MiCA Decoded: ‘We Have an EU Office’ Is Not Enough: Here’s What Regulators Actually Want to See

MiCA Decoded is simply a 12-article play bid for Bitcoin.com News, co-authored by LegalBison’s Co-Founding and Managing Directors: Aaron Glauberman, Viktor Juskin and Sabir Alijev. LegalBison advises crypto and FinTech companies connected MiCA licensing, CASP and VASP applications, and regulatory structuring crossed Europe and beyond.

This week’s introduction has been written by Krystian Lapka, Lawyer astatine LegalBison. Krystian specializes successful cross-border firm and commercialized transactions, alongside strategical hazard absorption astatine the intersection of civilian and communal law.

Most founders approaching their archetypal CASP exertion understand, astatine slightest abstractly, that MiCA requires a existent EU presence. What they underestimate is however the regulator defines “real.”

The emblematic early-stage setup looks coherent connected paper: a registered bureau successful a favorable EU jurisdiction, a manager named successful the governance documents, ICT systems either cloud-hosted oregon managed from the group’s planetary infrastructure, and paid-in superior sitting successful a recently opened slope account.

From the inside, this feels similar an EU company. From a National Competent Authority’s perspective, it whitethorn look similar a letterbox with a manager attached.

This nonfiction maps what MiCA’s substance requirements really request crossed personnel, technology, and fiscal resilience, and explains wherefore regulators dainty each class arsenic a functional trial alternatively than a documentation exercise.

The interest driving each of it is the same: preventing letterbox companies, entities that beryllium connected insubstantial successful a favorable jurisdiction but deficiency immoderate meaningful economical activity, quality capital, oregon operational capableness wrong it.

The Myth: Presence Equals Substance

The regulatory logic present is older than MiCA. In the landmark Cadbury Schweppes ruling (Case C-196/04), the Court of Justice of the European Union established that the state of constitution cannot beryllium utilized to make “wholly artificial arrangements” that deficiency genuine economical activity. MiCA codifies that rule straight into crypto-asset regulation.

Article 59(2) of MiCA states that authorized CASPs indispensable person their registered bureau successful a Member State wherever they transportation retired astatine slightest portion of their crypto-asset services, indispensable person their spot of effectual absorption wrong the Union, and indispensable person astatine slightest 1 manager nonmigratory successful the Union. The proviso is brief. What sits down it is considerably much demanding.

ESMA’s Supervisory Briefing connected Authorization of CASPs, portion non-binding, signals intelligibly however NCAs are expected to construe these requirements successful practice.

The spread betwixt the statutory substance and the supervisory anticipation is wherever galore applications brushwood friction.

Personnel: Who Is Actually Running This Entity

The minimum threshold nether MiCA is 1 EU-resident director. Supervisory guidance raises that bar.

ESMA’s briefing anticipates astatine slightest 2 elder executives jointly overseeing regular operations. The rationale is straightforward: a azygous enforcement creates attraction hazard and removes the interior checks that a functioning governance operation requires. Two executives with defined, overlapping responsibilities is the expected baseline.

Residency is not capable connected its own. The guidance indicates that wherever a absorption assemblage subordinate is not nonmigratory successful the NCA’s jurisdiction, that idiosyncratic should beryllium susceptible of attending in-person meetings astatine the authority’s petition wrong 2 concern days.

For jurisdictions wherever carnal proximity to the supervisor matters operationally, this is simply a applicable constraint connected however acold from the location jurisdiction a manager tin efficaciously beryllium located.

Time committedness is treated with akin seriousness. ESMA’s position, arsenic articulated successful its Supervisory Briefing connected Authorization of CASPs, is that enforcement absorption committee members should mostly dedicate 100% of their nonrecreational clip to the CASP role. Double-hatting, wherever the aforesaid idiosyncratic serves successful enforcement capableness astatine aggregate entities, is permitted lone successful restricted circumstances. An enforcement who splits their attraction betwixt the CASP and different radical institution is apt to pull scrutiny during the fit-and-proper assessment.

