Our response to the European Commission’s MiCA review consultation

MiCA’s first year proved the design and exposed the delivery. One authorisation that passports across thirty EEA states is the most valuable idea in crypto regulation anywhere, and 323 register entries by ESMA’s 31 July update show it works where it is allowed to. But the passport is only as real as its weakest member state, several of which have authorised nobody; the transitional period’s close stranded a large cohort of formerly registered firms with revenue, users and no lawful road back; and the asset-referenced token track has attracted zero issuers anywhere in the Union. Our response, in five positions, asks the review to finish the delivery rather than redesign the machine.

After the close, as at 6 October 2026: nothing has changed yet for non-EU crypto firms. The consultation closed on 30 September 2026, and MiCA applies as written until an amendment is adopted. The next fixed date is 30 June 2027, when Article 140(1) requires the Commission’s report, with a legislative proposal where appropriate. The direction for firms outside the EU is tighter, not looser: ESMA’s response of 30 September 2026 asks for powers against third-country firms that solicit EU investors without authorisation, and for the reverse solicitation exemption to be read as narrowly as possible. What happens next is set out after the five positions.

1. Make the passport real in every member state

Authorisation is concentrated where regulators function: Germany, France and the Netherlands lead the register, while several member states have authorised no CASPs at all, and at least one entered the post-transitional period without an implementing law or a designated regulator. A single market in which the right to authorisation depends on which capital a firm can practically file in is a passport with holes in it. The review should establish a backstop: where a member state cannot process applications within the regulation’s own timelines, applicants need an alternative, functioning route, whether through ESMA or through a designated peer authority. Firms should compete on compliance, not on their luck in choosing a regulator.

2. Choose supervisory consistency over supervisory relocation

On the proposal to move CASP supervision to ESMA, we support the direction the Parliament’s draft reports have taken: ESMA supervision for significant CASPs, with national authorities retained for the rest. What matters more than who supervises is how uniformly the process runs. The regulation already promises a 40-working-day substantive assessment; the review’s contribution should be transparency and discipline around that clock, including publication of actual processing times and stop-the-clock practices by member state. Consistency of experience, not centralisation for its own sake, is what makes the single market credible to an applicant.

3. Give the stranded cohort a lawful road back

The transitional period closed on 1 July 2026 with a clear instruction to unauthorised firms to wind down. The instruction was correct; the aftermath still needs policy. Thousands of firms that operated lawfully under national registrations before MiCA, in some member states with no domestic route to authorisation at all, now face a binary of exit or breach. The review should consider a defined re-entry path for formerly registered firms with clean supervisory records: not a reopened transition, but a predictable, time-limited application track that recognises prior supervised operation. Alongside it, reverse solicitation deserves clear, narrow guidance; today it functions as an untested belief rather than a rule, which serves neither consumers nor compliance.

4. Keep the proportionality that already works

Two features of the current framework deserve explicit preservation. The own-funds requirement that can be met by capital or by an insurance policy under Article 67(4) is a genuinely proportionate route for smaller, well-run firms, and should not be narrowed. And the knowledge-and-competence guidelines that took effect in July are sensible in substance but should scale with firm size in their documentation demands, so that a five-person CASP is not evidencing training on the apparatus of a bank. Proportionality of this kind is not laxity; it is what keeps the compliant path open to the firms most likely to bring innovation into the perimeter.

5. Answer the empty ART track, and define the interest-ban perimeter

Two calibration questions the review should not leave unexamined. First, the asset-referenced token regime has zero issuers anywhere in the EU while the e-money token track functions; a licensable category that a whole market declines to use for a full year is asking for a reassessment of its design, not merely more time. Second, on the consultation’s own question regarding the prohibition on granting interest: whatever policy choice the review makes, the perimeter needs precision. The current breadth, reaching benefits provided through third parties, leaves compliant product design guessing at the boundary. A defined rule, whichever way it is set, serves both consumer protection and the firms trying to respect it, particularly against the visibly divergent approaches taken in other major markets.

What happens next, after the 30 September close

The Commission’s targeted consultation closed on 30 September 2026 at 23:59 CEST. It runs under Articles 140 and 142 of MiCA, and the Commission says the responses will feed its report on the application of MiCA and on the latest developments in crypto-asset markets, a report that “may, if warranted, be accompanied by a new legislative proposal”. Article 140(1) sets the date: by 30 June 2027, having consulted EBA and ESMA, the Commission must report to the European Parliament and the Council, with a legislative proposal where appropriate. Any proposal to amend MiCA would then go to the Parliament and the Council, as MiCA itself did under the ordinary legislative procedure. Until an amendment is adopted and applies, MiCA governs as written, and the transitional period that ended on 1 July 2026 stays ended.

