Mica Exchange Requirements: What Crypto Trading Platforms Must Do to Get Authorised in the EU

The EU’s Markets in Crypto-Assets Regulation Regulation (EU) 2023/1114 has fundamentally reshaped the MiCA exchange requirements that every crypto trading platform must satisfy before it can lawfully serve customers across the European Economic Area. Whether you are a compliance officer mapping obligations, a founder planning market entry, or a legal team advising on licensing strategy, this guide delivers a concrete authorisation playbook: the governance, capital, custody, disclosure and filing steps you must complete, the typical timeline and cost ranges involved, and the downloadable checklists and templates you need to move from gap analysis to authorisation certificate.

The urgency is real. The European Commission has already launched its review and consultation on MiCA’s functioning following initial implementation, and National Competent Authorities (NCAs) across the EU are now actively processing applications and initiating supervisory actions. Exchanges that have not begun the authorisation process face the risk of market exclusion, operational restrictions, or enforcement fines.

Quick summary: MiCA scope and who it applies to

MiCA establishes a harmonised EU-level framework for crypto-asset issuers and crypto-asset service providers (CASPs). According to the EUR-Lex summary of the Regulation, in-scope entities include:

• Issuers of crypto-assets entities offering crypto-assets to the public or seeking admission to trading, including issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs).
• Crypto-asset service providers (CASPs) exchanges and trading platforms, custodians of crypto-assets, brokers and dealers, portfolio managers, transfer service providers, and advisers.
• Stablecoin issuers subject to enhanced prudential and reserve requirements under Titles III and IV of MiCA.

Principal exclusions from MiCA’s scope cover crypto-assets that already qualify as financial instruments under MiFID II, certain intragroup transactions, services provided by public authorities and central banks, and fully decentralised arrangements with no identifiable service provider. Firms operating at the boundary between MiCA and MiFID should commission a formal classification opinion before filing a step discussed in detail below.

Corporate and governance changes required under MiCA

MiCA imposes rigorous organisational requirements on exchanges seeking authorisation as CASPs. The ESMA Interactive Single Rulebook for MiCA consolidates supervisory expectations that NCAs will assess during the application review. Key MiCA governance obligations include:

• EU-incorporated entity the applicant must be a legal person established in an EU Member State with its registered office in the same Member State where it applies for authorisation.
• Fit-and-proper management members of the management body must demonstrate good repute, adequate knowledge, skills and experience. NCAs assess individual directors against criteria including criminal record, financial probity, and sector expertise.
• Organisational structure clear internal reporting lines, segregation of duties, a dedicated compliance function, and an internal audit capability proportionate to the scale of the CASP’s activities.
• AML/CFT governance appointment of a Money Laundering Reporting Officer (MLRO), board-level accountability for AML risk, transaction monitoring rules, and suspicious activity reporting protocols.
• Outsourcing and third-party risk documented policies for outsourcing critical or important functions, with due diligence, contractual controls and exit plans that the NCA can review.
• Incident response and business continuity policies covering cybersecurity incidents, system outages and operational disruptions, with defined escalation procedures and notification obligations to the NCA.

Exchanges should prepare a governance checklist that includes board minutes evidencing oversight of risk, IT security and AML, a complete set of internal policies (compliance manual, conflicts of interest policy, complaints handling procedure), and a staffing plan that maps roles to MiCA’s organisational requirements.

Capital and prudential tests MiCA capital requirements and modelling guidance

MiCA sets minimum initial capital thresholds and ongoing own-funds requirements for CASPs. The exact minimum depends on the services provided. The European Commission’s published list of Level-2 implementing and delegated acts specifies the detailed prudential ratios, reporting templates and capital calculation methodologies that firms must follow.

Under MiCA, a CASP operating a trading platform for crypto-assets must hold a higher minimum capital buffer than a firm providing only advisory or order-transmission services. In practice, exchanges should expect the following prudential obligations:

• Minimum initial capital a fixed minimum (varying by CASP service category) that must be evidenced at the time of application and maintained on an ongoing basis.
• Ongoing own-funds requirement the higher of the fixed minimum, a quarter of the previous year’s fixed overheads, or a percentage-based calculation linked to the volume and nature of activity.
• Stress testing and liquidity modelling applicants must present financial projections and scenario analyses covering adverse market conditions. Industry observers recommend modelling at least three stress scenarios: a sudden market halt, a stablecoin depeg event, and a custody incident involving partial or total loss of client assets.
• Auditor attestation financial projections should be accompanied by an auditor’s letter confirming the assumptions, methodology and adequacy of the capital model.

