Prudential Safeguards Under MiCA for Crypto-Asset Service Providers (CASPs)

This article looks at three practical questions every crypto-asset service provider faces: (1) how the permanent capital minimum depends on the class of services provided; (2) how the method for calculating the cost base evolved and was clarified by supervisors across the text of MiCA, Delegated Regulation (EU) 2025/305 and the positions of ESMA and the European Commission; and (3) the criteria for selecting stress tests for authorisation and ongoing capital planning.

1. From formally registered capital to a continuous prudential safeguard

With the full application of Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), the European market moved from a formal registration regime for anti-money laundering purposes to full prudential supervision. Under the previous framework, a company could provide crypto-asset exchange or custody services with nominal share capital, without the supervisor assessing whether its available own resources were sufficient to absorb an operational failure, a market shock or an orderly wind-down without losses for clients. Article 67 of MiCA fundamentally changes this logic by requiring a permanent financial buffer as a condition not merely for obtaining, but for maintaining the authorisation on a day-to-day basis.

An important terminological distinction is necessary from the outset. In everyday practice, reference is often made to “minimum share capital”, but the legislation deliberately uses the more precise concept of “prudential safeguards”. The reason is twofold. First, “share capital” under national company law refers only to the nominal registered capital recorded in the commercial register, whereas European supervision focuses on the actual net capital capacity to absorb losses. Second, Article 67(4) of MiCA allows the requirement to be met not only through own funds, but also through an insurance policy, a comparable guarantee, or a combination of the two.

The central rule in Article 67(1) of MiCA is concise but has far-reaching financial consequences: every crypto-asset service provider (CASP) must at all times maintain prudential safeguards equal to at least the higher of two amounts — the permanent minimum capital requirement set out in Annex IV according to the type of services provided, or one quarter (25%) of the fixed overheads of the preceding year, reviewed annually. Where a firm is newly established and does not yet have a full year of operating history, Article 67(2) requires the one-quarter amount to be calculated on the projected fixed overheads for the first 12 months included in the application for authorisation.

A key element of this architecture is the quality of the instruments used to cover the safeguard. Where the firm chooses to meet it with own funds under Article 67(4)(a), the Regulation refers directly to the elements of Common Equity Tier 1 (CET1) under Articles 26–30 of Regulation (EU) No 575/2013 (CRR) after the full deductions under Article 36 CRR, without applying the threshold exemptions under Articles 46 and 48. In practice, this means that capital invested in intangible assets (licences, goodwill, capitalised development costs) is, as a rule, deducted from regulatory CET1 capital and cannot cover the safeguard. The only relief for intangible assets that Article 36(1)(b) CRR itself allows is for prudently valued software assets: instead of a full deduction, they are subject to prudential amortisation over up to three years (Delegated Regulation (EU) 2020/2176).

Alternatively, or in addition, point (b) allows the use of an insurance policy (or comparable guarantee). It must cover the territories of the Union where the services are provided, be publicly disclosed on the firm’s website, have an initial term of at least one year and a notice period for cancellation of at least 90 days, be taken out from an undertaking authorised to provide insurance under Union or national law, and be provided by a third-party entity (Article 67(5)). The policy must cover all the risks listed in Article 67(6): loss of documents; misrepresentations or misleading statements; acts, errors or omissions resulting in a breach of legal and regulatory obligations, of the duty to act honestly, fairly and professionally towards clients, or of confidentiality obligations; failure to establish, implement and maintain appropriate procedures to prevent conflicts of interest; losses arising from business disruption or system failures; where applicable to the business model, gross negligence in safeguarding clients’ crypto-assets and funds; and the provider’s liability towards clients under Article 75(8).

2. First focus: services set the capital minimum, costs set the actual scale

The first question facing every firm when structuring its authorisation application is how the selected portfolio of services affects the initial capital threshold. Annex IV to MiCA groups the ten regulated crypto-asset services under Article 3(1), point (16), into three tiers according to the degree of operational, custody and market risk assumed by the provider vis-à-vis its clients and the market.

The logic behind this tiered structure is consistent. As long as the firm acts solely as an intermediary or adviser in Class 1, without holding clients’ crypto-assets or funds and without acting as principal in transactions for its own account, the minimum threshold is EUR 50,000. Once the business model includes the safekeeping of clients’ cryptographic keys (custody) or dealer exchange against funds or other crypto-assets, the risk increases materially and the threshold rises to EUR 125,000. The highest tier of EUR 150,000 is reserved for operators of trading platforms, where technical resilience and market integrity affect a large number of participants simultaneously.

Where several services are combined, the absorption rule applies rather than aggregation: it is not the number of services applied for, but the service with the highest risk and capital class that determines the permanent minimum. Thus, a firm providing advice, transfer services and custody at the same time is subject to a permanent minimum of EUR 125,000, not the sum of the thresholds for the individual classes. The other side of this rule is critical from a management perspective: adding even one ancillary service from a higher class to the authorisation application automatically raises the capital floor for the entire firm.

