CASP Authorisation Withdrawal — MiCA Practitioner Guide

How the procedure works in practice

MiCA’s withdrawal framework is the supervisory article that ends a CASP’s regulatory life. Where Article 63 establishes the authorisation grant process, The MiCA framework governs the withdrawal process — the supervisory tool of last resort when an authorised CASP fails to maintain compliance with the regulatory framework.

The article addresses three primary withdrawal scenarios:

Failure to commence services within 12 months — operators that obtain authorisation but fail to actually launch services within 12 months face automatic withdrawal grounds. The provision exists to prevent “shelf authorisations” — entities obtaining authorisation as a placeholder without genuine operational intent.

Serious or repeated breaches of MiCA obligations — operators that operate but fail to maintain ongoing MiCA compliance face withdrawal as escalation from less-serious supervisory measures. Single material breach (major AML failure, customer-asset misappropriation) or pattern of repeated lesser breaches both qualify.

No longer meeting authorisation conditions — operators that operated initially under acceptable conditions but where the underlying authorisation basis no longer holds. Examples: substantial changes in beneficial ownership without proper notification, key-person departures leaving inadequate management, capital reduction below Article 67 floor.

Each ground has thorough procedural protections — withdrawal is not summary, requires due process, and offers appeal rights.

The procedural framework

The withdrawal framework incorporates standard EU administrative-law procedural protections:

Written notice — the NCA provides formal written notice of intent to withdraw, identifying the genuine grounds and the evidence supporting them. Notice must be sufficiently specific to enable detailed response.

Opportunity to be heard — the operator has the right to respond, present evidence, challenge the NCA’s underlying grounds. The opportunity is real — NCAs withdraw notice if thorough response identifies grounds-flaws or remediation paths.

Reasoned decision — if the NCA proceeds, the final decision must be reasoned, addressing the operator’s response and identifying the genuine basis for withdrawal.

Right of appeal — under member-state administrative law, typically to specialised financial-services tribunals or administrative courts. Appeal can include suspension of withdrawal effect pending determination, though courts grant suspension cautiously where customer-protection concerns are material.

The procedural framework is robust. Operators facing the withdrawal framework proceedings have genuine legal-defence options, particularly where the genuine grounds are contestable or where NCA evidence has gaps.

Customer-protection deployment

The real operational concern is customer protection. The framework includes:

Mandatory wind-down plan — the NCA approves a wind-down plan addressing customer-asset return, ongoing-services continuity, customer-data handling, contract termination procedures.

Customer-asset return — segregated customer crypto-assets (under Article 75) must be returned to customers. The wind-down plan defines transfer mechanisms, customer communication, dispute-resolution arrangements for any asset-attribution disputes.

Ongoing-services continuity — for extended periods during wind-down, customers may need ongoing services (executing pending orders, processing pending withdrawals, providing customer support). The wind-down plan addresses how these services continue and when they terminate.

NCA monitoring throughout wind-down — the NCA maintains supervisory engagement during wind-down with reporting requirements on customer-asset return progress, customer-complaint handling, operational continuity.

Successor-operator transitions — where customer relationships transition to other authorised operators, the wind-down plan addresses customer-data transfer (subject to GDPR), customer-consent requirements, regulatory notification.

The customer-protection framework is meaningfully the most operationally-demanding aspect. Operators should have genuine business-continuity infrastructure in place before any withdrawal scenario arises — meaningful customer-data infrastructure, segregated custody addresses, ongoing-services contracts with potential successor operators.

Cross-border implications

For passport-active operators, the withdrawal framework has substantial cross-border implications:

Automatic passport termination — passport rights derive from home-state authorisation under Article 65. Withdrawal terminates passport access automatically across all member states where the operator was passporting.

Home-state NCA notification obligations — the home-state NCA must notify host-state NCAs and ESMA. Notification triggers host-state customer-protection engagement.

Host-state engagement — host-state NCAs may engage in their own customer-protection measures, asset-freezing actions, or local enforcement. The coordination is typically through ESMA-mediated supervisory cooperation.

ESMA register update — the public ESMA register reflects withdrawal, with major implications for the operator’s market reputation across the EU.

Counterparty notification — payment processors, banking partners, B2B suppliers, technology vendors all typically have contractual provisions triggered by regulatory authorisation loss. Required notification and renegotiation typically follows.

The versus Article 109 sanctions

The withdrawal framework withdrawal is distinct from Article 109 administrative sanctions:

Article 109 sanctions — penalty actions for breaches: fines (up to higher of EUR 5M, 3% of turnover, or 2x gain/avoided loss), individual bans, public statements, supervisory measures like restriction of services. Multiple sanctions can be combined.

the withdrawal framework — the most serious supervisory action: complete loss of authorisation and operating right. The operator can no longer provide regulated crypto-asset services.

Both can be applied for the same conduct. Serious MiCA breaches often trigger Article 109 sanctions on the individuals (key persons, board members) plus the withdrawal framework of the operating entity.

The combined consequences can be career-ending for affected individuals and terminal for the operating entity. Real compliance investment is the only meaningful protection against this scenario.

Operational preparation — what every CASP should do

Even operators not currently facing the withdrawal framework risk should maintain ongoing preparation:

Business-continuity-plan infrastructure — meaningful customer-data infrastructure enabling rapid transition, segregated custody addresses, ongoing-services contracts with potential successor operators.

Documentation infrastructure — thorough compliance documentation that would survive supervisory scrutiny in any future enforcement scenario. Documentation gaps that aren’t material in normal operations become exposed grounds-analysis.

Key-person succession — adequate succession planning so departures don’t trigger the withdrawal framework grounds.

Capital-maintenance monitoring — proactive monitoring of Article 67 own-funds adequacy with early-warning thresholds well above the regulatory minimum.

Beneficial-ownership-change procedures — detailed procedures for any material changes in beneficial ownership ensuring proper Article 83 notifications occur.

The substantive preparation isn’t about expecting the withdrawal framework to arise — it’s about maintaining the operational and documentation infrastructure that demonstrates ongoing compliance and provides legal-defence options if any supervisory engagement does arise.

The in the broader supervisory framework

The withdrawal framework sits within MiCA’s escalating supervisory framework:

• Article 109 — administrative sanctions: primary penalty tool for breaches
• the withdrawal framework — withdrawal of authorisation: most serious supervisory action
• Article 84 — recovery and resolution: framework for managing failing CASPs
• Title VI (Articles 86-92) — market abuse: specific enforcement framework for market-abuse violations
• Article 95 — supervisory cooperation: cross-border NCA coordination

The withdrawal framework is the article supervisors invoke when other measures have failed or when the genuine grounds are sufficiently serious to skip lesser supervisory tools. The meaningful procedural protections mean withdrawal is not arbitrary, but the operator’s legal-defence position depends entirely on the quality of compliance documentation and operational infrastructure built well before any supervisory engagement.