MiCA Compliance Software Development

A practical MiCA compliance checklist for CASPs and token issuers: CASP authorisation, KYC AML, Travel Rule, proof of reserves, market abuse, token white papers and DORA, mapped to EU deadlines.

ART vs EMT under MiCA explained: asset-referenced tokens, e-money tokens and other crypto-assets, their obligations, supervision and the software token issuers need to build.

The 10 MiCA crypto-asset services explained: custody, trading platform, exchange, execution, placing, advice, portfolio management and transfer services, with capital classes and the software each needs.

MiCA vs MiFID II explained: where MiCA stops and securities law starts, when a token is a financial instrument, the gray zones and how to build when classification is pending.

DORA for crypto firms explained: who it applies to, the five pillars, what CASPs must build, cost and penalties, and how DORA fits alongside MiCA.

Crypto market abuse under MiCA Title VI explained: wash trading, spoofing, insider dealing, STOR reporting and the surveillance a trading platform must build.

MiCA custody requirements mapped provision by provision: Article 70's safekeeping baseline for every CASP, Article 75's nine-paragraph custody rulebook, the three-limb segregation test, the liability cap at market value at time of loss and the evidence a CASP should have ready for each obligation.

The engineering decision underneath MiCA custody: MPC threshold signatures, HSM tamper-response hardware and on-chain multi-sig compared on single-point-of-failure resistance, auditability, recovery, cost and chain-agnosticism, with a cold/warm/hot tiering pattern and key ceremony, rotation and disaster-recovery design notes.

ESMA's 8 July 2026 Common Supervisory Action on custody, the six focus areas ESMA itself named, the DORA read-across, attributed commentary from Latham & Watkins and the MiCA Crypto Alliance and the engineering evidence a custody-authorized CASP should have ready, mapped to MiCA Article 75 and DORA obligations.

How a MiCA-authorized CASP builds and maintains the DORA Register of Information under Article 28: the 15-template data model from Commission Implementing Regulation (EU) 2024/2956, mandatory LEI/EUID identifiers, the criticality classification that drives subcontractor depth and risk assessment, common register-build mistakes and the xBRL-CSV submission pipeline.

DORA Threat-Led Penetration Testing (TLPT) for crypto firms mapped provision by provision: the Article 26(8) designation gate that decides which CASPs owe TLPT at all, how it differs from ordinary Article 25 testing, the ECB TIBER-EU phases behind it, tester requirements under Article 27 and the evidence a regulator expects afterward.

Crypto AML rule tuning covering the ATL/BTL threshold-testing lifecycle, a hedged sub-1 percent SAR-conversion retirement signal, the back-test gate before a threshold ships and what MiCA vs the incoming AMLR actually require of CASP transaction monitoring.

On 18 February 2026, nearly nine months after the question was submitted, the European Commission answered ESMA Q&A 2552: crypto-assets without an identifiable issuer sit outside MiCA Title II, so no white paper is required and Article 5(2) does not bind the platforms that list them. The answer that underpins Bitcoin and Ether listings across the EU is an administrative Q&A interpreting a recital, and neither is binding law. We trace what the Q&A actually says, what it leaves standing and what an engineering team builds around a determination that can be challenged years later.

The MiCA transitional period was over everywhere by 1 July 2026, earlier in Member States that shortened it. A third-country crypto firm serving EU clients without a CASP authorization now has exactly one legal basis left, Article 61 reverse solicitation, and two years of ESMA guidance have narrowed it to a keyhole. We work through the statute, the 26 February 2025 guidelines, the broker-model opinion on routing and letter-box entities and ESMA's freshest compliance table dated 10 July 2026, which shows Poland and Romania still without a designated authority for these guidelines ten days after grandfathering ended. Then we cover what an engineering team actually builds to prove a client showed up on its own.