MiCA readiness assessment: run your own self-check

Verified as of 6 October 2026. MiCA is Regulation (EU) 2023/1114; the article references orient you to the text. Register counts change weekly, the proposal to move CASP supervision to ESMA is under negotiation, and the Commission’s MiCA review consultation closed on 30 September 2026 with the review itself still open. Confirm anything you rely on against current law, or ask us to.

What a MiCA readiness assessment checks

A MiCA readiness assessment checks whether a non-EU crypto firm could file a complete CASP authorisation application today, and where it would fall short. It tests the firm against the information a national competent authority must receive under Commission Delegated Regulation (EU) 2025/305, in force since 20 April 2025, and the application form in Implementing Regulation (EU) 2025/306: entity, programme of operations, capital, governance, AML, management body, shareholders, ICT, client assets, complaints and service policies. The output is a gap list against each article, not a crypto legal opinion on how your token is classified.

Schedule A lists the twelve gaps the assessment tests. The self-assessment below is the free, do-it-yourself version of the same exercise, framed for the token side as well as the service side.

Schedule A · The twelve gaps a MiCA readiness assessment tests, keyed to Delegated Regulation (EU) 2025/305
Gap tested	What the regulator must receive	Keyed to
1. Legal entity and application file	Legal name and form, LEI, national registration evidence, articles of association, head office and registered office addresses, branches, website domains and social media accounts, plus a designated contact point and the standard application form.	RTS 2025/305 Art 1; ITS 2025/306 Arts 1 to 4 and Annex; MiCA Art 59
2. Programme of operations	A three-year programme: the crypto-asset services and crypto-assets covered, the member states and third countries served, target client types and numbers, means of access (domains, languages, apps), planned marketing, the outsourcing policy and provider list, a forecast accounting plan with stress scenarios, and any intended interaction with DeFi.	RTS 2025/305 Art 2
3. Prudential safeguards	The safeguard amount at filing and how it was calculated, split between own funds and insurance, a three-year forecast with stress scenarios, audited statements or a credit-institution statement for a new entity, and the insurance policy or signed agreement where that route is used.	RTS 2025/305 Art 3; MiCA Art 67 and Annex IV
4. Governance, internal control and conflicts	An organisational chart with reporting lines, CVs of the heads of internal functions, compliance and infringement-reporting procedures, record-keeping arrangements, internal control functions and their reporting periodicity, the external auditor, and a conflicts-of-interest policy with a register of cases.	RTS 2025/305 Art 4(1) and 4(2); MiCA Arts 68(9), 72
5. Business continuity	A business continuity plan.	RTS 2025/305 Art 5
6. AML and CFT programme	An inherent and residual risk assessment across customers, services, channels and geographies, the customer due diligence and suspicious-transaction procedures, the named AML officer and their qualifications, annual staff training, and the policy set as adopted.	RTS 2025/305 Art 6; Directive (EU) 2015/849; Regulation (EU) 2023/1113
7. Management body fitness	For each member: identity, ten-year residency and career history, criminal-record and enforcement disclosures, references, conflicts of interest of the member and close relatives, time commitment across all directorships, and the individual and collective suitability assessments.	RTS 2025/305 Art 7; MiCA Art 68
8. Qualifying shareholders	An organigram of the holding structure with capital and voting rights, the identity and good repute of each qualifying holder, the shares subscribed, and any security interests over them.	RTS 2025/305 Art 8; Delegated Regulation (EU) 2025/414
9. ICT systems and DORA	A documented ICT risk-management framework, the ICT services supporting critical or important functions and their third-party contracts, incident management, any cybersecurity audit including penetration testing and smart-contract review, and a non-technical summary.	RTS 2025/305 Art 9; MiCA Art 73; Regulation (EU) 2022/2554 Chapter V
10. Client asset segregation	Client wallets separate from the firm’s own, the cryptographic-key approval and safeguarding system including multi-signature, omnibus segregation, and a procedure placing client funds with a central bank or credit institution by the end of the next business day in a separately identifiable account.	RTS 2025/305 Art 10; MiCA Art 70
11. Complaints handling	The complaints-handling procedures for clients.	RTS 2025/305 Art 11; MiCA Art 71
12. Service-specific policies	For each service applied for: the custody and administration policy and client agreement, trading-platform operating rules and market-abuse detection, exchange arrangements, the execution policy, advice or portfolio-management arrangements, and transfer-service arrangements.	RTS 2025/305 Arts 12 to 17; MiCA Art 75

The readiness gap assessment is the first stage of the MiCA authorisation programme: Infinilex quarterbacks, EU local counsel files. Both regulations were adopted on 31 October 2024, published on 31 March 2025 and entered into force on the twentieth day after publication, as at 6 October 2026.

