A new era of cryptocurrency regulation in the EU

MiCA implementation timeline (2023–2024). The MiCA regulation was formally approved in May 2023, and its requirements are being phased in over two stages: 

• since June 30, 2024, rules for stablecoins have been in effect 
• from December 30, 2024, all other provisions apply, particularly the regulation of crypto-asset service providers 

In practice, this means that from the beginning of 2025, uniform rules apply to the crypto industry across the entire EU, and national regulators (in the Czech Republic, the Czech National Bank) assume supervision over compliance. 

Who is subject to MiCA? 

All entities that issue crypto-assets or provide services associated with crypto-assets in the EU – i.e., crypto exchanges, exchange offices, wallet providers (custody), trading platforms, crypto advisors, as well as issuers of new cryptocurrencies or tokens.

Exceptions include assets already regulated by other regulations (e.g., security tokens falling under securities laws) and unique NFTs, provided they are not actually serially tradable tokens. However, the vast majority of common cryptocurrencies (Bitcoin, Ethereum, etc.) and related services will now fall under MiCA. 

Below, we look at the main new obligations that MiCA introduces and the consequences of non-compliance.

Main obligations under MiCA

If you do business in crypto, a number of new regulatory obligations await you from 2025. MiCA introduces requirements similar to those known from the regulation of traditional financial markets (e.g., MiFID, MAR, PSD). Here is an overview of the key areas you need to prepare for:

Licensing of Crypto-Asset Service Providers (CASPs)

From December 30, 2024 (with a transitional period until July 1, 2026, at the latest), only entities with a CASP (Crypto-Asset Service Provider) authorization may operate a crypto exchange, brokerage services, cryptocurrency custody, and other crypto-asset services in the EU. 

This is a fundamental change – while many crypto firms have previously operated solely on the basis of a trade license, they will now have to obtain authorization from the regulator (in the Czech Republic, from the Czech National Bank). The CASP license will be uniform across the EU (the European passporting principle), meaning that with a single authorization, services can be legally offered in all member states. 

However, the conditions for obtaining a license will be strict: the applicant must have sufficient capital, trustworthy and qualified management, established processes for protecting client assets, measures against cyberattacks, etc. 

Firms currently operating only under trade licenses (typically small exchange offices) thus face a transition to a fully regulated regime – this will require significant investments in compliance and potentially changes to their business structure. 

It is expected that failure to meet the conditions will squeeze smaller players out of the market, leading to industry consolidation. Existing firms have the option to utilize the transitional period (until mid-2026) – if they qualify, they can temporarily continue their activities, but they must apply for a license in time, otherwise they will be forced to cease operations.

Whitepaper when issuing tokens

MiCA introduces an obligation for anyone publicly offering a crypto-asset (except stablecoins) or applying for its admission to trading on an exchange to publish an information document – a “crypto-asset whitepaper”. 

This document must contain clear information about the project, rights associated with the token, technology, risks, etc. – similar to a securities prospectus in an IPO. The whitepaper only needs to be notified to the regulator, not approved in advance, but the issuer is responsible for its accuracy and completeness. 

There are certain exemptions from this obligation – e.g., if the token offer is addressed to fewer than 150 persons in each member state, or the total volume does not exceed EUR 1 million over 12 months, a whitepaper is not required. 

Please note: even in such cases, obligations to investors still apply (e.g., providing basic information and adhering to fair communication rules). The whitepaper is a fundamental tool for protecting investors from fraudulent or unsustainable projects, and its absence or deficiencies can lead to a ban on the token offering.

Stricter regime for stablecoins (ART and EMT)

A special category consists of so-called stablecoins, i.e., tokens pegged to the value of another asset. MiCA divides them into asset-referenced tokens (ART) – for example, stablecoins backed by a basket of fiat currencies or commodities – and electronic money tokens (EMT) – stablecoins pegged 1:1 to a single fiat currency (functionally similar to electronic money). 

An exceptionally strict regime applies to these instruments, as their potential instability would threaten the wider financial system. 

