CASP Challenges in Bulgaria During MiCA Licensing Before the FSC

Working every day with companies applying for a CASP licence under MiCA before the Bulgarian Financial Supervision Commission, I see the same stumbling blocks repeating again and again. This article is about them — and it is long because the problems are not simple.

1. "We are not a bank, we are a tech company"

The most fundamental difficulty is not documentary, but conceptual. Businesses struggle to understand their new position: they are no longer just technology startups. They are now treated as financial institutions.

This requires a different reading of the word "risk" and a different understanding of risk management procedures.

There are no low-risk CASPs.

That is how ESMA frames the expectation in its Supervisory Briefing of January 31, 2025. Even where their scale is smaller than that of traditional financial institutions, CASPs deal directly with retail investors and have a short history of regulatory compliance. That is why the supervisory approach to them is naturally more cautious.

ESMA Supervisory Briefing on Authorisation of CASPs (opens in a new tab)

2. Prudential requirements are not just "EUR 50,000 in the bank"

Article 67 of MiCA provides for a capital requirement of EUR 50,000, EUR 125,000, or EUR 150,000 depending on the services provided, or one quarter of fixed overheads — the higher amount applies.

In practice, this does not work as a static threshold. National competent authorities apply a risk-based approach and pay particular attention to factors such as size, complex group structure, significant cross-border activity, a combination of several crypto-asset services, a new business model, extensive outsourcing, or an adverse supervisory history.

Many applicants make the wrong analogy with MiFID II. MiCA is not based only on rigid formal rules. It requires genuine risk management. Therefore, the capital base must match the risk profile, not merely the minimum prudential safeguard.

ESMA Q&A 2349 added an important clarification. When calculating one quarter of overhead expenses, the starting point is all expenses — fixed and variable — and only the items expressly listed in Article 67(3)(a)-(d) of MiCA may be deducted. Unlike the IFR, MiCA's provision is exhaustive and leaves no discretion to either the NCA or the CASP.

ESMA Q&A 2349 — Calculation of fixed overheads (opens in a new tab)

3. Historical accounts do not reflect the forward-looking reality

Financial statements from 2023, 2024, and 2025 often do not show the costs an applicant will incur during the licensing process: additional staff, software changes, external consultants, additional policies, and control functions.

These costs reduce the company's reserves, and those reserves play the role of a second layer of protection within the prudential framework.

The example is simple: a company of two or three people that used to handle the business suddenly has to hire 10-12 people for key functions just to meet the licensing requirements. That may mean a payroll four, five, or six times larger on an annual basis, while the client base and revenue remain the same.

In addition, the licensing process is not cheap in terms of external services and software work, so that CASP platforms can comply with DORA, AML/CFT requirements, the Travel Rule, and the other rules on security and traceability.

This is precisely why ESMA expects the business plan to cover projections for at least three years and to include pessimistic scenarios in which revenue falls below expected levels. The practical pressure to obtain professional insurance should also not be underestimated, even where it is not presented as a separate public item on the checklist.

4. Staffing is the second major stumbling block

The tech sector is usually built around developers. MiCA, however, requires financial experience, competence, good repute, and provable suitability of management and key function holders.

EBA and ESMA have published joint guidelines on the suitability assessment of management body members and qualifying shareholders. This assessment is not a formality. It includes a review of experience, knowledge of crypto-assets, management competence, and any prior supervisory issues.

EBA/ESMA Joint Guidelines on Suitability Assessment (opens in a new tab)

Foreign staff are common, but they do not always fit easily into the Bulgarian administrative reality. Their diplomas are not automatically recognised in Bulgaria, and legalisation or recognition may take longer than the deadlines the FSC usually gives for remedying gaps in the application documentation.

The positions that need to be covered in practice include:

• Compliance Officer
• AML/CFT Officer
• Risk Manager
• ICT Security Lead in the context of DORA
• Data Protection Officer
• persons providing information or advice to clients, with proven competence under Article 81 MiCA

5. Knowledge and competence requirements under Article 81 MiCA

On July 11, 2025, ESMA published a final report with guidelines on the knowledge and competence of CASP staff. The guidelines distinguish staff who provide information to clients from staff who provide advice.

