-assets
• exchanging crypto-assets for funds, or for other crypto-assets
• executing orders, and receiving and transmitting orders, for clients
• placing crypto-assets
• advice and portfolio management
• transfer services for clients

To provide any of them in the EU, a firm must be authorized as a CASP by the competent authority of its home Member State (Article 59). Regulated firms such as banks, investment firms, market operators, central securities depositories, e-money institutions and fund managers can instead notify their regulator at least 40 working days ahead, for the services that match their existing licence; only credit institutions can offer the full range this way (Article 60). An authorized CASP needs a registered office in a Member State where it operates, effective management in the EU and at least one EU-resident director, and it must meet its authorization conditions at all times.

One authorization covers the whole Union. To serve other Member States, a CASP sends its home authority the list of countries and services, the authority passes it to the host countries, ESMA and the EBA within 10 working days, and the CASP may start once informed, or at the latest on the 15th calendar day after submitting (Article 65). It needs no physical presence in the host country. ESMA lists authorized CASPs, notified white papers and non-compliant entities in its interim MiCA register.

When did MiCA take effect, and what applies in October 2026?

The dates come from Article 149 and Article 143.

The transitional period, often called grandfathering, let a CASP that served clients under national law before 30 December 2024 continue until 1 July 2026 or until its MiCA application was decided, whichever came first. Member States could shorten it or skip it. In April 2026, ESMA stated that the period would expire across the EU on 1 July 2026 and that any entity providing crypto-asset services to EU clients without a MiCA licence after that date would be in breach of EU law.

In October 2026, that leaves this position:

• Every part of MiCA applies, for all three token categories and all ten services.
• No national transitional regime remains. ESMA's June 2026 public statement expects unauthorized CASPs to stop onboarding EU clients, stop marketing and limit their services to helping clients sell, transfer or close positions.
• One transitional deadline is still running. For crypto-assets other than ARTs and EMTs admitted to trading before 30 December 2024, trading platforms have until 31 December 2027 to have a MiCA white paper drawn up, notified and published where the regulation requires one.

Two dated processes could still change how MiCA works:

1. The MiCA review. The European Commission's targeted consultation on the review of MiCA ran from 20 May to 30 September 2026. It feeds the Commission's report under Articles 140 and 142, which may come with a legislative proposal.
2. ESMA as CASP supervisor. On 4 December 2025 the Commission proposed to transfer the authorization and supervision of CASPs from national authorities to ESMA. Banks and other regulated firms that offer crypto-asset services under their existing licences would stay with their current supervisors, unless crypto becomes the main activity of a firm other than a bank. The proposal is still before the co-legislators. According to the European Parliament's Legislative Train, the rapporteur published a draft on 11 June 2026.

What MiCA means for issuers, CASPs and users

Issuers and offerors. The white paper is a legal document with liability attached, and marketing must be fair, clear, not misleading and consistent with it (Article 7). For a stablecoin, the reference asset sets the route. A token tied to one official currency is an EMT and needs a credit institution or e-money institution behind it, and a token tied to anything else is an ART that needs a MiCA authorization unless a credit institution issues it, with narrow exemptions for small ARTs and offers made only to qualified investors.

CASPs. Authorization is ongoing work. A CASP must keep meeting its authorization conditions, may not grant interest on EMTs or ARTs (Article 40) and is supervised by its home competent authority.

Users and investors. MiCA protections attach to the specific authorized legal entity in the EU, not to other companies in its group or to entities outside the EU. ESMA advises checking that a provider is listed as authorized in its register before investing or transferring funds.

Tokenized securities sit under MiFID II and the DLT Pilot Regime

MiCA covers crypto-assets that existing EU financial law does not already regulate. Article 2(4) excludes crypto-assets that qualify as financial instruments, deposits, funds (unless they qualify as EMTs), securitisation positions, and insurance and pension products. Article 2(3) also excludes crypto-assets that are unique and not fungible with other crypto-assets, the exclusion that applies to unique NFTs.

