This illustrative scenario examines how a crypto exchange operating in France approached MiCA CASP authorisation before the grandfathering period closed on 1 July 2026. It describes a realistic authorisation strategy, the regulatory milestones involved, and the complications that commonly arise – drawing on current ESMA guidance and the French competent authorities' expectations. The scenario is presented for informational purposes only and does not represent a specific client matter or actual outcome.
Context: The End of the MiCA Transitional Period in France
The Markets in Crypto-Assets Regulation (MiCA) established a transitional grandfathering mechanism allowing existing crypto-asset service providers to continue operating while pursuing formal authorisation. That mechanism expired on 1 July 2026. The European Securities and Markets Authority (ESMA) confirmed in a statement dated 17 April 2026 that no extensions would be granted. A further ESMA public statement issued on 23 June 2026 clarified that any unauthorised CASP must immediately cease onboarding new clients and cease marketing, limit remaining activity to selling or transferring client assets or closing open positions, and proceed to an orderly wind-down. Providing crypto-asset services to EU clients without a valid CASP authorisation is now unlawful.
In France, the competent authorities for CASP authorisation under MiCA are the Autorité des marchés financiers (AMF) and the Autorité de contrôle prudentiel et de résolution (ACPR), which exercise supervisory functions jointly across market integrity and prudential dimensions. By May 2026, approximately 210 full CASP authorisations had been issued across the EU. By 12 August 2026, the ESMA register recorded 325 authorised CASPs. For a French-domiciled exchange, obtaining authorisation before the deadline – or having a credible application well advanced – was therefore not a matter of procedural preference but of operational survival.
If your exchange is assessing its regulatory position in France or another EU jurisdiction, our team is available to discuss the situation. Please reach out to info@ferrazwhitmore.com or visit our contacts page.
Client Profile and Challenge
The entity in this scenario is a mid-sized crypto exchange incorporated in France, offering spot trading, custody, and crypto-to-fiat conversion services to retail and professional clients across several EU member states. Prior to MiCA's full application, the firm had operated under France's pre-MiCA national PSAN (Prestataire de Services sur Actifs Numériques) regime, which gave it a degree of market legitimacy but did not automatically translate into MiCA CASP status.
The challenge was threefold. First, the firm needed to map every service it provided against MiCA's defined categories of crypto-asset services to determine exactly which authorisations were required. Second, it had to demonstrate to the AMF and ACPR that its governance, internal controls, AML/CFT framework, and prudential buffers met the elevated MiCA standards – standards that go materially beyond the PSAN registration requirements. Third, the timeline was compressed: by the time the board formally committed to pursuing full authorisation rather than scaling back EU operations, the ESMA statements of April and June 2026 had already made clear that the deadline was firm.
Strategy and Rationale
The advisory strategy centred on three concurrent workstreams, each addressed in parallel rather than sequentially, to manage timeline risk.
- Service scope determination. The first step was a precise MiCA classification exercise – reviewing each product line against the regulation's enumerated crypto-asset services. This determined which licence categories were sought, avoiding both under-application (regulatory gap) and over-application (unnecessary compliance burden during the authorisation period).
- AML/CFT remediation. MiCA imposes robust AML/CFT obligations on CASPs, including enhanced due diligence on beneficial owners, transaction monitoring calibrated to crypto-specific typologies, and Travel Rule compliance. The firm's existing AML/CFT programme was benchmarked against MiCA requirements and the AMF's supervisory expectations, and a gap-remediation plan was implemented before the application was filed. Inadequate AML/CFT controls are among the most common grounds for authorisation refusal or delay across EU competent authorities.
- Application file preparation. The MiCA application to the AMF required detailed documentation of the firm's governance structure, fit-and-proper assessments for directors and qualifying shareholders, capital and liquidity planning, conflicts of interest policies, custody and safeguarding arrangements, and a client assets protection framework. Each element was prepared with reference to ESMA's published guidelines and the AMF's own communications on its expectations for CASP applicants.
The rationale for pursuing full authorisation – rather than contracting operations to avoid the requirement – was commercial as well as legal. A CASP licence issued by the AMF would allow the firm to passport services across the EU under MiCA's harmonised framework, opening markets that a purely national approach could not access.
Key Milestones
The following milestones reflect the stages typically involved in a CASP authorisation process of this type in France. Precise procedural timelines are subject to the AMF's and ACPR's current practices and the completeness of each application file.
- Internal readiness assessment: Mapping of services, identification of regulatory gaps, board resolution to pursue authorisation.
- AML/CFT programme upgrade: Policy revision, beneficial owner verification procedures, Travel Rule implementation, staff training.
- Pre-application engagement: Preliminary dialogue with the AMF to clarify the scope of services and expected file contents. This step, where the competent authority permits it, can materially reduce the risk of formal completeness objections after filing.