• Information staff: at least 80 hours of training or 6 months of experience under supervision
• Advisory staff: at least 160 hours of training or 12 months of experience under supervision

The CASP's management body must annually assess compliance with these requirements and take action where gaps are identified. For many companies, this is a completely new process: no procedures, no internal competence matrix, no budget.

ESMA Guidelines on Knowledge and Competence (opens in a new tab)

6. DORA — the digital operational resilience no one budgeted for

Since January 17, 2025, CASPs have fallen within Regulation (EU) 2022/2554, known as DORA. ESMA expects national competent authorities to review CASP ICT systems in light of DORA, particularly where critical functions such as custody are concerned.

In practice, for a small CASP this means penetration testing, incident response procedures, a business continuity plan, a disaster recovery plan, monitoring of third-party providers, and a documented ICT risk management framework.

All of this is new, expensive, and requires either specialist staff or outsourcing — which is itself regulated.

Regulation (EU) 2022/2554 — DORA (opens in a new tab)

7. Custody and segregation of client assets

For CASPs providing custody services, segregation requirements are not an abstract compliance checkbox. If client assets are held in omnibus wallets without proper segregation records, this may create serious risk for directors in an insolvency scenario.

During the licensing review, the supervisor expects evidence: hot/warm/cold wallet architecture, daily reconciliation, documented custody agreements, and clear recordkeeping. In the event of loss or compromise of client assets, liability under Article 75 of MiCA is one of the most sensitive points in inspections.

8. Outsourcing and the prohibition on letter-box entities

Many Bulgarian CASPs rely heavily on external teams, including teams in third countries. ESMA, however, emphasises that core functions cannot be outsourced to the point where the CASP becomes a letter-box entity: a facade company without real operational capability.

The national authority may assess whether outsourced functions represent a significant percentage of total costs and whether the internal team has real control. The CASP must have sufficient local capacity and at least one executive management member based in the jurisdiction.

9. Complaints, marketing, and conflicts of interest

Article 71 of MiCA requires effective and transparent procedures for the prompt, fair, and consistent handling of client complaints. Article 66 requires all communication with clients, including marketing materials, to be fair, clear, and not misleading. Conflicts of interest, especially in CASPs offering multiple services, are also subject to enhanced scrutiny.

Most applicants do not have working infrastructure for this. These procedures must not merely be written. They must be implemented and shown to work.

What does practice show?

The FSC's position when issuing the first MiCA licence in Bulgaria is telling. In the Commission's public announcement, Deputy Chairperson Denitsa Velichkova stressed that a MiCA licence "is not a formality", but evidence of maturity, readiness, and responsibility.

This is not abstract. Against the backdrop of publicly announced decisions concerning incomplete applications, obtaining a licence shows how high the threshold is for preparation, management maturity, and operational readiness.

FSC: first MiCA licence in Bulgaria (opens in a new tab)

Conclusion

MiCA is not "a new registration regime with a thicker file". It is a fundamental change in the way crypto businesses will operate in Europe.

Companies that understand this in time have a chance to pass. Companies that believe they can catch up at the last minute before July 1, 2026 will face a reality for which they are not prepared.

Preparation is not a matter of documents. It is a matter of mindset.

I hope this is useful.

Respectfully,
Marina Muchakova

Key Documents

• ESMA Supervisory Briefing on Authorisation of CASPs (31.01.2025) (opens in a new tab)
• ESMA Q&A 2349 — Calculation of fixed overheads (Art. 67 MiCA) (opens in a new tab)
• EBA/ESMA Joint Guidelines on Suitability Assessment (opens in a new tab)
• ESMA Guidelines on Knowledge and Competence (Art. 81 MiCA) (opens in a new tab)
• ESMA Peer Review — Malta CASP Authorisation (opens in a new tab)
• Regulation (EU) 2023/1114 — MiCA (opens in a new tab)