MiCA: obligations, transition periods and staffing needs for crypto-asset service providers

Short answer: MiCA compliance requirements now apply in full: Regulation (EU) 2023/1114 has applied since 30 December 2024, and to stablecoins since 30 June 2024. The transitional period for existing crypto-asset service providers ended EU-wide on 1 July 2026, in Germany on 31 December 2025. Serving EU clients now requires a CASP licence and the staff to meet its obligations.

This overview is written for management, legal and compliance teams at crypto-asset service providers, banks and fintechs in Germany and Switzerland. It sets out what MiCA requires in practice, which deadlines are still open and which roles and capacity firms need to stay compliant.

What is MiCA?

MiCA is the EU regulation on markets in crypto-assets. It applies directly in every member state and covers three areas:

• Public offers and admission to trading: offerors draw up a crypto-asset white paper and follow rules on marketing communications (Title II).
• Stablecoins: issuers of asset-referenced tokens and e-money tokens need authorisation and meet specific requirements (Titles III and IV).
• Crypto-asset service providers (CASPs): authorisation, governance, client protection and conduct of business (Title V).

MiCA lists ten crypto-asset services, including custody and administration on behalf of clients, operating a trading platform, exchanging crypto-assets for funds or for other crypto-assets, advice, portfolio management and transfer services (Article 3(1)(16)). It also contains market abuse rules: anyone professionally arranging or executing crypto-asset transactions needs effective systems to prevent and detect market abuse and must report suspicions without delay (Article 92).

Who does MiCA apply to?

MiCA applies to every firm that provides crypto-asset services in the EU, offers crypto-assets to the public or issues stablecoins. Only firms authorised as a CASP under Article 63, or financial institutions that notify the activity under Article 60, may provide crypto-asset services (Article 59(1)).

Source: Regulation (EU) 2023/1114 as published on EUR-Lex; compiled by Alpinum Solutions, November 2026.

MiCA deadlines: where things stand

The major MiCA dates have passed; the main open deadline is the white paper deadline for trading platforms on 31 December 2027. Since 1 July 2026, any firm providing crypto-asset services to EU clients without a MiCA licence is in breach of EU law. ESMA made this explicit in its statement of 17 April 2026.

Sources: Regulation (EU) 2023/1114, the German Crypto Markets Supervision Act (KMAG) and ESMA statement ESMA75-113276571-1679, accessed 11 November 2026. For other EU, German and Swiss deadlines, see the regulatory calendar for legal and compliance.

The regulation sets fixed time limits for authorisation: the authority checks completeness within 25 working days and decides within 40 working days of receiving a complete application (Article 63(2) and (9)). Missing documents extend the process. In Germany, BaFin is the competent authority (Section 3 KMAG).

What firms need to do now

With the transitional periods over, the work splits in two: authorised firms must meet their obligations in daily operations, and unauthorised firms must exit in an orderly way. A proven approach:

1. Confirm your status: record which entities provide which crypto-asset services and on what basis – authorisation, Article 60 notification or none.
2. Keep the licence file current: authorisation conditions must be met at all times (Article 59(4)). Update the business plan, governance and controls whenever something changes.
3. Test operational obligations: check client information, conflicts of interest (Article 72), complaints handling (Article 71), safekeeping of client assets (Article 70) and outsourcing (Article 73) against actual practice.
4. Secure client migration: ESMA expects authorised firms to onboard existing EU clients with robust AML processes, and unauthorised firms to have executed their wind-down plans.
5. Plan for the white paper deadline: trading platforms list the crypto-assets admitted before 30 December 2024 and schedule the white papers ahead of 31 December 2027.

Many obligations overlap with other regimes. Business continuity follows DORA (Article 68(7)), and the AMLR applies from 10 July 2027. For what it requires, see AMLR and AMLA: what compliance teams face from 2027.

Which roles and capacity MiCA requires

MiCA explicitly requires staff with the knowledge, skills and expertise needed for their duties, taking into account the scale, nature and range of services (Article 68(5)). Members of the management body must be of good repute, suitably qualified and able to commit enough time (Article 68(1)). Typical roles:

• Legal counsel for crypto-assets and financial regulation: classifies products and tokens, reviews white papers, client terms and outsourcing agreements.
• Regulatory specialist: keeps the licence file current, prepares notifications and supervisory submissions and tracks technical standards.
• Compliance officer: monitors conduct and client protection rules, conflicts of interest and complaints.
• AML specialist or MLRO: owns onboarding, transaction monitoring and suspicious activity reports, including during client migration.
• Market abuse surveillance analyst: runs surveillance under Article 92 and reports suspicions to the authority.
• Project lead: coordinates legal, compliance, IT and management through gap analysis and remediation.

