How should crypto-asset service providers prepare for MiCA compliance in Lithuania before the transition period ends?

Crypto-asset service providers should start by mapping their service class, capital needs, and licensing path, then align governance, AML and CTF controls, customer due diligence, transaction monitoring, and record keeping. They should also test whether risk management, incident response, and reporting processes work in practice. The transition period is a window to close gaps before enforcement tightens.

What MiCA readiness means for Lithuanian crypto-asset providers

MiCA preparation is less about a single filing and more about proving that the firm can operate as a regulated crypto-asset service provider under a consistent control model. For Lithuanian firms, that means understanding which services fall into scope, which legal entity will seek authorisation, and which parts of the current operating model must be hardened before the transition period closes.

The practical challenge is that MiCA readiness spans governance, conduct, financial resilience, control documentation, and day-to-day operating discipline. Firms that only review policy language without testing execution usually discover gaps late, when capital, outsourcing, recordkeeping, or incident-handling expectations become harder to fix quickly.

Preparation should therefore start with a service-by-service gap assessment. Map the services you provide, the client types you serve, and the control obligations those services create, then compare current practices against the authorisation path you expect to follow. That gives management a defensible view of what must be redesigned, what can be retained, and what needs evidence before submission.

Which control areas usually drive the largest MiCA workstream?

In practice, the heaviest lift is usually not the licence form itself but the control environment behind it. Providers need coherent governance, clear accountability, and operational controls that match the risk profile of the business. That includes customer onboarding discipline, AML and CTF controls, transaction monitoring, complaint handling, incident escalation, and retention of records that support both supervision and internal review.

Capital planning and financial resilience also matter because they affect whether the business can continue operating through growth, remediation, or a supervisory challenge. If the firm depends on a narrow set of people, vendors, or outsourced functions, the authorisation file should explain how continuity, oversight, and exit options will work under stress.

Data and security controls are part of the readiness picture even when the core question is regulatory. If customer records, wallet data, or transaction logs are incomplete or poorly governed, the firm will struggle to evidence compliance, investigate complaints, or support incident reporting. For baseline security and control alignment, many teams use CIS Controls v8 and ISO/IEC 27001:2022 Information Security Management as practical reference points for account management, logging, access control, and governance.

How to use the transition period without waiting for enforcement pressure

The transition period should be treated as an implementation window, not a grace period for inaction. The useful question is whether the firm can demonstrate repeatable control operation, not whether it has drafted a policy that describes the control. Supervisors will care more about evidence of execution than about intentions.

A sensible sequence is to freeze the scope of services, define the target operating model, close high-risk gaps first, and then test the controls that are hardest to evidence. Those usually include customer due diligence quality, monitoring thresholds, record retention, escalation timing, and incident reporting. Once those controls are stable, firms can focus on governance pack quality, board oversight, and the licensing submission itself. For AML and CTF structure, the FATF Recommendations remain the most useful international benchmark for customer due diligence, beneficial ownership, and suspicious activity handling.

Practical readiness also means testing the organisation under pressure. If a transaction-monitoring alert, cyber incident, or customer complaint arrives while the authorisation work is underway, the firm should still be able to preserve evidence, route decisions to the right owner, and keep a clear audit trail. That operational discipline is often what separates a paper-ready application from a genuinely supervised business.

Risk and Threat Considerations

The main risk is assuming that MiCA compliance can be assembled at the end from policy documents and scattered fixes. In reality, weak governance, incomplete AML controls, poor recordkeeping, and under-tested incident processes tend to fail together, which can delay authorisation and expose the firm to supervisory challenge or service disruption.

Failure mechanism: Control gaps remain hidden until the firm has to prove them in a licensing review, incident, or supervisory inspection, at which point remediation is slower and more disruptive than planned.

Impact: Delayed authorisation, constrained operating permissions, customer trust damage, and a higher likelihood of urgent remediation across finance, compliance, and operations.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	MiCA readiness depends on accountable access and operational control ownership.
Recommendation — Enforce account ownership and periodic review so compliance-critical access stays attributable.
ISO/IEC 27001:2022	A.5.15 — Access control	Access control supports secure handling of customer records, logs and compliance evidence.
	A.5.33 — Protection of records	Recordkeeping is central to MiCA evidence, supervision and incident review.
	A.5.24 — Information security incident management planning and preparation	MiCA preparedness requires incident processes that work before enforcement tightens.
Recommendation — Define and enforce access restrictions for regulated records and evidence repositories. Protect retained records with integrity, retention and retrieval requirements. Prepare and test incident procedures so reporting and escalation work under pressure.

Practitioner Guidance

What to prioritise: Focus first on the controls that are hardest to retrofit under deadline pressure, especially governance ownership, AML and CTF workflow quality, record retention, and incident reporting evidence. Those are the areas most likely to determine whether the firm looks supervised in practice, not just compliant on paper.

What to verify: Make sure each control can be demonstrated with artefacts, not assertions. A strong readiness pack should show who owns each obligation, how exceptions are approved, what evidence is retained, and how often the control is tested. If the answer depends on a single person’s memory, it is not ready.

Practitioner takeaway: Treat the transition period as a proof phase, because the firms that succeed will be the ones that can show repeatable control operation before the regulator asks for it.