MiCA Compliance Checklist for Tokenised Asset Issuers

Executive TL;DR

• This checklist covers the six domains of MiCA compliance relevant to tokenised asset issuers: scope determination, white paper, entity and authorisation, AML/CTF, market abuse, and ongoing reporting. It is structured as an operational tool, not an exhaustive legal guide each item requires verification with qualified EU legal counsel for the specific instrument and jurisdiction.

• The checklist applies specifically to issuers whose tokens fall within MiCA’s scope. Tokens qualifying as MiFID II financial instruments (most tokenised bonds, equities, fund units) are excluded from MiCA and subject to different frameworks confirm scope classification before using this checklist.

• MiCA penalties for non-compliance reach €15 million or 12.5% of annual turnover, whichever is greater. White papers published without national competent authority notification expose issuers to immediate enforcement. Operating a CASP without authorisation is an unlicensed financial services activity in all 27 EU member states simultaneously.

• Two items on this checklist are frequently missed: the 20 working day notification period before a white paper can be used to make an offering (common cause of delayed launches), and the ESMA interim register publication requirement (which applies to CASPs operating in multiple member states).

• Timeline note: MiCA authorisation processes are not instant. CASP applications typically require 3-6 months for competent authority review. ART authorisation involves the EBA and requires significantly longer. Build compliance timelines into project schedules before product design is finalised.

A compliance checklist for MiCA is not a substitute for legal counsel it is a structured starting point for identifying what needs to be addressed and in what order. Each item below represents an obligation or decision point under MiCA that a tokenised asset issuer must have addressed before making any public offering in the EU.

Domain 1: Scope Determination

Confirm whether the token qualifies as a financial instrument under MiFID II (transferable security, money market instrument, derivative): if yes, MiCA does not apply → comply with MiFID II, Prospectus Regulation, and applicable sectoral rules instead.
Confirm whether the token qualifies as a UCITS or AIF fund unit: if yes, MiCA does not apply → comply with UCITS Directive or AIFMD.
Confirm whether the token qualifies as an E-Money Token (pegged to a single fiat currency): if yes, MiCA Title III applies → obtain credit institution or EMI authorisation.
Confirm whether the token qualifies as an Asset-Referenced Token (pegged to multiple assets, currencies, or commodities): if yes, MiCA Title IV applies → obtain EBA authorisation and meet stricter capital requirements (minimum €350,000 capital, 3% reserve).
Confirm whether the token is a utility token providing access to an existing product or service: if yes, it may qualify for the public offering exemption under MiCA Article 4.
Obtain a written legal opinion from qualified EU counsel confirming the scope classification before launch.

Domain 2: Crypto-Asset White Paper

Prepare the white paper in accordance with ESMA’s technical standards description of issuer, token features, rights and obligations, underlying technology, risk factors, reserve information (ARTs/EMTs), and complaint procedure.
Ensure the white paper is accurate and not misleading the issuer bears civil liability for any inaccurate or misleading information causing investor loss.
Notify the competent authority of the home member state before publication. Do not use the white paper to make any offering until 20 working days after notification (commonly missed allow for this in project timelines).
Publish the white paper on the issuer’s website in a manner accessible to prospective investors in the EU.
Update the white paper promptly when material changes occur. Establish a document control process for ongoing white paper maintenance.
For ARTs and EMTs: additional white paper content requirements apply reserve composition, custody arrangements, redemption rights, and stabilisation mechanisms must be described.

Domain 3: Entity and Authorisation

Confirm EU establishment: ART and EMT issuers must be established in the EU; CASP licensees must have an EU legal entity as the authorised entity.
Determine home member state for authorisation purposes (where the issuer is headquartered or has a registered office in the EU) this competent authority will be the primary supervisor.
If operating any crypto-asset service (custody, exchange, trading platform, advisory, portfolio management, order execution, transfer service) in the EU: apply for CASP authorisation from the home member state competent authority.
Identify the applicable CASP class: Class 1 (€50,000 min capital), Class 2 (€125,000 min capital), or Class 3 trading platform operators (€150,000 min capital).
Allow adequate lead time for CASP authorisation competent authorities typically require 3-6 months from a complete application.
Once authorised, register in ESMA’s interim MiCA register for cross-border passporting within the EU.
Implement required governance structures: senior management with adequate qualifications and good repute, internal control functions, risk management procedures, and a fit-and-proper assessment process.

