What is MiCA? The EU's crypto rulebook, explained simply

MiCA is the European Union's rulebook for crypto. The full name is the Markets in Crypto-Assets Regulation, and it is the first crypto law to apply across the whole bloc. One licence now works in all 27 member states. The rules set hard limits on stablecoins and plain duties for the firms that sell or hold crypto for you.

What MiCA actually is

At its core, MiCA is a single regulation, numbered (EU) 2023/1114, that governs crypto across the European Union. Before it, each country ran its own rules, or none at all. A firm licensed in France had no automatic right to serve customers in Germany. That patchwork is what MiCA replaced. It now covers how crypto is created, how it is marketed, and how the companies in the middle must behave.

Crypto is split into a few buckets, and each one gets different treatment. Plain tokens like Bitcoin and Ether sit in the lightest category. Stablecoins face the tightest rules. Service providers, the exchanges and custodians in the middle, need a full licence to operate. The heavier the risk, the heavier the duties.

By writing one dedicated code, the EU became an early mover. Most of the world still handles crypto piece by piece, through old securities law or nothing at all. The bloc gave firms a clear path, and gave itself a template other governments now study. That clarity is the selling point. It is also the cost, because the duties are strict.

What MiCA covers, and what it leaves out

MiCA covers three broad groups: the issuers who create crypto-assets, the stablecoins known as asset-referenced tokens and e-money tokens, and the crypto-asset service providers that trade, hold, or advise on these assets. If a company touches crypto for EU customers, the rules almost certainly reach it.

Issuers of ordinary tokens must publish a crypto-asset white paper before they sell to the public. It has to set out what the token does, who is behind it, and the risks involved, in plain terms. For most tokens, no regulator signs off on that document in advance. The issuer notifies its national authority and carries the duty to tell the truth. Misleading claims can bring penalties later.

Marketing is policed too. Adverts must be clear, fair, and not misleading, and they have to match what the white paper says. Buyers of a new token often get a short window to change their minds and withdraw. The aim is to stop hype from doing the selling.

Some things fall outside. Unique NFTs are mostly excluded, as long as they are genuinely one of a kind and not a big series dressed up as art. Central bank digital currencies are not covered, because those are money issued by the state. Fully decentralized projects with no company behind them sit in a grey zone the rules do not fully settle. Regulators have not said how they will treat every edge case.

How MiCA came into force

MiCA entered into force on 29 June 2023, days after it appeared in the EU's Official Journal. The rules then switched on in stages, not all at once. Stablecoin rules came first. The main body of the law followed six months later.

Those stablecoin titles started to apply on 30 June 2024. The regime for service providers, and most of the rest of MiCA, applied from 30 December 2024. That two-step start gave stablecoin issuers, seen as the bigger risk, less runway than exchanges got. The gap was deliberate.

Why the staged start matters is simple. Firms needed certainty about which rules applied when. A business planning a stablecoin in 2024 faced different deadlines from one running an exchange. Getting the order wrong could mean operating illegally for months.

The stablecoin rules that bite hardest

Stablecoins drew the strictest treatment in MiCA, and for a reason. A coin that promises a steady value can move billions in a panic. MiCA splits them into two types. E-money tokens, or EMTs, track a single currency such as the dollar or the euro. Asset-referenced tokens, or ARTs, track a basket of currencies, commodities, or other assets.

Only banks and licensed e-money firms can issue an EMT in the EU, a rule set out in Article 48 of the regulation. Reserves must be held safely and be redeemable at face value, so a holder can always claim back one euro for one euro-pegged token. If you are new to how these coins work, our guide to what a stablecoin is explains the basics.

Bigger coins face even more. When a stablecoin grows large enough to count as significant, judged by its user numbers, market value, or payment volume, oversight moves up to the European Banking Authority. Those issuers hold more capital and meet tougher reserve and reporting rules. Size brings scrutiny.

There is a harder limit for large coins tied to a currency other than the euro. When such a coin is used widely as a means of payment, its use is capped at 1 million transactions or 200 million euros a day, whichever comes first. The cap does not apply when the coin is only held or traded on an exchange.

The European Central Bank pushed for that ceiling. Its worry was simple. A popular dollar stablecoin could crowd out the euro in everyday payments across the bloc. Coins without the right authorisation can also be pulled from EU trading venues. That rule has already changed which stablecoins Europeans can easily buy, as exchanges dropped tokens whose issuers were not licensed in time.

What a MiCA licence gives a company

A MiCA licence, called a CASP authorisation, lets a company offer crypto services across the whole EU from a single approval. CASP stands for crypto-asset service provider. Once a firm is licensed in one member state, it can passport that licence into the other 26 without applying again in each. Think of it like a driving licence that every country in the bloc accepts.

MiCA names the services that need a licence. They include running an exchange, operating a trading platform, holding crypto in custody, carrying out orders, placing new tokens, giving advice, and managing portfolios. Each one carries its own duties. A custodian, for one, must be able to return client assets even if the firm itself fails.

The licence comes with strings. Firms must keep client money apart from their own, warn customers about risk, publish clear terms, and watch for market abuse. They must run anti-money-laundering checks and handle complaints properly. Misleading adverts are not allowed. A licensed exchange that mishandles client funds can lose the authorisation that lets it trade at all, which gives the rules real teeth.

The transitional period and the 2026 deadline

MiCA gave existing crypto firms time to adjust through a transitional period, often called grandfathering. Companies already working legally under national rules could keep going while they applied for a full MiCA licence. That window closed on 1 July 2026.

On 17 April 2026, the European Securities and Markets Authority, known as ESMA, confirmed the date would hold with no extensions. Any firm serving EU clients without a licence after that date is breaking EU law, ESMA said, whether or not its home country had finished writing MiCA into local rules. Unlicensed providers were told to have wind-down plans ready and to move customer assets to a licensed firm or a self-hosted wallet.

ESMA also pointed consumers to a public list. To check whether a provider is licensed, you can look at the regulator's interim MiCA register of authorised firms. Grandfathering ran unevenly across the bloc. France and Malta used the full window, while Germany and Ireland closed theirs earlier. Other regions take very different paths, as our look at whether Bitcoin is legal in the UAE shows.

For ordinary users, the change is quieter but real. The exchange you use should now be licensed, keep your assets separate, and tell you clearly what you hold. If it loses its licence, it has to help you move your crypto out in an orderly way. You carry more protection than before. None of it makes a volatile asset less volatile.

Enforcement now sits with national regulators, from Germany's BaFin to France's AMF, working under shared ESMA guidance. They can fine firms, order them to stop, or pull a licence. A company that loses its MiCA authorisation in one country loses its passport into all the others at the same time.

What MiCA does not do

MiCA is a licensing and conduct law, not a promise that crypto is safe. A licensed exchange can still be hacked. A compliant stablecoin can still lose its peg in a crisis. The rules lift the floor for how firms behave. They do not remove the risk that comes with holding crypto, and they do not guarantee you get your money back if a token collapses.

There are gaps, too. The law says little about fully decentralized finance, and the treatment of lending and staking rewards still varies across the EU. Updates, sometimes called MiCA II, are already being discussed to cover those holes. This guide is general information, not legal or financial advice. If you run a crypto business in the EU, check the current rules with a qualified adviser before you act.