Authorisation and supervision: the decisions this practice answers
Authorisation and supervision covers one question: who must obtain permission before offering a crypto-asset service, and what a supervisor can demand afterwards. The anchoring regime is Regulation (EU) 2023/1114 (MiCA), in force from 30 December 2024. It sets who needs authorisation, and Regulation (EU) 2023/1113 (TFR) sets what information must travel with a transfer of crypto-assets. This hub sorts the questions that sit under those two regulations and points to the page that answers each one.
What MiCA and TFR change for an operating business
Before MiCA, a business issuing tokens or running an exchange relied on a patchwork of national rules. From 30 December 2024, offering crypto-asset services in the EU without the required authorisation is a breach of Regulation (EU) 2023/1114 (MiCA) itself, not of a national analogue. Alongside it, Regulation (EU) 2023/1113 (TFR) requires originator and beneficiary information to accompany transfers of crypto-assets, in the same way payment transfers already carry that data.
The practical effect is procedural. An unauthorised entity cannot lawfully provide the service at all; an authorised one accepts ongoing reporting, governance and transfer-data duties in exchange for the right to operate.
Where each question is answered
This hub does not resolve any single case. It routes the question to the page built to answer it.
| Question | Answered on |
|---|---|
| Does authorisation as a service provider trigger separate data-protection or AI-related duties? | Data, security and AI obligations overview |
| Does the token's name, logo or interface need protection of its own? | Trade marks, designs and brand portfolios overview |
| Who holds the rights to the code, whitepaper or design behind the token? | Ownership of results |
| Is the object we plan to launch a tokenised right rather than a plain crypto-asset? | Tokenised rights and digital objects |
What to do before applying
- Classify the object first. A tokenised right, a utility token and an asset-referenced token sit under different parts of the same regime.
- Map every jurisdiction where the service will be offered, not only where the entity is registered.
- Assemble the governance file: management structure, safeguarding arrangements, complaint-handling policy.
- Check whether an existing authorisation elsewhere in the EU can be used through the passporting mechanism, before building a parallel file.
- Confirm which transfer-data fields under Regulation (EU) 2023/1113 (TFR) your payment flow already captures, and which it does not.
- Send the assembled file for review before submission, not after a first rejection.
Who decides
The application is assessed by the national competent authority designated under Regulation (EU) 2023/1114 (MiCA) in the entity's home member state. That authority sets its own handling timetable and publishes it in its own procedure; the regulation itself does not fix a single EU-wide processing period.
Common scenarios
If the entity is already authorised in one EU member state and wants to operate in another, the question is passporting, not a fresh application. If the entity has never held authorisation anywhere in the EU, the question is a first application, and the classification step above decides which chapter of the file applies. If the entity only moves funds on behalf of clients without issuing tokens, the transfer-data duty under Regulation (EU) 2023/1113 (TFR) may apply even where full MiCA authorisation does not.
What this hub does not decide
This page names the regime and the routing. It does not classify a specific token, does not calculate a specific fee, and does not draft a specific application file. Those steps depend on the object, the jurisdiction and the current state of the file, and belong to the pages listed above or to a direct review of the file itself.
Verified
Checked against Regulation (EU) 2023/1114 (MiCA), in force from 30 December 2024, and Regulation (EU) 2023/1113 (TFR), in force from the same date. Both are cited from the Official Journal text; no national implementing measure is referenced on this page.
Related publications
A common failure point is a file returned by the supervisor with follow-up questions. That situation is covered separately: When the application file is returned with questions.
FAQ
What does this change in practice?
An entity offering a crypto-asset service in the EU now needs authorisation under Regulation (EU) 2023/1114 (MiCA) before it starts, not after a supervisor notices. Transfers of crypto-assets must also carry originator and beneficiary information under Regulation (EU) 2023/1113 (TFR). Both duties run in parallel, not as alternatives.
Which deadline applies?
There is no single EU-wide processing period. Each national competent authority sets its own handling timetable for applications and publishes it as part of its own procedure. The applicable deadline is the one stated by the authority receiving the specific file.
What do you need from us to start?
A description of the token or service, the jurisdictions where it will be offered, the current governance and safeguarding arrangements, and confirmation of any existing authorisation held elsewhere in the EU. The classification step in this hub determines what else the file needs.