What is MiCAR? The European crypto-asset regulation explained
MiCAR is the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114: the European framework for the issuance of crypto-assets and for the provision of services in them. It turns crypto-asset services into a licensed activity, with requirements on capital, governance, the safekeeping of client assets, disclosure and market integrity. If you provide crypto-asset services professionally in the EU, you need authorisation as a crypto-asset service provider (CASP). And you keep every obligation you already have under the Wwft, the Dutch anti-money laundering act.
Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.
Why MiCAR exists
Before MiCAR, crypto-asset services in Europe were governed by a patchwork. The Netherlands operated a registration duty with De Nederlandsche Bank that was aimed almost entirely at integrity: customer due diligence, transaction monitoring and reporting. It said very little about capital, business organisation, the safekeeping of client assets or what you had to tell consumers. Other member states did something different again, or nothing at all. A firm operating across borders had to reassemble its compliance model country by country.
MiCAR replaces that with a single regime, and adds passporting: a licence granted in one member state gives access to the whole internal market. For established firms that is an opportunity. For firms used to a light-touch registration it is above all a substantial step up in what must be evidenced — which is why the first licensing files took considerably longer than the applicants had budgeted for. If you are planning entry into the Netherlands, plan against that reality rather than against the statutory assessment period.
What MiCAR covers, and what it does not
MiCAR is broad but not unlimited. Before anything else, you need to know on which side of its perimeter your product sits, because the answer determines which licence you apply for at all.
| Within MiCAR | Outside MiCAR |
|---|---|
| Crypto-asset services provided by CASPs | Crypto-assets that qualify as financial instruments — these fall under MiFID II |
| Issuance of asset-referenced tokens (ARTs) | Fully decentralised provision of services without an intermediary |
| Issuance of e-money tokens (EMTs) | Unique, non-fungible tokens without fractionalisation or practical interchangeability |
| Offers to the public and admission to trading | Central bank digital money and services provided by central banks |
| Market abuse in crypto-assets | The tax treatment of crypto-assets |
In practice the hardest line to draw is the one between a crypto-asset and a financial instrument. A token that functions economically as a security falls under MiFID II rather than MiCAR, with an entirely different authorisation route as the consequence. That qualification question belongs at the very start of your project, not halfway through it. Note also the distinction between the two regimes MiCAR itself contains: providing services as a CASP is one thing, issuing ARTs or EMTs is a separate and heavier regime with its own requirements.
The ten crypto-asset services
MiCAR sets out a closed list of services. Your licence is granted for the services you apply for and no more. If you want to add an activity later, you go through a process again, so it is worth being deliberate at the outset about what you actually do today and what you realistically intend to do within the licence's first years.
- Custody and administration of crypto-assets on behalf of clients
- Operation of a trading platform for crypto-assets
- Exchange of crypto-assets for funds
- Exchange of crypto-assets for other crypto-assets
- Execution of orders for crypto-assets on behalf of clients
- Placing of crypto-assets
- Reception and transmission of orders on behalf of clients
- Advice on crypto-assets
- Portfolio management of crypto-assets
- Transfer services for crypto-assets on behalf of clients
The minimum capital requirement and the weight of the other conditions differ by service category. Custody and trading platforms sit at the heavy end; advice sits at the lighter end. Firms that apply for a wide bundle of services because it looks better commercially usually pay for it in assessment time.
What a CASP must have in place
The following is the substance a Dutch supervisor expects to see documented and, more importantly, operating.
- Prudential safeguards: a minimum capital requirement that depends on the services you provide, or equivalent insurance cover, together with a multi-year financial forecast you can substantiate.
- Governance: a board that is fit and proper, a clear allocation of duties and powers, and demonstrable counterweight from the second line.
- Safekeeping of client assets: segregation of your own assets from those of clients, and records from which it is clear at any moment what belongs to whom.
- ICT and operational resilience: control over key management, incidents and outsourcing, with the DORA requirements as the framework for most licence holders.
