Running the licence

At the desk

• Draft the programme of operationsThe business plan filed with a MiCA application — services, clients, geography, outsourcing, forecasts. You are supervised against it afterwards, so it is a commitment, not marketing. as a three-year commitment: group strategy, every activity regulated or not, target countries with client numbers, websites and languages, outsourcing named and located, forecasts with stress scenarios.
• Build the AML section to the RTS's shape: your own inherent-and-residual risk assessment, a copy of the policies themselves, the named AML officer with evidence of competence, the training plan.
• Describe segregation to the key-ceremony level: how keys are approved, how omnibus walletsOne wallet in which a provider pools many customers' coins. Nothing on the chain shows whose is whose. separate one client from another, funds to a credit institution by close of the next business day.
• Submit on the mandatory form. A mid-assessment change to the file restarts the clock — notify nothing avoidable.

In the boardroom

• The programme of operations is what you will be supervised against. Changing the permission set later is a fresh application, assessed on the same clock.
• Budget more senior time and external spend for this file than for any other phase of the journey — and budget it before the filing date is promised, not after.

At the desk

• Assemble per-member proof: no convictions or penalties in AML, fraud, financial services, insolvency or professional liability — and evidence the board collectively knows this business.
• Treat competence as qualifications and experience together: national practice expects hands-on time, ordinarily with a regulated firm, with supervised practice as the bridge where one limb is thin.
• Trace ownership to ultimate beneficial owners before someone else does. A qualifying holdingA stake of 10% or more of capital or voting rights, or one giving significant influence. Buying one in an authorised firm triggers its own regulatory assessment. is 10% or significant influence — and an acquisition triggers its own assessment with its own file.

In the boardroom

• Your own record is now a regulatory filing. Disclosure is survivable; discovery is not.
• An unready shareholder can stall the firm's application: qualifying holders supply their own fit-and-proper evidence, on the firm's timetable.

At the desk

• Publish the procedure and the standard complaint template; let clients file by the stated means and languages.
• Acknowledge receipt, verify admissibility, and investigate on the clock your own published timeline sets — then issue a reasoned decision and say what happens next.
• Keep the complaint file: the register of complaints, the communications, the measures taken in response.

In the boardroom

• The complaints book is the first thing an examiner samples, because the rules make you keep exactly the records that show how clients are actually treated. A tidy book is the cheapest credibility the firm can buy.

At the desk

• Stand up the three layers the RTSRegulatory technical standard — detail an EU authority drafts and the European Commission adopts as a delegated regulation. Until adoption, scrutiny and publication it is a draft, not law. names: organisational arrangements, a business-continuity policy, and the plans that implement it.
• Test the plans periodically — a plan that has never run is a document, not a control.
• Scale everything to complexity and risk: the RTS builds proportionality in, which means your reasoning for the scale you chose must exist in writing.

In the boardroom

• Continuity failures are client-visible within minutes and supervisor-visible within days. The test calendar is a board agenda item, not an IT one.

At the desk

• Map your stores to the RTS's categories: policies and procedures; the documents setting out the firm's and the client's rights; safekeeping of client crypto-assets and funds; orders; transactions.
• Key entities by identifier — the firm's own LEILegal Entity Identifier — the 20-character code that names a legal entity unambiguously in filings and registers. Registers record legal entities; firms market brands, and the LEI is how the two are matched. exists precisely so supervisors can join your records to everyone else's.
• Where platform records overlap other regimes' standards, keep them to those standards — the RTS says so itself.

In the boardroom

• Records are the firm's memory under examination: every other module on this page is evidenced — or not — by what this one keeps.

At the desk

• Run both inventories the RTS runs: conflicts potentially detrimental to the firm, and those potentially detrimental to clients — they are different lists with different owners.
• Cover remuneration and personal transactions explicitly: the RTS gives each its own policy article, including the connected persons around your people.
• Disclose with content, not boilerplate: the disclosure states the role and capacity in which the firm acts when providing the service.

In the boardroom

• Crypto firms concentrate roles — venue, dealer, custodian — that traditional finance separates by licence. The conflicts file is where that concentration is either managed or exposed.

At the desk

• Keep the order book to the RTSRegulatory technical standard — detail an EU authority drafts and the European Commission adopts as a delegated regulation. Until adoption, scrutiny and publication it is a draft, not law.'s field set and format — it is a supervisory record, designed to be read by machines other than yours.
• Present pre- and post-trade transparency data as the second RTS prescribes, not as the product team prefers.
• Remember the venue's operating rules already owe MiCA an admission process with due diligence on what is admitted — the venue is a gatekeeper, not just a matching engine.

In the boardroom

• Venue permissions are rare — eighteen platform authorisations in the whole register at the 24 August 2026 snapshot — because the duties attached to them are the heaviest in this stack. If the plan includes a venue, the plan includes that cost.

At the desk

• Scale your surveillance to your own size, scale and nature — the RTSRegulatory technical standard — detail an EU authority drafts and the European Commission adopts as a delegated regulation. Until adoption, scrutiny and publication it is a draft, not law. builds proportionality in, and expects you to have reasoned it.
• File a STOR on the template when orders, transactions or DLT behaviour look abusive — including conduct in how transactions are ordered on-chain.
• If the firm holds inside information about a crypto-asset, publish it by the prescribed technical means — and document any delay on the conditions the ITSImplementing technical standard — the forms-and-procedures sibling of an RTS, adopted as an implementing regulation on a faster track without the scrutiny period. sets.

In the boardroom

• Cross-border coordination is written into the act itself: one suspicious-transaction report can put several authorities around one table. File every report on the assumption that every relevant supervisor will read it.
• Who counts as a watcher was a genuinely argued question — the consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules.'s miners-and-validators debate is on the moving-edge page, resolved into this act.

At the desk

• Run suitability to the MiFID-aligned standard the guidelines import — the consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. asked whether crypto deserved a lighter regime, and the answer was no.
• Give portfolio-management clients their periodic statement in the guideline format.
• Build transfer procedures around the client's rights in them — the guidelines read the service from the client's side of the transaction.
• Watch the knowledge-and-competence clock: adopted July 2025, but the comply-or-explainHow EU guidelines bind: each national authority must say whether it complies, and explain publicly if not. Pressure on authorities — not a rule that binds firms directly. clock starts only when translations publish.

In the boardroom

• Guidelines bind through pressure on your supervisor, not directly on the firm — but a supervisor that declared compliance examines against them as if they were rules. Know your authority's declarations.