Fewer Than 300 Made the Cut: Ivan Nevzorov on MiCA, CASP Licensing, and What’s Next for Crypto Firms

Of the greater than 3,000 corporations that have been legally serving crypto shoppers throughout the EU as not too long ago as this June, fewer than 300 maintain the proper to take action at the moment, in line with CASP Tracker.

The motive is the Markets in Crypto-Assets Regulation (MiCA), which took full impact throughout the European Union on 1 July 2026: from that date, solely an organization holding Crypto-Asset Service Provider (CASP) authorisation — granted by a regulator in a single EU member state and passported throughout the remainder of the bloc — can serve EU shoppers. Companies that beforehand operated underneath nationwide Virtual Asset Service Provider (VASP) registrations had precisely till that date to transform. Most didn’t.

We talked to Ivan Nevzorov, CEO at SBSB Fintech Lawyers, about what’s really left for them now — and why the shortcuts most of them attain for first often aren’t the ones that maintain up.

Let’s begin with the apparent one. An organization nonetheless doesn’t have a CASP licence at the moment — what occurs to it now?

Ivan Nevzorov: Look, right here’s the factor individuals don’t wish to hear: the deadline’s already handed. From July 1st, day by day you retain serving EU shoppers with out authorisation is a day you’re in breach of MiCA — a minimal €5 million positive underneath Article 111, and in France it will probably imply felony legal responsibility for whoever’s accountable. So the reply everybody expects to listen to, “simply go get licensed,” isn’t really on the desk anymore for an organization working at the moment. You can’t file an utility, maintain the lights on for months whereas it will get reviewed, and name that compliance.

Which actually leaves two paths. One, you wind down, as a result of the enterprise can’t meet the new customary. Two, you relocate — transfer your base to a friendlier jurisdiction. Though that one solely retains you authorized in the event you cease advertising and marketing into the EU utterly and let shoppers come to you on their very own, what’s referred to as reverse solicitation. Keep promoting to EU customers from exterior the bloc, and you’re breaking the very same rule, simply from a unique deal with.

We’ll come again to relocating, as a result of it’s genuinely its personal dialog. Let’s begin with winding down, since that’s the place most of those corporations really are proper now — and truthfully, it’s painful to look at, as a result of most of them didn’t do something improper. They simply didn’t get there in time, and for loads of them, the causes had nothing to do with how good their compliance really was.

Winding down appears like the extra easy path, at the very least. Is it really?

Ivan Nevzorov: Not as easy as individuals assume, and there’s a proper approach and a improper approach to do it. The improper approach is switching off the app and disappearing — the consumer belongings sitting in these accounts don’t vanish, and holding them is a regulated exercise in itself. To the regulator, that firm hasn’t gone anyplace. It’s nonetheless working with no licence, solely now it’s additionally stopped answering its shoppers. The proper approach is one in all two issues: an orderly wind-down, or transferring your shoppers to a CASP that’s already authorised.

ESMA’s really spelled out what an orderly wind-down has to appear to be: cease onboarding, cease any advertising and marketing into the EU, prohibit your self to settling what’s already open. And transferring shoppers sounds easier on paper, however being on the CASP register solely tells you a agency’s allowed to take shoppers — it doesn’t inform you they’re really set as much as onboard just a few thousand new ones without delay. A variety of the companies that bought authorised quickest didn’t construct a crypto compliance perform from zero — they already held a MiFID or e-money licence and simply transformed it, lighter scrutiny hooked up. Good for them, however it additionally means a few of these brand-new CASPs are banks operating crypto as a aspect product, not specialists who can take up a wave of migrating shoppers. Every single a type of shoppers nonetheless wants full AML and KYC re-verification earlier than the new CASP can contact their cash. That’s months of labor for a crew that does it day by day. Longer for a crew that doesn’t.

You’d assume the larger platforms would have this solved by now. Is that really the case?

Ivan Nevzorov: Less than individuals assume, and Binance is definitely a good instance of why. A platform with years of European working historical past and monumental authorized and compliance assets nonetheless bumped into actual MiCA licensing issues — the identical wall loads of a lot smaller corporations are hitting. That tells you one thing value sitting with: this isn’t a niche you shut simply by throwing cash or headcount at it. If an organization at that scale couldn’t get it totally sorted earlier than the deadline, a smaller operator shouldn’t assume they’ll simply muscle by it both.

Let’s rewind for a second — solely a pair hundred corporations really made it by whereas that was nonetheless potential. What was going improper for the relaxation?

Ivan Nevzorov: Honestly, it’s not often the paperwork. A technically right utility simply will get you in the room — it doesn’t win you the determination. We noticed one submitting get rejected over how the share capital was deposited, and that requirement isn’t even written into MiCA, anyplace. The regulator simply invented a formality that isn’t in the textual content. That’s the sample I maintain seeing: no matter motive they put on paper is nearly by no means the actual one. The actual motive involves you informally, if it comes in any respect, and it’s about how they learn the firm — do you really perceive your personal threat mannequin, who’s accountable for what, who your shoppers actually are. A compliance coverage copied from a template solutions none of that. It’s the very first thing I flag when somebody walks into SBSB with one.

