MiCAR: How CASPs Should Prepare During the Transitional Period

MiCAR Implementation: Where Are We Now?

For years, crypto in Europe lived under borrowed rules. Anti-money laundering directives set the baseline for KYC and transaction monitoring, but every member state implemented them differently. Authorization regimes varied in scope and supervision. A firm authorized in one country often had no clear passport to operate across the bloc. Fragmentation was the norm.

MiCAR changes that. For the first time, the EU has a directly applicable regulation for crypto - uniform, comprehensive, and designed to replace the patchwork with a single framework. Instead of directives transposed nationally, the rules are the same from Lisbon to Tallinn, binding on firms and regulators alike.

Those rules are already in force. For stablecoin issuers, there is no grace period, no adjustment window. Authorization, governance, reserve management, disclosures - all are required today. The law is live, and the market is expected to comply.

For CASPs, the picture is more nuanced. The regulatory obligations exist, but with a transitional clause for firms that were already operating under national regimes before MiCAR took effect. They can continue under those authorizations until July 2026 at the latest - a maximum of 18 months to align systems, prepare for pan-EU licensing, and adjust to the new supervisory model. It’s a window of adaptation, not avoidance, for both industry and regulators.

The Transitional Period: Optional, Variable, and Cross-Border in Practice

One detail often missed in headlines is that MiCAR’s transitional period for CASPs is not automatic. The regulation gives member states the option to grant breathing room - up to 18 months - but it is a choice, not an obligation. In theory, a country could have required CASPs to switch to MiCAR authorization immediately.

In practice, every member state chose to offer some form of transition. But here’s the nuance: the 18 months set out in MiCAR is a ceiling, not a floor. National regulators decide whether to grant the full window or something shorter, depending on their local context. That means the timeline is not uniform. Some countries are giving firms the maximum runway until July 2026. Others are shortening the period, requiring authorization sooner. ESMA has already published a table mapping these variations across the EU.

For cross-border firms, this matters enormously. A CASP cannot assume the longest window applies everywhere. National authorizations granted under transitional rules do not come with passporting rights - only a MiCAR license allows services to flow across borders. So if a firm serves clients in a member state that has set an earlier deadline, it must be MiCAR-authorized before that date, regardless of how much time its home country has given.

Transitional Period: Who Qualifies and Who Doesn’t

The transitional period is not a blanket amnesty - it applies only to firms that were already operating legally before MiCAR came into force. That means CASPs with national authorization or AML registration in place by December 2024. For these incumbents, the window is a bridge: time to transition their operations into the MiCAR framework without interrupting services.

But it’s not just native crypto businesses. Traditional financial institutions that had launched crypto arms are also covered. Banks, investment firms, or other financial institutions that were already licensed under existing EU financial legislation don’t need a brand-new MiCAR authorization to keep those activities running. Their regulatory status is already strong. What they do need, however, is to notify their national competent authority of their crypto services - a formal step that keeps them within scope during the transition.

Both groups - native CASPs and regulated financial institutions with crypto businesses - are granted the same transitional window. By contrast, any firm entering the market after MiCAR’s effective date for CASPs does not qualify. For new players, MiCAR authorization is required upfront, before services can begin.

Simplified Authorization: Why Most CASPs Still Face the Full Process

For existing CASPs, another point to understand is whether the simplified authorization route under MiCAR applies to them. The regulation allows firms that were already authorized to move into the new regime through lighter procedures, rather than going through the full application process from scratch.

But here’s the catch: very few crypto businesses in Europe were “authorized” in the regulatory sense before MiCAR. Most were only AML-registered - meaning they were supervised for anti-money laundering and counter-terrorist financing obligations, but not subject to broader prudential, conduct, or governance requirements. For those entities, the simplified route will not apply.

Supervisors have already started to clarify this. The Central Bank of Ireland, for example, has been explicit that firms which were only AML-registered will need to go through the full MiCAR authorization process. By contrast, jurisdictions like Germany or Malta, where pre-MiCAR regimes required more traditional licensing frameworks that went beyond AML checks, may allow existing firms to benefit from the simplified procedures.

End of the Transitional Period: You Need the License in Hand

One final nuance often overlooked: the transitional period is designed to give CASPs time to obtain MiCAR authorization, not simply to apply for it. By the end of the window - whether July 2026 or an earlier national deadline - firms must already hold their license.

In other words, filing an application on the last day of the transition is not enough. National competent authorities will need time to review, assess, and issue authorizations. CASPs that delay risk running out of road: once the deadline passes, operating without a MiCAR license is no longer permitted.

The transition is therefore not just a grace period - it is a countdown. The firms that treat it as time to prepare and secure authorization early will have continuity. Those that wait until the last minute may find themselves locked out of the market altogether.

Knowing Your Supervisor: Continuity or Change

As CASPs prepare for MiCAR, it’s not only the authorization process that matters - it’s also knowing who will actually supervise them. And here the landscape splits into two clear trends.

In many member states, the same authority that supervised AML-registered CASPs will continue as the MiCAR supervisor. The Central Bank of Ireland is one example; BaFin in Germany is another. These regulators already had the perimeter, and under MiCAR they simply adjust their supervisory model to reflect the broader scope of obligations. For firms, this continuity can make the transition smoother: the names and processes are familiar, even if the requirements are heavier.

In other countries, however, supervision shifts. The Netherlands, Poland, and Italy are examples where the MiCAR mandate moves from one authority to another. In the Netherlands, oversight of crypto firms passes from De Nederlandsche Bank (DNB) to the Autoriteit Financiële Markten (AFM). In practice, that means firms face a new point of contact, new processes, and in some cases a different regulatory philosophy.

To help clarify this patchwork, ESMA has published a consolidated list of the competent authorities designated under MiCAR. For CASPs, it’s an essential resource - because understanding who will be supervising you is as important as understanding what you must comply with.

