MiCA Readiness Checklist 2026 — Is Your CASP Ready to File?

MiCA readiness — what the regulator actually tests

MiCA readiness is not a checklist exercise — it is the substantive question of whether the NCA's completeness check will accept your application as filed and start the statutory clock of 40 working days under MiCA Article 63. Completeness requires evidence across seven operational phases. An application missing material content in any phase faces NCA information-request rounds that delay authorisation by 3–12 months and add EUR 25,000–100,000 in legal-advisory time per round. The practitioner standard: file complete, not file early. The 15-point checker above identifies the components; this guide explains what each component actually requires for completeness.

The 7-phase MiCA readiness framework

The MiCA readiness framework runs across seven phases mapped to MiCA Articles 7, 14–17, 32, 63, 67–82, and the Title II white paper rules. Each phase must be complete before the NCA considers the application file ready for review:

1. Phase 1 — Classification. Token category (utility / asset-referenced / e-money token), regulated activities (Class 1 / 2 / 3 service set), MiFID II boundary check confirming the asset is not a financial instrument under MiCA vs MiFID classification.
2. Phase 2 — Capital and substance. Article 67 own funds calculation, Annex IV class floor, Maltese/Irish/Lithuanian/etc. local substance, fit-and-proper management body documented under Article 68 + EBA Guidelines.
3. Phase 3 — AML/CFT programme. AML manual aligned with FATF Recommendations, EU AMLR, MLRO appointment with documented EEA residency and operational engagement, transaction monitoring infrastructure (Chainalysis / Elliptic / TRM Labs), sanctions screening (OFAC, EU, UN lists).
4. Phase 4 — ICT and DORA framework. ICT-risk-management framework under DORA Article 5, business-continuity plan, incident-reporting infrastructure with 4-hour initial notice and 72-hour full-report capability, ICT third-party risk management under DORA Article 30.
5. Phase 5 — White paper compliance. Where the operator issues crypto-assets, substantive Title II white paper drafted with the content elements required by Articles 6–15, jurisdictional notification logistics, marketing-consistency framework under Article 7.
6. Phase 6 — Customer protection. Customer-protection framework, complaints-handling procedure under MiCA Article 71, custody segregation under Article 75, best-execution policy under Article 80 (where applicable), conflicts-of-interest framework under Article 72.
7. Phase 7 — Reporting and governance. Record-keeping infrastructure under Article 68 (5-year retention, retrievability), prudential reporting infrastructure, conduct-of-business reporting, internal audit cycles, board-level oversight documentation.

Capital and substance — Article 67 + Annex IV

Capital readiness requires own funds calculated under MiCA Article 67 and Annex IV. The class floors (EUR 50,000 / 125,000 / 150,000 for Class 1 / 2 / 3) are overridden by the one-quarter-of-fixed-overheads rule wherever that produces a higher number. NCAs expect working buffer above the regulatory minimum — typical expectation is 150–200% of the binding figure. See the CASP cost calculator for the own-funds and operational-cost estimate.

Substance readiness covers: home-state legal entity (incorporated, capitalised, banking arrangements in place), local director with documented residency and operational engagement, registered office that is more than a corporate-services-provider address, senior management headcount including Chief Compliance Officer and Money Laundering Reporting Officer with EEA residency and direct board access. Substance shortcuts — letterbox entities, nominal local directors, outsourced MLRO without engagement — face NCA pushback during fit-and-proper review.

AML/CFT programme readiness — MLRO, monitoring, sanctions, Travel Rule

AML readiness is the component most CASP applicants underestimate. The AML programme must address:

• AML manual aligned with FATF Recommendations 10–24, EU AMLR substantive requirements, member-state AML transposition. The manual runs 80–150 pages covering risk assessment, CDD/EDD procedures, ongoing monitoring, sanctions screening, reporting workflows, training, independent testing, and record-keeping.
• MLRO appointment with seniority, EEA residency, direct board access, documented operational engagement, fit-and-proper review evidence. See the MLRO substance practitioner guide.
• Transaction monitoring infrastructure — transaction-graph analysis using Chainalysis, Elliptic, or TRM Labs. For crypto-native operations, on-chain monitoring with cross-chain bridging analysis. Typical infrastructure investment EUR 150,000–400,000 in Year 1.
• Sanctions screening — real-time screening against OFAC, EU, UN sanctions lists. Both customer-identity screening and wallet-address screening. See Sanctions compliance for CASPs guide.
• Travel Rule (TFR) infrastructure — cross-CASP information exchange under Regulation (EU) 2023/1113, originator and beneficiary information on all crypto-asset transfers, enhanced due diligence on self-hosted wallet transfers above EUR 1,000. See EU Travel Rule TFR implementation by member state.
• Suspicious-transaction reporting — STR workflow to home-state FIU, documented escalation procedures, training across all customer-facing staff.