The issuer of a stablecoin will have to obtain prior authorization, meet capital requirements, and be subject to ongoing supervision by regulators. For example, EMT issuers will need to be a bank or an electronic money institution (i.e., licensed under e-money regulations), while ART issuers will obtain a special authorization under MiCA. 

Stablecoins must be fully backed by reserve assets, the issuer must ensure the right of holders to redeem the tokens at any time, and must regularly publish stability reports. For so-called significant stablecoins (e.g., more than 10 million holders or a value exceeding EUR 5 billion; at least three of the criteria in Article 43 of MiCA must be met), supervision will be assumed by the European Banking Authority (EBA), and special supervisory fees will apply. 

No non-compliant stablecoin may be offered in the EU from mid-2024 – which is why, for example, some foreign issuers are withdrawing their stablecoins from the European market until they obtain the necessary authorizations.

Customer protection and market integrity

Crypto-Asset Service Providers (CASPs) must act honestly, fairly, and in the best interests of their clients. For example, MiCA imposes an obligation to segregate client crypto-assets from their own (custody services must not mix client funds with their own) and to establish rules for handling customer complaints. 

Firms will have to transparently disclose fees and warn of the risks associated with their products so that customers have a clear idea of what they are getting into. 

In terms of market integrity, MiCA introduces a regime similar to that known from the traditional capital market: a ban on market manipulation and insider trading involving cryptocurrencies. 

Practices such as artificially influencing token prices, spreading false news to move exchange rates, insider trading, etc., will therefore be prohibited – violations will be treated with similar severity as in stock trading.

AML/CFT and risk management

Crypto firms subject to MiCA will have to comply with anti-money laundering and countering the financing of terrorism (AML/CFT) requirements to the same extent as banks. This means an obligation to perform customer identification and due diligence (KYC), monitor transactions, report suspicious transactions to the Financial Analytical Office, etc. In addition, MiCA emphasizes cybersecurity and operational resilience – firms must implement measures to protect systems and data, disaster recovery plans, etc. 

Custody providers, for example, will need to have securely protected wallets and backup mechanisms in case of technical issues. This requirement goes hand in hand with another new regulation, DORA, on digital operational resilience, which also applies to the fintech sector. 

Overall, MiCA forces crypto firms to establish a robust risk management system – spanning financial, operational, and legal risks.

Consequences of non-compliance under MiCA

The introduction of MiCA will significantly raise the regulatory bar for the crypto business. Firms that do not adapt to the new rules will not be able to legally continue – operating crypto services without a license will now be illegal and heavily penalized. Supervisory authorities (in the Czech Republic, the CNB) gain broad powers under MiCA to enforce order in the market. 

What specific sanctions are risked in the event of a violation of the regulation?

High financial fines

For legal entities, a fine of up to CZK 118,475,000 or 5% of annual turnover can be imposed (Section 22(3) of Act No. 31/2025 Coll.; MiCA in Article 111(3) requires a cap of at least EUR 5,000,000 or 5%). These amounts are comparable to the strictest sanctions under GDPR and signal that the EU intends to demand strict compliance with the rules. 

For example, continuing to operate an unregulated exchange in 2025 could lead to a fine in the hundreds of millions of Czech korunas. However, even less serious violations can be heavily penalized – MiCA requires a cap of at least EUR 700,000 for natural persons; in the Czech Republic, up to CZK 16,587,000, e.g., for providing services without authorization (Section 20(1)(c) and (2) of Act No. 31/2025 Coll.). 

For a smaller startup, a fine of tens of thousands of EUR could already pose an existential threat, let alone millions. 

In addition, sanctions can accumulate – a firm that violates multiple obligations (e.g., lacks a license and simultaneously fails to comply with AML) can receive several fines concurrently.

Loss of license and ban on activity

In addition to fines, there is a risk that the regulator will suspend or completely revoke a firm's license if it grossly or repeatedly violates its obligations. Operating crypto services without a valid license after 2025 will not be possible at all – such activity will be considered unauthorized and can be immediately halted. Revocation of the license would mean the virtual end of business in the industry for a crypto startup, as it is impossible to legally serve clients without a license. The license is therefore a matter of survival for a crypto firm. 

