MiCA Compliance Checklist for Small CASPs in 2026

The MiCA transition period is over. The maximum Article 143 transition period for CASPs ended on July 1, 2026, and some Member States used shorter periods. If you hold a MiCA authorisation, the task now is to keep evidence-ready controls working every day. If you are not authorised, or your application is still pending, do not treat the filing as permission to operate: stop onboarding, prepare or execute an orderly wind-down for affected EU services, and consult your national competent authority (NCA) before any client activity.

This guide covers the 15 specific requirements a small CASP (5-50 employees) must meet, what they cost, and how to run them after authorisation. Every article reference points to the actual MiCA regulation text. Where requirements are set or supervised at national level, we say so.

---

What does MiCA require from CASPs?

MiCA's CASP framework lives in Title V of Regulation (EU) 2023/1114. The core obligations break down into three layers:

• Authorization (Articles 59-64) -- You cannot provide crypto-asset services in the EU without authorization from your home Member State's NCA. Article 59 sets the requirement; Articles 62-63 specify what your application must contain. After the applicable transition period, a pending application is not enough unless your NCA has given a specific basis for continued activity.
• Ongoing obligations (Articles 66-83) -- Once authorized, you must maintain capital, governance, client protection, and operational standards continuously. These aren't one-time setup items.
• Conduct of business (Articles 66-76) -- Rules for how you interact with clients: fair dealing, transparent pricing, conflict management, and complaints handling.

On top of MiCA itself, CASPs are also subject to the Digital Operational Resilience Act (DORA, Regulation EU 2022/2554) for ICT requirements, EBA Guidelines on Restrictive Measures (GL/2024/15) for screening and controls over Union and national restrictive measures, and national AML/CFT transpositions of Directive (EU) 2015/849 (AMLD5).

---

What is the 15-point MiCA compliance checklist?

Every item below maps to a specific MiCA article or related regulation. This isn't a summary of principles -- it's a list of things your NCA will check during authorization review and ongoing supervision.

1. Capital requirements by service class (Art. 67, Annex IV)

   MiCA sets three minimum own funds thresholds based on which services you provide:

   Service type	Minimum capital	Typical CASP example
   Advisory, portfolio management, execution, placement, transfer	EUR 50,000	Advisors, brokers
   Custody, exchange (fiat & crypto-crypto)	EUR 125,000	Custodians, exchanges
   Operation of a trading platform	EUR 150,000	Trading platforms

   If you provide multiple service types, the highest threshold applies. Additionally, under Article 67(1)(b), you must hold own funds equal to at least one quarter of the preceding year's fixed overhead expenditures, if that figure exceeds the minimum. For a small CASP with EUR 800K in fixed costs, that's EUR 200,000 -- above the EUR 150K minimum.

2. Board and governance structure (Art. 68)

   Article 68 requires your management body to be of "sufficiently good repute" and possess "adequate knowledge, skills and experience." In practice, NCAs check for:

   • No criminal convictions related to money laundering, fraud, or financial crime
   • Relevant professional experience (crypto, fintech, or traditional finance)
   • Documented fit-and-proper assessments for all directors
   • Clear organizational chart with reporting lines
   • Policies on management body composition and succession

   For a small CASP, this usually means at minimum a CEO, a compliance officer (can be the same person if justified), and at least one non-executive director or advisory board member with financial services experience. Check with your NCA -- some Member States require a dedicated MLRO (Money Laundering Reporting Officer) as a separate role.

3. AML/CFT policies and procedures (AMLD5 + national transposition)

   MiCA doesn't replace AML obligations -- it layers on top of them. Your CASP must have:

   • Written AML/CFT policy approved by the management body
   • Customer Due Diligence (CDD) procedures -- standard, simplified, and enhanced
   • Suspicious activity reporting (SAR) procedures to your national FIU
   • Risk assessment methodology (firm-wide and per-client)
   • Staff training program with records
   • Appointed MLRO with direct board access

   EBA/GL/2024/01 was final on January 16, 2024 and has applied since December 30, 2024. It added CASP-specific ML/TF risk factors and mitigating measures, including expectations around self-hosted addresses, anonymity-enhancing products, high-risk jurisdictions, blockchain analytics, and transaction monitoring. If you're in Cyprus, CySEC Circular C685 provides additional specifics for sanctions screening systems.