Domain 4: AML/CTF Obligations

Implement KYC/AML procedures meeting EU AML Directive standards for all EU customer relationships.
Implement FATF Travel Rule compliance: collect and transmit sender and recipient identifying information for all crypto-asset transfers above applicable thresholds.
Conduct sanctions screening against EU, UN, and relevant national sanctions lists for all customers and counterparties.
Establish a suspicious activity reporting (SAR) process with designated AML/CTF compliance officer.
Maintain records of all transactions and customer due diligence for at least 5 years.
Conduct regular AML/CTF risk assessments and update policies as the business model or customer base changes.

Domain 5: Market Abuse

Establish an insider information management policy: define what constitutes inside information for the issuer’s crypto-assets, restrict access to that information to those who need it, and establish disclosure procedures.
Implement market abuse monitoring: surveillance systems to detect potentially manipulative trading patterns in the issuer’s crypto-assets on EU trading platforms.
Train senior management and key personnel on MiCA market abuse prohibitions: insider trading, unlawful disclosure of inside information, and market manipulation.
Establish a market abuse incident response procedure: how to respond if a potential breach is identified, including reporting to the relevant competent authority.

Domain 6: Ongoing Reporting and Compliance

Submit periodic reports to the home member state competent authority as required by MiCA and the applicable CASP authorisation conditions.
Annual audited financial statements to be submitted to the competent authority.
Promptly notify the competent authority of material events: significant breaches, outages, security incidents, or material changes to the issuer’s business or financial position.
Maintain ongoing white paper accuracy: update and re-notify the competent authority when material changes occur.
For ARTs and EMTs: quarterly reserve reports confirming the composition, custody arrangements, and value of reserves backing the outstanding token supply.
Monitor ESMA and EBA publications for updates to technical standards and guidance affecting the issuer’s obligations the MiCA framework continues to be supplemented by Level 2 technical standards.

Frequently Asked Questions

1. What happens if an issuer publishes a white paper without notifying the competent authority?

Using a white paper to make a public offering before the 20 working day notification period has elapsed exposes the issuer to immediate enforcement action, which can include cease-and-desist orders, fines up to €15 million or 12.5% of annual turnover, and publication of a public notice of the violation.

2. Can a non-EU issuer offer MiCA-scope crypto-assets to EU investors?

The rules for third-country issuers are complex and still developing. In practice, non-EU issuers seeking to offer to EU retail investors typically need EU establishment or must rely on reverse solicitation (where the EU investor approaches the issuer without solicitation) a limited exception that regulators interpret narrowly. Legal counsel in each target jurisdiction is required.

3. How long does CASP authorisation take?

Competent authorities typically require 3-6 months from a complete application for CASP authorisation, though timelines vary by member state and the complexity of the application. ART authorisation, which involves the EBA, takes significantly longer. Build these timelines into project schedules.

4. Does the Travel Rule apply to all crypto-asset transfers?

The FATF Travel Rule applies to crypto-asset transfers above applicable thresholds the specific threshold varies by implementation in each EU member state, but the general obligation is to collect and transmit originator and beneficiary information for transfers above these thresholds.

Blockmaze as Network-Level Compliance Infrastructure

The six domains this checklist covers — scope determination, white paper, entity authorisation, AML/CTF, market abuse, and ongoing reporting — describe compliance obligations that issuers must satisfy across the full life of every instrument they issue. The most frequently missed items the checklist identifies — the 20 working day notification period, the ESMA register publication requirement, the CASP authorisation timeline — are process failures that occur before launch. The harder and more persistent compliance challenge is post-launch: maintaining eligibility-checked allowlists, confirming reserve coverage, satisfying reporting cycles, and handling the governance decisions that arise across a multi-year instrument lifecycle. Blockmaze provides that compliance infrastructure at the network level. For issuers who have completed the authorisation process and need the operational infrastructure to sustain MiCA compliance for the full life of their instruments — not just obtain initial authorisation — the allowlist architecture, Proof of Reserve attestation, and DAO governance are built precisely for that purpose.

Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Readers should conduct their own research and consult with qualified professionals before making any investment or business decisions.