Reporting lines substance arsenic overmuch arsenic idiosyncratic profiles. The absorption assemblage indispensable show that strategical and operational power sits wrong the EU entity, not with a genitor institution successful a 3rd state that makes the existent decisions and issues instructions downward.

An EU subsidiary whose executives functionally service arsenic implementation agents for a non-EU office is not, successful the supervisory sense, an entity with genuine EU management.

The AML magnitude reinforces this. The idiosyncratic liable for filing suspicious enactment reports (the MLRO) indispensable beryllium physically present, clasp genuine authorization wrong the entity, and beryllium capable to interact straight with the section Financial Intelligence Unit. This request reflects a broader planetary trend: the FATF and OECD’s Crypto-Asset Reporting Framework (CARF) operates connected the aforesaid logic, extending substance and transparency requirements beyond the EU.

MiCA’s unit requirements and CARF are not unrelated developments; they bespeak a converging planetary modular for what a regulated crypto entity indispensable look similar from the inside.

The corporate suitability modular from Article 68(1) requires the absorption assemblage to person due knowledge, skills and acquisition some individually and collectively. As covered successful the erstwhile installment of this series, that modular spans accepted fiscal markets regulation, DLT infrastructure and cybersecurity, and organizational governance. Each of those domains needs to beryllium represented successful the room.

A squad drawn wholly from crypto-native backgrounds with nary regulated fiscal services experience, oregon 1 with heavy TradFi acquisition and nary capableness to measure on-chain risk, carries structural gaps that the appraisal process volition surface.

Technology: Control, Not Just Hosting

DORA (Regulation (EU) 2022/2554) applies straight to CASPs and sets the model for ICT resilience requirements. The question regulators inquire astir exertion is not what infrastructure a steadfast uses. The question is who controls it.

Cloud infrastructure hosted by AWS, Azure, oregon akin providers is acceptable nether existent supervisory practice. The contented arises erstwhile the entity authorized successful the EU lacks meaningful administrative power implicit the systems it depends on.

If encryption cardinal absorption sits with a genitor company’s planetary IT team, if entree rights to lawsuit information are administered from extracurricular the EU, oregon if the catastrophe betterment program depends connected approvals from a third-country headquarters, the EU entity cannot show genuine operational independence.

ESMA’s position, arsenic reflected successful its consultation materials, is that the EU absorption squad indispensable clasp existent power implicit the ICT infrastructure applicable to the CASP’s operations. The concern continuity argumentation and catastrophe betterment plans required under Article 68(7) indispensable beryllium owned and executable by the EU entity, not babelike connected a planetary relation that whitethorn oregon whitethorn not respond successful a crisis.

The applicable trial is pointed: if the genitor company’s planetary IT squad became unavailable overnight, could the EU entity proceed to operate, entree lawsuit funds, and instrumentality assets to clients? If the reply is no, oregon not without important escalation to non-EU personnel, the substance question has not been resolved.

GDPR compliance and information governance requirements furniture connected apical of the DORA framework. Data processing arrangements, controller-processor relationships, and information residency considerations each signifier portion of the method architecture that regulators volition examine.

Financial: Capital That Actually Works

Article 67 sets the minimum prudential safeguards. The superior tiers are defined by work class:

The minimum superior fig is the starting point, not the ceiling. Prudential safeguards indispensable adjacent the higher of either the imperishable minimum superior oregon one-quarter of the preceding year’s fixed overheads.

As a CASP grows and its fixed overheads increase, this 2nd limb becomes the binding constraint. When overheads transcend 4 times the archetypal paid-in capital, the steadfast indispensable modulation to the overheads-based framework. That inflection constituent arrives faster than galore operators anticipate, and regulators expect proactive monitoring alternatively than reactive adjustment.

A structural constituent worthy noting: superior indispensable beryllium paid into an relationship held with a ceremonial recognition institution.

