The Markets in Crypto-Assets Regulation sets out how crypto-asset service providers are authorised, governed and supervised across the EU. Every transitional period ended on 1 July 2026, so the question has moved from getting a licence to showing, at any moment, that you still deserve it.
The file sets out how the firm is run and how it controls money laundering risk.
The home regulator checks the file and grants one authorisation.
One notification, and the same licence serves clients across the EU.
From then on the obligations run every day, and have to be shown.
the date MiCA’s rules for crypto-asset service providers began to apply
the end of the last transitional period, with no extensions
member states served from a single authorisation
minimum retention for records of services, orders and transactions
MiCA is broad. These are the obligations a compliance team carries every day, and how Avus keeps each one evidenced.
Only an authorised CASP, or a firm permitted under Article 60, may offer crypto-asset services in the EU. The application must describe the firm’s internal controls, including how it identifies and manages money laundering risk.
Your monitoring policy, rules and risk framework sit in one place, ready to describe and to show.
An authorised CASP can serve clients in other member states after notifying its home regulator, without a second licence.
Rules, thresholds and reporting are set per country, so one programme follows you into each market.
Management must be of good repute and competent, policies must work in practice, and records of services, orders and transactions are kept for at least five years.
Approvals, roles and every decision are written to one log that cannot be edited afterwards.
Conflicts between the firm, its people and its clients must be identified, prevented or managed, and disclosed to clients.
Separation of duties is checked all the time, so the person who writes a rule cannot approve it.
Handing a function to a provider does not hand over responsibility. The CASP stays accountable and keeps control of what it outsources.
Every provider, its role and its exit plan sit next to the integration it describes.
MiCA assumes CASPs meet EU anti-money laundering law and the Transfer of Funds Regulation. A weak AML programme puts the authorisation itself at risk.
Monitoring, investigation and filing run as one workflow with one record.
MiCA arrived in stages. For service providers, every one of them has now passed.
Supervisors now ask how controls run, not whether they exist on paper.
Policies are set and signed by the people who answer for them, and every change carries their name.
Rules, thresholds and four-eyes approvals are enforced by the platform, not by reminders.
Case AI assembles the trail as cases are worked, so nothing is rebuilt for an inspection.
Every regime writes to the same controls and the same record, so meeting one helps you evidence the others.
One EU rulebook for due diligence and monitoring, applied the same way every time.
Read moreOriginator and beneficiary data travels with every transfer and is checked before funds move.
Read moreOperational resilience, with the logs, controls and third-party records auditors ask for.
Read moreLicensing, a travel rule from AED 3,500 and AML records kept for eight years.
Read moreWe will map your MiCA obligations onto Avus and show the evidence each one leaves.
A summary to help you find your way, not legal advice. The official texts are the reference, and your own counsel should confirm how they apply to you.