Things Crypto Firms Miss About MiCA After Authorisation
- 6 days ago
- 9 min read
MiCA authorisation is a major milestone, but it is not the end of regulatory work.
For crypto-asset service providers, authorisation is the point where the work changes. The focus moves from entering the regime to staying aligned with the rules, interpretations, technical standards and supervisory expectations that develop after authorisation.
That is where some firms become exposed.
The authorisation project can easily be treated as the main event. Policies are drafted, governance documents are produced, applications are submitted, questions are answered, and the firm reaches the approval point. Then the internal urgency drops.
That is a mistake.
MiCA post-authorisation compliance is not static. A CASP still needs to monitor Q&As, RTS, ITS, guidelines, national competent authority updates, material register-related developments, enforcement signals, supervisory communications and practical interpretation. Some updates may create direct obligations. Others may clarify how an existing requirement is expected to work in practice.
The firms that handle MiCA well after authorisation will not be the ones that simply received approval. They will be the ones that keep their internal controls, governance and operating model aligned as the regime develops.
1. Authorisation is not the finish line
Many firms naturally focus on the authorisation process. That is understandable. It is a visible, resource-heavy project with a clear target.
But authorisation does not freeze the firm’s obligations, operating model or supervisory risk. Once a CASP is authorised, the questions evolve. The firm still needs to check whether its current operating model matches the assumptions made during authorisation, whether later Q&As, RTS, ITS or guidelines affect interpretation, whether the national competent authority has published relevant local material, and whether products, tokens, customers, custody arrangements, outsourcing structures or marketing activities have changed.
The board and senior management also need to keep receiving the right regulatory information. If regulatory updates stop reaching senior decision-makers after authorisation, the firm may have a governance weakness even if the original application was strong.
That is the shift many firms underestimate. MiCA authorisation may confirm entry into the regime, but ongoing CASP compliance requires continued review.
For more on the wider post-authorisation shift, see CASP Regulatory Updates Under MiCA: What Changes After Authorisation?.
2. The material around MiCA keeps developing
One common mistake is treating MiCA as if it were only the Level 1 regulation.
The regulation is the foundation, but the practical detail often sits elsewhere. CASPs may need to track:
RTS and ITS
ESMA and EBA Q&As
Guidelines
National competent authority updates
Consultations and final reports
Material register-related developments
Supervisory statements
Enforcement and warning material
Related AML, financial promotions, custody or operational resilience developments
The problem is not just volume. The problem is classification.
A consultation is not a final rule. A Q&A does not carry the same weight as a technical standard. A guideline may not bind like legislation, but it can still signal supervisory expectations. A national regulator update may matter directly to one firm and barely matter to another.
The firms that miss this distinction either overreact to everything or underreact to material signals. Neither is good.
For more detail on Q&As, RTS and ITS, see MiCA Regulatory Monitoring: Q&As, RTS and ITS CASPs Should Track After Authorisation.
MiCA post-authorisation monitoring should cover technical standards, Q&As, national updates, governance drift and evidence of review, not just the original authorisation file.
3. Governance can drift after approval
Governance often looks strongest during the authorisation process. Roles are documented, committees are described, senior management responsibilities are mapped, policies are reviewed and evidence is prepared.
After authorisation, governance can drift.
That drift may show up in small ways. Committee packs become thinner. Regulatory updates are not escalated consistently. Ownership of MiCA developments becomes unclear. Board reporting becomes generic. Product changes are not mapped back to regulatory obligations. Outsourcing changes are not reviewed through a MiCA lens. Senior management no longer sees the same level of regulatory detail.
This is rarely dramatic at first. It is usually gradual.
The practical question for a CASP is whether governance still works once the authorisation project team has moved on. A post-authorisation review should ask who owns MiCA regulatory monitoring internally, which updates go to compliance, legal, risk, product, finance or senior management, how material updates are recorded, how the firm evidences no-action decisions, and how board or committee packs are updated when MiCA developments matter.
Authorisation is not enough if the governance process cannot absorb later regulatory change.
