Skip to content
← Dossiers

Training module · European Union · Part 2 of 2

MiCA: the application, phase by phase

August 2026·EU
MiCACASPAuthorisationAMLTraining

Training module · European Union · Part 2 of 2

Part 1 established what a permission set does to a firm. This part follows one applicant through the process of getting it — eight phases, from the perimeter analysis to the first supervisory cycle, with the practitioner's task list and the decision-maker's brief side by side at every step.

The applicant is a composite. NORTHWIND is not a real firm and is not modelled on one. Its permission set — custody, exchange for funds, exchange for other crypto-assets, transfer services — was chosen because 26 authorisation records in the ESMA register hold exactly that basket, so the shape is realistic even though the company is invented. No competent authority publishes application files, and any account claiming to describe how a named firm obtained its licence is inference dressed as reporting.

In summary

  • MiCA times two things and nothing else. Twenty-five working days for the completeness assessment, forty for the substantive one, suspensions capped at twenty, notification within five. Roughly thirteen working weeks of regulator time.
  • The clock starts on a complete application, not on receipt. Completeness is the applicant's problem, and the gate is where badly-run projects lose their first month.
  • Your answering speed is inside the regulator's timetable, not outside it. Requests for information suspend the clock, and the suspension allowance is finite.
  • The licence takes months; the passport takes a fortnight. Article 65 lets a firm begin in another member state by the fifteenth calendar day after notifying.
  • Everything before submission is unmeasured. No authority publishes elapsed time from decision-to-apply to register entry. Advisory-firm commentary converges on four to twelve months elapsed for a well-prepared file and nine to eighteen from board decision to operating — commentary, not authority, and labelled as such throughout.
  • There is no grandfathering left. The transitional period expired across the EU on 1 July 2026, and Germany and Ireland closed theirs six months earlier.

The perimeter test, in full

Phase 1 turns on a question most summaries wave at: is this token a financial instrument, in which case MiCA is the wrong regime entirely and the answer is a MiFID II investment firm authorisation?

ESMA's guidelines of 19 March 2025 give the test, and it is worth stating exactly because it is cumulative. A crypto-asset is a transferable security where it:

  1. is not an instrument of payment — a crypto-asset used as a medium of exchange is excluded;
  2. forms a class of securities — issued by the same issuer and interchangeable, conferring the same rights; and
  3. is negotiable on the capital market.

All three, or it is not one. Two framing rules decide most cases before the limbs are reached. The assessment is technology-neutral: the DLT format "should not be considered a determining factor". And it is substance over form — a tokenised financial instrument "should continue to be considered as financial instruments for all regulatory purposes".

The hard cases are hybrids. Where a token carries a payment component alongside something else, ESMA requires a case-by-case analysis of the most appropriate qualification rather than a default. An applicant that resolves a hybrid by assertion has written the weakest paragraph in its file.

Why the pre-submission phases carry the risk

The regulation's own timetable creates a misleading impression of the project. Thirteen working weeks sounds manageable, and it is — but it measures only the period during which the authority is working, and it begins at a point the applicant controls.

The consequence is that the phases MiCA does not time are the phases that decide the outcome. Perimeter analysis determines the permission set, which determines the capital class, the conditional items in the application file, and the shape of the anti-money-laundering function for the life of the firm. Choosing the home authority determines the substance commitment, the language of the file, and whether the assessor has seen the applicant's shape before. Assembling fit-and-proper evidence for indirect qualifying holders in several jurisdictions has no legal deadline and routinely takes longer than the statutory assessment it precedes.

None of that appears in the regulation, and none of it appears in the register. It is where the work is.

The two audiences, and why they need different documents

A practitioner and the person paying for the application need the same facts arranged differently, and a training module that serves only one of them produces the failure it was meant to prevent: a compliance function that knows the articles and a board that does not know what it has committed to.

The practitioner's version of Phase 4 is nineteen items in Article 62(2), six of them conditional on the permission set, each needing an owner and a document. The decision-maker's version of the same phase is that this is where the external spend concentrates, that the programme of operations is a binding commitment rather than a pitch, and that adding a service later means an extension application assessed on the same timetable as the original.

Both are true. Neither is sufficient. The walker below carries both, phase by phase, along with the stakeholders each phase brings into the room — including the regulator-side ones, because the authorisation team, the fit-and-proper assessors, the ICT and AML specialists and the supervision team that inherits the relationship afterwards are different people with different questions.