This is also where one of the most common practical misconceptions in budgeting a CASP project becomes apparent — the assumption that EUR 50,000, EUR 125,000 or EUR 150,000 exhausts the capital burden. In reality, the service class determines only the floor, while the cost base can very quickly become the actual regulatory scale, as illustrated by comparing two firms with the same Class 2 authorisation scope:

The example shows why, for an actively operating provider, the permanent minimum under Annex IV ceases to be the binding constraint once annual costs exceed EUR 500,000 (Class 2) or EUR 600,000 (Class 3). Moreover, the requirement under Article 67(1) is not a static amount checked only on the date of filing the application or on 31 December — it must be covered continuously on every day of the year.

3. Second focus: the divergence over “fixed overheads” and the supervisory shift by ESMA and the European Commission

Once one quarter of annual costs becomes the decisive factor for most growing firms, a natural question arises: which costs exactly are included in that base? Between 2024 and early 2026, a significant divergence developed precisely here between the way some market participants modelled their costs and the strict supervisory interpretation of the European institutions. A closer reading of the sources shows that this is not a technical conflict between MiCA and the delegated legislation, but rather the closing of attempts to narrow the cost base through accounting labelling.

The starting formula in Article 67(3) MiCA and the mandatory financial audit

Although Article 67(1)(b) uses the traditional prudential term “fixed overheads”, paragraph 3 of the same Article does not define that amount by adding selected fixed cost items (such as rent and base salaries), but instead applies the reverse subtractive approach. The calculation starts from total expenses after distribution of profits to shareholders or members, as shown in the latest audited annual financial statements (or statements validated by the national supervisor where audited statements are not available).

In this context, ESMA Q&A 2344 is also important: CASPs should have their annual financial statements audited by an independent auditor every year in order to calculate their own funds requirements. The answer makes no exception for small undertakings, so an audit is needed even where the firm would fall below the statutory audit thresholds under national accounting law. The only exception is where the national law of the CASP’s home Member State allows the financial statements to be validated by a specific national supervisor.

From this total amount of expenses, Article 67(3), points (a)–(d), of MiCA permits only four specifically defined categories to be deducted: (a) staff bonuses and other remuneration, insofar as they depend on the firm’s net profit for the relevant year; (b) employees’, directors’ and partners’ shares in profits; (c) other appropriations of profits and other variable remuneration, insofar as they are fully discretionary; and (d) non-recurring expenses from non-ordinary activities.

Delegated Regulation (EU) 2025/305 and the reasons for the market divergence

Where, then, did the practical dispute arise? On the one hand, Delegated Regulation (EU) 2025/305, which governs the content of the authorisation application under Article 62 MiCA, requires in Article 3 three-year projected calculations of prudential safeguards and own funds based on fixed overheads and stress scenarios, without introducing a separate formula for expense deductions. The regime for investment firms is different: there, Article 13(4) of Regulation (EU) 2019/2033 (IFR) itself allows items such as shared commissions and fees paid to tied agents to be deducted, and Delegated Regulation (EU) 2022/1455 adds further deductions. The MiCA legislator provided neither such additional deductions nor a separate regulatory technical standard for them.

Nevertheless, many applicants and advisers mechanically imported either the accounting distinction between fixed and variable costs or the more flexible practice under the IFR. As a result, financial projections attempted to exclude from the cost base cloud infrastructure costs scaling with transaction volumes, marketing budgets, variable fees paid to technology providers, and outsourced contractors, on the argument that the firm could reduce those costs if business activity declined.

The “no low-risk CASP” principle and the answer in ESMA Q&A 2349 (18 February 2026)

This narrow reading did not find support with supervisors. As early as 31 January 2025, in its Supervisory Briefing on the Authorisation of CASPs, ESMA set the general tone with the principle that “There are no low-risk CASPs”. Although the scale of their activity is typically smaller than that of traditional financial institutions, CASPs often deal directly with retail investors and have a limited track record of regulatory compliance and supervision. National competent authorities should therefore not carry out a cursory assessment of applications based on a “low-risk” label, even for smaller firms. The briefing does not address the cost base as such, but it set the direction in which the question was later settled.

The decisive step came on 18 February 2026 with the publication of the European Commission’s official answer in ESMA Q&A 2349. The Commission stated unequivocally that CASPs must calculate the fixed overheads of the preceding year starting from the total amount of all overhead expenses of the firm — both fixed and variable — in accordance with the applicable accounting framework. Since the prudential requirements under Article 67 MiCA are a consumer-protection tool, all operating expenses must be included. It was expressly emphasised that, unlike Article 13(4) IFR (which provides only a minimum list of deductible items), the list of four categories in Article 67(3), points (a)–(d), MiCA is legally exhaustive and gives neither firms nor national competent authorities discretion to deduct other variable operating expenses.

