MiCA for software teams
How the EU's Markets in Crypto-Assets Regulation licenses crypto-asset service providers, what it asks of issuers and custody, and how the travel rule changes every transfer.
What MiCA is
Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA)
MiCA, Regulation (EU) 2023/1114, is the EU law for crypto-assets that are not already covered by financial services law. Its rules on stablecoins (asset-referenced tokens and e-money tokens) have applied since 30 June 2024, and the rest since 30 December 2024.
It covers three groups: people who offer crypto-assets to the public or seek admission to trading, issuers of stablecoins, and crypto-asset service providers (CASPs) such as exchanges, custodians, brokers and wallet providers that hold assets for clients. A CASP authorised in one member state can serve the whole EU.
MiCA works alongside Regulation (EU) 2023/1113, which applies the travel rule to crypto: every transfer between providers must carry information about the sender and the receiver.
Who it applies to
Crypto-asset service providers
Firms that provide custody, run a trading platform, exchange crypto for money or other crypto, execute or pass on orders, place assets, give advice, manage portfolios or transfer crypto for clients.
Issuers and offerors
Anyone offering crypto-assets to the public in the EU, or seeking their admission to trading, must publish a crypto-asset white paper. Stablecoin issuers need authorisation.
Regulated financial firms
Banks, investment firms, e-money institutions and some others can provide crypto-asset services by notifying their regulator instead of applying for a new licence.
Unique, non-fungible crypto-assets such as most NFTs, crypto-assets that are already financial instruments, and services provided in a fully decentralised way without an intermediary are outside MiCA. A project that is decentralised in name but run by an identifiable team may still be covered.
Key requirements, and what they mean for the build
Each row links the official text. Read the source for the exact wording before you rely on it.
Scope and crypto-asset services
MiCA lists the crypto-asset services that need authorisation, including custody, trading platforms, exchange, order execution, advice, portfolio management and transfer services.
Map each product feature to the service it may count as. Holding user keys or moving assets for users usually means custody or transfer services.
Crypto-asset white paper
Offers to the public and admissions to trading need a white paper with information on the offeror, the issuer, the project, the rights attached, the technology and the risks.
Keep the white paper's claims about the token and protocol consistent with what the code actually does, and version both together.
CASP authorisation
Crypto-asset services in the EU need authorisation as a CASP, or notification by an already regulated firm.
Expect the licence application to ask for your systems, security, outsourcing and business continuity. Build those documents from the real architecture.
Act in clients' best interests
CASPs act honestly, fairly and professionally, and give information that is fair, clear and not misleading, including in marketing.
Show fees, risks and order outcomes clearly in the interface, and keep marketing claims in a reviewed, versioned store.
Governance
Managers must be of good repute and have the right skills. CASPs ensure continuity of their services with resilient and secure ICT systems as DORA requires, and a business continuity policy.
Treat DORA's ICT risk, incident and testing duties as part of the MiCA build, not a separate project.
Safekeeping and custody
CASPs that hold client assets or keys protect clients' ownership, never use client assets for their own account, place client money with a bank or central bank by the end of the next business day, and agree a custody policy with each client.
A ledger that keeps each client's holdings separate from the firm's, reconciled against on-chain balances, with key management and approvals around every withdrawal.
Complaints and conflicts of interest
Free, prompt and fair complaint handling with a published procedure and a record of every complaint, plus policies to identify and disclose conflicts of interest.
A complaints queue with deadlines and outcomes logged, and disclosures shown where the conflict arises.
Market abuse detection
Anyone professionally arranging or executing crypto transactions has systems to prevent and detect market abuse, and reports suspicious orders and transactions without delay.
Surveillance rules on orders and trades, alerts for review, and a case record for each suspicious transaction report.
Travel rule for crypto transfers
The sender's provider sends name, address and account details for the sender and the receiver with every transfer, whatever the amount. For transfers over EUR 1,000 to a self-hosted address, it checks whether the address belongs to the sender.
Travel rule messaging with other providers, a way to prove ownership of self-hosted wallets, and holds on transfers missing required data.
Source: Regulation (EU) 2023/1113 (transfer of funds and crypto-assets), EUR-Lex
Engineering controls for MiCA
How the rules change the way the software is designed.
