ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The MiCA compliance cost has one component the Regulation fixes and several it does not. Article 67 fixes the prudential floor: a crypto-asset service provider must hold, at all times, the higher of the Annex IV permanent minimum capital — €50,000 for Class 1 services, €125,000 for Class 2, €150,000 for Class 3 — and one quarter of the preceding year’s fixed overheads, held as own funds, an insurance policy, or a combination. Everything else — the authorisation file, the policies and procedures Title V requires, the systems for safeguarding, complaints, conflicts, market abuse surveillance and the travel rule, the ICT resilience DORA layers on top, the national competent authority’s fees, and the people who run it — is set by the firm’s size, service mix and starting point. What follows is our own estimate, labelled as such, built the way we build every cost guide on this site: the fixed statutory numbers first, then typical ranges for the variable lines with the assumptions stated, then a worked example. None of the variable figures are MiCA figures, and the right answer for any firm is the one its own scoping produces.
| Class (Annex IV) | Services | Permanent minimum capital | Alternative |
|---|---|---|---|
| Class 1 | Execution of orders; placing; transfer services; reception and transmission of orders; advice; portfolio management | €50,000 | One quarter of the preceding year’s fixed overheads, if higher |
| Class 2 | Any Class 1 service plus custody and administration; exchange of crypto-assets for funds; exchange for other crypto-assets | €125,000 | The same |
| Class 3 | Any Class 2 service plus operation of a trading platform | €150,000 | The same |
Three points on the floor. It is the higher of the two figures, so a Class 2 firm with €800,000 of annual fixed overheads holds €200,000, not €125,000. A firm in its first year uses the projected fixed overheads from its authorisation application (Article 67(2)). And the safeguard can take the form of own funds — Common Equity Tier 1 items — or an insurance policy covering the specified liabilities, or a mix (Article 67(4)); the insurance route converts capital into a premium, at a price the market sets. Issuers are separate: an asset-referenced token issuer needs the higher of €350,000, 2% of the reserve and a quarter of fixed overheads under Article 35, and an e-money token issuer needs an e-money or banking licence with its own capital. Our guide to asset-referenced tokens vs e-money tokens covers those regimes.
| Driver | Effect on cost | What you control |
|---|---|---|
| Service class | Class 3 (trading platform) brings the heaviest operating rules — Article 76 platform rules, market abuse surveillance for every listed asset; Class 1 advice-only firms carry the lightest | Whether to seek every service at once or phase the licence |
| Starting point | A firm already regulated (EMI, investment firm, credit institution) uses the Article 60 notification route and reuses its governance; a new entity builds everything | Where the CASP sits in a group |
| Member State | NCA application and supervisory fees vary by country and by class; some charge per service | The home Member State choice, within substance requirements |
| Volume and asset count | Transaction monitoring, travel rule messaging and market abuse surveillance scale with transfers and listed assets | Listing policy; which assets and chains to support |
| Third-country exposure | Counterparty CASP due diligence under the travel rule and cross-border marketing rules | Which markets and counterparties to serve |
| DORA | ICT risk framework, incident reporting, testing and third-party register apply to CASPs from 17 January 2025 | Reuse of an existing ISO 27001 or ICT framework |
The Article 62 application requires a programme of operations, governance arrangements, a description of the ICT and security systems, the safeguarding arrangements, the complaints procedure, the segregation and custody policy where relevant, the market abuse detection arrangements for trading platforms, the AML/CFT and travel rule framework, and proof of the Article 67 safeguards — plus fit-and-proper evidence for management and qualifying shareholders. The competent authority has 25 working days to check completeness and 40 working days from a complete application to decide (Article 63); in practice the file takes far longer to build than to assess.
| Line (our estimate) | Class 1 (advice, RTO, execution) | Class 2 (adds custody, exchange) | Class 3 (adds trading platform) |
|---|---|---|---|
| Legal and regulatory advice on the application | €25,000 – 60,000 | €50,000 – 120,000 | €80,000 – 200,000 |
| Policy and procedure set (Title V, AML, travel rule, DORA) | €15,000 – 40,000 | €25,000 – 70,000 | €40,000 – 100,000 |
| ICT, security and safeguarding design work | €10,000 – 30,000 | €30,000 – 100,000 | €60,000 – 200,000 |
| NCA application fee | Varies by Member State; low thousands to tens of thousands of euros | Varies; typically higher per service | Varies; the highest tier |
| Internal project time (staff days) | 60 – 120 | 120 – 250 | 200 – 400 |
| Total external spend, indicative | €50,000 – 130,000 | €105,000 – 290,000 | €180,000 – 500,000 |
These are typical ranges from a standing start with a specialist law firm and a documentation toolkit; a firm building on an existing regulated entity sits at or below the bottom of each range, and one using a Big Four adviser for a multi-service, multi-chain platform sits above the top. Our guide to CASP authorisation covers what the file contains.