Regulators can also issue a ban on activity for a specific person – managers responsible for the violation can be banned from operating in the industry (e.g., a ban on serving as a member of CASP management for up to several years). The threat of career loss will certainly lead company management to be cautious.

Criminal liability

While a violation of MiCA itself falls under administrative law (fines, regulatory measures), some related actions may constitute a criminal offense. 

Money laundering through crypto or organizing a fraudulent ICO can lead to criminal prosecution of the responsible individuals. Managers who deliberately ignore warning signs and allow proceeds of crime to flow through their platform can be charged with money laundering. 

Similarly, if a failure to comply with obligations (e.g., neglecting security or segregation of funds) leads to damage to clients – data leaks, loss of funds – lawsuits from damaged customers are a risk. Personal freedom and the assets of management may therefore also be at stake.

Reputational risk and loss of clients

The fintech and crypto sector is built on customer trust. If it comes to light that a firm does not respect regulatory rules, or has underestimated security or client rights, it can cause irreparable damage to its reputation. For example, a leak of client data due to neglected security, or the exposure of market manipulation, will lead to an outflow of users to competitors. 

Particularly for young crypto companies, such a loss of trust could be devastating – regaining trust is extremely difficult. 

Reputational loss can be compared to a domino effect: it can deter investors, business partners, and talented employees. Therefore, compliance with MiCA is not only a legal obligation but also a matter of business strategy and long-term prosperity of the firm.

In short, ignoring MiCA does not pay off. Sanctions can reach devastating proportions, and regulators are gaining new tools to enforce the law. Financial penalties, revocation of licenses, criminal prosecution, and loss of reputation – these are all real threats. 

On the other hand, firms that adapt in time will gain a competitive advantage and the opportunity to grow legally across the entire European market. So how should you prepare for the new regulation, and where might problems arise?

Where problems can arise and how to solve them (practical examples)

Implementing MiCA in practice will bring many challenges. Below, we present specific scenarios where crypto firms risk stumbling and how to overcome these pitfalls. For each problem, we offer a recommended solution – including the opportunity to utilize the professional assistance of the Prague-based legal team at ARROWS, who already have experience with similar situations.

Example 1 – Unlicensed crypto exchange after 2025: 

Imagine a smaller crypto exchange that ignored the obligation to apply for a CASP license and continues to operate cryptocurrency trading illegally after January 1, 2025. 

Risk: The regulator (CNB) will shine a light on it very quickly. This could be followed by an immediate ban on activity and a fine in the millions of euros, not to mention reputational damage if it were publicly announced that the firm violated the law. For its clients, this means frozen accounts and forced termination of trading. 

Solution: Such a situation can only be prevented in one way – by applying for a CASP license in time. The firm should prepare all documents for the application by 2024 at the latest and submit it to the CNB. The licensing process includes proving capital, a business plan, setting up internal controls, etc. 

Utilizing legal experts (e.g., the Czech legal team at ARROWS) can significantly facilitate communication with the regulator and ensure that the application is complete and correctly submitted. Existing exchanges that already have a temporary registration (as a VASP) should take advantage of the simplified regime and not wait until the last minute. 

The key is not to delay – obtaining a license is a demanding process, and the sooner you start, the better.

Illustration: Crypto trading platform. Failure to comply with MiCA licensing obligations (e.g., operating an exchange without a CASP license) will lead to regulatory intervention and the threat of high sanctions. 

Lesson: Unauthorized crypto business after MiCA takes effect will not be tolerated. Once MiCA is in force, you must either have a license or cease operations. 

Our advice: Conduct an internal audit of your business – which of your services fall under the definition of a CASP? If almost any, take steps toward licensing immediately. ARROWS can help you navigate this process smoothly – from analyzing the impact of the regulation on your model to drafting the application and representing you before the CNB.