If you sit outside the EU, the scope test comes first. Article 59 lets crypto-asset services be provided in the Union only by an authorised legal person with a registered office in a member state where it carries out at least part of its services, its place of effective management in the EU and at least one EU-resident director. The one route around authorisation, Article 61, covers a service that a client established or situated in the EU initiates at their own exclusive initiative, and it falls away where you, or anyone acting for you, solicit, promote or advertise in the Union, whatever the disclaimer says. Read the reverse solicitation note for non-EU firms before relying on it, then work through section 0 below. Already sure you will file? The MiCA CASP authorisation readiness checklist is the seven-step build that follows this page.

How to use this. Tick each statement that is true of your project. Most items are things that should be in place, an unticked box is an open item. Items marked flag are the opposite: ticking one means it applies to you and needs resolving, not that you are done. Your live read builds at the bottom as you go.

0. Does MiCA reach you at all?

Nexus first, then the exclusions that can put you outside MiCA entirely.

We offer, market, or sell the token to persons in the EU or EEA. We have an EU or EEA establishment, team, or place of effective management. We seek admission to trading on an EU trading platform.

A third-country firm with no EU authorisation may serve a client in the EU only where that client initiated the service at their own exclusive initiative. Soliciting, promoting or advertising in the Union, directly or through anyone acting for you and by any means, takes the service outside that exemption, and a contractual clause or disclaimer saying otherwise does not help. Art 61(1)

flagThe token gives holders rights like a share, bond, or fund unit: profit, dividends, repayment, or a share of returns. If so it may be a financial instrument under MiFID II, outside MiCA and into securities and prospectus law. Art 2(4)(a) scopeEvery unit is genuinely unique and not fungible, a true one-of-one, not a large series or fractionised. A genuine NFT may sit outside MiCA; a fungible token dressed as an NFT does not. Art 2(3) scopeThe token is e-money, a deposit, or another instrument already regulated under other EU law. Art 2

1. What are you actually doing?

Each ticked trigger switches on a part of MiCA. You can be caught by more than one.

Title IIWe offer a crypto-asset (not an ART or EMT) to the public, or seek its admission to trading. Art 3(1)(12) Title IIIWe issue, offer, or seek admission for an asset-referenced token. Title III Title IVWe issue, offer, or seek admission for an e-money token. Title IV Title VWe provide one or more crypto-asset services by way of business. Art 3(1)(16)

The ten crypto-asset services that make you a CASP: custody and administration; operating a trading platform; exchange for funds; exchange for other crypto-assets; execution of orders; placing; reception and transmission of orders; advice; portfolio management; transfer services. Providing any of them to EU clients requires authorisation. Art 3(1)(16)(a)-(j)

2. What is your token, in MiCA’s terms?

Classification drives everything. Your label does not survive contact with the definitions.

It purports to keep a stable value by referencing one official currency: an e-money token (EMT). Art 3(1)(7) It purports to keep a stable value by referencing assets, rights, or a basket (including several currencies): an asset-referenced token (ART). Art 3(1)(6) It is only intended to give access to a good or service we supply: a utility token. Art 3(1)(9) None of the above: another crypto-asset under Title II. flagWe call it “asset-referenced” or “RWA” but it does not hold a stable-value peg. Then it is not a MiCA ART, and an RWA token that carries economic rights is more likely a financial instrument. Recheck section 0.

3. Token design and terms

Where most “utility” tokens fail. Ticking a flag here is the finding, not a failure of the form.

flagHolders can expect yield, profit share, revenue, buy-backs, redemption at a gain, or a claim on assets or their cashflows. flagThe token, or our service on it, grants interest or any time-based benefit, directly or through a third party or the pricing of another product. For ARTs and EMTs this is prohibited and the ban reaches service providers too. Art 40, 50 flagOur terms say “utility only” or “not a security”, but our green paper, site, or marketing promise returns or profit. The documents contradict each other. The rights and obligations attached to the token are clearly and completely defined. Art 6(1)(g) The issuing entity and the governing law are stated and consistent across every document.

4. Marketing

Marketing communications are supervised in their own right, and what they say feeds your classification. Art 7

All marketing is fair, clear, not misleading, and clearly identifiable as marketing. Art 7(1)(a),(b) Marketing is consistent with the white paper. Art 7(1)(c) Marketing states that a white paper is published and gives the offeror’s website, phone number, and email. Art 7(1)(d) Marketing carries the required statement that no competent authority has reviewed or approved it and the offeror is solely responsible. Art 7 flagOur marketing makes claims about the token’s future value, price, or returns. Art 6(4), 7 flagWe run marketing before the required white paper is published. Art 7(2)

6. Structure, substance and capital

For CASPs and issuers. Substance is a continuing condition, not a filing formality.

