MiCA in 2026: Stablecoin Issuer and CASP Compliance Checklist

MiCA is no longer a future licensing project. The rules for asset-referenced tokens (ARTs) and e-money tokens (EMTs) have applied since 30 June 2024, the broader regime since 30 December 2024, and the EU-wide maximum transitional period for eligible pre-existing crypto-asset service providers ended on 1 July 2026.

That changes the management question. It is no longer “when does MiCA start?” It is:

• which regulated role does each product and legal entity perform;
• which authorisation, notification, or issuer status supports that activity;
• whether the published white paper and marketing match the operating model; and
• whether governance, reserve, custody, complaints, market-abuse, outsourcing, and resilience evidence actually works.

This guide is for stablecoin issuers, crypto-asset service providers (CASPs), and enterprises buying their services. It reflects official EU materials available on 7 October 2026.

Classify the product and service before choosing controls

Classification is a legal and product-architecture exercise. Token labels, marketing terms, or an “NFT” flag in code do not control the result. A series or collection can be fungible in substance, and a token can fall under another financial-services law rather than MiCA.

The 2026 transition is over

MiCA allowed Member States to let qualifying firms that provided crypto-asset services under national law before 30 December 2024 continue temporarily. States could shorten or decline that transition.

ESMA stated that the EU-wide maximum ended on 1 July 2026. It also urged firms not authorised by then to have orderly wind-down plans and asked supervisors to prevent unauthorised services.

For a CASP operating today, retain a simple authorisation matrix:

Match the matrix to customer terms, websites, applications, order routing, support scripts, and actual transaction flows. A licensed affiliate does not automatically cover services provided by another group entity.

Stablecoin issuer controls

Asset-referenced tokens

An ART program typically needs evidence covering:

• issuer authorisation or the applicable credit-institution route;
• governance, fitness and propriety, conflicts, complaints, and outsourcing;
• a compliant crypto-asset white paper and marketing controls;
• a reserve of assets constituted and managed in accordance with MiCA;
• custody, segregation, liquidity, investment, and concentration controls;
• token-holder rights and redemption arrangements;
• recovery and redemption planning; and
• regulatory reporting and supervisory communication.

Additional obligations apply when an ART is classified as significant. The EBA directly supervises significant ARTs, while national competent authorities retain other responsibilities defined by the regulation.

E-money tokens

An EMT issuer must be a credit institution or electronic money institution. MiCA applies token-specific requirements alongside the relevant e-money framework, including issuance at par on receipt of funds, redemption at par, a white paper, and restrictions on granting interest.

Do not combine ART and EMT reserve narratives into a single generic “1:1 backing” claim. The legal category affects issuer eligibility, safeguarding or reserve mechanics, rights, investment limits, reporting, and supervision.

White paper and marketing governance

A white paper is a controlled regulatory disclosure, not a launch blog post. Establish:

1. a named owner for every factual field and risk disclosure;
2. legal and technical review before notification or publication;
3. version control and proof of the published version;
4. monitoring for material changes, errors, and misleading statements;
5. a marketing approval rule that checks consistency with the white paper; and
6. a correction, modification, and notification workflow.

Statements about stability, redemption, custody, reserve quality, yield, insurance, and regulatory status deserve evidence-based review.

CASP operating requirements

Authorisation is a starting point. A CASP must operate within its permitted services and maintain controls appropriate to its activities.

Governance and prudential safeguards

Document management responsibilities, suitability, internal control, continuity, conflicts, complaints, outsourcing, and prudential safeguards. Keep capital or insurance evidence traceable to the legal entity and service scope.

Client assets and custody

Where custody or administration is provided, reconcile client positions, wallets, keys, and books. Define segregation, authorisation, recovery, loss allocation, incident escalation, and return-of-assets procedures. Test privileged access and key ceremonies rather than relying only on a custody-provider contract.

Conduct and communications

Information must be fair, clear, and not misleading. Product approval should connect target market, risks, fees, execution, conflicts, complaints, and marketing. Advice or portfolio management requires additional suitability-oriented processes.

Trading and market integrity

Firms operating trading venues or handling orders need surveillance and escalation proportional to their role. Preserve order, execution, communication, and investigation evidence. MiCA's market-abuse framework addresses inside information, insider dealing, unlawful disclosure, and market manipulation involving crypto-assets admitted to trading or for which admission is requested.

Outsourcing

Outsourcing does not transfer regulatory responsibility. Maintain due diligence, contracts, service monitoring, concentration analysis, access and audit rights, incident paths, data-location knowledge, resilience tests, and exit plans.

MiCA, DORA, AML and the Travel Rule

MiCA is one layer of the control environment.