Example 2 – Issuing tokens without a whitepaper:

A startup plans to issue its own cryptocurrency (token) and sell it to the public to finance a project, but does not prepare a whitepaper under MiCA. It either underestimates the obligation or believes it does not apply to them. 

Risk: If it offers tokens to investors in the EU without an approved information document, it is making an unauthorized offer of an investment instrument. The regulator can ban the distribution of the token, impose a fine, and order compensation for investors. In addition, the firm will lose credibility – investors may feel deceived and abandon the project. 

Solution: Before starting the token offering, it is necessary to conduct a legal analysis to determine whether it is a crypto-asset falling under MiCA and whether a whitepaper obligation arises. If so, prepare a whitepaper with all the requirements under MiCA (project description, team, rights, tokenomics, risks...). Then notify the document to the relevant authority (in the Czech Republic, the CNB) before starting the sale. 

Do not underestimate the quality – the whitepaper is the project's calling card and at the same time a legal guarantee for investors. It is worth having it reviewed by experts who will ensure that it meets all requirements and that nothing essential is missing. If you want to avoid red tape, consider whether you meet any of the exemptions (e.g., a limited circle of investors up to 150 people, etc.) – but apply these only after consulting with a lawyer, as the conditions are strict. 

ARROWS attorneys have already helped prepare whitepapers for clients and can provide you with a template as well as valuable practical advice.

Example 3 – Insufficient protection of customer assets: 

A crypto exchange offers cryptocurrency custody to customers but is unclear about the segregation of client funds. It holds client cryptocurrencies in a few shared wallets along with the firm's own funds. Additionally, it may not have established a formal complaint handling process. 

Risk: Such a practice is unacceptable under MiCA, and in the event of an audit, the firm would fail to meet the obligation of segregated asset custody. Furthermore, if a hack and cryptocurrency leak occurred, clients would likely lose everything, which would mean not only regulatory penalties but also legal liability for damages. 

Solution: Adjust internal processes to fully comply with MiCA requirements for customer protection. This includes: having clearly segregated wallets (accounts) for client assets, separate from corporate operational funds; regularly reporting the status of held assets; establishing guidelines for handling client complaints and claims; transparently disclosing all fees and risks. 

The firm should also develop an incident response plan – what it will do if crypto is stolen or a service outage occurs, to minimize the impact on clients. Many of these measures require detailed knowledge of the regulation, so we recommend conducting a compliance audit with the help of experienced experts. 

For example, ARROWS offers an analysis of the regulation's impact on your business, identification of gaps, and assistance with setting up the necessary guidelines. As a result, you will not only comply with the letter of the law but also increase customer trust that their funds are safe with you.

Example 4 – Stablecoin without sufficient backing: 

A firm wants to issue its own stablecoin pegged to the euro but does not meet capital requirements and lacks a clear reserve mechanism. Nevertheless, it starts offering the stablecoin on the market. 

Risk: Under MiCA, such an issuer is violating the law – to issue an electronic money token (a fiat-pegged stablecoin), they must have an electronic money institution license and hold 100% backing in reserves. Otherwise, the regulatory authority will order them to cease activities. If the stablecoin suddenly loses its peg to the euro (so-called depeg), it will threaten token holders and trigger panic – the firm faces both supervisory sanctions and investor lawsuits. 

Solution: Do not venture into stablecoins without thorough preparation. It is necessary to obtain the appropriate authorization – either become a licensed electronic money institution (for fiat-pegged tokens) or meet the conditions for an asset-referenced token. This involves having sufficient capital, ensuring segregated and secure reserves, and setting rules for maintaining value and withdrawals. For more significant stablecoins, supervision by the EBA and mandatory fees must be expected. 

For a firm that lacks the capacity, we recommend not venturing into their own stablecoin, or collaborating with a partner who holds a license. Alternatively, they might consider issuing a classic token (utility token) instead of a stablecoin. Here too, prior legal consultation is essential. 

Experts from ARROWS can assess your stablecoin business plan and suggest how to bring it into compliance with MiCA, or what changes to make so that the project meets regulatory requirements (e.g., adjusting the model, securing an investor for capital).