4. Restrictive measures screening (EBA GL/2024/15)

   This is where most small CASPs have gaps. EBA Guidelines GL/2024/15, applicable since December 30, 2025, set expectations for PSPs and CASPs to comply with Union and national restrictive measures when performing transfers of funds and crypto-assets, with focus on KYC, screening, and due diligence. In Cyprus, CySEC Circular C685 says its inspections focused on UN Sanctions and EU Restrictive Measures, plus relevant screening practices for U.S. and UK sanctions lists.

   Requirements include:

   • Pre-transfer screening of all counterparties
   • Re-screening existing relationships when sanctions lists update
   • Timestamped audit trail of every screening event
   • Documented match-handling procedures (escalation, blocking, SAR filing)
   • Assessment of circumvention risk

   Free tools like the Chainalysis sanctions oracle cover several major lists -- but provide only a binary yes/no with no audit trail, no compliance certificates, and no risk scoring. You need screening with list-version audit trails, match-handling evidence, and regulator-ready documentation.

5. Transaction monitoring (Art. 76, AMLD5)

   Beyond sanctions screening (which checks who), transaction monitoring checks what -- looking for suspicious patterns, structuring, layering, and unusual activity. Requirements:

   • Automated monitoring rules calibrated to your risk assessment
   • Alert investigation and disposition workflow
   • Threshold-based and behavioral detection
   • Regular tuning and effectiveness review (at least annually)
   • Documented rationale for rule calibration

   For a small CASP, this might mean a combination of on-chain analytics (for crypto flows) and traditional transaction monitoring (for fiat movements). The key is documented, auditable rules -- not just "we look at things manually."

6. Client asset segregation (Art. 70)

   Article 70 requires CASPs to "make adequate arrangements to safeguard the ownership rights of clients, especially in the event of the crypto-asset service provider's insolvency." In practice:

   • Client crypto-assets must be held separately from the CASP's own assets
   • Client fiat funds must be deposited in a segregated account at a credit institution or central bank
   • Custody policies must be documented and disclosed to clients
   • Regular reconciliation between internal records and on-chain/bank balances
   Insolvency protection

   This is not optional or aspirational. If your CASP holds client assets in omnibus wallets without proper segregation records, you are creating personal liability for directors in an insolvency scenario. NCAs will ask for proof of segregation during authorization review.

7. Complaints handling procedure (Art. 71)

   Article 71 requires "effective and transparent procedures for the prompt, fair and consistent handling of complaints." You need:

   • Published complaints policy (on your website, in client-accessible format)
   • Free-of-charge complaint submission for clients
   • Defined response timelines (check your NCA for specifics -- many require acknowledgment within 5 business days)
   • Internal logging and tracking of all complaints
   • Escalation path to your NCA or designated ADR body
   • Regular reporting to management body on complaint volumes and trends
8. Outsourcing governance (Art. 73)

   If you outsource any operational function -- compliance, custody technology, node infrastructure, customer support -- Article 73 applies. Key requirements:

   • Written outsourcing policy approved by management body
   • Due diligence on all service providers before engagement
   • Written agreements specifying responsibilities, audit rights, and termination
   • No delegation of regulatory responsibility -- your CASP remains liable
   • NCA notification for critical or important outsourcing arrangements
   • Exit strategy for each outsourced function

   This catches many small CASPs off guard. Using a third-party custody provider? Outsourcing KYC to an external vendor? Running infrastructure on AWS? All of these require documented outsourcing governance.

9. ICT security and operational resilience (DORA)

   CASPs authorized under MiCA fall within the scope of the Digital Operational Resilience Act (DORA, Regulation EU 2022/2554), which has applied since January 17, 2025. DORA requires:

   • ICT risk management framework with documented policies
   • Incident detection, classification, and reporting procedures
   • Major ICT incident reporting to your NCA within defined timelines
   • Regular resilience testing (at least annually for small CASPs)
   • Third-party ICT risk management (especially for cloud providers)
   • Business continuity and disaster recovery plans

   DORA is a separate regulation with its own compliance timeline, but NCAs will assess DORA readiness as part of MiCA authorization review. If your ICT resilience framework doesn't exist, your MiCA application will be delayed or rejected.

