MiCA for CASPs: Governance and Ongoing Obligations

Authorisation under the Markets in Crypto-Assets Regulation is a beginning. From the day the licence is granted, a crypto-asset service provider has to run itself the way its application said it would, every day, and show it. This orientation explains what that means and how the course is built around it.

• The shift From getting authorised to staying authorised.
• Seven disciplines The map used in every unit of the course.
• The rulebook Five layers of rules and who writes each one.
• The course Units, case studies, videos and assessment.

About 20 minutes of study time

Every operating condition in MiCA is delivered by people working inside a structure that someone designed and someone oversees. This module explains the governance requirements for crypto-asset service providers: the management body, the people who own the firm, the policies and staff, internal control and records.

• The board Good repute, knowledge, skills, experience and time.
• The owners Qualifying shareholders of sufficiently good repute.
• The system Policies, staff, internal control and continuity.
• The record Records, and notifying changes before they take effect.

About 32 minutes of study time

A crypto-asset service provider holds client assets and makes promises about them. Prudential safeguards are the buffer that stands behind those promises, and the wind-down plan is how the firm keeps them even if it has to close. This module explains how both work.

• The test The higher of the class minimum and a quarter of fixed overheads.
• The forms Own funds, insurance or a combination.
• The monitoring At all times, not once a year.
• The exit An orderly wind-down without undue harm to clients.

About 32 minutes of study time

Custody is where the promises of a crypto-asset service provider become physical. Client holdings sit in wallets controlled by keys, and whoever controls the keys controls the assets. This module explains the MiCA rules for safekeeping client crypto-assets and funds and for the custody service.

• Safekeeping Client ownership protected, no use for the firm’s own account.
• Client funds Placed with a bank or central bank by the end of the next business day.
• The custody service Agreement, policy, register, statements and return.
• Liability Losses from incidents attributable to the firm.

About 32 minutes of study time

The conduct rules in MiCA translate one sentence into daily practice: act honestly, fairly and professionally in the best interests of clients. This module follows the client journey from the first marketing message to the last complaint, with conflicts of interest running underneath it.

• The duty Honestly, fairly, professionally, in the client’s best interests.
• Conflicts Identify, prevent, manage, disclose and review.
• Complaints Free of charge, prompt, fair and consistent.
• Execution and advice Best result, no paid routing, suitable advice.

About 32 minutes of study time

Every crypto-asset service provider depends on others: cloud providers, wallet software, onboarding checks, support desks, data feeds. MiCA and the Digital Operational Resilience Act allow that dependence, on one condition: responsibility never leaves the firm. This module explains how to keep it there.

• Outsourcing Seven conditions, a policy, an agreement and an exit.
• Records A common standard for orders and transactions.
• Continuity Keep running, or recover quickly.
• DORA ICT risk, incidents, testing and third parties.

About 32 minutes of study time

An authorised crypto-asset service provider is watched through three windows: the returns and notifications it sends to its supervisor, the disclosures on its website, and the information it gives clients. This module explains what goes through each window, when and who is responsible.

• The authority Returns, notifications and incident reports.
• The public Website disclosures required by MiCA.
• The passport Notifying services in other Member States.
• Scale The significant-CASP threshold.

About 32 minutes of study time

No firm stays the same as the one described in its authorisation file. Owners change, directors change, products and systems change. MiCA does not prevent change; it requires the firm to manage it, to tell the supervisor when it must, and to be able to show that the firm still meets its conditions afterwards.

• The gate Four questions before any change goes live.
• Owners Qualifying holdings: thresholds and timetable.
• The supervisor Engaging openly and on time.
• Enforcement Powers, penalties, publication and withdrawal.

About 32 minutes of study time

An illustrative Cyprus custodian loses client crypto-assets through a compromised signing interface supplied by a technology company it relies on. This case study follows the firm through the first 48 hours and applies Modules 1 to 3, together with the digital resilience rules taught in Module 5.

• Contain Stop the loss and protect what remains.
• Assess Liability, capital and client positions.
• Report The authority, the clients and the board.
• Learn What the custody policy should have said.

About 38 minutes of study time

An illustrative Greek exchange learns that the identity documents of its clients were reviewed, and then exposed, by a company it had never heard of. This case study applies Modules 1 to 5: outsourcing, DORA, conduct, records and governance, with data protection and anti-money laundering rules alongside.

• Map Find the real supply chain.
• Classify Which regimes and which reports?
• Decide Remediate or exit.
• Repair Clients, records and the register.

About 38 minutes of study time

An illustrative Cyprus crypto-asset service provider with a large Greek client base faces four changes in one quarter. Each is manageable on its own. Together, they test whether the firm can plan change, sequence it and explain it to its supervisors. This case study draws on all seven modules.

• Separate Four streams, four sets of rules.
• Sequence What must happen first.
• Integrate One plan, one board decision.
• Engage One message to two supervisors.

About 38 minutes of study time

About 30 minutes of study time