Transitional Counterparties: How to Assess Them Under MiCAR

Another question raised by the transitional rules is how already regulated CASPs - or traditional financial institutions - should treat their partners who are still operating under transitional arrangements. After all, MiCAR makes clear that only authorized entities will ultimately be allowed to provide crypto services.

ESMA has clarified this point. CASPs making use of the transitional period are not yet MiCAR-authorized, but they can still be treated as meeting compliance requirements during the window. In practice, that means business relationships do not have to be disrupted simply because one counterparty is still operating under its national registration.

But this recognition is temporary. Once the transitional period ends in a given member state, counterparties will need to reassess. At that point, only fully MiCAR-authorized CASPs will count as compliant partners. If a firm has not secured its license by the deadline, the relationship may expose its counterparties to regulatory risk.

MiCAR and Other Authorizations: Knowing the Boundaries

MiCAR is Europe’s first directly applicable framework for crypto, but it is not the only regulatory perimeter that matters. Depending on the business model, CASPs may also fall under other EU regimes that continue to apply in parallel.

For example, if a crypto-asset qualifies as a financial instrument under MiFID II, then the service provider is not a CASP under MiCAR but an investment firm under MiFID. That brings a completely different set of obligations.

Similarly, CASPs offering certain activities linked to e-money tokens may need authorization as a payment service provider. These activities fall under the EU’s Payment Services Directive, soon to be replaced by PSD3/PSR, which carries its own supervisory regime.

For firms, the lesson is clear: MiCAR does not displace all other regimes. It regulates crypto markets - but if your business touches securities law or payment services, other licenses may also be required. The transitional period under MiCAR does not extend to those obligations. CASPs must map their activities carefully to avoid blind spots at the intersections of regimes.

AML and the Travel Rule: No Pause Button

The transitional period under MiCAR gives CASPs time to adjust and secure their new licenses - but it does not suspend their other obligations. Anti-money laundering requirements were in place long before MiCAR, and they continue to apply in full. The European Banking Authority has underlined this point: the AML framework is not paused just because MiCAR is phasing in.

The same goes for the EU’s Transfer of Funds Regulation (TFR). Since December 2024, the TFR has imposed the Travel Rule on crypto transactions, requiring information on originators and beneficiaries to accompany transfers across the EU. The TFR is a standalone regulation, with its own enforcement path and supervisory expectations. It is already live and binding across all member states.

For CASPs, the message is clear. The MiCAR transition may give breathing room on licensing, but it does not give relief from AML duties or the Travel Rule. Those obligations are fully active, fully enforceable, and firmly on supervisors’ radar today.

AML Under MiCAR: The Hidden Factor in Authorization Decisions

It’s worth underscoring that MiCAR is not an anti-money laundering regulation. Its focus is on market structure, authorization, and conduct. But that does not mean AML obligations fall into the background. On the contrary: MiCAR repeatedly references AML controls, and the EBA has made clear in its guidance that robust AML frameworks remain of utmost importance.

In practice, this means authorization decisions will not be made in a vacuum. Supervisors will look closely at how firms prevent abuse of their platforms - whether AML and counter-terrorist financing systems are comprehensive, well-documented, and effectively enforced. Weak AML controls could undermine an otherwise strong MiCAR application.

That’s where ComPilot can help. Our AML aggregation layer helps CASPs prove that their AML frameworks are not just formally in place, but customized, operational, auditable, and regulator-ready. In a MiCAR world, that assurance isn’t optional - it’s the foundation of credibility.

Using the Transitional Period Wisely: What CASPs Should Do Now

For incumbents, the transitional period is not downtime - it is preparation time. Used well, it is a structured runway into MiCAR. Used poorly, it is a countdown to disruption.

Preparation means more than drafting an application. It means treating the next 18 months as the period to align every compliance pillar that supervisors already expect to see in place.

• Map your deadlines. Transitional periods vary across member states. For cross-border firms, the shortest one applies - because national registrations do not allow passporting. Only MiCAR authorization does.
  
  
• Understand your customer base. Where are your clients located? Local cut-offs determine when you must be MiCAR-licensed to continue serving them.
  
  
• Engage your supervisor. Whether it’s the same authority that handled your AML registration or a new MiCAR regulator, now is the time to learn their procedures, fees, and review timelines. Early dialogue reduces surprises.
  
  
• Check your regulatory status. If you were AML-registered only, prepare for the full MiCAR process - the simplified route likely won’t apply. If you were already under a stricter licensing regime (e.g. Germany, Malta), simplified procedures may be available.
  
  
• Keep AML frameworks live. AML rules long predate MiCAR and remain fully enforceable. The EBA has confirmed this clearly: the transitional period does not suspend AML compliance.
  
  
• Comply with the Travel Rule. Since December 2024, the EU’s Transfer of Funds Regulation (TFR) requires originator and beneficiary data to accompany every crypto transfer. It is already in force - with no relief.
  
  
• Address operational resilience. The Digital Operational Resilience Act is also live, imposing ICT risk, incident reporting, and third-party oversight requirements. CASPs cannot treat MiCAR in isolation.
  
  
• Consider other licenses. MiCAR regulates crypto markets, but other regimes may also apply. If the asset qualifies as a financial instrument, MiFID II rules kick in. If your services include EMTs, PSP authorization may be required.
  
  
• Monitor counterparties. During the transitional period, ESMA has clarified that CASPs can be deemed compliant. But once the window closes, only MiCAR-authorized firms will qualify. Counterparty risk assessments must be refreshed.
  
  
• Start early. The transitional period is time to obtain authorization, not just to apply. Supervisors will need time to review and issue licenses. Firms that delay risk being left in regulatory limbo.
  
  

‍