*Summary of examples: Every crypto firm is unique, but the situations described above show typical problematic areas: licensing, information obligations, internal processes, and special regimes (stablecoins). 

The key to successfully managing MiCA is proactivity – identifying weak spots now and strengthening them in time. If you are unsure where to start, seek advice from experts. 

As the old saying goes: “Fortune favors the prepared.” In the context of MiCA, we would add: the prepared will survive and grow, the unprepared may disappear from the market.

The team at ARROWS law firm

How the ARROWS law firm can help you

Navigating such extensive regulatory changes and correctly implementing them in practice can be challenging for crypto firms. The Prague-based ARROWS law firm offers comprehensive support and partnership in this area. Our Czech legal team specializes in financial law and fintech and closely monitors current developments in European legislation, including MiCA. Thanks to our rich experience in implementing regulatory requirements for financial institutions, we know what to focus on and where the greatest risks lie for firms. 

How specifically can we help you?

Analysis of MiCA's impact on your business: 

We will conduct a detailed audit of your services and processes from the perspective of the new regulation. We will identify which specific MiCA obligations apply to your company and whether you meet all requirements. We will point out any compliance gaps and suggest what needs to be adjusted. You will thus obtain a clear plan of what you must do to comply with MiCA.

Turnkey implementation: We will help you create or modify all necessary internal guidelines, procedures, and contractual documentation to meet the new requirements. For example, we will prepare new terms and conditions and information materials for clients (under MiCA), guidelines for the segregation and protection of client assets, market abuse prevention rules, updates to internal AML regulations, etc. 

We will set everything up in compliance with Czech law and European standards to ensure you are fully protected.

Training and workshops: 

We will provide practical training for your employees and management focused on the new obligations. We will teach your team to recognize risky situations (e.g., cyber incidents, suspicious transactions) and react correctly in accordance with legal requirements. This minimizes the risk of human error that could lead to regulatory violations and sanctions.

Support during the licensing process: 

If you need to obtain a new license (typically a CASP license for crypto services), we will guide you through the entire process with the CNB. We will prepare the application, all necessary attachments, and communicate with the regulator to ensure the process runs smoothly. Likewise, we can assist with notification obligations – e.g., preparing and submitting a whitepaper notification under MiCA. We also have experience with other licenses (payment institutions, e-money), so we know what the CNB expects.

Ongoing advisory and compliance monitoring: 

Regulatory compliance is not a one-off event. We offer long-term cooperation in the form of external oversight of your compliance with obligations. We will monitor further changes in the law for you, warn you of new obligations in time, and consult on specific situations (e.g., introducing a new technology or product). 

We will help you identify a potential problem before it can escalate into sanction proceedings. We will become a partner you can rely on for legal and regulatory matters, while you focus on growing your business.

Incident and dispute resolution: 

If an unpleasant event already occurs – e.g., a cyber incident, a regulatory audit, or even the initiation of administrative proceedings – we will represent your interests. We will assist with mandatory communication (reporting the incident, explaining supervisory findings, preparing corrective measures) and defend your company to minimize the impact. Having an experienced legal team by your side can significantly influence the outcome of any dispute or proceeding.

Conclusion 

The MiCA regulation will shake the world of cryptocurrencies, but at the same time, it will move it closer to the mainstream. For crypto firms, it represents a challenge – they must invest time and resources to achieve compliance with the new rules. However, the risks of inaction are too great, as described above. On the contrary, those who prepare in time can leverage the regulation into a competitive advantage: they will gain client trust, a head start over latecomers, and the entire European market with uniform rules will open up to them. 

Leave nothing to chance. Start preparing for MiCA now – map the impacts on your business, consult on disputed issues, adjust processes, and apply for the licenses you need. 

The ARROWS law firm is ready to extend a helping hand on this path to responsible growth. Reach out to us and contact our team – together, we will ensure that your business is fully compliant with MiCA in 2025 and ready to seize all the opportunities that the new era of cryptocurrency regulation will bring. 

Contact us today, we will help you successfully prepare for MiCA!