ESMA Technical Standards Under MiCA: The Operational Details That Define Compliance
While MiCA establishes the legislative framework for crypto-asset regulation in the EU, the European Securities and Markets Authority (ESMA) provides the granular operational detail through regulatory technical standards (RTS) and implementing technical standards (ITS). These standards translate MiCA’s principles into specific, actionable requirements — defining exactly how CASPs must apply for authorization, what white papers must contain, how sustainability information must be disclosed, and how market abuse must be detected and reported.
For compliance practitioners, ESMA’s technical standards are where MiCA becomes operational. The regulation tells you what to do; the technical standards tell you how to do it.
ESMA’s Role Under MiCA
Mandate and Authority
MiCA grants ESMA extensive mandates to develop technical standards, guidelines, and opinions:
- Regulatory Technical Standards (RTS): Binding standards that specify the technical details of MiCA’s provisions. RTS are developed by ESMA and adopted as delegated acts by the European Commission.
- Implementing Technical Standards (ITS): Standards that specify uniform conditions for implementing MiCA. ITS are adopted as implementing acts by the Commission.
- Guidelines: Non-binding but authoritative guidance on how NCAs and market participants should apply MiCA. While not legally binding, NCAs must comply on a “comply or explain” basis.
- Opinions and Q&As: Interpretive guidance on specific MiCA provisions.
Standards Development Process
ESMA’s standards development follows a structured process:
- Consultation paper: ESMA publishes a draft standard with explanatory text and seeks public comment (typically 3-month comment period)
- Review of responses: ESMA reviews all consultation responses and publishes a feedback statement
- Final report: ESMA publishes the final standard with a final report explaining any changes from the consultation draft
- Commission adoption: The European Commission reviews and adopts the standard (with or without modifications)
- Publication: The standard is published in the Official Journal and enters into force
Key Technical Standards
CASP Authorization Standards
RTS on CASP Authorization Application:
ESMA’s RTS on the CASP authorization application specifies:
- The standard forms and templates for authorization applications
- The information to be provided for each type of crypto-asset service
- The format and content of the business plan
- The information required regarding the governance arrangements, internal control mechanisms, and risk management procedures
- The format for providing information about qualifying shareholdings
- Templates for demonstrating own funds compliance
Key requirements from the authorization RTS:
- Management body: Detailed requirements for demonstrating the collective suitability of the management body, including knowledge matrix templates, time commitment assessments, and diversity policies
- Internal control functions: Specific requirements for the compliance function, risk management function, and internal audit function (where required based on proportionality)
- IT systems: Detailed requirements for describing the technology infrastructure, including system architecture, security protocols, and business continuity arrangements
- Outsourcing: Specific information about outsourced functions, including the identity of service providers, the scope of outsourced activities, and the oversight arrangements
White Paper Standards
RTS on Crypto-Asset White Paper Content:
The white paper RTS specifies detailed content requirements organized into mandatory sections:
- General information about the issuer: Legal form, registration details, management body, business activities, financial condition
- Information about the crypto-asset: Technical description, rights attached, functionality, utility, standards used
- Information about the offer: Terms, pricing, distribution method, use of proceeds
- Information about the DLT: Consensus mechanism, validation process, key design features, scalability, interoperability
- Risk information: Technology risks, market risks, legal risks, issuer-specific risks
- Sustainability information: Energy consumption and environmental impact data
The sustainability disclosure requirement is particularly detailed:
- Estimated annual energy consumption of the consensus mechanism (in kWh)
- Climate and environmental impacts of the consensus mechanism
- Whether the DLT uses a proof-of-work, proof-of-stake, or other consensus mechanism
- Information on the principal adverse sustainability impacts
Market Abuse Standards
RTS on Market Abuse Detection and Reporting:
ESMA’s market abuse standards for crypto-asset markets establish:
- Suspicious transaction and order reports (STORs): Procedures for CASPs operating trading platforms to detect and report suspicious orders and transactions
- Insider dealing indicators: Specific indicators that may suggest insider dealing in crypto-assets
- Market manipulation indicators: Specific indicators for wash trading, spoofing, layering, pump-and-dump schemes, and other manipulation techniques
- Inside information disclosure: Procedures for issuers to identify, handle, and disclose inside information
Practical requirements:
- Trading platforms must implement real-time surveillance systems capable of detecting the specified manipulation indicators
- Surveillance must cover both order book activity and completed transactions
- STORs must be filed with the NCA without delay upon detection
- Trading platforms must maintain detailed records of surveillance alerts, investigations, and STOR filings
Conduct of Business Standards
RTS on Best Execution:
For CASPs executing client orders, the best execution RTS specifies:
- Factors to consider: price, costs, speed, likelihood of execution and settlement, size, nature, and any other relevant consideration
- The weight to be given to each factor based on the client type (retail vs. professional)
- How to assess the quality of execution obtained
- Annual reporting requirements on execution quality (top five execution venues, quality metrics)
RTS on Conflicts of Interest:
- Categories of conflicts of interest that CASPs must identify
- Organizational measures to prevent and manage conflicts
- Disclosure requirements when conflicts cannot be adequately managed
- Requirements for CASPs operating trading platforms that also execute orders or provide other services
Prudential Standards
RTS on Own Funds:
The own funds RTS specifies:
- The method for calculating own funds, including the composition of eligible items
- The method for calculating the fixed overhead requirement (one quarter of previous year’s fixed overheads)
- Deductions from own funds
- Prudential reporting templates and frequencies
RTS on Client Asset Safeguarding:
For CASPs providing custody services:
- Segregation requirements for client crypto-assets
- Requirements for custody wallets (operational wallets vs. cold storage)
- Insurance requirements or equivalent guarantees
- Record-keeping requirements for client asset positions
- Reconciliation procedures
Implementation Challenges
Technical Complexity
ESMA’s technical standards impose requirements that demand significant technology investment:
- Market surveillance systems: Real-time monitoring of trading activity across multiple asset types and trading venues
- Reporting infrastructure: Automated generation of prudential reports, transaction reports, and suspicious activity reports
- Risk management systems: Integrated risk management covering market risk, credit risk, operational risk, and liquidity risk
- Data management: Comprehensive data governance to ensure accuracy, completeness, and timeliness of regulatory data
Proportionality
ESMA has incorporated proportionality principles into many of its standards, recognizing that the same requirements cannot be applied identically to a large exchange and a small advisory firm. However, the application of proportionality is itself complex:
- CASPs must document their proportionality assessment
- NCAs retain discretion to require enhanced measures regardless of proportionality
- The “simplified regime” for smaller CASPs still imposes substantial requirements
Cross-Standard Interactions
MiCA technical standards interact with standards under other EU regulations:
- DORA (Digital Operational Resilience Act): ICT risk management, incident reporting, and third-party risk management standards apply to CASPs as financial entities
- Transfer of Funds Regulation (TFR): Travel Rule standards require CASPs to collect and transmit originator and beneficiary information
- AMLD/AMLR: AML/CFT requirements under the EU’s AML framework apply to CASPs
Compliance teams must manage these interactions holistically — MiCA compliance in isolation is insufficient.
What This Means for Your Business
For CASPs preparing authorization applications: Use ESMA’s standardized forms and templates as part of the CASP licensing process. Deviation from the prescribed format creates processing delays. Engage legal counsel experienced with ESMA standards to ensure your application meets every technical requirement.
For compliance officers: Build your compliance monitoring program around ESMA’s specific indicators and requirements. The market abuse surveillance system must be operational from day one of authorization — it is not something that can be implemented gradually.
For technology teams: ESMA’s technical standards drive significant technology requirements. Invest in systems that automate regulatory reporting, surveillance, and record-keeping. Manual compliance with ESMA’s data-intensive requirements is not sustainable at scale.
For white paper authors: Follow ESMA’s prescribed content structure precisely. The sustainability disclosure requirements are mandatory and require specific data points that must be calculated or estimated using recognized methodologies. Engage environmental consultants if necessary.