MiCA Guide for Crypto-Asset Issuers (September 2026)

MiCA – the EU Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 – has applied in full since 30 December 2024. For an issuer it works in three steps. First, check the token is inside MiCA at all: crypto-assets that qualify as financial instruments (tokenized shares, bonds, fund units) are excluded and stay under MiFID II and the Prospectus Regulation. Second, find the category: e-money token (EMT), asset-referenced token (ART) or “other” crypto-asset.

Third, follow that category’s route. For other crypto-assets the route is a legal person, a white paper notified to the national competent authority at least 20 working days before publication, marketing that matches it, and liability for its content. No regulator approves it. ARTs need an authorisation, EMTs need a bank or e-money licence, and anyone providing crypto-asset services needs a CASP authorisation. Every national transitional period for CASPs has now ended.

Stobox is not a broker-dealer, investment adviser, custodian or law firm, and this guide is general information as of September 2026, not legal advice.

Key takeaways

• MiCA does not apply to crypto-assets that qualify as financial instruments (Article 2(4)). A tokenized security is regulated as a security. The token format does not change that.
• For other crypto-assets, a public offer needs no white paper if it goes to fewer than 150 persons per member state, raises no more than €1,000,000 over 12 months, or is made only to qualified investors (Article 4(2)).
• The white paper is notified, not approved. It goes to the home authority at least 20 working days before publication, and its first page must say no authority has approved it (Articles 6 and 8).
• ART issuers need own funds of at least €350,000 (or 2% of the reserve, if higher). CASPs need a minimum capital of €50,000, €125,000 or €150,000 depending on their services (Article 35, Annex IV).
• The CASP grandfathering regime ended on 1 July 2026 at the latest. Member states chose periods from 6 to 18 months, per ESMA’s list.
• ESMA’s interim register, last updated on 24 September 2026, lists 1,012 white-paper entries for other crypto-assets, 49 EMT issuer entries, 362 CASP entries and no ART issuers.

First question: is your token a crypto-asset or a financial instrument?

MiCA defines a crypto-asset as “a digital representation of a value or of a right” that can be transferred and stored using distributed ledger technology (Article 3(1)(5)). The definition is broad on purpose. The exclusions are what matter to most issuers who come from real-world assets.

Article 2(4) says MiCA does not apply to crypto-assets that qualify as financial instruments, deposits, funds (unless they are e-money tokens), securitisation positions, insurance or pension products. Article 2(3) also excludes crypto-assets that are “unique and not fungible” with other crypto-assets. What decides the category is the rights a token carries. Its label or its blockchain does not.

ESMA’s guidelines on qualifying crypto-assets as financial instruments (final report of 17 December 2024, published with translations on 19 March 2025) set a “substance over form” test. For hybrid tokens they are explicit: “If the hybrid token displays features of a financial instrument, such nature should take precedence in its classification.” A token that pays a share of profits is assessed as a security first, whatever the white paper calls it.

This is where Stobox works. A tokenized share, note or fund interest is a financial instrument. It sits under MiFID II, the Prospectus Regulation and, for regulated DLT trading and settlement, the DLT Pilot Regime (Regulation (EU) 2022/858, applicable since 23 March 2023).

The US reaches the same answer. SEC Commissioner Hester Peirce wrote on 9 July 2025: “Tokenized securities are still securities.”

If this describes your asset, stop here and read our EU tokenization guide, which covers prospectus exemptions, passporting and the DLT Pilot. For national rules, see Germany, Luxembourg and Liechtenstein. The security token vs utility token comparison explains the line in plain terms.

The three MiCA token categories

If the token is inside MiCA, it falls into one of three categories. Each one has its own title in the regulation and its own entry route.

The ART authorisation requirement has two exemptions. They apply where the average outstanding value never exceeds €5,000,000 over 12 months, or where the offer is made only to qualified investors (Article 16(2)). A white paper is still required in both cases. When an ART is classified as significant, its issuer is supervised by the European Banking Authority. For a significant EMT issued by an e-money institution, the EBA supervises some of the extra obligations (Article 117).

Offering other crypto-assets: the Title II white paper regime

Most issuers outside payments and stablecoins land in Title II. Under Article 4(1), a person may make a public offer of such a crypto-asset in the EU only if it:

1. is a legal person;
2. has drawn up a white paper under Article 6;
3. has notified it to the competent authority under Article 8;
4. has published it under Article 9;
5. has drafted any marketing communications under Article 7 and published them under Article 9;
6. complies with the conduct duties in Article 14: act honestly, fairly and professionally, manage conflicts of interest and keep systems secure.