ICT and DORA framework readiness

DORA (Digital Operational Resilience Act, Regulation EU 2022/2554) became operationally binding on 17 January 2025 and applies to CASPs alongside MiCA. DORA readiness requires:

• ICT-risk-management framework — written framework covering ICT asset inventory, incident classification, business-continuity plan, ICT third-party risk management, periodic testing. Substantive documentation runs 60–120 pages.
• Incident reporting infrastructure — infrastructure supporting 4-hour initial notice for major ICT-related incidents and 72-hour full-report submission. Operators without substantive incident-classification framework face supervisory engagement on inadequate readiness.
• Threat-Led Penetration Testing (TLPT) — infrastructure for TLPT cycles under DORA Article 26. Required every three years for significant CASPs, on-demand for other CASPs at NCA request. Per-cycle cost EUR 80,000–250,000.
• ICT third-party risk management — contractual provisions under DORA Article 30 for ICT providers. Heightened obligations for Critical ICT Third-Party Providers (CTPP) designated by the ESAs Joint Committee. See DORA CTPP designation guide.
• Operational-risk tooling — SIEM, EDR, threat-monitoring infrastructure, key-management infrastructure for custody operators.

White paper compliance — Title II readiness

Operators issuing crypto-assets face Title II white paper notification obligations under MiCA Articles 6–15. White paper readiness requires:

• White paper draft with the content elements required by Article 6 — project description, issuer information, token-economics, rights and obligations of token holders, risks disclosure, governance arrangements.
• Jurisdictional notification logistics — home-state NCA notification under Article 14, with notification period before public offering or admission to trading.
• Marketing-consistency framework — all marketing materials consistent with white paper content under Article 7. Marketing that contradicts or materially extends beyond white paper disclosure triggers supervisory engagement.
• Liability documentation — understanding that white paper liability attaches to the offeror and management body individually. Content errors or material omissions create individual liability for senior managers responsible for approval.

CASPs that do not issue crypto-assets — pure exchange, custody, trading-platform operators — face lighter Title II obligations focused on white-paper-compliance verification before admitting third-party-issued assets to trading.

Customer protection and complaints-handling readiness

Customer-protection framework covers the interaction between CASP and customer:

• Complaints-handling procedure under MiCA Article 71 — procedure for receiving, investigating, and resolving customer complaints within regulatory timeframes, escalation procedures, NCA reporting infrastructure. See CASP complaints handling guide.
• Custody segregation under Article 75 — segregation of customer crypto-assets from operator assets, separate addresses, accounting separation, customer-asset return procedures in operator-insolvency scenarios. See Article 75 custody segregation guide.
• Best-execution policy under Article 80 — for CASPs providing execution services, best-execution framework with multi-factor analysis (price, costs, speed, likelihood of execution and settlement, size), monitoring infrastructure, annual disclosure.
• Conflicts-of-interest framework under Article 72 — identification, management, and disclosure of structural and transaction-level conflicts. See Article 78 inducements + conflicts guide.
• Customer-facing disclosure framework — risk disclosure, fee transparency, terms-and-conditions clarity, marketing-conduct compliance.

Operational resilience and incident reporting — 4h/72h

Operational resilience readiness combines DORA ICT obligations with MiCA conduct rules. The incident reporting timeline is sharp:

• 4-hour initial notice for major ICT-related incidents to home-state NCA. Substantive initial notice covers incident classification, affected systems, customer-impact estimate, response actions in progress.
• 72-hour full incident report with root-cause analysis, customer-impact quantification, remediation actions completed, lessons-learned framework.
• Final incident report within one month of incident resolution with post-incident review and framework-improvement actions.
• Operational-risk-event reporting — ongoing reporting framework for operational risk events, with quarterly aggregate reporting to NCA.

Operators without incident-classification framework face supervisory engagement on inadequate readiness. The 4h/72h timeline cannot be retrofitted reactively — it requires substantive pre-existing infrastructure and trained response teams.

Governance, internal controls, and reporting readiness

Governance readiness covers the board and management-body framework:

• Management body fit-and-proper under Article 68 + EBA Guidelines — substantive fit-and-proper review of every management body member including documented criminal-record checks across all jurisdictions of nationality and residence, reputation review, financial-position verification, professional-qualifications evidence.
• Qualifying-holdings notification under Article 83 — notification procedures for any acquisition or disposal of qualifying holdings (10%+) including due-diligence documentation.
• Internal audit function — internal audit cycles, audit-committee oversight, documented internal-audit charter, independent reporting line to board.
• Risk-management function — risk-appetite framework, key risk indicators, risk-committee oversight, independent reporting line to board.
• Compliance function — compliance officer with board access, documented compliance programme, regular board-level compliance reporting.
• Record-keeping infrastructure under Article 68 — 5-year retention minimum, retrievability standards, cross-border accessibility for NCA cooperation.

