MiCA is the EU Markets in Crypto-Assets regulation, a harmonized licensing and conduct framework for crypto-asset firms across the EU. It brings crypto into a clear market-regulation regime, but it sits alongside AML rules rather than replacing them, and confusing the two is a common trap.
What is MiCA, in plain English?
MiCA is the European Union's market-regulation framework for crypto-assets. It creates a single, harmonized set of rules for crypto-asset service providers and token issuers across the EU, replacing the patchwork of national regimes that came before. In practice it governs authorization, conduct, disclosure, and consumer protection: who may offer crypto services, what they must tell customers, and how they must behave.
Crucially, MiCA is about market regulation, not anti-money-laundering. It is the layer that says a crypto firm is licensed and must operate to certain conduct standards. It does not, on its own, contain the customer-due-diligence, screening, and travel-rule obligations that fraud and AML teams live by. Those come from the separate EU AML framework.
So the mental model is two parallel tracks that both apply to the same firm. MiCA is the market-conduct passport; the EU AML rules are the financial-crime controls. A crypto operator in the EU has to satisfy both at once.
MiCA versus AML obligations
The single most useful thing to keep straight is what each regime does and does not cover:
What changes | MiCA | EU AML framework |
Purpose | License and conduct for crypto firms | Detect and prevent money laundering |
Core duties | Authorization, disclosure, consumer protection | CDD, screening, travel rule, reporting |
What it proves | The firm may operate in the EU | The firm controls financial-crime risk |
Common trap | Assuming it covers AML | Must be met in parallel, not instead |
Who is involved?
Who | Their role |
Crypto-asset service providers | Exchanges, custodians, and others that need MiCA authorization to operate in the EU. |
Token issuers | Issuers of asset-referenced and e-money tokens subject to MiCA disclosure and conduct rules. |
National regulators | Authorize and supervise firms under MiCA within their member state. |
AML supervisors | Enforce the separate EU AML obligations that apply to the same crypto firms. |
What it looks like in practice
In practice
A crypto exchange secures MiCA authorization and treats it as the finish line, assuming the license covers its compliance obligations. It launches across several EU markets on the strength of that passport.
An AML supervisor then reviews the firm and finds that customer due diligence is thin, sanctions screening on wallet counterparties is missing, and travel-rule data is not being collected on transfers. None of those are MiCA requirements, but all are required under the separate EU AML framework. The firm scrambles to build the financial-crime controls it should have had from day one, having learned the hard way that a MiCA license and an AML program are two different things.
Why MiCA matters to operators
For crypto operators, MiCA finally puts EU market regulation on a clear, harmonized footing, which is genuinely useful: one authorization regime instead of many, with defined conduct and disclosure duties. Understanding it as the market-regulation layer lets you plan authorization and product design across the EU with far more certainty than before.
The danger is treating MiCA as the whole compliance picture. It is not. Your AML and CFT obligations, including customer due diligence and the travel rule, come from the separate EU AML rules and must be satisfied in parallel. Teams that keep the two tracks distinct build both properly; teams that conflate them leave a financial-crime hole that supervisors will find.
What to watch
- Do not conflate the regimes. A MiCA license does not satisfy AML duties; build customer due diligence and screening separately.
- Travel rule. Crypto transfer information requirements come from the AML framework, not MiCA, and are easy to overlook.
- Authorization scope. Check which crypto services your license actually covers before offering new products.
- Stablecoin rules. MiCA imposes specific duties on asset-referenced and e-money tokens; issuers need to meet them precisely.
- Parallel supervision. Expect both a market regulator and an AML supervisor to look at your firm, each with its own questions.
Quick questions
Does MiCA cover anti-money-laundering?
No, and this is the most common misunderstanding. MiCA is a market-regulation and conduct framework. AML and CFT obligations for crypto firms come from the separate EU AML rules and must be met in parallel.
Who needs MiCA authorization?
Crypto-asset service providers such as exchanges and custodians operating in the EU, and issuers of certain tokens. The authorization acts as a passport to offer services across member states.
What does MiCA actually require?
Authorization to operate, plus conduct, disclosure, and consumer-protection duties, with additional rules for stablecoin-style tokens. It defines who may offer crypto services and how they must behave.
Where does the crypto travel rule come from then?
From the EU AML framework, not MiCA. Firms must collect and pass on required information about the parties to crypto transfers, and this obligation sits outside MiCA entirely.
Does a MiCA license mean I am compliant?
Only for market regulation. You still need a full AML program, sanctions screening, and travel-rule compliance. Treating MiCA authorization as complete compliance leaves a financial-crime gap.
How does MiCA interact with FATF standards?
MiCA is EU market regulation, while FATF sets the AML standards that the separate EU AML rules implement for crypto. The two work on different layers, so both shape a crypto firm's obligations.