MiCA explained

MiCA regulates two groups. Issuers of asset-referenced tokens and e-money tokens — the stablecoin category — face reserve, redemption and disclosure requirements. Crypto-asset service providers, covering custody, exchange, transfer, order execution and advice, face authorisation, governance, safeguarding and conduct requirements.

It deliberately leaves gaps. Fully decentralised arrangements with no identifiable provider, and assets that are already financial instruments under existing securities law, sit outside it — the latter because they were already regulated elsewhere.

An authorised provider must safeguard client assets separately from its own, maintain governance and fit-and-proper management, hold prudential capital, publish clear disclosures and complaints procedures, and operate market-abuse controls.

For custody specifically, the segregation and liability provisions are the substantive change: client crypto must be held so that it is distinguishable from the firm's own assets, and providers are liable for loss of client assets within defined limits.

• Authorisation in one member state, passported EU-wide
• Client assets segregated from the firm's own
• Prudential capital and governance requirements
• Clear disclosure, complaints and conflict-of-interest rules
• Reserve and redemption rules for stablecoin issuers

The visible effects are fewer, better-documented options and clearer paperwork. Some tokens were delisted for European users because their issuers did not meet the stablecoin requirements, and some offshore platforms restricted EU access rather than seek authorisation.

The less visible effect matters more: an authorised provider must be able to demonstrate where your assets are and how they are protected, and there is a supervisor to complain to when it cannot.

Authorised providers appear in registers maintained by national competent authorities and at EU level. The register entry names the legal entity and the services it is authorised for, which is the detail to verify — authorisation for exchange is not authorisation for custody.

Match the entity name in the register against the entity named in the terms you are signing. A group can contain both authorised and unauthorised entities, and the one you contract with is the one that counts.

Anti-money-laundering obligations, the transfer-of-funds rules that require originator and beneficiary information to travel with a transaction, DAC8 tax reporting and national consumer-credit law all continue to apply alongside it.

So a provider that is MiCA-authorised is not thereby authorised for everything it might offer. Lending, payment services and account issuance each carry their own permissions, which is why serious providers list them separately rather than gesturing at 'regulation'.