4. Technical standards and Q&As can change practical interpretation
RTS, ITS and Q&As can look less visible than headline regulation, but they can be operationally significant.
Technical standards may affect how firms handle reporting, authorisation information, complaints, conflicts, custody, prudential matters, market abuse controls, white papers, notifications or other operational requirements.
The mistake is assuming technical material is only for lawyers or consultants. In practice, technical standards can affect systems, data fields, templates, control design, reporting calendars, client processes and internal ownership.
A final RTS or ITS may require a gap analysis, policy update, process review, system change or internal training. A consultation should not be treated as a final obligation, but it may indicate where the direction of travel is heading and whether the firm should prepare for possible future change.
Q&As are also easy to underestimate. They may be short, narrow and practical, which can make them look less important than a new regulation or technical standard. But for a firm dealing with a specific business model, a narrow Q&A can be highly relevant.
A Q&A may affect service classification, token treatment, passporting, notifications, white paper analysis, group structure or interactions with other EU financial services frameworks. Those issues are highly contextual to the firm’s business model.
Most Q&As will not be high priority for every firm. That is the point. Materiality is contextual.
A Q&A that is irrelevant to one CASP may be material to another because of its product, client base, token model, custody arrangement, group structure or cross-border activity.
A passive process says: “ESMA published a Q&A.”
An active process asks: “How does this specific Q&A affect our current service classification, passporting analysis, token treatment or operating model?”
That is the difference between noticing an update and using it.
5. National competent authority updates still matter
MiCA is an EU regime, but national competent authorities still matter.
This is especially true during the transition from national VASP regimes into the CASP framework, but it does not stop there. National regulators may publish local application material, supervisory communications, register updates, deadline reminders, guidance, Q&A-style material, enforcement notices or practical instructions.
For a firm supervised in a particular member state, national material may be directly relevant.
The mistake is assuming that only EU-level publications matter because MiCA is an EU regulation. A CASP should monitor both central EU-level material and relevant national sources. The national competent authority may be the firm’s day-to-day supervisory touchpoint. Its local communications can shape authorisation, supervision, transition management and practical expectations.
For more on transition issues, see MiCA Transition Period 2026: What Crypto Firms Need to Watch Before the Deadline.
6. The firm changes after authorisation
MiCA monitoring is not only about whether the law changes. It is also about whether the firm changes.
A CASP may launch new products, add tokens, change custody arrangements, update wallet infrastructure, introduce new group entities, alter outsourcing arrangements, change marketing channels, amend customer journeys or onboard new types of client.
Those changes can make the original MiCA analysis stale.
This is often missed because firms separate “regulatory change” from “business change”. In practice, the two interact. A firm should consider whether internal review is needed when there are changes to product design, token listings, custody or safeguarding arrangements, outsourcing, marketing, complaints handling, group structure, affiliate relationships, technology infrastructure, client types or conflicts of interest.
The question is not only: “Has MiCA changed?”
It is also: “Has the firm changed in a way that makes the existing MiCA analysis stale?”
That question is often more practical than a broad legal update.
7. Custody, safeguarding and outsourcing remain live issues
Custody, safeguarding and outsourcing are not static authorisation documents. They are live operational risk areas.
During authorisation, firms may describe custody arrangements, wallet controls, private key governance, segregation, reconciliation, incident response, access controls, third-party dependencies and outsourced functions. After approval, commercial reality moves on.
Vendors change. Wallet infrastructure changes. Cloud providers change. Group services evolve. Operational dependencies deepen. New third-party tools are adopted. Some arrangements become more important than they were at the point of authorisation.
A regulatory update affecting custody, safeguarding, client asset treatment, operational resilience, ICT risk, vendor governance or incident response should not sit only with compliance. It may need legal, operations, technology, risk and senior management review.
The practical test is simple: does the update affect how client assets are held, controlled, recorded, protected, disclosed or returned?
If yes, it should be reviewed carefully.
8. Complaints and client communications can become supervisory issues
Complaints handling can look like a back-office issue, but it can become a real supervisory signal.
