Topic starter
05/07/2026 9:28 pm
TL;DR: MiCA’s grandfathering period is still active in some jurisdictions, but full licensing will be required across the EU from July 1, 2026, and SumSub’s guide focuses on scope, licensing milestones, and AML/CFT obligations that sit alongside MiCA rather than inside it.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Guide for EU CASPs - Legal requirements and Sumsub functionalities”.
Key questions
Q: How should CASPs prepare for MiCA licensing if grandfathering is still available?
A: Treat grandfathering as preparation time, not a reason to defer governance work.
Q: Why do AML/CFT and Travel Rule controls matter when MiCA does not create them?
A: Because regulators will still expect those obligations to be met through the correct legal basis outside MiCA.
Q: What breaks when a CASP treats MiCA readiness as a policy exercise only?
A: The application pack becomes weak, ownership stays unclear, and supervisors cannot easily verify that controls operate in practice.
Practitioner guidance
- Map regulated activities to MiCA obligations Build a service-by-service matrix that links each CASP activity, token type, and operating jurisdiction to the exact licensing and governance obligations it triggers.
- Separate AML/CFT evidence from MiCA evidence Maintain distinct control narratives and evidence packs for MiCA licensing, identity verification, AML screening, and Travel Rule compliance so reviewers can assess each obligation independently.
- Prepare an application pack with proof, not prose Assemble artefacts that show ownership, operating procedures, approval paths, and control operation, not just policy statements or high-level compliance claims.
Bottom line: MiCA readiness for CASPs is not just a legal interpretation exercise. It depends on whether identity controls, verification evidence, and governance ownership can be shown in an auditable way.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 9:30 pm
MiCA readiness is really a controlled-identity problem for CASPs: licensing only works when the firm can prove who it is, what activity it performs, and which obligations attach to that activity. The article makes clear that compliance is not satisfied by reading MiCA in isolation, because the operational burden sits in identity verification, governance, and evidence production. For CASPs, the practitioner question is how well identity controls map to regulated services, not whether the regulation exists.
A question worth separating out:
Q: What should compliance and IAM teams align on before a MiCA licence application?
A: They should agree on which activities are in scope, which controls support each obligation, and which artefacts prove those controls are working. That alignment makes the licensing story coherent and avoids duplicated or contradictory evidence across teams.
👉 Read our full editorial: MiCA licensing readiness for CASPs depends on identity controls