MiCA testing requirements for crypto-asset service providers
MiCA, Regulation (EU) 2023/1114, sets EU authorisation and conduct rules for crypto-asset service providers (CASPs) and token issuers, and every CASP transitional period ended by 1 July 2026. MiCA testing verifies client position registers, on-chain segregation, order price controls, and travel rule data under Regulation (EU) 2023/1113. FintechAssuranceLabs produces article-mapped test evidence.
- Jurisdiction
- EU (directly applicable in all Member States)
- Primary source
- eur-lex.europa.eu
Engineering interpretation of testing requirements, not compliance advice.
What MiCA and the transfer of funds rules require
Regulation (EU) 2023/1114 was published in the Official Journal on 9 June 2023 (MiCA text on EUR-Lex, checked on 2026-09-16). Under Article 149, Titles III and IV on asset-referenced tokens and e-money tokens apply from 30 June 2024, and the rest of the Regulation from 30 December 2024.
Status on 2026-09-16. Article 143(3) let crypto-asset service providers that operated under national law before 30 December 2024 continue until 1 July 2026, or until authorisation was granted or refused. Member States could shorten it; ESMA's list shows 6 months for the Netherlands. The ESMA statement of 17 April 2026 sets 1 July 2026 as the end of the transitional period across the EU, so on 2026-09-16 no CASP transitional period remains. After that date, an entity serving EU clients with crypto-asset services without a MiCA licence is in breach of EU law. One date remains: by 31 December 2027, trading platforms publish white papers for crypto-assets admitted before 30 December 2024 (143(2)(b)).
The requirements that change test scope for a crypto-asset service provider (CASP):
- Authorisation, Articles 59 to 63. Article 3(1)(16) lists ten crypto-asset services, including custody, trading platforms, exchange, and transfer services. The application includes technical documentation of ICT systems and security arrangements (62(2)(j)) and the procedure for segregation of client crypto-assets and funds (62(2)(k)). The authority decides within 40 working days of a complete application (63(9)).
- Governance and records, Article 68. Continuity relies on resilient ICT systems and on the continuity, response, and recovery plans of DORA Articles 11 and 12 (68(7)). Records of all services, orders, and transactions are kept for 5 years, or up to 7 years on request (68(9)). Delegated Regulation (EU) 2025/1140 specifies those records.
- Client assets, Articles 70 and 75. Client funds reach a credit institution or central bank by the end of the next business day (70(3)). Custodians keep a register of positions per client (75(2)), credit rights from forks and similar events (75(4)), send a statement of position at least every three months (75(5)), and hold client crypto-assets separately from their own on the distributed ledger (75(7)).
- Trading and exchange, Articles 76 to 78. Trading systems handle peak order and message volumes, reject orders above pre-determined volume and price thresholds, and are fully tested for both (76(7)(b), (d), and (e)). Final settlement on the ledger starts within 24 hours of execution (76(12)). Exchange providers execute at the price displayed when the order is final (77(3)).
- Market abuse, Article 92. Any person who professionally arranges or executes crypto-asset transactions detects suspicious orders and transactions and reports them without delay. Delegated Regulation (EU) 2025/885 sets the systems and the report template.
Regulation (EU) 2023/1113, the recast transfer of funds regulation, applies the travel rule to crypto-asset transfers from 30 December 2024 (Article 40). The originator's CASP sends the originator and beneficiary information of Article 14(1) and 14(2) before or with the transfer (14(4)) and does not initiate or execute the transfer before it meets every Article 14 obligation (14(8)). For a transfer above EUR 1,000 to a self-hosted address, the CASP assesses whether the originator owns or controls that address (14(5)). The beneficiary's CASP detects missing information (16(1)) and rejects, returns, or requests the information before it credits the crypto-assets (17(1)). EBA Guidelines EBA/GL/2024/11 add detail from 30 December 2024.
