MiCA ongoing compliance for authorised CASPs

They run continuously and they are not a subset of the application. Under Regulation (EU) 2023/1114 a CASP must keep acting honestly, fairly and professionally in clients’ best interests (Article 66); hold own funds at the higher of its service-class floor and a quarter of the preceding year’s fixed overheads, reviewed annually (Article 67); maintain governance arrangements and a suitable management body (Article 68); notify the competent authority of changes to that body before new members act (Article 69); safeguard and segregate client crypto-assets and funds (Article 70); operate complaints-handling procedures (Article 71); identify, prevent, manage and disclose conflicts of interest (Article 72); control and monitor outsourcing (Article 73); and maintain a wind-down plan (Article 74). On top of the regulation sit CySEC’s own periodic returns and circulars.

Readiness is everything up to the licence: a gap assessment, remediation, and the evidence pack behind an application. Ongoing compliance is everything after it: the recurring cycle of reviews, evidence, notifications and supervisory responses that proves you still meet the conditions you were authorised against. The distinction matters commercially because firms routinely budget for the first and not the second, then find that their first supervisory contact tests arrangements nobody has looked at since the application was filed. Authorisation is the entry ticket. Supervision is the job.

Producing evidence on a cadence rather than on demand. In practice that means a register of every obligation that applies to your specific permissions, an owner and an evidence definition for each, and a calendar that fires before the due date rather than after. The recurring work is mostly custody and segregation verification, reconciliation of on-chain activity to the ledger, refreshing the prudential figures, and keeping the complaints, conflicts and outsourcing records current. The test of whether monitoring is real is simple: if a supervisor asked today for last quarter’s safeguarding evidence, could you produce it without reconstructing it?

Every obligation that applies to your permissions, assessed against what the firm actually did rather than what its policies say it does. That means governance and management body suitability re-assessed rather than assumed; the Article 67 own funds calculation rerun against the latest audited fixed overheads; safeguarding and segregation tested on-chain for the period; complaints, conflicts and outsourcing registers reviewed; and last year’s open findings either closed or carried with a reason. The output should be a rated findings list with owners and dates, and a written position the board can sign.

Evidence, in a specified format, to a deadline. Typically that means the arrangements described in your authorisation file, records demonstrating they operated over a stated period, wallet and client-balance data supporting your safeguarding and segregation claims, the prudential calculation and its inputs, minutes of the governance decisions you are relying on, and the complaints and outsourcing registers. ESMA’s Common Supervisory Action on CASPs’ digital operational resilience for custody runs from the second half of 2026 into the first half of 2027, and CySEC communicated it to Cyprus firms by circular in August 2026, so custody arrangements are the live focus.

More often than annually, because Article 70 describes a standing state rather than a periodic event. Client assets must be segregated and their ownership protected including in the event of the firm’s insolvency, which means the question a supervisor asks is not whether you segregated at year end but whether you were segregated throughout. A monthly or quarterly on-chain verification tied to client balances answers that; an annual snapshot does not. The practical argument for the shorter cycle is cost: a break found this month is explainable, and the same break found eleven months later usually is not.

Article 67 sets own funds at the higher of the floor for your service class and one quarter of the fixed overheads of the preceding year, reviewed annually. The second limb is why the audit matters: the fixed overhead figure has to come from somewhere defensible, and that is your audited financial statements. This is the point where MiCA compliance and the statutory audit stop being separate workstreams, because a supervisor reviewing your prudential position is reading numbers an auditor signed. Holding own funds in the same account as operating cash is a common and avoidable finding.

Article 69 is explicit about the management body: a CASP must notify its competent authority without delay of any changes to that body, before any new member exercises activities, and provide the information needed to assess suitability under Article 68. Beyond that, material changes to the conditions on which authorisation was granted follow the same principle, including changes to the services provided, custody arrangements, outsourcing of critical functions, and qualifying shareholdings. The filing itself belongs to your compliance function and counsel. What we maintain is the evidence pack underneath it, so the notification is supported rather than asserted.

Yes. Authorised CASPs are financial entities for the purposes of the Digital Operational Resilience Act, so ICT risk management, incident reporting, resilience testing and third-party risk obligations apply alongside MiCA. The two intersect most visibly in custody: ESMA’s Common Supervisory Action for 2026 and 2027 examines CASPs’ digital operational resilience specifically in relation to custody activities, which is a MiCA Article 70 subject being tested through a DORA lens. Firms that treat the two as separate projects tend to produce two sets of evidence about one set of systems.

No, and you should be wary of anyone who says yes. The compliance function and the anti-money-laundering compliance officer are roles the firm appoints and the supervisor assesses; they carry personal accountability and cannot be contracted out to a service provider. What can be outsourced, subject to the Article 73 outsourcing requirements, is the evidence work underneath: the recurring verification, reconciliation, register maintenance and review documentation that your compliance function relies on. That is what we do, and your appointed officer remains the accountable person.

It depends almost entirely on whether you found it or the supervisor did. Competent authorities have a graduated toolkit, from information requests and remediation timetables through to administrative fines, public statements, restrictions on services and, under Article 64, withdrawal of authorisation. A breach that is self-identified, documented, notified and remediated is a different conversation from one a supervisor uncovers in an inspection while the firm is asserting that the arrangements work. That asymmetry is the strongest practical argument for a real review cycle rather than a nominal one.

They draw on the same data, so they should be run off one reconciled foundation rather than three. Your MiCA safeguarding evidence, your AML transaction monitoring and control testing, and your DAC8 reporting all ultimately describe the same wallets, the same client balances and the same movements. Firms that build them separately end up defending small inconsistencies between three descriptions of one year, which is an avoidable and expensive way to spend an inspection. We reconcile once and let the three obligations draw from it.