MiCA licensing requirements: the application and the MiCA assessment

The statutory list: Article 62(2)

An application for authorisation as a crypto-asset service provider goes to the home member state's competent authority. It must contain every item in Article 62(2) of Regulation (EU) 2023/1114. There are 19, lettered (a) to (s), and the last seven depend on the services you intend to provide.

• Identity and constitution: legal and commercial names, legal entity identifier, website, contact email, telephone number, physical address, legal form and articles of association.
• A programme of operations setting out the services you intend to provide, including where and how they will be marketed.
• Proof of prudential safeguards meeting Article 67, and a description of governance arrangements.
• Proof of good repute and competence for the management body, and the identity, holdings and repute of every direct or indirect shareholder with a qualifying holding.
• Internal control mechanisms, the policies and procedures for identifying, assessing and managing risk including money laundering and terrorist financing risk, and the business continuity plan.
• ICT documentation: the technical documentation of systems and security arrangements plus a description in non-technical language.
• Client asset segregation procedure and the complaints-handling procedure.
• Service-specific documents: a custody and administration policy; trading platform operating rules and a market abuse detection system; a non-discriminatory commercial policy and pricing methodology for exchange; an execution policy; evidence of knowledge and expertise for advice or portfolio management; and a description of how transfer services will be provided.

What Article 62(3) actually asks you to prove

For the management body and every qualifying shareholder, direct or indirect, evidence the absence of a criminal record and of penalties under commercial, insolvency or financial services law. That extends to money laundering, counter-terrorist financing, fraud or professional liability.

Show too that the management body collectively has the knowledge, skills and experience to run the firm, and that its members can commit sufficient time. Article 63(11) required ESMA and the EBA to issue joint guidelines on assessing that suitability.

The technical standard that fills in the detail

Commission Delegated Regulation (EU) 2025/305 of 31 October 2024, published in the Official Journal on 31 March 2025, is the regulatory technical standard under Article 62(5). It specifies what each heading means in practice.

That includes a three-year programme of operations with financial forecasts, the organisational structure and reporting lines, the AML and CFT framework, ICT and cybersecurity documentation, and service-specific policies. For a document checklist that is not marketing content, that Regulation is the list.

The clock

1. 5 working days: the competent authority acknowledges receipt in writing (Article 63(1)).
2. 25 working days: it assesses whether the application is complete, and sets a deadline for anything missing. It may refuse to review an application that stays incomplete (Article 63(2) and 63(3)).
3. 40 working days from a complete application: it assesses compliance with Title V and adopts a fully reasoned decision, then notifies you within 5 working days (Article 63(9)).
4. Suspension: one request for further information, made no later than the 20th working day, suspends the clock for up to 20 working days. Later requests do not suspend it (Article 63(12)).

Those are statutory maximums for the authority's own steps, not a prediction of how long your project takes. The elapsed time is usually dominated by pre-application engagement and by how many times the file goes back for completion.