We are a legal person with a registered office in a member state where we carry out at least part of our services, our effective management in the EU, and at least one EU-resident director. Art 59 Decisions on our EU business are genuinely made in the EU. We are not a letter-box for a group elsewhere, and we do not run more functions outside the EU than inside. ESMA briefing, 31 Jan 2025 We hold prudential safeguards at the higher of our class minimum (Class 1 EUR 50,000; Class 2 EUR 125,000; Class 3 EUR 150,000) or a quarter of last year’s fixed overheads, as own funds or qualifying insurance. Art 67, Annex IV Our management body and qualifying shareholders meet the good-repute and knowledge tests. Art 68 ART issuers only. We are EU-established and authorised, hold the reserve of assets and own funds (the higher of EUR 350,000, 2% of the reserve, or a quarter of overheads), and give holders redemption at any time. Title III EMT issuers only. We are a credit institution or an authorised e-money institution, and the token is redeemable at par at any time. Art 48, 49

7. Ongoing and other requirements

The duties projects underestimate. They start at authorisation, not after it.

We are set up as an AML and CFT obliged entity, with the programme, customer due diligence, and suspicious-transaction reporting. We meet the Travel Rule on every crypto transfer: full originator and beneficiary information, with no de-minimis threshold, and we verify self-hosted wallet ownership above EUR 1,000. Reg 2023/1113; since 30 Dec 2024 We meet DORA: ICT risk management, incident reporting, resilience testing, and third-party ICT risk. Reg 2022/2554; since 17 Jan 2025 We segregate and safeguard client crypto-assets and funds, with client money placed with a central bank or credit institution promptly. Art 70 We have complaints handling, conflicts-of-interest management, outsourcing controls, and record-keeping. Art 71, 72, 73 Client-facing staff meet the ESMA knowledge and competence standard, which applies from 28 July 2026. We passport by notifying the home authority before serving other member states. Art 65

On the horizon, not yet in force: the AML Regulation applies from 10 July 2027, and AMLA begins direct supervision of selected firms from 2028. Build for them now.

8. Timing and context, as at 6 October 2026

The transitional period ended on 1 July 2026. There is no grandfathering. Serving EU clients without the right MiCA status is now a breach, and ESMA has set out how unauthorised firms must wind down.

Choose the home member state deliberately. Authorisations concentrate in a handful: Germany, the Netherlands, France, Ireland, Malta, Luxembourg, and Lithuania. The choice affects speed, banking, and credibility.

The Commission’s targeted consultation on the MiCA review ran from 20 May to 30 September 2026 and is closed; the review itself continues, and our response sets out what we asked for. Separately, a proposed package would move CASP supervision to ESMA. Its scope is still contested and the outcome is expected around end-2026.

A reality check worth keeping: as of mid-2026 no asset-referenced token issuer has been authorised anywhere in the EU, while a few hundred CASPs are. Verify the live ESMA register before relying on any number. The 30 September 2026 file is counted state by state in the MiCA CASP register by member state.

Your read

Which parts of MiCA apply to you

Tick section 1 to see this.

Flags to resolve

None ticked yet.

Open readiness items

0 of 0

Work through the sections. Your read updates as you tick.

Set a discovery call

Get your read reviewed

Send us your assessment and we will come back to set up a discovery call. Your answers above are attached automatically, so the call starts from where you actually are, not a blank page.

Frequently asked questions

What does a MiCA readiness assessment check?

Two things, in order. First, scope: whether Regulation (EU) 2023/1114 reaches the business at all, which of Titles II to V apply, and what the token is in MiCA's own terms, a financial instrument outside MiCA, an e-money token, an asset-referenced token, a utility token or another crypto-asset. Second, filing readiness: whether the firm could file a complete application for authorisation as a crypto-asset service provider today, tested against the information blocks in Commission Delegated Regulation (EU) 2025/305 of 31 October 2024, in force since 20 April 2025. Schedule A on this page lists the twelve: legal entity and application file, programme of operations, prudential safeguards, governance, business continuity, AML and CFT, management body, qualifying shareholders, ICT and DORA, client asset segregation, complaints handling and service-specific policies. The output is a gap list keyed to each article, not an opinion on how the token is classified.

Can I run a MiCA readiness assessment on my own crypto business?

Yes, for the first pass, and this page is built for it. Tick what is true of your project in sections 0 to 7 and the live read at the bottom tells you which titles of MiCA apply, which flags need resolving and how many readiness items are still open. Print it or save it as a PDF and you have a gap list to work from. What a self-run assessment cannot settle are the judgement calls: whether the token is a financial instrument under MiFID II rather than a crypto-asset, whether an exemption in Article 4 genuinely applies to your offer, and whether your substance in the home member state would satisfy its competent authority. Those need counsel qualified in that member state. Treat your own read as the agenda for that conversation, not as the answer.