Article 140(2) lists what the report must contain. Three items matter most to a firm outside the EU. Point (v) requires an assessment of whether an equivalence regime should be established for crypto-asset service providers and for issuers of asset-referenced and e-money tokens from third countries. Point (ac) requires an assessment of the advantages and disadvantages of national authorities or ESMA supervising significant CASPs. Point (r) asks whether CASP prudential requirements should be aligned with the investment-firm regime in Regulation (EU) 2019/2033 and Directive (EU) 2019/2034.

What ESMA asked for on the closing day

ESMA published its own response on 30 September 2026 (ESMA75-113276571-1721). Six of its proposals reach non-EU firms directly:

• Specific supervisory powers to address third-country firms that actively solicit EU investors without MiCA authorisation, so that the Article 61 reverse solicitation exemption is read consistently and “in as narrow a way as possible”. What Article 61 covers today is on MiCA reverse solicitation for non-EU exchanges.
• Explicit powers for national authorities to order the removal of scam or unauthorised websites, because fraudulent domains are often registered, hosted and promoted outside the EU.
• An express rule that a CASP cannot provide any licensable MiCA service in relation to asset-referenced or e-money tokens that do not comply with MiCA.
• A new regulated service for CASPs that act as gateways to DeFi, and a definition of DeFi written into the Regulation in place of the uncertainty in Recital 22, with the exemption kept as narrow as possible.
• Binding ESMA opinions on token classification, including on ESMA’s own initiative, where today Article 97(3) allows only non-binding opinions requested by a national authority.
• Targeted conduct, disclosure and safeguarding rules for staking, lending and borrowing, with added governance requirements where a CASP uses affiliated or third-country entities in its staking arrangements.

ESMA’s paper does not propose a third-country equivalence regime.

Who supervises CASPs is a separate file

The supervision question in our second position is being decided outside this review. On 4 December 2025 the Commission adopted its market integration and supervision package, which proposes transferring direct supervision of all CASPs to ESMA (COM(2025) 943, procedure 2025/0383(COD)). ESMA’s response notes that CASP supervision falls outside the scope of this consultation. In the Parliament, the ECON committee’s draft report was submitted on 11 June 2026 and amendments were tabled on 31 July 2026. On 6 October 2026 the Legislative Observatory listed the file as awaiting committee decision. Until it becomes law, a CASP authorised by one national authority keeps its passport across the EEA under the current rules.

What this means for a firm outside the EU

Plan on MiCA as it stands. Neither the Commission’s consultation page nor ESMA’s response points to reopening the transitional period or widening Article 61, and ESMA’s asks run the other way. A firm with EU clients needs CASP authorisation from one national authority today, and an EU structure that would still work if direct supervision moves to ESMA. Who is authorised where is tracked on the CASP register by member state; whether the EU or Dubai fits your users better is on MiCA vs VARA.

How ESMA’s response sits against our five positions

ESMA asks for stronger convergence tools and more effective supervision of cross-border risks, the same direction as our first two positions. Its prudential proposal is narrower than a rewrite: it would let CASPs deduct further variable costs when calculating fixed overheads under Article 67(3), in line with the investment-firm rules, and it does not touch the insurance route in Article 67(4) that our fourth position asks the review to keep. ESMA’s paper does not address a re-entry path for formerly registered firms, the absence of asset-referenced token issuers, or the prohibition on granting interest. Those points, our third and fifth positions, now rest with the Commission’s report.

Sources for this section: Regulation (EU) 2023/1114 (OJ L 150, 9 June 2023), Arts. 61, 67, 97(3), 140 and 142; European Commission, targeted consultation on the review of MiCA, 20 May to 30 September 2026; ESMA response to the EC consultation on the review of MiCA, ESMA75-113276571-1721, 30 September 2026; European Commission press release IP/25/2893, 4 December 2025; European Parliament Legislative Observatory, procedure 2025/0383(COD), checked 6 October 2026.

Frequently asked questions

Who we are

Infinilex is a legal, compliance and structuring consultancy for founders and high-growth companies operating across India, the UAE and the US, with a Web3 and digital-assets practice that runs MiCA authorisation programmes for non-EU firms, with EU local counsel handling regulator-facing filings. Our comparative work on the regime is published openly, including MiCA vs VARA and the CASP authorisation readiness checklist. We are a member of the Circle Alliance Program. Our US counterpart to this response, a comment letter on the SEC’s proposed Regulation Crypto Assets, was filed on 6 October 2026.

This response states general regulatory positions and is not legal advice. Register figures are dated to ESMA’s 31 July 2026 update. The consultation closed on 30 September 2026; the review and the legislative processes referenced here are ongoing, positions may evolve with them, and the section on what happens next is stated as at 6 October 2026.