A gap analysis often needs one experienced specialist part-time. Client migration or extensive remediation usually calls for a team across several levels. For the roles that DORA, AI Act and AMLR projects add, see staffing regulatory projects: the roles DORA, MiCA, the AI Act and AMLR require.

Switzerland: MiCA, DLT law and planned crypto institutions

MiCA does not apply in Switzerland, but Swiss providers are affected as soon as they want to serve clients in the EU. EU authorisation requires a registered office in a member state, effective management in the EU and at least one director resident in the EU (Article 59(2)). The reverse solicitation exemption is narrow (Article 61), and ESMA stresses that it also applies business to business.

Within Switzerland, crypto-assets have so far been covered by existing financial market law and the amendments for distributed ledger technology (DLT). On 22 October 2025 the Federal Council opened a consultation on amending the Financial Institutions Act. It proposes two new licence categories: payment instrument institutions, replacing today's fintech licence and allowed to issue stablecoins, and crypto institutions for services involving crypto-assets. The consultation ran until 6 February 2026; according to the State Secretariat for International Finance (SIF), the dispatch to Parliament will follow in the second half of 2026 at the earliest. No date of entry into force has been set.

How interim support helps

Interim specialists close the gap between running the business and regulatory remediation. They work inside the client's team; the client directs the work and remains accountable to the supervisor.

Alpinum Solutions provides lawyers with financial regulation experience, regulatory specialists, compliance officers and AML specialists through staff leasing and freelancing, part-time or full-time, from junior to senior level. Alpinum Solutions typically presents two to four profiles per search; shortlisted profiles are usually available within 48 hours, and the start date is agreed between the client and Alpinum. Specialists can also hold formal functions, such as money laundering reporting officer. For the MLRO role, regulatory restrictions may rule out an external mandate or require Swiss staff leasing (Personalverleih) or German temporary agency work (Arbeitnehmerüberlassung). For how fintechs plan capacity for licence applications, see fintech and crypto: legal and compliance capacity for licensing and MiCA.

Frequently asked questions about MiCA compliance

When does MiCA apply?

MiCA has applied in full since 30 December 2024 (Article 149(2)). The rules on asset-referenced tokens and e-money tokens have applied since 30 June 2024. Existing crypto-asset service providers could continue without a MiCA licence until 1 July 2026 at the latest, and in Germany only until 31 December 2025. The white paper deadline for trading platforms on 31 December 2027 is still open.

Who needs a CASP licence?

Any firm that provides crypto-asset services in the EU on a professional basis needs a CASP licence, for example custody, trading platforms, exchange, advice or transfers. Banks, investment firms, e-money institutions, central securities depositories and fund managers are the exception: they notify their authority under Article 60 at least 40 working days before starting the service.

Does MiCA apply to Swiss providers?

Not within Switzerland, but it does for business with EU clients. A Swiss provider needs authorisation in an EU member state, with a registered office and effective management in the EU (Article 59(2)). The reverse solicitation exemption is narrow. In Switzerland, the Federal Council is planning its own licences for crypto institutions and payment instrument institutions.

Which compliance functions does MiCA require?

MiCA requires policies and procedures effective enough to ensure compliance, and suitably qualified staff (Article 68(4) and (5)). In practice this means compliance for conduct and client protection rules, AML, market abuse surveillance, complaints handling and oversight of outsourcing. The management body reviews their effectiveness regularly and fixes deficiencies (Article 68(6)).

How long does MiCA authorisation take?

The regulation gives the authority 25 working days to check completeness and 40 working days to decide once the application is complete (Article 63). Actual timelines depend on how complete the file is: each request for further documents extends the process. A well-prepared application with business plan, governance and AML framework therefore saves time.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region and provides specialists for MiCA remediation, client migration and ongoing crypto compliance in Germany, Switzerland and Austria. Tell us what you need and we will show you suitable profiles.

• Regulatory compliance and regulatory change: specialists for new rules
• Staffing regulatory projects: roles for DORA, MiCA, the AI Act and AMLR
• Fintech and crypto: legal and compliance capacity
• Regulatory radar: all articles on regulatory change
• Discuss your needs

Last updated: 11 November 2026.