Exemptions. The white paper steps do not apply to an offer to fewer than 150 persons per member state, an offer of no more than €1,000,000 over 12 months, or an offer only to qualified investors who alone can hold the token (Article 4(2)). Title II does not apply at all to free tokens, mining and validation rewards, utility tokens for a good or service that already exists, or limited-network tokens (Article 4(3)). None of these exemptions survive if the offeror announces that it intends to seek admission to trading (Article 4(4)). A utility-token offer for a service not yet built may run for no longer than 12 months (Article 4(6)).

What the white paper must contain

Article 6 and Annex I set the content: the offeror, the issuer if different, the project, the offer, the token, the rights and obligations attached, the underlying technology, the risks, and the principal adverse climate and environmental impacts of the consensus mechanism. The paper must be fair, clear and not misleading, and it must not predict the token’s future value.

Several statements are mandatory. The first page must carry the statement that the paper “has not been approved by any competent authority in any Member State of the European Union”. Then comes a statement from the management body and a summary with prescribed warnings. The paper must also warn that the token may lose its value in part or in full, may not always be transferable, may not be liquid, and is not covered by investor compensation or deposit guarantee schemes. It must be written in an official language of the home member state or in a language customary in international finance.

The paper must also be machine-readable (Article 6(10)). Under Implementing Regulation (EU) 2024/2984, that means the iXBRL format, which ESMA says entered into application on 23 December 2025. ESMA publishes the taxonomy and Excel-based examples on its MiCA page.

Notification, not approval

The white paper goes to the competent authority of the home member state at least 20 working days before it is published (Article 8(5)). The notification must explain why the token is not an EMT, not an ART and not excluded under Article 2(4) (Article 8(4)). The ESAs have issued guidelines with a template and a standardised test for that explanation, listed on the EBA’s MiCA page.

“Competent authorities shall not require prior approval of crypto-asset white papers” (Article 8(3)). Once published, the paper lets the offeror offer the token throughout the EU (Article 11). The offeror also lists the host member states. The home authority forwards the paper to them within five working days, and ESMA adds it to its register by the start date of the offer.

Marketing communications

Marketing must be clearly identifiable as marketing, fair, clear and not misleading, and consistent with the white paper. It must name the website and a phone and email contact, and it must carry its own statement that no authority has reviewed or approved it (Article 7(1)). Where a white paper is required, no marketing may go out before the paper is published (Article 7(2)). The authority of each member state where the marketing runs may check it.

After the launch

• Results. A time-limited offer publishes its result within 20 working days of the end of subscription. An open-ended offer publishes the number of units in circulation at least monthly (Article 10).
• Safeguarding. For a time-limited offer, funds raised are kept by a credit institution, and crypto-assets by a CASP providing custody (Article 10(3)).
• Withdrawal. Retail buyers who buy directly from the offeror or its placing agent may withdraw within 14 calendar days, without fees or reasons. The right does not apply once the token is admitted to trading (Article 13).
• Updates. A significant new factor or a material mistake requires a modified white paper, notified at least 7 working days before publication. Older versions stay online for at least 10 years, marked as no longer valid (Article 12).
• Cancellation. If an offer is cancelled, funds go back to buyers within 25 calendar days (Article 14(3)).

Liability

If a white paper is incomplete, unfair, unclear or misleading, the offeror and the members of its management body are liable to holders for the resulting loss. Contractual exclusions of that liability have no legal effect (Article 15). The holder must show the infringement and that they relied on it. The summary alone creates liability only if it is misleading or incomplete when read with the rest of the paper.

Seeking admission to trading (“listing”) under MiCA

Admission to trading follows the same rules as a public offer (Article 5): a legal person, a notified and published white paper, and compliant marketing. Two practical points differ.

• The issuer and the platform operator may agree in writing that the operator takes over all or part of the white paper duties (Article 5(3)). The issuer still answers for information it gives the operator (Article 15(3)).
• If the token is already admitted on another EU platform and an up-to-date white paper exists, a new white paper is not needed, as long as its author consents in writing (Article 5(4)).

Before admitting a token, the platform must assess its suitability. The platform’s rules must bar tokens without a required white paper, and tokens with a built-in anonymisation function unless holders and their transaction history can be identified (Article 76). For tokens that were already trading before 30 December 2024, platforms have until 31 December 2027 to make sure a compliant white paper exists (Article 143(2)).

