MiCA: EU office alone won’t satisfy CASP regulators

EU regulators are rejecting crypto-asset service provider (CASP) applications that rely only on a registered office. National authorities and the European Securities and Markets Authority (ESMA) expect firms to show operational presence in the EU through resident executives, local control of IT and disaster recovery, and paid-in capital held at a regulated bank.

MiCA Article 59 requires a registered office, a place of effective management in the EU, and at least one EU-resident director. Supervisory guidance treats substance as an empirical test and triggers closer review or refusal when an application presents only incorporation documents and a nominal director.

On personnel, ESMA guidance anticipates at least two senior executives jointly managing day-to-day operations, with defined and overlapping responsibilities to limit single-person concentration risk. Regulators expect management to be reachable in person within two business days if required and generally to devote most of their professional time to the CASP role. Reporting lines must demonstrate that strategic control sits with the EU entity rather than with a non-EU parent. Anti-money-laundering duties require the person responsible for suspicious-activity reporting to be physically present, empowered to act, and able to interact directly with the local financial intelligence unit.

Technology control is assessed under DORA’s ICT resilience rules. Use of cloud providers such as AWS or Azure is acceptable, but key management functions must be administratively controlled by the EU firm. Encryption key custody, access rights, backups and disaster recovery plans should be executable by the local entity without approvals from outside the Union. Regulators review data processing arrangements and where data is stored or processed as part of the technical assessment.

MiCA sets minimum initial capital by service class: 50,000 euros for basic reception, transmission, advice and portfolio management; 125,000 euros for firms adding exchange, execution or placing services; and 150,000 euros for trading platforms or custody. Those minima are the floor. Prudential rules require capital equal to at least one-quarter of the prior year’s fixed overheads when that figure is higher. Paid-in capital must be lodged with a regulated credit institution; e-money or payment service accounts do not qualify. Banks often exercise caution when onboarding crypto businesses, so firms are advised to start banking talks early. Financial statements used to calculate overheads must be audited or validated as required by national rules.

Outsourcing of functions is permitted, but regulators will examine whether the arrangement leaves the EU entity without meaningful operational capacity. Supervisors use indicators such as the share of costs paid to non-EU providers to judge whether outsourcing has hollowed out the authorized entity. Delegation does not transfer regulatory responsibility.

Member-state practice varies. Cyprus has required a majority of a CASP’s board to be resident in Cyprus. Estonia moved supervision from its FIU to a financial supervisor, changing the licensing pathway. In Poland, delays in domestic implementing legislation have affected the availability of a formal CASP application route. Applications that document functional EU substance face less scrutiny than those that rely mainly on paper filings.