Where the AML function sits

It is not a phase. It runs alongside all eight, and the module shows it that way deliberately.

The common failure is sequencing: perimeter and permission set decided by the commercial and legal teams, then handed to compliance to document. By then the decisions that determine the anti-money-laundering operating model have already been taken. Custody makes address attribution a core function. Transfer services make the travel rule under Regulation (EU) 2023/1113 an infrastructure project with a counterparty-protocol dependency. Exchange for funds makes the banking relationship the constraint on the whole business.

And where the permission set includes a trading platform, the market-abuse surveillance obligation under Article 92 is a separate pipeline with a separate report to a separate recipient. Applicants who describe one system serving both AML and market-abuse detection invite a question they generally cannot answer.

Reading the walker

Each phase carries a statutory period where MiCA sets one, and a planning estimate where it does not — labelled differently, because one is law and the other is judgement. Switch between the practitioner and decision-maker views for the same phase to see how the same facts change shape depending on who is reading them.

Sources

Training material, not legal advice. NORTHWIND is a composite and is not modelled on any real firm. Statutory periods are sourced to the regulation; all other durations are planning estimates and are labelled as such. The information provided is for research and educational purposes only and does not constitute legal advice.

NORTHWIND — the application, phase by phase

A non-EU exchange group establishing an EU subsidiary to serve retail and professional clients across the EEA. Custody, exchange for funds, exchange for other crypto-assets and transfer services — permission set a, c, d, j. It would like to operate a trading platform later.

NORTHWIND is a composite. It is not a real firm and is not modelled on one. Its permission set was chosen because 26 authorisation records in the ESMA register hold exactly that basket, so the shape is realistic even though the company is invented.

Phase 1 · Perimeter

Establish that MiCA is the right regime, and that it is the only one.

Planning estimate · 4–8 weeks · not published by any authorityArt 3(1)(16) service definitions · Art 2 scope · Art 61 reverse solicitation
  • Map each proposed activity onto the ten services in Art 3(1)(16). The mapping decides everything downstream — capital class, which articles attach, which parts of the application file are required.
  • Test whether any token in scope is a financial instrument under MiFID II. If it is, MiCA is the wrong regime for that token and the answer is an investment firm authorisation, not a CASP one.
  • Run ESMA's actual test rather than a general impression of it. Under Guideline 2 of the March 2025 guidelines, a crypto-asset is a transferable security where it CUMULATIVELY (i) is not an instrument of payment, (ii) forms a class of securities — same issuer, interchangeable, conferring the same rights — and (iii) is negotiable on the capital market. All three, or it is not one.
  • Apply the two framing rules that decide most cases before the three limbs are reached: the assessment is technology-neutral, so the DLT format is not a determining factor; and it is substance over form. A tokenised financial instrument remains a financial instrument for all regulatory purposes.
  • Where a token has several components — a payment element alongside something else — ESMA requires a case-by-case analysis of the most appropriate qualification. Hybrid tokens are the hard cases and should be documented as such rather than resolved by assertion.
  • Test whether any token is an e-money token or asset-referenced token, which pull in Titles III and IV and a different authorisation route entirely.
  • Kill the reverse-solicitation theory early. ESMA's guidelines treat it as very narrowly framed and not a route around authorisation; a business plan that leans on it will not survive the programme of operations.
The AML function, in parallel

The AML function should be in the room from this phase, not brought in at the file-drafting stage. The permission set determines the AML operating model: custody makes address attribution a core function; transfers make the travel rule an infrastructure project; exchange for funds makes the bank relationship the choke point.

What exists at the end of this phase
  • A written service-mapping analysis, activity by activity, letter by letter
  • A token classification memorandum
  • A decision record for the services deliberately not applied for

The only periods MiCA fixes are the 25 working days for the completeness assessment and the 40 working days for the substantive assessment, plus suspensions capped at 20 and a 5-working-day notification. That is roughly thirteen working weeks of regulator time. Everything before submission is unmeasured: no competent authority publishes elapsed time from decision-to-apply to register entry, and the register records only the authorisation date. Practitioner commentary converges on four to twelve months elapsed for a well-prepared file, and nine to eighteen months from board decision to operating under the licence — but that is advisory-firm commentary, not an authority, and it is cited here as such. The phase estimates below sit inside those ranges and are offered so they can be argued with.

Working on a matter this touches?

Start a conversation