The CASP regime in brief: custody, brokers and exchanges

Issuing your own token is not, by itself, a crypto-asset service. Holding clients’ tokens, running a market or placing tokens for someone else is. MiCA lists ten services (Article 3(1)(16)): custody and administration, operating a trading platform, exchange for funds, exchange for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management, and transfer services. Anyone who provides one of them in the EU needs a CASP authorisation (Article 59).

An authorised CASP needs a registered office in a member state where it provides at least part of its services. Its place of effective management must be in the EU, and at least one director must be resident in the EU (Article 59(2)). It can then serve the whole EU without a physical presence in each state (Article 59(7)).

Brokers and banks do not always need a new licence. Credit institutions, central securities depositories, investment firms, market operators, e-money institutions, UCITS managers and AIFMs may provide the equivalent services after notifying their authority at least 40 working days in advance (Article 60). For an investment firm, reception and transmission and execution of orders map onto its existing MiFID permissions.

The prudential requirement is the higher of the Annex IV amount and a quarter of the previous year’s fixed overheads (Article 67).

MiCA custody requirements

Custody means “the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets”, including private keys (Article 3(1)(17)). A custodian must:

• sign an agreement with each client covering the service, the custody policy, security systems, fees and applicable law;
• keep a register of positions in each client’s name and send a statement of positions at least every three months;
• segregate client holdings from its own, including on the ledger. The custodian’s creditors have no recourse to client assets in insolvency;
• return assets or access to them as soon as possible;
• accept liability for losses from incidents attributable to it, capped at the market value of the lost asset when the loss occurred (Article 75).

Client cash other than e-money tokens must be placed with a credit institution or central bank by the end of the next business day (Article 70). On 8 July 2026 ESMA launched a common supervisory action on CASPs’ digital operational resilience for custody. It covers key management, smart-contract risk and third-party dependencies, and runs from the second half of 2026 to the first half of 2027.

The transitional period has ended

Article 143(3) let firms that provided crypto-asset services under national law before 30 December 2024 continue until 1 July 2026, or until their MiCA application was decided, whichever came first. Member states could shorten or skip this period, and most did. The list ESMA currently publishes shows:

ESMA notes that some periods were national expectations not yet written into law, and some states set earlier application deadlines. In September 2026 the practical position is simple. A firm providing crypto-asset services in the EU needs a MiCA authorisation or an Article 60 notification. ESMA’s statement of 17 December 2024 had already warned that firms relying on grandfathering had no passport during the transition.

Two other transitional rules still matter. Offers that ended before 30 December 2024 are outside Articles 4–15. Tokens admitted to trading before that date need a compliant white paper by 31 December 2027, which the platform operator must ensure (Article 143(1)–(2)).

ESMA and EBA technical standards (RTS, ITS and guidelines)

MiCA gave ESMA and the EBA many mandates for detailed rules. ESMA tracks them in its Level 2 and Level 3 overview. The ones an issuer meets first:

ART and EMT issuers deal mostly with EBA standards on own funds, liquidity, recovery and redemption plans. The EBA’s MiCA page lists them.

The ESMA interim MiCA register

Articles 109 and 110 require ESMA to keep a central register. ESMA publishes it as an interim set of five CSV files on its MiCA page and updates it weekly. In the version dated 24 September 2026:

• 1,012 entries for white papers of other crypto-assets, the largest share (383) notified to the Central Bank of Ireland;
• 49 entries for e-money token issuers;
• 0 entries for asset-referenced token issuers;
• 362 entries for authorised CASPs, 98 of them authorised by BaFin in Germany;
• 173 entries for non-compliant entities, 164 of them reported by Italy’s CONSOB.

These are our counts of rows in ESMA’s files, not ESMA statistics. The register is the quickest way to check whether a counterparty that claims to be a CASP is authorised, and which services it holds. Because ESMA publishes weekly, a recent national decision may not show yet.

Penalties

Member states must give their authorities power to fine legal persons up to at least €5,000,000. For Title II breaches the alternative ceiling is at least 3% of annual turnover. It is 5% for CASP breaches and 12.5% for ART and EMT breaches (Article 111(3)). Authorities can also issue public statements and cease-and-desist orders, and some states use criminal law instead. The exact figures depend on national implementing law.