| Line (our estimate, per year) | Small Class 1–2 CASP | Mid-size Class 2–3 CASP |
|---|---|---|
| Compliance function (MLRO, compliance officer, staff) | 1–2 FTE: €90,000 – 200,000 | 3–8 FTE: €300,000 – 900,000 |
| Transaction monitoring and travel rule messaging tooling | €20,000 – 60,000 | €80,000 – 300,000 |
| Market abuse surveillance (Class 3, or listed own token) | n/a or €15,000 – 40,000 | €60,000 – 250,000 |
| Blockchain analytics and screening | €15,000 – 50,000 | €50,000 – 200,000 |
| DORA: ICT testing, third-party register, incident reporting | €20,000 – 60,000 | €80,000 – 300,000 |
| External audit, safeguarding reconciliation, reserve or custody assurance | €15,000 – 40,000 | €50,000 – 200,000 |
| NCA supervisory fees | Varies by Member State | Varies; often turnover- or activity-based |
| Insurance (where used for Article 67 safeguards, plus professional indemnity) | €10,000 – 40,000 | €40,000 – 150,000 |
| Total, indicative | €170,000 – 490,000 | €660,000 – 2,300,000 |
The people line dominates in both columns, as it does under every financial-services regime: MiCA’s Title V obligations — complaints, conflicts, outsourcing, safeguarding, client asset segregation, the travel rule, market abuse reporting — are run by staff, and the tooling exists to make the staff efficient rather than replace them. Our guides to MiCA market abuse and the crypto travel rule cover the two obligations whose tooling costs vary most with volume.
A new Class 2 CASP — custody and exchange, one Member State, two chains, 40,000 customers, €600,000 projected first-year fixed overheads — our estimate, illustrative only:
| Line | Basis | Estimate |
|---|---|---|
| Article 67 safeguard | Higher of €125,000 and ¼ × €600,000 = €150,000 | €150,000 held (capital, not spent) |
| Authorisation project, external | Mid-range Class 2 | €180,000 |
| Authorisation project, internal | 180 staff days at €500 loaded | €90,000 |
| Ongoing compliance, year one | 2 FTE, tooling, analytics, DORA, audit, insurance | €330,000 |
| Year-one cash cost | Project + ongoing | €600,000 |
| Capital held in addition | Article 67 | €150,000 |
Year two drops the project lines and keeps the ongoing ones, growing with volume; a firm that chose the insurance route under Article 67(4) would replace part of the €150,000 with an annual premium.
Our MiCA compliance checklist lists the obligations the ongoing budget has to cover.
What is the minimum capital for a CASP under MiCA?
Article 67 and Annex IV: at least the higher of €50,000 (Class 1), €125,000 (Class 2) or €150,000 (Class 3) and one quarter of the preceding year’s fixed overheads — held as own funds, an insurance policy, or a combination.
How much does MiCA authorisation cost?
Our estimate for external spend from a standing start: roughly €50,000–130,000 for a Class 1 firm, €105,000–290,000 for Class 2 and €180,000–500,000 for Class 3, plus NCA fees that vary by Member State and 60–400 internal staff days. Firms building on an existing regulated entity sit at the bottom of the range.
What does ongoing MiCA compliance cost per year?
Our estimate: €170,000–490,000 for a small Class 1–2 CASP and €660,000–2.3 million for a mid-size Class 2–3 CASP, dominated by compliance staff, with tooling for monitoring, travel rule messaging, surveillance and DORA making up most of the rest.
Are there MiCA application fees?
Yes, set by each national competent authority; they vary from low thousands to tens of thousands of euros depending on the Member State and the services applied for, with annual supervisory fees on top.
How long does authorisation take?
The competent authority has 25 working days to check completeness and 40 working days from a complete application to decide (Article 63). Building the file typically takes several months before that clock starts.
Budget the MiCA compliance cost in three parts: the Article 67 capital you hold, the authorisation project you spend once, and the compliance operation you run every year — and expect the third to be the largest. Scope the licence to the services you will actually run, reuse the management systems you already have, and build the file completely before the 25-day clock starts, because every one of the variable lines is set by decisions you make before the application goes in.
The CASP Authorisation Application Pack, the Article 67 prudential safeguards calculator, the Title V policy and procedure set, the DORA ICT risk framework mapping and the compliance budget model are in the MiCA Toolkit, or start with the free templates.
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026