4. Third focus: how do we select the stress tests to include in the financial projections?

The third pillar of the prudential framework shifts the analysis from reported past performance to the firm’s future resilience. Pursuant to Article 3(b)(i) and (ii) of Delegated Regulation (EU) 2025/305, every authorisation application must include projected calculations of prudential safeguards and plans for determining own funds for the first three business years after authorisation, supported by planning assumptions and stress scenarios. Recital 5 of the same Delegated Regulation sets the qualitative standard for their design: the scenarios must simulate “severe but plausible events”, enabling the supervisory authority to assess whether the applicant can withstand external financial shocks, including shocks directly affecting the value of crypto-assets.

Because the legislation deliberately does not prescribe a mechanical catalogue of fixed percentages, stress tests must be selected according to the actual architecture of the business, in line with ESMA’s principle that there are no low-risk CASPs. To be defensible before the regulator, the methodology follows five natural steps: mapping the services applied for and revenue streams; linking each service to its principal material risks (ICT and cyber risk in connection with DORA, market and liquidity risk, custody liability under Article 75(8) MiCA, legal and compliance risk, concentration and third-party dependencies); defining specific shock events; calibrating the parameters at levels that are historically plausible for crypto-asset markets; and, finally, verifying whether the prudential safeguard remains covered throughout all three years and which management recovery measures would be triggered.

Applying this logic, a convincing package of stress scenarios is structured around three main risk channels. The first channel covers market and revenue shocks — a prolonged decline in trading volumes and commissions (a “crypto winter”), in which revenues fall sharply while the operating structure remains unchanged, combined with the sharp fall in crypto-asset prices expressly referred to in Recital 5, reducing both fees linked to the value of client portfolios and the balance-sheet value of the firm’s own crypto-assets. The second channel tests concentration, technological and operational vulnerability: the sudden loss of a key institutional client, liquidity provider or servicing bank account; a prolonged outage of critical ICT systems or an external technology service provider within the meaning of DORA; and a one-off loss from a cyber incident, fraud or operational error whose amount exceeds the limit or scope of the insurance policy.

The third, and often underestimated, channel is the cost shock with a “double effect” and the combined stress scenario. An unforeseen increase in the cost of specialised staff, cybersecurity, audit and legal compliance works in two directions: on the one hand, it reduces the current financial result and available CET1 capital; on the other hand, following the interpretation in ESMA Q&A 2349, it automatically increases the required prudential safeguard for the next period by 25% of the additional cost whenever one quarter of expenses is the higher of the two amounts. A mature financial model should therefore conclude with a combined stress test in which a market-driven fall in revenues coincides with an operational or cost shock, demonstrating to the supervisor a specific and realistic capital recovery plan.

Conclusion: three practical management decisions

Translated into the day-to-day work of CASP management bodies, chief financial officers and compliance teams, the prudential framework discussed above requires three strategic management decisions. First, the scope of authorisation should be planned selectively, because each service applied for carries a specific capital cost (EUR 50,000, EUR 125,000 or EUR 150,000) and strict rules on eligible CET1 capital under the CRR after the deduction of intangible assets. Second, the cost base should be managed as a direct regulatory variable, because accounting labels such as “variable” for operating cost items do not reduce the capital requirement, and every expansion of the budget requires simultaneous planning for a 25% capital buffer. Third, stress tests must arise from the actual business model, demonstrating that the firm has sufficient capital and prepared management responses not only under the base case, but also during periods of acute market or operational stress.

Legal basis and sources

• Regulation (EU) 2023/1114 (MiCA) (opens in a new tab), Article 3(1)(16), Article 67, Article 75(8) and Annex IV
• Delegated Regulation (EU) 2025/305 (opens in a new tab) (content of the application for authorisation as a CASP), Recital 5 and Article 3
• ESMA Q&A 2349 — Calculation of fixed overheads (European Commission answer of 18 February 2026) (opens in a new tab)
• ESMA Q&A 2344 — annual audit of CASPs’ financial statements (opens in a new tab)
• ESMA — Supervisory Briefing on the Authorisation of CASPs under MiCA (31 January 2025) (opens in a new tab)
• Regulation (EU) No 575/2013 (CRR) (opens in a new tab), Articles 26–30, 36, 46 and 48; Delegated Regulation (EU) 2020/2176 (opens in a new tab) (software assets)
• Regulation (EU) 2019/2033 (IFR) (opens in a new tab), Article 13(4); Delegated Regulation (EU) 2022/1455 (opens in a new tab)

The legislation is stated as at 30 October 2026.