A capital modelling spreadsheet covering scenario inputs, volume shocks, liquidity buffers and reverse stress tests is an essential deliverable for any exchange preparing its MiCA application. Firms should begin building this model at least six months before their planned filing date.

Whitepaper and transparency/disclosure requirements

MiCA whitepaper requirements apply directly to issuers of crypto-assets, but exchanges that list tokens or operate primary-market services must verify that compliant whitepapers are in place for every asset admitted to trading. The whitepaper must include:

• Token description technical characteristics, underlying protocol, consensus mechanism and rights attached.
• Governance and economics tokenomics, supply schedule, fee structures and governance rights.
• Risk disclosure material risks including market, technology, regulatory and liquidity risk.
• AML controls and roadmap measures to prevent misuse and the project’s development timeline.
• Legal opinion and classification test a formal opinion confirming that the crypto-asset does not constitute a financial instrument under MiFID, attached as an annex using the ESAs classification template.

Exchanges should establish an internal listing committee that reviews each whitepaper for MiCA transparency and disclosure compliance before a token is admitted to trading.

Custody and safeguarding obligations

Where an exchange holds client crypto-assets, MiCA’s custody rules require strict safeguarding measures. These include segregation of client assets from the CASP’s own holdings, documented custody policies covering both hot and cold wallet management, and operational security controls such as penetration testing, SOC 2 or ISO 27001 evidence, and multi-signature authorisation protocols. Exchanges must choose between maintaining an insurance policy covering custody risk or holding an additional capital buffer. There is also a notable overlap with the Digital Operational Resilience Act (DORA), and firms should map both sets of requirements concurrently a topic explored further in MiCA vs DORA operational overlap guidance.

MiCA exchange requirements: step-by-step authorisation checklist and timeline

The MiCA authorisation process follows a structured sequence. Timelines vary by NCA workload and the completeness of the applicant’s filing, but the typical end-to-end journey spans 12 to 24 months from initial scoping to operational go-live.

Pre-filing phase (3–6 months)

1. Conduct MiCA classification and scope mapping. Produce a legal opinion confirming whether each crypto-asset and service falls within MiCA’s scope, using the ESAs classification template. Deliverable: classification report and legal opinion.
2. Build governance, compliance and AML/KYC framework. Draft and adopt all required internal policies, hire or appoint an MLRO, implement transaction monitoring systems, and establish board oversight protocols. Deliverable: complete policy set and staffing plan.
3. Complete capital modelling and liquidity stress tests. Prepare multi-scenario financial projections, obtain auditor attestation, and evidence initial capital. Deliverable: capital model, auditor letter and proof of funds.
4. Draft the whitepaper and disclosure pack. For any tokens the exchange issues or for which it acts as the first admission point, prepare a MiCA-compliant whitepaper with all required annexes. Deliverable: whitepaper and legal opinion annex.
5. Implement custody and technical safeguards. Finalise custodian agreements (whether in-house or third-party), implement asset segregation, cold storage protocols, and obtain penetration test and SOC/ISO reports. Deliverable: custody policy, custodian contracts and test reports.

Filing phase (6–12 months)

6. Prepare the filing bundle. Collate all deliverables, prepare local-language translations where required by the NCA, and map every document to the NCA’s specific filing checklist. Deliverable: complete filing packet.
7. Submit the application to the chosen NCA. File with the National Competent Authority of the Member State where the entity is incorporated. Request a pre-application meeting many NCAs offer these and they materially reduce review cycles. Deliverable: filing confirmation and pre-application meeting notes.
8. Respond to NCA queries. NCAs typically issue one or more rounds of questions. Prepare response logs, provide supplementary evidence, and submit any remedial plans where deficiencies are identified. Deliverable: response logs and remediation plans.

Post-authorisation phase (3–6 months)

9. Receive authorisation and execute go-live plan. Upon receiving the authorisation certificate, map to an operational go-live plan covering ongoing compliance monitoring, periodic reporting to the NCA, consumer disclosure updates, and passporting notifications via the ESMA register. Deliverable: authorisation certificate and go-live checklist.