- Application submission: Full application file lodged with the AMF, including all required annexes and supporting documentation.
- Completeness review and supplementary information requests: The competent authority's assessment of whether the file is procedurally complete, followed by substantive review. Requests for supplementary information at this stage are common and require prompt, precise responses.
- Authorisation decision: Formal decision by the AMF / ACPR. The MiCA regulation establishes procedural timelines for competent authorities, though the practical duration depends on file quality and the authority's workload at any given time.
Complications Encountered
Even in a scenario where the firm had prior PSAN registration, several complications arose that are instructive for other applicants.
Governance restructuring. The fit-and-proper assessment under MiCA applies to a broader set of individuals than the firm had previously subject to formal vetting. Several senior managers required reassessment, and the board composition needed adjustment to satisfy independence requirements. This process took longer than anticipated and introduced scheduling pressure on the overall application timeline.
Beneficial ownership documentation. The AMF's expectations around beneficial owner identification – particularly for corporate shareholders with layered holding structures – required engagement with foreign registries and, in one instance, notarised translations of documents from a non-EU jurisdiction. This is a recurrent complication in cross-border group structures and underscores the importance of beginning the documentation exercise early.
Custody and safeguarding arrangements. MiCA imposes specific requirements on how CASPs hold client crypto-assets, including segregation, liability, and insurance or equivalent protection obligations. The firm's existing custodial arrangements required contractual renegotiation with its technology partners before the application could accurately represent the safeguarding framework in place.
The ESMA June 2026 statement. The ESMA public statement of 23 June 2026 created immediate operational tension: the firm was in the application process but not yet authorised, and the statement required all unauthorised CASPs to cease onboarding. Managing client communications, preserving existing relationships within the permitted scope of activity, and maintaining internal morale during a period of operational constraint required careful coordination across legal, compliance, and commercial teams.
Outcome Category
This scenario falls within the category of application-in-progress with operational continuity maintained under restricted conditions. The firm submitted a complete application file ahead of the 1 July 2026 deadline and, following the ESMA June 2026 statement, limited its activities to those permitted for unauthorised CASPs – serving existing clients within the permitted scope while awaiting the AMF's decision. No finding of unlawful conduct was made. The outcome of the authorisation process itself is not represented here, consistent with the illustrative nature of this scenario and the firm's obligations regarding ongoing confidentiality.
For exchanges or crypto-asset businesses at any stage of the MiCA authorisation process, early legal advice on file preparation and AMF/ACPR engagement can reduce both timeline risk and the likelihood of substantive objections. Contact our team at info@ferrazwhitmore.com to discuss your situation, or visit our contacts page for further information. You may also find our dedicated MiCA licensing services page for France a useful starting point.
Three Transferable Lessons
1. Treat the MiCA Deadline as an Operational Risk, Not a Regulatory Formality
The ESMA statements of April and June 2026 confirmed that the 1 July 2026 deadline was absolute. Firms that treated the grandfathering period as an extended runway – rather than a finite window requiring active management – found themselves caught between operational restriction and an incomplete application. The lesson is structural: authorisation timelines should be planned backwards from the regulatory deadline, with contingency built in for documentation delays, governance adjustments, and supplementary information requests from the competent authority.
2. AML/CFT Readiness Is a Prerequisite, Not a Parallel Track
MiCA's AML/CFT requirements – including beneficial owner identification, transaction monitoring, Travel Rule compliance, and the obligations applicable to crypto-asset service providers under the EU AML framework – must be fully implemented before an application is filed, not during the review period. Competent authorities across the EU, including the AMF, have consistently identified inadequate AML/CFT frameworks as a primary ground for delay or refusal. Firms with cross-border group structures should pay particular attention to beneficial owner documentation in layered corporate arrangements, which routinely generates requests for supplementary information. Our AML compliance resources address comparable obligations in other EU jurisdictions and may provide useful comparative reference.
3. Pre-Application Engagement With the Competent Authority Reduces Downstream Risk
Where the AMF's procedures permit preliminary dialogue before a formal application is lodged, that opportunity is worth taking seriously. Pre-application engagement allows the firm to clarify the competent authority's current expectations on specific file elements, identify gaps early, and reduce the probability of a completeness objection that resets the procedural clock. This approach requires preparation – the dialogue must be substantive and based on a sufficiently developed understanding of the application requirements – but it consistently reduces the overall time from decision to authorisation across comparable matters.
The transition to MiCA has materially raised the regulatory bar for crypto-asset service providers in France and across the EU. If your business is navigating the authorisation process, responding to a competent authority request, or assessing the implications of the post-1 July 2026 landscape, our team is available to advise. Please write to info@ferrazwhitmore.com or visit our contacts page. You may also review the latest regulatory developments on our MiCA transition alert for France.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.