Tokenized shares and bonds therefore stay under securities law. When a crypto-asset qualifies as a financial instrument, MiFID II and the rest of the securities rulebook apply, and ESMA has published guidelines on the conditions and criteria for that classification. Trading and settling tokenized financial instruments on distributed ledger market infrastructure falls under the DLT Pilot Regime, Regulation (EU) 2022/858, which has applied since 23 March 2023. It created three types of infrastructure:

• a DLT multilateral trading facility (DLT MTF)
• a DLT settlement system (DLT SS)
• a DLT trading and settlement system (DLT TSS)

For regulated onchain markets, a euro e-money token used to pay for a tokenized bond follows MiCA's EMT rules, while the bond follows MiFID II and, on a DLT market infrastructure, the DLT Pilot Regime. Our guide to tokenized securities explains how wrapped securities differ from natively issued ones.

Where Dusk fits in Europe's regulated markets

Dusk is privacy-preserving infrastructure for regulated onchain finance with selective disclosure. MiCA, MiFID II and the DLT Pilot Regime place their obligations on the issuers, venues and service providers that use a network. Dusk is the layer underneath, built so those firms can run their markets without putting their clients' balances and positions on public display.

On Dusk, Moonlight carries public transactions and Phoenix carries shielded transfers. In shielded flows, balances, positions and counterparties stay confidential, and selective disclosure lets an authorized party see what a rule requires. Settlement is deterministic, with finality in about 10 seconds.

For securities, Dusk provides infrastructure capable of carrying native issuance workflows for regulated securities. Dusk does not itself issue regulated securities. Institutions, venues and issuers need the required authorizations and product setup to issue regulated securities natively on Dusk, including DLT-TSS authorization where applicable. Dusk works with NPEX, an AFM-licensed investment firm operating a Multilateral Trading Facility (MTF) and holding a European Crowdfunding Service Provider (ECSP) licence under ECSPR; NPEX is pursuing the DLT-TSS licence. Dusk also onboarded with 21X, operator of the EU's first DLT-TSS-licensed market, as a trade participant in April 2025. On the MiCA side, Quantoz, NPEX and Dusk released EURQ, a euro-backed e-money token, in February 2025.

With these three frameworks in place, Europe's regulated markets can move onchain under defined rules. Those markets still need infrastructure that keeps client data confidential, gives supervisors the evidence they ask for and settles with finality, and Dusk's architecture is designed around those three needs.

FAQ

Is MiCA fully in force in 2026?

Yes. MiCA has applied in full since 30 December 2024, and the transitional period for existing providers ended across the EU on 1 July 2026. One deadline remains, for trading platforms to bring white papers for older crypto-assets in line with MiCA by 31 December 2027.

What is the difference between an EMT and an ART under MiCA?

An e-money token (EMT) references one official currency, such as the euro, and only a credit institution or an electronic money institution can issue it. An asset-referenced token (ART) references any other value or right, or a combination, and its issuer needs a MiCA authorization unless it is a credit institution. Neither may pay interest to holders.

Does MiCA apply to utility tokens?

Yes, with exemptions. A public offer of a utility token normally needs a notified white paper, but Title II does not apply when the token gives access to a good or service that already exists or is in operation, unless the offeror intends to seek admission to trading.

Do crypto companies need a MiCA licence to operate in the EU?

Firms providing crypto-asset services to EU clients must be authorized as a CASP, or be a regulated financial firm such as a bank or investment firm that has notified its regulator under MiCA. An authorization from one Member State can be passported across the EU.

Does MiCA cover tokenized securities?

No. Tokenized shares, bonds and other crypto-assets that qualify as financial instruments fall under MiFID II, and their trading and settlement on distributed ledger infrastructure can take place under the DLT Pilot Regime.

Read how Dusk approaches access controls, privacy with selective disclosure and settlement for regulated assets in the Assets & Regulations section of the Dusk docs.

This article is for informational purposes only and does not constitute financial, legal, or investment advice.