- Disclosure: fair, clear and not misleading communication, and for offers to the public a white paper that meets the formal requirements.
- Complaints and conflicts of interest: a complaints procedure that works in practice, and a policy that identifies and manages conflicts.
- Market abuse: measures to prevent and detect insider dealing and market manipulation.
- Outsourcing: demonstrable control where core processes sit with third parties — a point on which many applications have come unstuck.
MiCAR and the Wwft run in parallel
This is the most common misunderstanding among applicants, and it is an expensive one. MiCAR governs market access and market conduct. It does not govern your gatekeeper role. Customer due diligence, risk classification, transaction monitoring, sanctions screening and the reporting of unusual transactions to FIU-the-Netherlands come from the Wwft, the Dutch anti-money laundering and anti-terrorist financing act — and in due course from the EU Anti-Money Laundering Regulation. A MiCAR licence does not release you from any of it; it is layered on top.
| Subject | MiCAR | Wwft / AMLR |
|---|---|---|
| Licensing and market access | Yes | No |
| Capital and governance | Yes | Indirectly, through the duty to run an ethical operation |
| Customer due diligence (CDD/KYC) | No | Yes |
| Transaction monitoring | No | Yes |
| Reporting unusual transactions | No | Yes |
| Sanctions screening | No | Sanctions Act 1977 and EU regulations |
| Source of funds enquiry on large deposits | No | Yes, as part of enhanced due diligence |
| Safekeeping of client assets | Yes | No |
In a licensing procedure the supervisor assesses both tracks at the same time. An excellent prudential file with a thin AML/CFT framework does not pass the assessment, and neither does the reverse. If you are building the two in sequence, you are building them in the wrong order.
The travel rule: Regulation (EU) 2023/1113
Alongside MiCAR sits Regulation (EU) 2023/1113, known in practice as the travel rule. It requires crypto-asset service providers to send, receive and verify information about the originator and the beneficiary when a transfer of crypto-assets is made.
Two features make this harder than the equivalent obligation for ordinary payments. First, there is no de-minimis threshold: unlike conventional transfers of funds, the obligation applies from the first euro, so you cannot design a process that only engages above a certain value. Second, transfers to self-hosted addresses — wallets with no intermediary behind them — call for additional measures, because there is no institution on the other side able to supply the data.
Missing or incomplete information must lead to a recorded decision on whether to execute, reject or suspend the transfer. Firms without a documented decision process here cannot explain afterwards why a particular transfer went through, and that is exactly the question a supervisor asks.
Who supervises you
Supervision of MiCAR in the Netherlands is divided between two national authorities, with two European authorities setting standards above them and the financial intelligence unit receiving reports.
| Authority | Role |
|---|---|
| De Nederlandsche Bank (DNB) | Prudential and integrity supervision, including AML/CFT and the Sanctions Act |
| Autoriteit Financiële Markten (AFM) | Conduct supervision, disclosure, market abuse |
| ESMA | European standards and guidelines, register of licence holders |
| EBA | Standards for issuers of ARTs and EMTs |
| FIU-the-Netherlands | Receipt and analysis of reports of unusual transactions |
For a licence application you will in practice deal with both DNB and the AFM, and your documentation has to satisfy both perspectives without contradicting itself.
How an application runs, and where they fail
- Qualification. Do your products fall under MiCAR or under MiFID II? Which of the ten services do you actually provide, and which will you apply for?
- Preparation. Business plan, financial forecast, governance documentation, AML/CFT framework, ICT and outsourcing file, custody arrangement, complaints procedure.
- Pre-application discussion. A conversation with the supervisor about your model before you submit. This is not a formality: most of the sticking points surface here.
- Submission. The formal assessment period only starts once the application has been declared complete.
- Assessment and questions. Several rounds of follow-up questions are normal. The speed and consistency of your answers largely determine the overall lead time.
- Licence and go-live. Authorisation is followed by ongoing supervision, with reporting obligations and an early assessment of how the framework works in practice.
