For founders asking how to apply MiCA authorisation, the critical question is not simply which form to submit. It is whether your proposed crypto business can demonstrate that it is governed, funded, staffed and secured as a regulated financial services operation from day one. A weak application can delay market entry, strain investor confidence and leave payment, banking and commercial partnerships on hold.
MiCA, the EU Markets in Crypto-Assets Regulation, creates a harmonised authorisation framework for crypto-asset service providers, or CASPs. Once authorised in one EU Member State, a CASP may be able to provide authorised services across the EEA through passporting. That creates a significant expansion opportunity, but it also means regulators expect a dossier that matches the scale and risk profile of the business you intend to build.
Start by defining the regulated perimeter
The first stage is to map the actual services your group will provide, rather than adopting a broad licence strategy for appearance alone. MiCA covers services such as custody and administration of crypto-assets, operating a trading platform, exchange of crypto-assets for funds or other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management and transfer services.
Your customer journey matters as much as your commercial description. If your platform holds client keys, determines trade execution, receives and transmits customer orders, or facilitates conversion between crypto-assets and fiat currency, those activities must be assessed carefully. A business that describes itself as a technology provider may still be undertaking regulated activity in practice.
This analysis should also identify what sits outside the CASP application. Issuing an asset-referenced token or e-money token involves separate MiCA requirements. NFT activity may fall outside MiCA in limited cases, but fractionalisation, broad marketability or product features can change the analysis. Decentralisation is not a blanket exemption where a legal entity or management team materially operates the service.
Over-applying can increase capital, governance and operating burdens. Under-scoping is worse: it can require a hurried variation, create exposure before authorisation, and undermine trust with regulators. The right authorisation is the one that supports the revenue model you can evidence today and the expansion plan you can credibly deliver tomorrow.
Choose the right EU home state before you apply
MiCA is an EU regulation, but the application is submitted to the national competent authority in the Member State where the applicant is established. Regulatory approach, supervisory capacity, local talent, banking access, tax position and the practical quality of your operating presence can all affect the outcome.
The CASP must be an EU legal person with a registered office in a Member State in which it carries out at least part of its crypto-asset services. Its place of effective management must be in the EU, and at least one director must be resident in the EU. A nominal office and outsourced management arrangement are unlikely to withstand serious scrutiny.
Cyprus can be attractive for businesses seeking an EU operating base, particularly where founders value international corporate expertise, a skilled professional-services market and a practical route to EEA expansion. Yet no jurisdiction is automatically the best choice. A firm pursuing institutional custody, for example, may prioritise a different banking and talent ecosystem from a consumer-facing exchange targeting several European markets.
The decision should be made alongside group structuring. Consider where intellectual property sits, which entity contracts with customers, where revenue is recognised, how capital will be injected, and how the regulated company will interact with offshore holding or technology entities. The aim is a structure that protects assets and supports tax efficiency without blurring the regulated firm’s accountability.
Build the MiCA application around evidence
A MiCA authorisation application is a business case supported by policies, controls and proof that the business can operate safely. Regulators will test whether the documents reflect the real operating model, not whether they look polished in isolation.
A complete dossier typically addresses the following areas:
- a programme of operations explaining the services, target clients, geographic reach, distribution model and projected financial position;
- constitutional and ownership documents, including qualifying holdings and the fitness and propriety of shareholders where relevant;
- governance arrangements, management-body information and clear allocation of senior responsibilities;
- prudential safeguards, own-funds calculations and a credible plan for maintaining capital as the business grows;
- risk management, internal controls, conflicts of interest, complaints handling and outsourcing oversight;
- anti-money laundering and counter-terrorist financing controls, including customer due diligence, sanctions screening and transaction monitoring;
- ICT security, operational resilience, business continuity, incident management and data protection arrangements; and
- client-asset protections, custody arrangements, segregation procedures and disclosures appropriate to the services offered.
The exact material depends on the service profile. A custody provider needs to show how private keys are generated, stored, accessed, backed up and protected against internal misuse. A trading platform must explain market-surveillance arrangements, order-handling rules, listing governance and systems for detecting abusive behaviour. An execution or exchange business needs transparent pricing, liquidity and counterparty arrangements.
Do not treat policies as generic templates. A regulator may ask how a specific control works at 2am during a systems outage, who has authority to suspend transactions, how a suspicious wallet is escalated, or how client assets are reconciled. If management cannot answer, the policy will not carry much weight.
Put governance and substance in place early
Many applications become slower because the applicant has designed its legal structure but not its operating substance. MiCA expects the management body to be of sufficiently good repute and to possess the knowledge, skills and experience to manage the CASP. That does not mean every director must be a blockchain engineer. It does mean the board and senior team collectively need genuine command of technology, financial crime, operational risk, customer protection and the commercial model.
Key roles should be identified before filing, including compliance, AML leadership, risk ownership, ICT security and finance. In smaller firms, one suitably qualified person may cover more than one role where conflicts can be managed and the workload is realistic. As transaction volumes, customer numbers and services increase, that model may no longer be defensible.
Outsourcing is permitted, but it is not a transfer of responsibility. Whether you use a cloud provider, custody technology partner, KYC vendor, liquidity provider or customer-support partner, the authorised CASP must retain control. Due diligence, contracts, service levels, audit rights, data access, exit planning and ongoing monitoring should be documented before the relationship becomes business-critical.
MiCA compliance also sits alongside other obligations. The Transfer of Funds Regulation affects information accompanying crypto-asset transfers, while the Digital Operational Resilience Act imposes demanding ICT risk-management and third-party oversight expectations. Building these workstreams together avoids contradictory controls and expensive remediation after launch.
Submit, respond and prepare for scrutiny
When the dossier is ready, submit it to the relevant competent authority through its required channel and format. The authority first reviews completeness. Under MiCA, the regulator generally has 25 working days to assess whether an application is complete, after which the substantive assessment timetable begins. Information requests, changes to the business plan or incomplete evidence can extend the practical timeline.
A well-managed response process matters. Nominate a single project owner, maintain a controlled evidence library and ensure every answer is consistent with the original programme of operations. Regulators notice when the financial forecast, IT architecture, AML policy and board narrative describe different businesses.
Pre-application engagement can be useful where available, especially for novel products, complex group structures or a business moving from an existing national regime. It should be approached with a clear position and carefully prepared materials, not as a substitute for deciding fundamental questions internally.
Existing providers should also check national transitional arrangements. Some Member States permit certain pre-existing CASPs to continue operating for a limited period, potentially until 1 July 2026, subject to local conditions. Transitional treatment is not a reason to postpone preparation. It is a finite window to achieve a sustainable authorisation position.
Treat authorisation as the operating foundation
The strongest MiCA applications are built as launch plans, not regulatory paperwork. They connect licence scope to commercial strategy, financial resources, payment-rail planning, technology architecture and a management team that can make sound decisions under pressure.
For founders with cross-border ambitions, early advice can prevent a costly mismatch between the entity structure, regulatory home and market-entry plan. Ivyascent helps clients turn that analysis into an executable licensing and operating strategy, with the legal, corporate and commercial pieces aligned from the outset.
A regulator is ultimately assessing whether your business deserves the trust placed in a financial intermediary. Build the application as proof of that trust, and it can become far more than permission to operate: it can be the platform from which your European business grows.