And the second factor individuals underestimate utterly: the place you filed mattered nearly as a lot as what you filed. This wasn’t one course of throughout the EU — it was twenty-seven variations of it, shifting at utterly totally different speeds, with utterly totally different appetites for saying no. Germany’s BaFin wasn’t shy about it: its first-ever MiCA enforcement motion was rejecting Ethena’s utility and then forcing the firm to wind down its German operation and redeem its tokens. Italy’s regulator went the different approach — it spent most of the transition interval with out having authorised anybody in any respect, so filings there simply sat. Same regulation, wildly totally different odds relying on the door you knocked on. A couple of nations by no means even constructed the door — Poland’s the loudest instance, it went into the deadline with no authority issuing CASP licences in any respect — however that’s the excessive finish of a spectrum the complete market was sitting on.

Let’s discuss the corporations really going by the licensing course of, then — a primary utility in a market they haven’t touched but, or a return down the line after an orderly exit. What does a method that really works appear to be, in follow?

Ivan Nevzorov: Honestly, it begins earlier than you’ve touched a single type. You go discuss to the regulator first, discover out precisely what they count on from a enterprise like this one, and solely then do you construct the construction round that reply — the AML coverage, the governance, the documentation. MiCA’s a directive, which implies each nation implements it slightly in another way, so a compliance bundle that labored in a single member state will get rechecked earlier than you dare reuse it someplace else. People skip that step continually, and it prices them.

At SBSB, a full mandate for us appears to be like like this: firm formation, the utility itself, dealing with the regulator correspondence, and then the components most founders genuinely can’t construct alone — banking relationships, fee infrastructure, penetration testing by our companions, licensed compliance software program. And staffing issues simply as a lot. Regulators examine AML certifications early, so get that sorted earlier than the utility goes in, not after you’ve already filed.

How ought to an organization really select which EU market to use in — Germany, Austria, the Netherlands, Estonia?

Ivan Nevzorov: I don’t give each consumer the identical reply, truthfully, and if anybody tells you there’s one magic jurisdiction, they’re oversimplifying it for you. But the variations between regulators are actual, and by now they’re nicely documented. Germany’s BaFin provides you the heaviest signature in Europe — company shoppers respect it — however you pay for it: a German entity, at the very least two certified administrators really current in the nation, capital paid up at submitting, and a documentation pack that runs to tons of of pages, with the formal submitting in German. France is the reverse story: the AMF had been licensing crypto companies underneath its personal nationwide regime for 5 years earlier than MiCA existed, so companies already registered there bought a genuinely streamlined path, and the regulator’s crypto unit is aware of what it’s . Luxembourg, Ireland, and Malta grew to become the hubs the massive exchanges really picked: Coinbase went by Luxembourg, Kraken by Ireland, OKX and Crypto.com by Malta. That’s not a coincidence; it’s the place the course of was mature sufficient to deal with a file that dimension.

But right here’s what I really inform shoppers: the regulator’s pace shouldn’t determine it — your personal capability ought to. Every critical regulator now checks for the identical factor: an actual workplace, actual employees on the floor, a reputable plan for that particular market. Pick the jurisdiction the place you’ll be able to truthfully present that, not whoever’s bought the shortest queue — a quick course of with no substance behind your utility simply will get you a quick rejection. And sure, Germany leads on uncooked licence numbers proper now, however chunk of that’s banks and brokers changing a licence they already had, not crypto-native companies getting freshly authorised. “Germany has the most CASPs” and “Germany’s the best place for a crypto firm” are two totally different claims, and individuals combine them up continually. I don’t assume any single nation’s lead holds for lengthy anyway — regulator capability is finite all over the place. We’ve watched this film earlier than, it’s principally what occurred with Curaçao’s gaming licence reform. Once the quantity outpaces what the regulator can really course of, the course of itself turns into the bottleneck.

Let’s come again to relocating, the third path you talked about earlier. For corporations considering globally, how ought to they weigh an EU licence in opposition to licences elsewhere — Latin America, Asia, offshore?

Ivan Nevzorov: Look, the most secure place is full compliance all over the place you use — higher banking phrases, full market entry, nothing sitting in a gray space. But that takes a price range most startups simply don’t have. So in follow, most of them find yourself operating from a business-friendly base — El Salvador, Panama, the UAE, Singapore, Mexico, these come up continually — and serving EU shoppers solely by reverse solicitation, generally with geo-blocks stacked on high for the riskier markets.