Resourcing note: Industry experience suggests that a mid-size exchange should budget 0.5 to 1.0 FTE-equivalent of dedicated internal staff for 6 to 9 months, supplemented by external legal counsel and technical advisers. Cost ranges depend on the complexity of the business model and are discussed in the comparison table below.

Comparison table: MiCA authorisation routes, timelines and indicative costs

These figures are indicative and vary significantly by NCA jurisdiction, the applicant’s existing compliance maturity, and whether a full technology build or remediation is required. Exchanges planning to passport across the EEA should factor in additional time for ESMA register notifications.

Practical implementation examples and downloadable templates

To support firms in preparing their MiCA applications, the following downloadable assets are available:

• MiCA authorisation checklist (Excel) maps every required document to the relevant MiCA Article, the responsible NCA, the internal filing owner and current status. Download the MiCA authorisation checklist to begin your gap analysis.
• Sample whitepaper sections (Word template) redactable template covering tokenomics, governance structure, risk disclosure and AML controls, aligned with MiCA whitepaper requirements. Access the MiCA whitepaper template.
• Capital modelling spreadsheet scenario-based stress testing tool with pre-built inputs for volume shocks, stablecoin depeg events and custody loss incidents. Request the MiCA capital modelling template.
• Custody readiness checklist and pen test template operational controls mapping and penetration test scope document aligned with MiCA safeguarding standards and DORA requirements.

Implementation case studies (anonymised)

Exchange A restructured its governance by incorporating a new entity in an EU Member State, appointing an experienced MLRO from the traditional financial services sector, and commissioning an early classification opinion from external counsel. The combination of proactive NCA engagement (including a pre-application meeting) and a complete filing bundle enabled authorisation within nine months. Key success factor: early classification and governance build, completed before the capital modelling phase.

Exchange B adopted a faster route to market by partnering with an authorised EU custodian, reducing its custody compliance burden. However, the NCA identified material deficiencies in the exchange’s disclosure documentation specifically incomplete risk disclosures and a missing legal opinion annex. Remediation added four months to the timeline. Lesson learned: disclosure completeness is as critical as operational readiness, and whitepaper review should be prioritised alongside custody arrangements.

Common pitfalls and remediation strategies

• Weak asset classification: Failing to produce a robust legal opinion on whether listed tokens fall under MiCA or MiFID is the single most common cause of NCA pushback. Remediation: use the ESAs classification template and engage specialist counsel before filing.
• Underestimated capital and liquidity modelling: Many applicants present optimistic base-case projections without adequate stress scenarios. Remediation: run reverse stress tests, include at least three adverse scenarios, and attach an independent auditor attestation to every capital model submission.
• Insufficient AML/KYC processes for cross-border customers: Exchanges serving multiple EU jurisdictions must align their KYC procedures to the highest-risk jurisdiction served. Remediation: document risk assessment reports (RARs) by jurisdiction and implement enhanced due diligence for high-risk customer segments.
• Poor custody segregation and contract terms: Generic custodian agreements drafted before MiCA often lack the specific safeguarding provisions NCAs now require. Remediation: rebuild custody agreements to mirror MiCA’s segregation, insurance and reporting standards explicitly.
• Late engagement with the NCA: Firms that file without a pre-application meeting typically face longer review cycles and more rounds of queries. Remediation: request a pre-application meeting early and use it to clarify the NCA’s specific expectations and preferred filing format.

How Global Law Experts supports MiCA authorisation

Global Law Experts connects exchanges and crypto-asset service providers with specialist legal and advisory professionals across every EU Member State. Through its multi-jurisdiction network, GLE facilitates end-to-end MiCA authorisation support from initial scope mapping and classification opinions through governance build, capital modelling, whitepaper drafting, custody policy design, NCA filing and post-authorisation compliance monitoring. Firms can request an authorisation readiness review, access the downloadable MiCA exchange requirements checklists and templates referenced throughout this guide, and obtain tailored introductions to qualified advisers experienced in the specific NCA process relevant to their chosen jurisdiction.

Sources

• EUR-Lex Regulation (EU) 2023/1114 (Markets in Crypto-Assets Regulation)
• EUR-Lex Summary: European Crypto-Assets Regulation (MiCA)
• ESMA MiCA Interactive Single Rulebook
• ESAs Consultation on Guidelines under the Markets in Crypto-Assets Regulation
• European Commission MiCA Level-2 Implementing and Delegated Acts
• European Commission Consultation on the Functioning of EU Crypto-Assets Rules (2026)