MiCA requirements that testing verifies
| Requirement | What we test | Evidence produced |
|---|---|---|
| MiCA Article 75(2): a register of positions per client records movements | Each synthetic client balance against the sum of its deposit, withdrawal, trade, and fee entries | Register-of-positions reconciliation report per test client |
| MiCA Article 75(7): client crypto-assets are held separately from own holdings on the ledger | Client and house wallet balances after fee collection, gas top-ups, and hot-to-cold wallet sweeps | On-chain segregation check with wallet addresses and balances per test run |
| MiCA Article 75(4): clients receive crypto-assets created by a fork or similar event | Crediting of a simulated fork or airdrop on a test network against client positions at the event block | Entitlement calculation per client with the event block height |
| MiCA Article 77(3): orders execute at the price displayed when the order is final | A price change between the displayed quote and client confirmation, and confirmation after quote expiry | Quote-to-execution price comparison log |
| MiCA Article 76(7)(d): orders above volume and price thresholds are rejected | Orders at and above each price band and size limit, through the web interface and the API | Order rejection test cases with the threshold value per trading pair |
| Regulation (EU) 2023/1113 Article 14(1), 14(2), and 14(8): a crypto-asset transfer does not execute without complete travel rule information | Withdrawals to another CASP with each required originator and beneficiary field left empty in turn | Travel rule payload capture and the block decision per test withdrawal |
| Regulation (EU) 2023/1113 Article 14(5): a transfer above EUR 1,000 to a self-hosted address triggers an ownership assessment | Withdrawals valued just below and just above EUR 1,000 at the conversion rate the platform applies | Self-hosted address threshold decision table |
| Regulation (EU) 2023/1113 Article 17(1): an incoming transfer with missing information is rejected, returned, or held for information | Incoming test transfers with no travel rule message, a late message, and a message with a missing beneficiary name | Incoming transfer handling log per missing field |
The crypto deposit reorg testing guide covers the confirmation thresholds behind register entries.
Artifacts a competent authority requests
A national competent authority, an AML supervisor, or a banking partner typically requests:
- technical documentation of ICT systems and security arrangements, with a description in non-technical language (62(2)(j));
- the segregation procedure for client crypto-assets and funds, and the custody policy (62(2)(k), 62(2)(m), 75(3));
- trading platform operating rules, the market abuse detection system description, and the exchange pricing methodology (62(2)(n), 62(2)(o));
- the business continuity policy with ICT continuity, response, and recovery plans under DORA Articles 11 and 12 (68(7));
- records of services, orders, and transactions for 5 years, and order data for at least 5 years (68(9), 76(15));
- the orderly wind-down plan (74);
- suspicious order and transaction reports (92(1));
- travel rule records for 5 years, and reports on CASPs that repeatedly fail to send required information (Regulation (EU) 2023/1113 Articles 26(1) and 17(2)).
Common MiCA and travel rule findings
- Gas top-up from the house wallet. The platform sends its own ETH into client omnibus wallets for network fees and never records or recovers it. Client and house assets mix on the ledger, which breaks Article 75(7).
- Airdrop credited to the house balance. A token airdropped to the omnibus wallet stays in the platform's own balance and never reaches client positions. The defect breaks Article 75(4).
- Re-quote at confirmation. The client confirms at the displayed price, and the service re-prices the order during settlement with no notice. The defect breaks Article 77(3).
- Price band enforced in the interface only. The web interface blocks an order 40% from the last trade price, and the API accepts it. The defect breaks Article 76(7)(d).
- Transfer broadcast before the travel rule message. The withdrawal service signs and broadcasts the on-chain transaction, and the message to the beneficiary's CASP fails later without a retry. The defect breaks Regulation (EU) 2023/1113 Article 14(4) and 14(8).
- Stale rate on the EUR 1,000 check. The self-hosted address check converts the amount at a rate cached hours earlier, so a withdrawal worth more than EUR 1,000 skips the ownership assessment. The defect breaks Article 14(5).
- Deposit credited while information is missing. An incoming transfer from another CASP is credited on confirmation, before the travel rule message arrives. The defect breaks Regulation (EU) 2023/1113 Article 17(1).
How we cover MiCA testing
Crypto exchange and wallet testing covers Articles 75(2), 75(4), and 75(7) and the travel rule withdrawal checks. It delivers a "Deposit and withdrawal test suite per supported chain" and a "Custody and signing workflow test report".
Trading and investment platform testing covers Articles 76(7), 76(12), and 77(3) with the "Order lifecycle test suite (place, amend, cancel, partial fill, reject)". KYC, AML and fraud testing covers Regulation (EU) 2023/1113 through the "Transaction monitoring rule test matrix". The AML and KYC testing requirements page covers the customer due diligence rules that Article 14(7) relies on.
Audit and certification test evidence builds a "Requirement-to-test traceability matrix" from these articles to test results, and a "Gap report before the assessment". Article 68(7) points to DORA for ICT continuity; the DORA testing requirements page covers failover and recovery tests.
We test MiCA and travel rule requirements for crypto exchanges and wallets, trading apps with crypto, neobanks that offer crypto-assets, and robo-advisors with crypto portfolios. We do not prepare authorisation applications or legal opinions.
Related
Services
Segments
Adjacent standards
Questions
What is MiCA?
What is a MiCA license?
How to check a MiCA licence?
Scope your testing
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing