MiCA Compliance Checklist for Crypto Firms After the Transition

The Markets in Crypto-Assets Regulation's grandfathering window closed on 1 July 2026. Article 143(3) of Regulation (EU) 2023/1114 let firms already serving EU clients under national law continue "until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63, whichever is sooner." As of 30 September 2026, a crypto firm touching EU clients is authorized, notified under Article 60, exempt, or operating unlawfully.

That means most MiCA checklists written before July answer an expired question. "How to get ready for the deadline" stopped being useful on 1 July. The checklist that matters now is an operating document: which obligations attach to your entity type, on what cadence, and what evidence a supervisor will ask to see. Below is a full obligations register for five entity types with article-level citations, plus the dates where the travel rule, DORA and the EU's new AML rulebook land on the same firms.

The grandfathering window closed on 1 July 2026, and it was never uniform

Article 143(3) had a second subparagraph: member states could decide not to apply the transitional regime or to shorten it where they judged their pre-MiCA national framework to be less strict. Many did. According to ESMA's list of national grandfathering periods, the window was six months in Finland, Hungary, Latvia, the Netherlands, Poland and Slovenia, nine in Sweden, twelve in Austria, Germany, Ireland, Lithuania and Slovakia (and Norway), and the full eighteen in the rest, including France, Italy, Spain, Luxembourg and Malta. Anyone treating "the July 2026 deadline" as an EU-wide fact was already late in several markets, which ESMA made explicit in its December 2024 statement when it described member states' "complete discretion not to apply this transitional regime or to reduce its duration." Germany's KMAG, for example, let legacy permissions run no longer than "spätestens mit Ablauf des 31. Dezember 2025" (section 50). Article 143(6) also allowed member states to run a simplified authorization procedure for applications filed between 30 December 2024 and 1 July 2026 by entities already authorized under national law.

ESMA's interim MiCA register is the authoritative scoreboard for where the market stands three months after the deadline: five CSV files covering white papers, ART issuers, EMT issuers, CASPs and non-compliant entities, last updated on 30 September 2026, which ESMA says will run until the register is integrated into its IT systems. Counting the CASP file as published that day gives 364 rows covering 361 entities: 358 legal-entity identifiers plus three Greek entities listed without one. Two carry end dates, so 359 entities are currently listed across 27 jurisdictions: the 24 EU member states that have entries plus Liechtenstein, Norway and Iceland. Germany has 96, France 36, the Netherlands 28, Cyprus 24 and Malta 23. Three caveats apply. The file mixes Article 63 authorizations with Article 60 notifications, so many of the names are established banks. The register is back-filled, so counts for earlier months keep rising; June 2026, the last full month before the window closed, shows 76 entities by listed date. And Hungary, Poland and Romania have no CASP entries. Elsewhere in the register, the ART file holds no issuers (header row only), 25 distinct EMT issuers appear, and the non-compliant file lists 173 entries, 164 of them submitted by Italy's CONSOB. Article 110 calls that file "non-exhaustive," so absence from it proves nothing, but presence on it is public, and your banks and counterparties can read it.

Key dates: five regimes land on the same firms between 2024 and 2028

MiCA is the regime everyone names, but a crypto firm's 2026 to 2028 compliance calendar is at least four instruments deep, with a fifth if you also face the UK. This is the table I would pin to the wall, with statuses as of 30 September 2026:

Three conflations to kill before they cost you. First, MiCA is not silent on anti-money-laundering controls: Article 68(8) requires CASPs to have effective procedures and arrangements for risk assessment to comply with national law transposing the Anti-Money Laundering Directive. But the detailed obligations come from that Directive as amended, the TFR since 30 December 2024, and the AMLR from 10 July 2027, so when a vendor says their tool "covers MiCA AML requirements," ask which instrument they mean. Second, an EMT issuer does not get "a MiCA license": it must already be a credit institution or e-money institution (Article 48). Third, the transfer of supervision to ESMA is still a proposal, and its shape may change (see below).

Find your entity type before you open any checklist

MiCA is five regimes wearing one name. Everything below keys off this table:

For CASPs, the Annex IV figure is a floor, not the requirement. Article 67 makes the prudential safeguards the higher of the class minimum or one quarter of the preceding year's fixed overheads, reviewed annually, held as Common Equity Tier 1 items, as an insurance policy covering every EU territory where you provide services (or a comparable guarantee), or as a combination. A Class 1 adviser with a heavy cost base can owe far more than EUR 50,000, so check business plans that were modeled on the flat figure alone. A note for issuers: significant EMTs come with extra capital and reserve rules under Article 58, so "EMT issuers hold capital under their banking or e-money regime" is only a starting point.

The MiCA obligations register gives each entity type its own table

The register below has one table per entity type; every row carries the obligation in plain language, its legal basis, whether it is one-time or ongoing, the evidence a supervisor will expect, and a suggested owner by role. Copy your table into your tracker as it stands, then add two working columns, Status (RAG) and Last reviewed. The structure follows our obligations register template: one row per obligation, never one row per law, because rows are what you can assign, evidence and test. If the term is new, start with the obligations register definition.

All legal bases are stated as of 30 September 2026; MiCA articles cite Regulation (EU) 2023/1114 unless another instrument is named. The Level 2 technical standards under MiCA (for example the record-keeping standard in Delegated Regulation (EU) 2025/1140) sit beneath these rows and set the format of the evidence.

CASPs (all classes; Class 3 adds the platform rows)

ART issuers

EMT issuers

Title II offerors and admission-seekers

Article 60 notified financial entities

The evidence column is the point, because a checklist that ends at "comply with Article 70" gives you nothing to show. Supervisors sample artifacts (reconciliations, registers, filings, logs), and the fastest gap-finder is asking, for each row, "could I produce this within 48 hours?"

Authorization was the easy part: ESMA told supervisors there are no low-risk CASPs

If you hold an authorization and consider the project finished, read ESMA's January 2025 supervisory briefing on CASP authorization. Its risk-based-approach section opens with this: "ESMA is of the view that there are no low-risk CASPs." A cursory assessment on the basis of a low-risk categorization, it adds, should never happen.

The briefing then gets specific in ways worth building controls around:

• Elevated scrutiny has thresholds, and other triggers too. More than 1,000,000 yearly active EU users or a balance sheet above EUR 3 billion earns it, as does serving more than 200,000 yearly active users outside your home member state, which drags in host-state authority coordination. Group complexity, an ecosystem role and issuer-plus-CASP models also draw attention, and authorities may scrutinize smaller firms.
• Substance is enforced. The CEO "should as a rule devote 100%" of their time to the CASP; at least one executive board member should be resident in the authorizing member state (smaller member states may accept a resident of a neighboring country); and the EU entity must decide autonomously, without "taking the discussed points back to the (head) group entity for clearance."
• Outsourcing cannot hollow out the entity. Key roles stay predominantly in the home jurisdiction; support functions can sit elsewhere. Your Article 73 outsourcing register is where this gets tested.

Supervisors are also being graded. In July 2025, ESMA published a fast-track peer review of a CASP authorization in Malta and found that the authorization process only partially met expectations, with several material issues unresolved at the time of the authorization. A supervisor publicly criticized for leniency does not usually respond by getting more lenient. On 8 July 2026, ESMA also launched a Common Supervisory Action on the digital operational resilience of CASPs, with an emphasis on custody: national authorities will test governance, key management, transaction controls, incident response, smart contracts and third-party dependencies from the second half of 2026 to the first half of 2027. If you provide custody, treat those six areas as your evidence list.

The bigger structural question is who supervises you. On 4 December 2025 the Commission proposed to move the authorization and supervision of CASPs from national authorities to ESMA (COM(2025) 943), with credit institutions staying with their existing supervisors, other Article 60 entities staying unless crypto becomes their main activity, and the transfer taking effect 24 months after the regulation enters into force. As of 30 September 2026 it is still a proposal. In the Council, the Irish Presidency reports broad support in principle for focusing direct ESMA supervision on genuinely significant cross-border entities, with the criteria for significance across CASPs and market infrastructures still to be decided, and is aiming for a general approach in October 2026 at the latest (ST 11406/26). In Parliament the ECON committee has a draft report and amendments tabled in July (procedure file), and ESMA itself expects final agreement in 2027 (ESMA, 28 September 2026). Plan for the direction of travel, not the final text.

Article 111 sets floors for national maximums, not caps

The most repeated penalty claim about MiCA, "fines go up to EUR 5 million," is wrong twice. Article 111 sets minimum levels for the maximum administrative fines that member states must make available to their authorities, and the market-abuse tier goes far past EUR 5 million. As of 30 September 2026:

The text states each euro amount and each percentage as a separate floor for the authority's power, so read "and" as "the authority must be able to reach at least both," not as a formula. For natural persons the floors are at least EUR 700,000 for infringements of Titles II to V (Art. 111(2)(d)), and EUR 1,000,000 (Art. 88) or EUR 5,000,000 (Arts. 89 to 92) for market abuse (Art. 111(5)(i)). Authorities must also be able to fine at least twice the profit gained or loss avoided (three times for market abuse). Member states may set higher levels, and some have: Ireland's transposition provides for maximum fines of EUR 1,000,000 against natural persons for Titles II to V (S.I. 607/2024, regulation 6). Turnover is measured at the consolidated ultimate-parent level where consolidated accounts are required, which changes the arithmetic materially for group structures.

Two forward markers. The EBA opened a consultation on its methodology for setting fines under MiCA (EBA/CP/2026/10) on 26 June 2026; it closed on 28 September 2026 and the final methodology is pending. It applies only to fines the EBA itself imposes on issuers of significant ARTs and EMTs, not to national authorities, whose powers sit under Article 111. And with the transition over, expect the first real enforcement actions against formerly grandfathered firms; the register's non-compliant file and the national authorities' warning lists are the early-warning channel. As of 30 September 2026 we found no enforcement action against a formerly grandfathered firm in the sources we checked.

Stand up the register, calendar 2027 and 2028, and watch the sources weekly

Three moves, in order.

Stand up the register. Copy your entity-type table into a tracker, add Status and Last reviewed columns, put a named owner on every row, and date every row "as of." Run the 48-hour evidence test this month and treat every miss as the finding a supervisor would have written. Keep a visible change log on the register itself; the structure in our register template works unmodified here.

Put the 2027 to 2028 calendar into your impact process now. The AMLR makes you an obliged entity on 10 July 2027, AMLA supervision phases in from around 2028, the Commission's MiCA review report is due by 30 June 2027 with scope changes to NFTs, DeFi, staking and lending on the table, and the ESMA supervision proposal could move your supervisor. Each deserves a dated row in your change pipeline with an owner and a first-assessment deadline; a regulatory change impact assessment template is the right instrument, and the patterns in how compliance teams track regulatory changes apply directly.

Watch the sources weekly, because that is the cadence they publish on. The ESMA register files update on ESMA's own schedule, the EBA published a fines-methodology consultation five days before the transition ended, national transpositions diverge quietly, and the Council and Parliament files on ESMA supervision move every few weeks. This is more than a quarterly manual sweep can handle. It is the workflow RegWatch (my company) was built for: a Watchlist pointed at ESMA, the EBA and your national authorities, monitoring runs on the schedule you set, triage that scores each Finding against your company profile and writes a plain-language "Why this matters" for each one it accepts, and one step from an accepted Alert to a tracked Obligation with an owner, a deadline and evidence. A spreadsheet register plus a disciplined weekly sweep is a legitimate way to start. The failure mode is a register that was accurate on authorization day and never again.

MiCA compliance work from here on is register maintenance under tightening supervision, not project delivery. We maintain this same post-deadline structure for other regimes: the EU AI Act deployer checklist and the US state privacy laws tracker run on the identical register-plus-changelog pattern.

---

This article is general information, not legal advice.