   ESMA's 2026 Common Supervisory Action will review authorised custody CASPs from H2 2026 to H1 2027, focusing on governance, key and storage management, transaction controls, incident response, smart contracts, and third-party dependencies.

10. Record keeping -- 5 years (Art. 68(9))

    Article 68(9) requires CASPs to maintain records of all crypto-asset services, orders, and transactions for at least five years. Records must be:

    • Sufficient to enable the NCA to fulfill its supervisory tasks
    • Stored in a format that allows reconstruction of each transaction
    • Available to the NCA on request
    • Including any amendments or cancellations

    This covers transaction records, client communications, compliance decisions, screening results, complaint files, and management body minutes. Five years from the end of the business relationship or transaction date.

11. Conflict of interest policy (Art. 72)

    Article 72 requires CASPs to maintain and implement a conflict of interest policy. Specific obligations:

    • Identify all actual and potential conflicts of interest (between the CASP, its staff, its shareholders, and its clients)
    • Written policy with measures to prevent, manage, and disclose conflicts
    • Annual review and update of the policy
    • Public disclosure on your website
    • Specific attention to proprietary trading, if applicable

    For small CASPs, common conflicts include: operating a trading platform while also trading as principal, providing advice while earning referral commissions, and listing tokens from related parties.

12. Business continuity plan (Art. 68 + DORA)

    Your CASP must have a documented BCP covering:

    • Business impact analysis identifying critical services and maximum tolerable downtime
    • Recovery procedures for each critical function
    • Communication plan for clients, NCA, and counterparties during disruption
    • Regular testing (at least annually)
    • Wind-down plan -- how client assets are returned if the CASP ceases operations

    The wind-down plan is particularly important for authorization. NCAs want to see that if your company fails, client assets are protected and returned in an orderly manner.

13. Marketing compliance (Art. 66 + Art. 94)

    All marketing communications must be fair, clear, and not misleading (Article 66). Article 94 adds specific requirements for crypto-asset marketing:

    • Marketing must be clearly identifiable as such
    • Consistent with any published white paper
    • Include specific risk warnings as defined by ESMA
    • No misleading claims about potential returns
    • Documented approval process for all marketing materials
    • Accessible on the CASP's website for the duration of the offering

    NCAs are actively enforcing this. Several CASPs have already received warnings for social media posts that made return guarantees or downplayed risks.

14. White paper (if applicable) (Art. 6, Art. 51)

    If your CASP issues or offers crypto-assets to the public, a crypto-asset white paper is required under Article 6. For asset-referenced tokens, Article 51 applies with stricter requirements. The white paper must include:

    • Description of the issuer and the crypto-asset
    • Rights and obligations attached to the crypto-asset
    • Technology and protocols used
    • Risk factors
    • Environmental impact disclosure (energy consumption)

    If you only provide services (exchange, custody, brokerage) without issuing tokens, white paper requirements generally don't apply to you. But if you list tokens from third-party issuers, verify they have compliant white papers filed with the relevant NCA.

15. Regulatory reporting (Art. 68 + NCA-specific)

    CASPs must provide regular reporting to their NCA. While MiCA sets the framework, specific reporting templates and frequencies are defined at the national level. Expect:

    • Quarterly or semi-annual financial reporting (own funds, capital adequacy)
    • Transaction reporting for market surveillance purposes
    • Annual compliance reports
    • Ad-hoc reporting on material changes (management, shareholders, services offered)
    • Incident reports (ICT incidents under DORA, AML under AMLD)

    ESMA has published technical standards on reporting formats, including iXBRL for white papers and JSON schemas for transaction data. Check your NCA's portal for submission requirements.

---

What should CASPs do after July 1, 2026?

The pre-deadline build phase is over. The right next step depends on your status: authorised CASPs should move into evidence-based supervision mode; unauthorised or pending CASPs should stop new client activity, preserve client assets, and agree the next steps with their NCA.

---

How much does MiCA compliance cost for small CASPs?

These figures are based on published estimates from legal firms and industry surveys for CASPs with 5-50 employees. Actual costs vary by jurisdiction, service type, and existing infrastructure.

---

What happens if you don’t comply with MiCA?

MiCA's enforcement framework is in Articles 111-115. For CASPs that breach the regulation, NCAs can impose:

• Financial penalties for legal entities: Up to EUR 5,000,000 or 5% of annual turnover, whichever is higher
• Financial penalties for natural persons: Up to EUR 700,000 for directors or managers personally responsible
• Public statement: NCA publishes your name and the nature of the breach -- reputational damage that's hard to undo
• Authorization withdrawal or suspension: You lose the right to operate
• Temporary management ban: Directors can be barred from holding management positions at any financial entity
• Permanent ban: Up to 10 years for repeat offenders
• Disgorgement of profits: NCA can require you to hand over all profits gained from the breach

Some Member States may set higher penalty caps under national transposition. Check your NCA's published penalty framework.

Operating without authorization after the applicable transition period is the clearest violation. But the enforcement articles also cover: insufficient capital, inadequate governance, missing AML procedures, failure to maintain effective restrictive measures controls, and failure to maintain records. Each of these can trigger penalties independently.

---

Where does restrictive measures screening fit into MiCA compliance?

Of the 15 items on this checklist, restrictive measures screening is the one where we see the most gaps in practice. Many small CASPs have some form of screening, but when audited against EBA GL/2024/15, the coverage falls short:

• Screening against OFAC only, with no documented coverage for applicable Union and national restrictive measures
• No re-screening when sanctions lists update
• No timestamped audit trail showing what was screened, when, against which list version
• No documented match-handling procedure
• Manual screening that doesn't scale with transaction volume

This is a compliance gap your NCA will find during an inspection -- and it's one of the easiest to close. Purpose-built screening tools that cover EU and UN legal requirements plus relevant U.S. and UK screening practices, with list-version audit trails, exist at price points accessible to small CASPs.

---

Frequently asked questions

Is the MiCA transition period still available for CASPs?

No. The maximum Article 143 transition period ended on July 1, 2026, and some Member States used shorter periods. ESMA's Q&A says a CASP that has not been authorised by the end of the applicable transition period must cease providing crypto-asset services until authorisation is granted. A pending application alone is not a safe harbour; consult the home NCA before any client activity.

How much capital does a small CASP need under MiCA?

MiCA Article 67 and Annex IV set three tiers: EUR 50,000 for advisory and portfolio management services, EUR 125,000 for custody and exchange services, and EUR 150,000 for operating a trading platform. You must also hold own funds equal to at least one quarter of the preceding year's fixed overhead expenditures, if that amount exceeds the minimum threshold.

What are the penalties for not complying with MiCA?

For CASPs, NCAs can impose fines up to EUR 5 million or 5% of annual turnover (whichever is higher) on legal entities, and up to EUR 700,000 on natural persons (directors, managers). Additional measures include public statements, temporary or permanent management bans, authorization withdrawal, and disgorgement of profits.

Does MiCA require CASPs to comply with DORA?

Yes. CASPs authorized under MiCA fall within the scope of the Digital Operational Resilience Act (DORA, Regulation EU 2022/2554), which has applied since January 17, 2025. This means CASPs must meet DORA's ICT risk management, incident reporting, resilience testing, and third-party risk management requirements on top of MiCA's own obligations. NCAs assess DORA readiness as part of MiCA authorization.

How much does MiCA compliance cost for a small CASP?

For a small CASP with 5-50 employees, expect EUR 65,000-170,000 in one-time authorization costs (legal, application prep, compliance framework setup), plus EUR 50,000-150,000 in minimum capital (retained, not spent). Ongoing annual compliance costs typically run EUR 125,000-260,000 covering a compliance officer, legal counsel, screening and monitoring tools, audits, and reporting infrastructure.

---

Bottom line

MiCA compliance for a small CASP is not a single checkbox -- it's 15 distinct requirements that your NCA will verify at authorization and monitor on an ongoing basis. The good news: every requirement is documented, every article reference is public, and the post-deadline task is concrete: keep the controls working and keep the evidence ready.

The most common failure mode we see is underestimating how many items there are. A CASP that has capital and governance sorted but no restrictive measures screening policy will get the same supervisory problem as one that has none of the above.

Start with a status check. If you are authorised, map your current state against the 15 items and close any evidence gaps. If you are unauthorised or pending, stop onboarding, preserve clients and records, prepare an orderly wind-down for affected services, and speak to your NCA before continuing any EU-facing activity.

July 1, 2026 has passed. Treat MiCA as the operating perimeter, not a project plan.