But discover what these two choices actually are: one’s too costly for most, and the different cuts you off from actively profitable EU shoppers in any respect. Which is why the query I hear continually proper now could be: can’t I simply function underneath another person’s licence? And right here’s the place MiCA catches individuals off guard. In funds, underneath the Second Payment Services Directive, PSD2, there’s a correct agent mannequin — an unlicensed firm can work the market on behalf of a licensed one, and the business makes use of it all over the place. MiCA has nothing like that. Articles 59 and 60 draw a tough line round who’s allowed to supply crypto companies in any respect, so the traditional white-label — an unlicensed supplier serving shoppers in its personal identify underneath another person’s licence — formally doesn’t work.

What no one forbids, although, is supplying a licensed CASP with expertise or advertising and marketing. That’s totally authorized, and the whole market has rushed into the hole between these two factors — KvarnX, Bitpanda, Bit2Me are all operating their very own variations of it, and Spain’s regulator has even given the grey-label method a cautiously constructive learn, with actual limits hooked up. The catch is what position you’re really enjoying: the licensed companion holds each pockets, each checking account, each consumer transaction. You’re the expertise behind their provide, not the supplier in entrance of the consumer. For loads of corporations that’s a wonderfully great way again into the EU market. Just be sincere with your self about which aspect of that line your corporation mannequin really must be on.

Last one — as soon as an organization has the CASP licence, what does the ongoing workload really appear to be?

Ivan Nevzorov: Getting the licence is truthfully the straightforward half to speak about. Staying licensed is the place corporations really get examined. I’ve watched a licence get pulled by an EU regulator inside months of being granted, as a result of the enterprise simply didn’t comply with by on what it promised in the utility. What really issues, when you’re authorised, is precisely what you signed up for on paper — lively threat evaluation, ongoing AML monitoring, reporting to the regulator on time, each single time.

Has that hole between paperwork and follow really value one in all your shoppers?

Ivan Nevzorov: This one’s a bit totally different — no regulator pulled something right here, and it’s really from exterior crypto. But it’s the identical underlying lesson, so it’s value telling. We had a consumer at SBSB who did every thing proper on paper: MSB registration, their API — Authorised Payment Institution — licence, linked to a banking-as-a-service companion, concentrating on the European market. Business plan strong, AML coverage strong, source-of-funds checks all cleared. Where it fell aside was the economics no one had stress-tested. The advertising and marketing spend wanted to truly hit their projected consumer quantity ran nicely above what they’d budgeted. The companion financial institution’s personal compliance screening filtered out a bit of the high-risk consumer phase their complete mannequin was constructed round. And the tariffs the financial institution really provided have been thinner than what they’d deliberate for. Nothing unlawful occurred anyplace in that chain. The enterprise simply didn’t survive contact with the promote it was constructed for. They made the name to promote, and we’ve already discovered a purchaser — offered it, kind of, at this level.

One factor that’s genuinely modified the economics right here is AI in compliance monitoring. Transaction monitoring that used to eat up an entire crew can run with a fraction of the individuals now — cheaper for the firm, and from what regulators have signalled, simpler for them to work with too. None of that replaces the fundamental requirement, although. The licence is the straightforward half. Staying licensed — that’s the job.

If you needed to give one piece of recommendation to an organization nonetheless sitting on this determination — wind down or relocate, switch or maintain — what wouldn’t it be?

Ivan Nevzorov: Pick your technique and begin shifting — this week, not this quarter. The window between now and the first wave of regulatory checks is the solely asset these corporations have left, and it’s shrinking: we flagged again in May that the first checks would land round the third quarter of this yr, and the Netherlands has already proven how this performs out — their central financial institution fined Kraken €4 million and Crypto.com €2.85 million underneath the outdated registration regime, and OKX €2.25 million simply final yr, for one thing that occurred two years earlier.

An organization that makes use of these months to truly execute — switch the shoppers, shut out the obligations, or get the relocation construction in place — walks into that first examine with a narrative of motion behind it. An organization that’s nonetheless weighing its choices in September walks in with a proof for why it did nothing. Given the alternative, I do know which dialog I’d slightly have with a regulator.

Disclaimer: The above article is sponsored content material; it’s written by a 3rd occasion. CryptoPotato doesn’t endorse or assume accountability for the content material, promoting, merchandise, high quality, accuracy, or different supplies on this web page. Nothing in it needs to be construed as monetary recommendation. Readers are strongly suggested to confirm the data independently and fastidiously earlier than partaking with any firm or challenge talked about and to do their very own analysis. Investing in cryptocurrencies carries a threat of capital loss, and readers are additionally suggested to seek the advice of an expert earlier than making any choices that will or might not be primarily based on the above-sponsored content material.

Readers are additionally suggested to learn CryptoPotato’s full disclaimer.

The put up Fewer Than 300 Made the Cut: Ivan Nevzorov on MiCA, CASP Licensing, and What’s Next for Crypto Firms appeared first on CryptoPotato.