A MiCA checklist for issuers

1. Classify. Apply ESMA’s guidelines. If the token is a financial instrument, leave MiCA and follow the securities route in our EU guide.
2. Pick the category. One currency reference makes it an EMT; any other stable-value reference makes it an ART; everything else is Title II.
3. Check the exemptions. Test the 150-person, €1,000,000 and qualified-investor limits, and remember that announcing a listing removes them.
4. Choose the home member state. For a Title II offeror this is where its registered office is. A non-EU offeror without an EU branch chooses the state of its first offer or of its first application for admission to trading.
5. Write the white paper. Follow Annex I, in iXBRL, with the mandatory statements and the classification explanation.
6. Notify 20 working days ahead. Send the host-state list and the start date.
7. Align marketing. Publish nothing before the paper, and include the required statement and contacts.
8. Line up service providers. Use an authorised CASP for custody, placing and trading, and check each one in ESMA’s register.
9. Run the post-launch duties. These are results, safeguarding, withdrawal rights, updates and ten-year archiving.

What MiCA does not do

A MiCA white paper is not a regulator’s endorsement. The regulation makes the issuer say so on the first page. Compliance does not make a token liquid, protect its value or bring it under a deposit guarantee or investor compensation scheme. MiCA also leaves real differences between states: grandfathering, penalties and the choice between administrative and criminal sanctions were set nationally.

MiCA does not regulate tokenized securities. For a real estate SPV, a private credit note or company equity, the questions are prospectus exemptions, MiFID II licensing and the DLT Pilot Regime. A white paper is not one of them.

Stobox has structured and supported $305M+ in assets for 100+ clients in 20+ jurisdictions since 2018. For Los Patios Ibiza, a historical Spanish hotel, the engagement was our Regulatory Framework service, which covers securities classification and licensing requirements. Decentraliced in Germany was a token structuring engagement.

Our 8-phase, 48-step Tokenization Framework settles “under whose rules you may sell” in its first three phases, and the tokenization cost index shows what the legal work usually costs.

Questions, answered

Does MiCA apply to security tokens?

No. Article 2(4)(a) excludes crypto-assets that qualify as financial instruments. A token representing shares, bonds or fund units is regulated under MiFID II and the Prospectus Regulation, and may trade on DLT market infrastructures under the DLT Pilot Regime. ESMA’s guidelines apply substance over form, so a token with financial-instrument features is classified as one, whatever it is called.

Does a MiCA white paper need regulator approval?

Not for other crypto-assets. Article 8(3) forbids competent authorities from requiring prior approval. The paper is notified at least 20 working days before publication, and the offeror is liable for its content. ART white papers are different: they are approved as part of the issuer’s authorisation.

Can I offer tokens in the EU without a white paper?

Yes, in three cases under Article 4(2): fewer than 150 persons per member state, no more than €1,000,000 over 12 months, or qualified investors only. You still need to be a legal person and follow the marketing and conduct rules. The exemptions fall away if you say you intend to seek admission to trading.

Who can issue a stablecoin under MiCA?

A stablecoin referencing one official currency is an e-money token. Only a credit institution or an electronic money institution may issue it, at par and redeemable at par at any time. A stablecoin referencing a basket or other assets is an asset-referenced token. It needs an authorised EU issuer or a credit institution, a reserve of assets and own funds of at least €350,000. Neither may pay interest.

What are the MiCA custody requirements?

A custodian needs a CASP authorisation (minimum capital €125,000) or an Article 60 notification. It must sign a custody agreement with each client, keep a register of positions, send a statement of positions at least every three months, and segregate client assets on the ledger and in law. It is liable for losses attributable to it, up to the market value of the lost asset (Article 75).

Do brokers need a CASP licence?

Receiving and transmitting orders and executing orders are crypto-asset services, so a broker needs a CASP authorisation (Class 1, €50,000 minimum capital). An investment firm already authorised under MiFID II can instead notify its authority at least 40 working days before starting, for the services equivalent to its existing permissions (Article 60(3)).

Is the MiCA transitional period over?

Yes. The CASP grandfathering period under Article 143(3) ended on 1 July 2026 at the latest, and earlier where member states shortened it. The shortest periods were 6 months, for example in the Netherlands and Poland. Tokens admitted to trading before 30 December 2024 still have until 31 December 2027 for a compliant white paper.

How do I check whether a company is MiCA-authorised?

Use ESMA’s interim MiCA register on its MiCA page. It has CSV files for Title II white papers, ART issuers, EMT issuers, authorised CASPs and non-compliant entities, and it is updated weekly. Confirm with the national register of the home authority, which may be more recent.

Before you draft a white paper, confirm which regime your token is in. The Stobox readiness score asks 25 questions across seven axes, starting with legal and compliance, and takes about eight minutes with no email required. Stobox Compass is a free three-minute diagnostic. If the answer is “security”, the EU tokenization guide is your next step.