CASPs should be alert to updates affecting complaint handling, client communications, disclosures, risk warnings, marketing controls, client categorisation, product explanations or terms of service.
The risk is often practical. The firm launches a new product feature. Marketing language evolves. Customer journeys change. Disclosures are updated informally. A website or app flow is modified. Client service teams respond to recurring customer questions in a way that is not aligned with compliance expectations.
After authorisation, firms should ensure that regulatory updates flow into the teams responsible for client-facing material. That includes marketing, product, client service, compliance and legal.
MiCA post-authorisation compliance is not just a policy file problem. It is also a communication problem.
9. AML and financial crime should not sit in a separate silo
MiCA compliance and financial crime compliance should not be treated as entirely separate worlds.
Crypto firms may need to monitor AML, sanctions, Travel Rule, fraud, suspicious activity, onboarding, transaction monitoring, wallet screening and counterparty VASP developments alongside MiCA material.
Some financial crime updates may not mention MiCA at all, but still affect CASPs operationally. For example, an AML or sanctions update may affect customer due diligence, enhanced due diligence, wallet screening, transaction monitoring, counterparty VASP checks, unhosted wallet controls, suspicious activity reporting, Travel Rule processes, onboarding risk assessment or senior management reporting.
A CASP that treats MiCA monitoring and AML monitoring as separate silos may miss the combined operational impact.
For more on this, see Crypto AML Updates: What Financial Crime Developments Firms Should Treat as Material.
10. Evidence of review matters
A firm may have reviewed an update properly, but if there is no record, the process is weaker.
Post-authorisation compliance should leave evidence. That does not mean every update needs a long memo, but material updates should be traceable.
A useful record may include:
Official source
Date reviewed
Type of update
Affected business area
Materiality assessment
Internal owner
Decision made
Action required
Deadline or review date
Reason for exclusion, where relevant
Evidence of completion
This matters because regulatory monitoring is not only about awareness. It is also about demonstrating process discipline.
A “no action required” decision can be legitimate. But where the item is potentially material, that decision should usually be recorded.
For more on briefing workflow, see How to Action a Crypto Regulatory Briefing: A Step-by-Step Guide for Compliance Teams.
Common post-authorisation mistakes
Several mistakes appear regularly.
The first is treating authorisation as the end of the project. It is not. The firm still needs ongoing monitoring, governance and evidence.
The second is monitoring only the main MiCA regulation. That misses the practical material that often shapes implementation.
The third is failing to distinguish between final rules, consultations, Q&As, guidelines, national updates and supervisory signals.
The fourth is letting governance drift after approval.
The fifth is failing to connect updates to product, marketing, technology, finance, operations or senior management.
The sixth is keeping no record of excluded items.
The seventh is ignoring firm changes. Even if the rule has not changed, the firm may have changed enough to require a fresh review.
These mistakes do not always create immediate problems. They create weak points that build over time.
Final point
MiCA authorisation is not the end of regulatory work.
For CASPs, the real challenge after authorisation is keeping the firm aligned with the developing body of technical standards, Q&As, guidance, national competent authority updates, material register-related developments and supervisory signals.
The strongest firms will not simply ask whether they are authorised. They will ask whether their policies, controls, governance, product design, outsourcing, custody arrangements, marketing, complaints handling, AML processes and evidence records remain aligned with how the regime is developing.
That requires a disciplined, ongoing monitoring process, not a one-time project.
Crypto Regulation Desk monitors selected official regulatory sources across the UK/EU, Singapore and the Middle East, including MiCA-related Q&As, RTS, ITS, guidance, national updates, material register-related developments and supervisory signals where relevant to crypto firms.
We filter official source material for material crypto regulatory relevance and produce concise, source-linked briefings for compliance, legal, regulatory, licensing and risk teams.
To reduce the manual burden of post-authorisation monitoring without building the process from scratch, request a 14-day trial of Crypto Regulation Desk.
This article is for general information only and is not legal or regulatory advice.
