Skip to content
← Dossiers

Training module · European Union · Part 2 of 2

MiCA: the application, phase by phase

August 2026·EU
MiCACASPAuthorisationAMLTraining

Training module · European Union · Part 2 of 2

This page follows one invented applicant through a MiCA licence application, from deciding what to apply for to the first months of supervision. Part 1 explains what each permission means for a firm.

The applicant, NORTHWIND, is made up and is not based on any real firm. Its four services are custody, exchange for money, exchange for other crypto-assets, and transfers. They were chosen because 26 firms in ESMA's register hold exactly that set.

The short version#

  • The law times only the regulator. It has 25 working days to check that an application is complete, then 40 to decide. Questions can pause the clock for up to 20 working days in all. That is about 13 weeks.
  • The clock starts when the file is complete, not when it arrives.
  • Your replies count against that time. Slow answers use up the pause allowance.
  • Most of the work comes before you apply, and no one measures it. Advisory firms estimate four to twelve months for a well-prepared file. That is their estimate, not the law.
  • Changing the application during the assessment restarts the 40 days. A new director is enough.
  • The transition period is over. It ended across the EU on 1 July 2026, and earlier in Germany and Ireland.
  • Once licensed, other EU countries follow quickly. A firm can start there no later than 15 calendar days after telling its home regulator (Article 65).

Is MiCA the right licence?#

Start here. If a token is a financial instrument, MiCA does not cover it, and the firm needs an investment-firm licence instead.

ESMA's guidelines of 19 March 2025 set the test. A token is a transferable security only if all three are true:

  1. it is not a means of payment;
  2. it belongs to a class of identical tokens from one issuer, with the same rights; and
  3. it can be traded on the capital market.

Two rules come first. The technology does not decide the answer, and substance beats form: a tokenised share is still a share. A token that mixes a payment use with something else needs its own analysis. Asserting an answer is not enough.

What the application must contain#

MiCA lists 19 items (Article 62(2)). Two technical standards, both in force, spell them out: Delegated Regulation (EU) 2025/305 sets the content and Implementing Regulation (EU) 2025/306 sets the form. They ask for far more than the list suggests. Three examples:

  • A three-year business plan, with client numbers by country, every website and app, named outsourcing providers, and financial forecasts that include stress scenarios.
  • An AML section that shows its working: the firm's own risk assessment, the AML officer's name and experience, the training plan, and a copy of the policies themselves.
  • Client assets in detail: how keys are controlled, how clients are kept apart in shared wallets, and how client money reaches a bank by the end of the next business day.

Why the early phases matter most#

The regulator's 13 weeks start at a point the applicant controls. Before then, the firm decides what to apply for, where, and with whom. Those choices set its capital, its paperwork and its AML set-up for years. Gathering evidence about owners in several countries often takes longer than the regulator's whole assessment.

Two readers, one set of facts#

The walker below shows each phase twice: once for the person doing the work, and once for the person paying for it. The first needs a task list. The second needs to know what is being promised. The business plan, for example, is a promise the regulator will hold the firm to, and adding a service later means a new application.

AML runs through every phase#

It is not a separate step. The services a firm chooses decide how its AML work runs. Custody means tracing addresses. Transfers mean the Travel Rule (Regulation (EU) 2023/1113). Exchange for money makes the bank relationship the main constraint. A trading platform also needs market-abuse surveillance, a separate system with its own reports (Article 92).

Reading the walker#

Where MiCA sets a time limit, the walker shows it as law. Every other duration is a planning estimate, and is labelled as one.

Sources#

Training material, not legal advice. NORTHWIND is invented. Time limits come from the regulation; all other durations are planning estimates.

Finished the walker? The operations page covers running the firm once it holds the licence.

NORTHWIND — the application, phase by phase

A crypto exchange group from outside the EU, setting up an EU company to serve customers across Europe. It wants four services: custody, exchange for money, exchange for other crypto-assets, and transfers. It may add a trading platform later.

NORTHWIND is invented and is not based on any real firm. Its four services were chosen because 26 firms in ESMA's register hold exactly that set.

Phase 1 · Is MiCA the right licence?

Decide which services you need, and check that MiCA, not another law, covers them.

Planning estimate · 4–8 weeks · not published by any authorityArt 3(1)(16) the services · Art 2 scope · Art 61 reverse solicitation
  • Match each planned activity to MiCA's list of ten services. That choice sets the capital, the rules that apply and the contents of the application.
  • Check that no token is a financial instrument. ESMA's test: it is one only if it is not a means of payment, belongs to a class of identical tokens, and can be traded on the capital market. All three must be true.
  • Check for e-money or asset-referenced tokens. They follow a different route.
  • Do not rely on 'reverse solicitation' (clients approaching you). ESMA reads it very narrowly.
The AML function, in parallel

Bring the AML lead in now. The services decide how AML work runs: custody means tracing addresses, transfers mean the Travel Rule, and exchange for money depends on a bank.

What exists at the end of this phase
  • A note matching each activity to a service
  • A token analysis
  • A record of the services you chose not to seek

MiCA sets only the regulator's time limits: 25 working days to check the file is complete, 40 to decide, pauses of up to 20 working days, and 5 to give the decision. That is about 13 weeks. No regulator publishes how long the work before submission takes. Advisory firms estimate four to twelve months for a well-prepared file. The phase estimates below are planning figures, not law.

Working on a matter this touches?

Start a conversation