• DORA applies digital operational resilience requirements to in-scope financial entities, including authorised CASPs, covering ICT risk, incidents, testing, third-party risk, and governance.
• EU anti-money-laundering rules require customer, monitoring, reporting, governance, and record-keeping controls according to their scope and application dates.
• The EU transfer-of-funds framework extends traceability requirements to specified crypto-asset transfers—the “Travel Rule.”
• GDPR applies where customer, employee, counterparty, transaction, device, or monitoring information is personal data.

Build one control inventory, but keep separate obligation fields. An incident record can support MiCA governance, DORA reporting analysis, AML investigation, and GDPR breach assessment without implying that the thresholds or deadlines are identical.

A 12-week evidence plan

Weeks 1–2: prove perimeter and permission

• Map products, tokens, services, entities, countries, and customer types.
• Record legal classification and unresolved assumptions.
• Reconcile authorisation and passport records with actual services.
• Identify activities that require restriction or wind-down.

Weeks 3–5: reconcile disclosures to reality

• Compare white papers, terms, marketing, reserve descriptions, and risk warnings with production.
• Trace fees, execution, custody, redemption, and complaints end to end.
• Assign owners and change triggers for every regulated disclosure.

Weeks 6–9: test operating controls

• Sample onboarding, transactions, reconciliations, redemptions, complaints, incidents, and conflicts.
• Test wallet and key access, backups, recovery, and client-asset return.
• Review outsourcing monitoring and exit feasibility.
• Exercise DORA, AML, sanctions, Travel Rule, and data-protection escalation paths.

Weeks 10–12: remediate and govern

• Rate exceptions by customer, market, asset, and regulatory impact.
• Update risk, recovery, redemption, wind-down, and continuity plans.
• Obtain management approval for residual risk and restrictions.
• Schedule recurring assurance with evidence owners and deadlines.

The 2026 MiCA review does not change today's law by itself

The European Commission ran a targeted MiCA review consultation that closed on 30 September 2026. It asked about issues including supervision, trading-platform access, global stablecoins, innovation, and simplification.

A consultation is not an amendment. It may inform a future report or legislative proposal, but firms should not build current compliance on an anticipated change. Track adopted legal texts, official supervisory measures, and the scope of the firm's existing authorisation.

Compliance checklist

• Every token and service has a documented classification and legal owner.
• Authorisations, permitted services, passporting, and restrictions match production activity.
• Any firm without a valid route has stopped or completed an orderly wind-down.
• ART or EMT issuer status and reserve or safeguarding controls are evidenced by category.
• White papers and marketing match product, reserve, redemption, risk, and fee reality.
• Client assets, wallets, keys, records, and legal-entity books reconcile.
• Complaints, conflicts, execution, advice, and market-abuse controls are operating.
• Outsourcing retains access, monitoring, incident, resilience, and exit controls.
• DORA, AML, sanctions, Travel Rule, GDPR, and consumer-law obligations are separately mapped.
• Governance receives exceptions, metrics, regulatory change, and remediation decisions.

Frequently asked questions

Did MiCA's EU transitional period end in 2026?

Yes. The EU-wide maximum transitional period for eligible pre-existing crypto-asset service providers ended on 1 July 2026. Member States could choose shorter periods, and firms without authorisation or another valid route had to implement wind-down plans.

Are all stablecoins treated the same under MiCA?

No. MiCA distinguishes asset-referenced tokens, which reference another value or right or a combination of them, from e-money tokens, which purport to maintain value by referencing one official currency. The issuer status, reserve, redemption, white-paper and supervisory requirements differ.

Can a CASP authorisation be used across the EU?

An authorised EU crypto-asset service provider can use MiCA's passporting framework to provide authorised services across Member States after the required notifications. The permission only covers the services and conditions within its authorisation.

Does MiCA exempt DeFi?

Only services provided in a fully decentralised manner without an intermediary fall outside MiCA's scope under its recital and scope framework. Calling a product DeFi does not decide the issue; governance, control, interfaces, fees and identifiable service provision require factual analysis.

Does MiCA replace DORA or anti-money-laundering duties?

No. A CASP may need to comply with MiCA, DORA, EU anti-money-laundering and transfer-of-funds rules, sanctions, data protection, consumer law and national requirements at the same time. Evidence can be reused, but each regime keeps its own scope and tests.

Research and review note

This article was researched and reviewed on 7 October 2026 using MiCA, European Commission, ESMA, and EBA materials. It distinguishes binding requirements, supervisory statements, and a closed consultation that may inform future proposals. Token classification, authorisation, transitional eligibility, significant-token status, and the interaction with other financial-services law require fact-specific analysis.

Official sources

1. EUR-Lex — Regulation (EU) 2023/1114 on markets in crypto-assets
2. European Commission — Crypto-assets and MiCA
3. ESMA — Statement on the end of MiCA transitional periods
4. EBA — Asset-referenced and e-money tokens under MiCA
5. EBA — Supervisory role under MiCA
6. European Commission — Targeted consultation on the review of MiCA