An EMI oregon outgo work supplier relationship does not fulfill this requirement. Establishing a banking narration arsenic a crypto concern takes clip and is not guaranteed. Beginning that process early, earlier the exertion is formally filed, is not optional. It is simply a sequencing constraint that affects the full authorization timeline.

The request that fiscal statements utilized successful the fixed overheads calculation beryllium duly audited oregon validated by nationalist regulatory authorities adds a further administrative dimension. Newly incorporated entities projecting their archetypal 12 months of overheads indispensable see those projections successful their authorization application, with the methodology intelligibly documented.

Outsourcing and the Substance Threshold

Article 73 permits CASPs to outsource operational functions to 3rd parties. The constraint is that outsourcing cannot hollow retired the authorized entity. Responsibility remains with the CASP; delegation does not transportation accountability.

ESMA’s Supervisory Briefing connected Authorization of CASPs identifies the percent of full costs attributable to functions located extracurricular the EU arsenic a applicable indicator of whether outsourcing has gone excessively far. A CASP whose bulk of operational expenditure flows to non-EU work providers, adjacent well-run and reputable ones, whitethorn look questions astir whether the EU entity has capable interior capableness to suffice arsenic a genuine work supplier alternatively than a conduit.

The favoritism the regulator draws is betwixt CASPs that outsource circumstantial functions portion retaining power and CASPs that outsource everything substantive portion retaining lone the ineligible form. The second is simply a shell, careless of however the statement is described successful the application.

Jurisdictional Variation: Same Law, Different Practice

MiCA is straight applicable crossed each EU subordinate states. The substantive requirements are uniform. Supervisory signifier is not.

Cyprus, done CySEC, has explicitly required that the bulk of a CASP’s committee of directors beryllium carnal residents of Cyprus. For a committee of 2 enforcement and 2 non-executive directors, that means a minimum of 3 Cyprus-resident directors. This goes beyond what MiCA’s substance requires and reflects nationalist AML directives layered connected apical of the harmonized EU framework.

Estonia presents a antithetic dynamic. Under the erstwhile VASP registration authorities administered by the Financial Intelligence Unit, Estonia became 1 of Europe’s astir accessible licensing jurisdictions. The modulation to MiCA shifted supervisory work to the Estonian Financial Supervision and Resolution Authority, which brings a antithetic organization attack to reappraisal and ongoing oversight.

Poland’s legislative situation, covered successful earlier installments of this series, has produced a structural spread wherever the home MiCA implementation instrumentality has not yet been enacted, leaving the KNF without ceremonial designation arsenic the competent authorization and VASP holders without a viable home CASP exertion pathway.

These variations are not loopholes oregon administrative quirks. They bespeak the world that a harmonized ineligible model inactive operates done nationalist supervisory cultures, staffing constraints, and organization histories. Selecting a jurisdiction for CASP authorization means selecting a regulator, with each the applicable implications that entails.

What ‘Genuine Establishment’ Actually Requires

Taken together, the substance requirements nether MiCA bespeak a supervisory doctrine alternatively than a checklist. The regulator wants to beryllium satisfied that, if thing goes wrong, it has meaningful recourse.

That means enforcement enactment is physically reachable and legally liable nether EU law. It means ICT systems controllable by the EU entity without dependency connected non-EU authorization chains. It means superior that is genuinely disposable and sized against existent operational risk.

And it means governance wherever the EU entity makes existent decisions alternatively than implementing instructions issued from elsewhere.

Firms that attack this arsenic a documentation workout thin to find the process harder than expected. Firms that physique the substance archetypal and papers what they person built thin to find it much straightforward. The exertion does not make the organization. It describes 1 that should already mostly exist.

Sources:

• ESMA Supervisory Briefing connected Authorization of CASPs
• ESMA MiCA Consultation Paper, 2nd Package
• MFSA MiCA Rulebook

This nonfiction is based connected a study conducted by LegalBison successful May 2026. The contented is for informational purposes lone and does not represent ineligible advice.