Common readiness gaps that derail authorisation files

Supervisory engagement patterns through 2025–2026 identify recurring readiness gaps:

1. Evidence gaps — policies in place but inadequate evidence of operational implementation. NCAs test evidence of policy operation, not just policy existence.
2. Token classification errors — incorrect classification of crypto-assets as utility tokens when analysis indicates asset-referenced or e-money token status. Triggers Title III or Title IV reauthorisation.
3. Change-related breakage — operational changes not reflected in policy documentation, creating divergence between actual operation and authorised framework.
4. Inadequate marketing consistency — marketing materials inconsistent with white paper content or operating-framework documentation. Supervisory engagement on Article 7 compliance.
5. Record-keeping infrastructure gaps — records nominally retained but inadequate retrievability under NCA supervisory testing. See Article 68 record-keeping guide.
6. Missed escalations — operational events not escalated through substantive framework, creating operational-risk-management documentation gaps.
7. Undisclosed conflicts — structural conflicts not documented in conflict-management framework, particularly for operators running combined trading-platform + market-making + custody operations.

Timeline from start to readiness

MiCA readiness build for a venture-stage operator typically requires 9–15 months. The substantive breakdown:

• Months 1–3: jurisdiction selection, legal entity incorporation, capital raising or deployment, initial governance documentation, MLRO and CCO recruitment.
• Months 3–6: AML/CFT programme drafting, ICT and DORA framework build, customer-protection framework, business plan complete.
• Months 6–9: white paper drafting (where applicable), policy stack completion, pre-application NCA engagement, fit-and-proper documentation completion.
• Months 9–12: file submission, NCA information-request rounds, supervisory engagement on completeness, technical specifications refinement.
• Months 12–15+: NCA review under statutory clock of 40 working days from complete-file determination, technical certification, authorisation grant.

For operators with existing financial-services authorisation infrastructure (MiFID-licensed investment firms, EMI licensees, banking-services providers) the readiness timeline compresses to 6–9 months. For venture-stage operators starting from minimal regulatory infrastructure, 15–24 months is realistic. See How long MiCA CASP authorisation takes 2026 for timeline expectations.

FAQ — MiCA readiness

How long does it take to become MiCA-ready?

MiCA readiness build typically takes 9–15 months for venture-stage operators starting from minimal regulatory infrastructure. Operators with existing financial-services authorisation (MiFID, EMI, banking) face compressed 6–9 month timelines. The file completion is followed by statutory NCA review of 40 working days under Article 63 from complete-file determination.

What percentage readiness score should I aim for before filing?

Practitioner standard: 90%+ on the readiness checklist with evidence behind each component. NCAs accept complete files; incomplete files trigger 2–4 rounds of information requests adding 3–12 months to authorisation timeline plus EUR 25,000–100,000 in legal-advisory time per round.

Can I file without an MLRO appointed?

No. MLRO appointment is mandatory under MiCA + EU AMLR. The MLRO must have EEA residency, fit-and-proper documentation, direct board access, and operational engagement. Outsourced MLRO arrangements face heightened NCA scrutiny — nominal appointments do not satisfy substantive expectation.

Does DORA readiness need to be complete before filing the CASP application?

Yes. DORA applies to CASPs from 17 January 2025 alongside MiCA. The ICT framework, incident-reporting infrastructure, and ICT third-party risk management must be in place at the application phase, not deferred to post-authorisation build-out.

What is the 4-hour / 72-hour incident reporting rule?

Under DORA, major ICT-related incidents require 4-hour initial notice to the home-state NCA and 72-hour full incident report with root-cause analysis, customer-impact quantification, and remediation actions. A final incident report follows within one month of resolution. Operators without incident-classification framework face supervisory engagement on inadequate readiness.

Do I need a white paper if I am only running an exchange?

White paper notification under MiCA Title II is required only where the operator issues crypto-assets. Pure exchange, custody, or trading-platform operators face lighter Title II obligations focused on white-paper-compliance verification before admitting third-party-issued assets to trading. See MiCA token sale white paper rules.

What penalties apply for inadequate MiCA readiness?

Under MiCA Article 111, member states must give NCAs power to impose, on a CASP that is a legal person, maximum fines of at least EUR 5 million or 5% of annual turnover, or at least twice the profit gained or loss avoided. For individuals the maximum fine must be at least EUR 700,000. NCAs can also publish a statement naming the firm and order the conduct to stop.

Related practitioner resources

• CASP cost calculator — cost estimate alongside readiness assessment.
• Jurisdiction finder — jurisdiction selection framework.
• DORA ICT resilience for CASPs — DORA compliance framework.
• MLRO substance requirements — MLRO appointment framework.
• CASP management body fit-and-proper — governance readiness.
• Best EU MiCA passport hub comparison 2026 — jurisdiction selection.

MiCA readiness is the substantive question that determines whether an authorisation application succeeds at first NCA completeness check or triggers 3–12 months of information-request rounds. The 15-point checker above identifies the components. The readiness build requires 9–15 months of focused operational work across the seven phases. Readiness pays dividends in authorisation timeline, supervisory relationship quality, and ongoing operational economics.