- 01
Client asset ledger
An internal double-entry ledger per client, reconciled with on-chain balances and bank accounts every day.
- 02
Key management
Keys in HSMs or MPC, with quorum approvals, withdrawal limits, allow-lists and cold storage for most assets.
- 03
Travel rule messaging
Sender and receiver data exchanged with counterparties before or with each transfer, and transfers held when data is missing.
- 04
Wallet screening
Addresses screened against sanctions and risk data, with self-hosted wallet ownership checks above the threshold.
- 05
Market surveillance
Rules that flag wash trading, spoofing and insider patterns, with cases a compliance analyst can work.
- 06
Clear disclosures
Fees, risks, order details and conflicts shown in the product at the point of decision.
- 07
Complaints handling
A tracked queue with deadlines, outcomes and reporting, so nothing sits in an inbox.
- 08
Operational resilience
DORA-grade incident management, testing, backups and provider controls for the whole platform.
Key dates
- 29 June 2023MiCA entered into force.
- 30 June 2024Rules for asset-referenced tokens and e-money tokens apply.
- 30 December 2024The rest of MiCA applies, including CASP rules. The crypto travel rule applies from the same day.
- 1 July 2026Latest end of the transitional period for CASPs that served clients under national law before 30 December 2024.
Member states could shorten or skip the transitional period for existing providers, so the real deadline depends on the country. ESMA's MiCA page lists technical standards and the interim register of authorised firms.
Checked against the official sources on 2026-10-25.
4 OceanLab product builds cite MiCA
Counted from our published case studies: a build counts when MiCA is in the list of rules it was built for.
Allmend - Tokenisation Platform for Funds, Property and Private Credit
Designed and built a clickable tokenisation platform for a Vaduz token issuer registered under the TVTG: permissioned tokens for fund units, real estate SPV shares and private credit notes, with every on-chain operation approved under a signing policy, every investor transfer checked before it settles, and the token ledger kept in step with the legal register.
Riegel - Institutional MPC Custody Platform with Quorum Approvals and Client Policies
Designed and built a clickable client console for a German crypto custodian's MPC custody platform: institutions see their vaults and holdings, follow every transaction from request to final confirmation, approve with a security key against a quorum per approver group, and test their own first-match withdrawal policy before it goes live.
Levada - Non-Custodial DEX Aggregator with Split Routing and an Ops Console
Designed and built a clickable non-custodial DEX aggregator for a Lisbon DeFi team: a swap app that splits trades across liquidity sources and shows every fee before the user signs, gasless limit orders, wallet history with approval revoking, transaction status, and an ops console that watches chain health, quote quality and failure clusters.
Kindlus - Smart Contract Admin Console with Reviewed, Simulated and Multi-Signed Changes
Designed and built a clickable smart contract admin console for a Tallinn infrastructure company that serves protocol teams and token issuers: a registry of deployed contracts across chains, a role map that flags single keys with admin power, and a queue where every upgrade, role change, parameter change or pause is reviewed, simulated and signed through a Safe and a timelock.
Check your product
Other frameworks and industries
Build with MiCA in mind from day one
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
MiCA questions
Does MiCA apply to a self-custody wallet app?
A wallet where only the user holds the keys and the company never controls the assets is usually not custody. If the app also exchanges, transfers or holds assets for users, those parts may be crypto-asset services that need authorisation.
Are NFTs covered by MiCA?
Unique, non-fungible crypto-assets are outside MiCA. Large series or fractions of an NFT can be treated as fungible, so the label alone does not decide it.
Is DeFi covered?
Services provided in a fully decentralised way without an intermediary are outside MiCA. Front ends, aggregators and admin teams that control parts of a protocol can still be in scope.
Does the travel rule have a minimum amount for crypto?
No. In the EU, information must travel with every crypto transfer between providers, whatever the amount. The EUR 1,000 figure applies to extra checks on transfers to self-hosted addresses.
How does OceanLab approach MiCA on a build?
We map features to crypto-asset services with your legal team, then build the client ledger, key controls, travel rule messaging and surveillance into the platform. The builds below list MiCA in the rules they were built for.