Am I in scope of MiCA as a non-EU firm?

If you provide any of the ten crypto-asset services to clients established or situated in the EU, yes, unless the service was initiated at the client's own exclusive initiative under Article 61. That exemption is narrow. Article 61(1) says that where a third-country firm, including through an entity acting on its behalf or having close links with it, solicits clients or prospective clients in the Union, regardless of the means of communication used, the service is not deemed to be provided at the client's own exclusive initiative, and no contractual clause or disclaimer stating otherwise changes that. Article 61(2) adds that the client's initiative does not let the firm market new types of crypto-assets or services to that client. ESMA's reverse solicitation guidelines, final report December 2024, say when a firm is deemed to solicit. Everything else runs through Article 59: a legal person with a registered office in a member state where it carries out at least part of its services, its place of effective management in the EU and at least one EU-resident director. Offering a token to the EU public is caught separately under Title II regardless of where the offeror sits. Before relying on Article 61, read the reverse solicitation note on this site. It covers what ends the exemption.

What is the difference between a MiCA gap assessment and CASP authorisation?

A gap assessment is yours and comes first; authorisation is the competent authority's decision and comes last. The gap assessment compares what you have today with what Article 62 of MiCA and Delegated Regulation (EU) 2025/305 require the authority to receive, block by block, and lists what is missing. CASP authorisation is the formal application filed with the competent authority of the home member state on the form in Implementing Regulation (EU) 2025/306. Under Article 63 the authority first checks that the file is complete and then decides within a set number of working days. The MiCA CASP authorisation readiness checklist on this site sets out that clock. Since the transitional period ended on 1 July 2026 there is no grandfathering, so a firm serving EU clients without the right status is in breach while it prepares. Closing the gaps first is the difference between a file the authority can assess and a file it can refuse to review.

Is this the same as the MiCA CASP authorisation readiness checklist?

No, they are two halves of one exercise. This self-assessment starts with scope: whether MiCA reaches you, which titles apply, what the token is and where its terms and marketing would fail, with the service-side gaps in Schedule A. The MiCA CASP authorisation readiness checklist is the seven-step build for a firm that already knows it is a crypto-asset service provider: the perimeter, the class, the member state, capital, governance, the policy set and the clock. Run this page first if you are not yet sure MiCA applies; run the checklist once you know you will file.

What does Infinilex do in a MiCA readiness assessment, and who signs the filing?

Infinilex runs the readiness gap assessment as the first stage of its MiCA authorisation programme. It classifies the token, maps which titles of MiCA apply, tests the firm against the twelve blocks of Delegated Regulation (EU) 2025/305 and returns a gap list keyed to each article, with the member-state analysis and the order in which to close the gaps. Infinilex is a legal, compliance and structuring consultancy. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. On MiCA that means Infinilex quarterbacks, EU local counsel files. Send your completed self-assessment through the form on this page, or email info@infinilex.io; email is answered within one working day.

Primary texts, each read on 6 October 2026: Regulation (EU) 2023/1114 (MiCA), OJ L 150, 9 June 2023 (Articles 4, 59, 61, 62, 63 and 143); Commission Delegated Regulation (EU) 2025/305 of 31 October 2024, OJ 31 March 2025; Commission Implementing Regulation (EU) 2025/306 of 31 October 2024, OJ 31 March 2025; European Commission, targeted consultation on the review of MiCA, 20 May to 30 September 2026, closed; ESMA, Markets in Crypto-Assets Regulation (final report on the guidelines on reverse solicitation, December 2024; interim MiCA register).

This self-assessment is general information for founders, not legal or regulatory advice for your specific project. MiCA, its implementing measures and national practice change; confirm every point against current law before relying on it. Infinilex is a consultancy working with EU-qualified local counsel where a filing must be signed. Have your setup reviewed before you file.

Prepared by Infinilex Consultancy · infinilex.io · Verified as of 6 October 2026. Printed copies date; check infinilex.io/resources/ for the current version.

Should you be filing for MiCA?

What a MiCA readiness assessment checks

0. Does MiCA reach you at all?

1. What are you actually doing?

2. What is your token, in MiCA’s terms?

3. Token design and terms

4. Marketing

5. Disclosures and the white paper

6. Structure, substance and capital

7. Ongoing and other requirements

8. Timing and context, as at 6 October 2026

Get your read reviewed

Thanks, that is with us.

Frequently asked questions

What does a MiCA readiness assessment check?

Can I run a MiCA readiness assessment on my own crypto business?

Am I in scope of MiCA as a non-EU firm?

What is the difference between a MiCA gap assessment and CASP authorisation?

Is this the same as the MiCA CASP authorisation readiness checklist?

What does Infinilex do in a MiCA readiness assessment, and who signs the filing?