Many assume MiCA doesn’t apply if a company is incorporated outside the EU — in Singapore, Hong Kong, or Canada. That’s a dangerous mistake.
December 2024 marked a turning point for European crypto markets. Before that, each of the EU’s 27 member countries maintained its own approach to regulating crypto assets — creating a compliance nightmare for companies operating across borders: overlapping legal costs, fragmented frameworks, and endless national adaptations.
MiCA — the Markets in Crypto-Assets Regulation — ended all of that. The EU now operates under a single, unified rulebook. A license obtained in one member state opens the door to all 27. For any business thinking seriously about Europe, this is a fundamental shift in market entry logic.
Where most founders get it wrong
MiCA follows the service, not the company. It doesn’t matter where your servers are, where your team sits, or where your legal entity was formed.
If your product is accessible in the EU — if a user in Germany or France can open an account and use your crypto service — you are already operating in the European market. And MiCA already applies to you.
Targeted advertising and content directed at EU audiences alone can trigger licensing obligations.
That leaves companies with exactly two options: obtain a CASP license in an EU member state, or close your product to European users entirely. The second path is technically feasible. It also means voluntarily walking away from a market of roughly 450 million people.
VASP is not CASP
Another persistent misconception involves conflating VASP status with what MiCA now requires.
VASP — Virtual Asset Service Provider — belongs to an earlier regulatory era. It emerged from FATF’s AML agenda and was designed primarily for baseline oversight: KYC compliance, transaction monitoring, and bringing businesses under supervisory control. CASP is an entirely different regime. Under MiCA, it carries hard requirements around capital adequacy, corporate governance, client asset custody, disclosure obligations, and consumer protection.
The most costly mistake is treating CASP licensing as a bureaucratic formality
MiCA demands substance, not just paperwork. Regulators expect a physical office, local management, and a functioning internal structure — from a designated director and MLRO to compliance, risk, IT security, and accounting functions. The burden of proof is real: you must demonstrate that what stands before the regulator is an operational, governed, and accountable entity — not a shell.
Obtaining a CASP license is not simple. But it is a manageable process — provided the company works with a reliable legal partner.
- Choosing a jurisdiction. MiCA gives companies the freedom to license in any EU member state. Larger markets like the Netherlands and Germany carry reputational weight, but their regulators are heavily backlogged. At Medici Expert, we most often recommend the Czech Republic, Slovakia, Latvia, Lithuania, and Estonia.
- Corporate structure. Regulators assess both the company’s internal organization and its business model — board composition, management qualifications, ownership structure, control mechanisms, and whether the operational plan is realistic and coherent. Opaque beneficial ownership, offshore elements, weak management, or a formulaic business plan can each be grounds for rejection at the application stage.
- Capital. Minimum requirements range from €50,000 to €150,000, depending on service type — but regulators evaluate actual financial resilience and liquidity management, not just whether the threshold has been met on paper.
- Operational infrastructure. AML and KYC policies, risk management, client asset custody standards, and IT security. Regulators scrutinize whether processes genuinely function — not just whether they exist on paper.
The realistic timeline from the start of preparation to license issuance is six to eight months — assuming the company enters the process ready.
Attempting to navigate MiCA licensing without qualified legal support is the most dangerous mistake of all. The framework is still evolving, and national regulators continue to interpret it differently. Without expert guidance, you risk delays, rejections, or outright failure.
Over the past year, the market has split into three distinct groups.
The first is already in the licensing process, building a structured EU presence as a strategic priority.
The second is running the numbers — weighing whether the compliance burden is worth the market access.
The third still operates under the belief that this regulation doesn’t concern them.
That third group carries the greatest risk — most simply don’t yet grasp the scale of what they’re exposed to.
As MiCA takes hold across Europe, its influence will extend well beyond the EU — shaping global regulatory norms and the future architecture of the crypto industry.
MiCA will be one of the central topics in our conversations at Money20/20 Asia. For many companies, it’s already a practical question: does your business fall within scope, which jurisdiction makes sense, how long will the process realistically take, and where are the gaps in your current readiness?
If you’re heading to Money20/20 Asia, we have a limited number of meeting slots available. To discuss your situation with our team directly, book in advance.
About the author:
Nataly Medici is the CEO of Medici Expert, a boutique legal consultancy with a global outlook. The company helps fintech companies, Web3 projects, and financial institutions navigate licensing, compliance, banking, and regulatory challenges across 30+ jurisdictions.
