We missed the MiCA CASP deadline: what now

MiCA has applied to crypto-asset service providers since 30 December 2024. Article 143 allowed Member States to apply transitional measures to firms that had provided services under national law before that date. ESMA confirmed that all such periods had ended by 1 July 2026. As of July 2026, the live question is therefore not how much transition time remains, but whether the entity providing each service is authorised under Article 63 or is an eligible financial entity permitted under Article 60.

The ESMA MiCA register and the relevant competent authority record are the public starting points for that check. A legacy registration, a pending application or a group-level regulatory statement should not be presented as current authority for a specific entity and service.

Article 59 permits crypto-asset services in the EU only where the provider is an authorised CASP or an eligible financial entity acting within the applicable MiCA route. A firm cannot replace that gate with a pending application, historic VASP status, an API agreement or another group company's authorisation. Continued activity can create regulatory, contractual, banking, safeguarding and customer remediation exposure, but the consequences must be assessed for the actual facts and competent authority.

Reverse solicitation is not a general continuity route. MiCA treats it as a narrow client-initiative situation, and ESMA guidance addresses its strict application. It should not be used as the assumed basis for maintaining an EU client book. Any continuity decision needs transaction-specific legal review and current authority evidence.

A fresh application is the route for a business that intends to provide regulated crypto-asset services through its own EU entity. The file must fit the requested services and evidence governance, prudential resources, ownership, management, safeguarding, complaints, outsourcing, ICT resilience, AML controls and operational readiness. MiCA contains procedural assessment periods, but they are not a universal end-to-end delivery estimate. Completeness work, information requests, file quality, supervisory review and applicant readiness determine the real plan.

The applicant must establish a defensible home-state and substance position rather than select a filing venue from an unofficial speed ranking. It must also plan for the operating gap: filing an application does not itself permit the applicant to provide the regulated services. A separate provider-led or wind-down arrangement may be considered only after the responsibilities and customer consequences are mapped.

An acquisition can be examined where a real target has the required services, operating model and regulatory record. It is not an automatic continuity solution. A proposed acquisition of a qualifying holding is subject to the MiCA Articles 83-84 framework, and the transaction also requires corporate, regulatory, financial, technology, client-asset and compliance diligence.

A register entry does not show that an entity is for sale, suitable for the buyer or ready for the proposed change. Scope, liabilities, customer assets, outsourcing, financial crime controls, ICT dependencies, ownership assessment and remediation can each change the decision. We cover the process in detail in our guide to acquiring an authorised CASP.

Not every firm should claw its way back to EU authorisation. If EU-facing revenue is a modest share of the book, the honest answer may be to stop providing crypto-asset services in the EU: keep serving your non-EU markets from the existing entity, and wind down or migrate the EU client base in an orderly, documented way.

Orderly matters. Customer notices, asset return or migration, open orders, complaints, records, data retention and provider obligations should be mapped and carried out under a legally reviewed plan. A later CASP application may remain a separate strategic option, but it does not cure activity conducted without a valid current basis.

A provider-led model can sit inside this route where an EU-authorised CASP genuinely supplies the regulated services under its own agreement and within its verified scope. The product company may coordinate the customer experience and technical integration, but it does not inherit the CASP's authorisation. The contracting, order, custody, payment, AML and data roles must be mapped before this is treated as a viable operating model.

The route decision turns on facts the business can assemble: EU customers and services, contract and entity structure, current authority evidence, assets and money in flight, banking dependencies, provider options and any real acquisition target. SKY7 structures those facts into a route recommendation, evidence gaps and decision gates. See how a SKY7 mandate runs for the engagement model.