Allow nine to eighteen months from first preparation to licence. The statutory deadlines apply to the formal assessment, but they only begin to run once the file is complete, and in practice that is where most of the time goes.
Where applications fail
The AML/CFT framework is described but not implemented. Policy that refers to a monitoring process still to be built, or to scenarios not yet calibrated, is recognised as paper.
The business plan and the risk framework contradict each other. A forecast built on rapid growth in higher-risk markets, next to a risk assessment stating that the client base is low risk, invites precisely the wrong question.
Outsourcing is insufficiently controlled. If you place core processes — custody, screening, onboarding — with a third party, you must show that you can genuinely direct and monitor that party.
The directors are not demonstrably suitable. Suitability is about knowledge, experience and time commitment. A director who combines five roles on paper raises doubt.
The work started too late. Nine to eighteen months is realistic, and an application assembled under time pressure shows it in the documentation.
Frequently asked questions
What is MiCAR?
MiCAR stands for Markets in Crypto-Assets Regulation: Regulation (EU) 2023/1114. It is the European framework for the issuance of crypto-assets and for the provision of services in them. Among other things it introduces a licensing requirement for crypto-asset service providers (CASPs) and sets requirements on capital, governance, the safekeeping of client assets, disclosure and the prevention of market abuse.
Who needs a MiCAR licence?
Any party that provides crypto-asset services to clients in the EU on a professional basis. That includes the custody and administration of crypto-assets for third parties, operating a trading platform, exchanging crypto-assets for funds or for other crypto-assets, executing, placing and receiving and transmitting orders, advice, portfolio management and transfer services.
Does MiCAR replace the Wwft registration with DNB?
MiCAR replaces the former national registration regime for crypto service providers with a full European licence carrying passporting rights. The obligations under the Wwft, being customer due diligence, transaction monitoring and the reporting of unusual transactions, continue to apply in full alongside it. A MiCAR licence therefore does not release you from your gatekeeper role; it comes on top of it.
How long does a MiCAR licence application take?
Allow nine to eighteen months from first preparation to licence. The formal assessment has statutory deadlines, but those only start running once the application has been declared complete, and in practice that is where most of the time goes. Incomplete governance documentation, an underdeveloped AML/CFT framework and a business plan without substantiated figures are the usual causes of delay.
What is the travel rule for crypto transfers?
Regulation (EU) 2023/1113 requires crypto-asset service providers to send and verify information about the originator and the beneficiary when crypto-assets are transferred. Unlike ordinary transfers of funds there is no de-minimis threshold: the obligation applies from the first euro. Missing or incomplete information must lead to a recorded decision on whether to execute, reject or suspend the transfer.
What is the difference between a CASP, an ART and an EMT?
A CASP is a crypto-asset service provider, meaning the service firm itself. An ART (asset-referenced token) and an EMT (e-money token) are two kinds of crypto-asset with a value stabilisation mechanism, referenced respectively to a basket of values and to a single official currency. Issuing ARTs and EMTs is subject to its own, heavier regime than providing services as a CASP.
Does DNB or the AFM supervise MiCAR in the Netherlands?
Supervision is divided. DNB focuses on the prudential side and on integrity, including AML/CFT, while the AFM covers conduct, disclosure and market abuse. For a licence application you will in practice deal with both, and at European level with ESMA and the EBA for standards and guidelines.
Sources
- Regulation (EU) 2023/1114 (MiCAR) — EUR-Lex
- Regulation (EU) 2023/1113 (transfers of crypto-assets) — EUR-Lex
- MiCAR — De Nederlandsche Bank, Open Boek Toezicht
- European Securities and Markets Authority (ESMA)
- Wwft, the Dutch anti-money laundering and anti-terrorist financing act — wetten.overheid.nl
Read next
What that looks like in practice
Facing this in practice? In a free thirty-minute call we look at your situation with you and say plainly whether we can help. Book a call or ring +31 6 11 32 53 62.