Incorporating a subsidiary in an EU member state is, for most crypto businesses, the easy part. A notary files, a registry number arrives, a lease is signed, a local director is appointed, and the founding team quite reasonably treats the moment as a milestone. Under MiCA it is nothing of the kind. The regulation creates an EU-wide authorisation regime for crypto-asset service providers, with a passport that allows an authorised firm to serve clients across member states, and that authorisation is granted by a national competent authority which is being asked to take supervisory responsibility for how the firm behaves. What the authority is assessing is not whether an entity exists on paper. It is whether the business described in the application will genuinely be run from inside its jurisdiction. That is a much harder thing to produce on demand, and it is where otherwise well-funded applications stall.
Mind and Management, Not a Registered Address
Supervisors use an old piece of shorthand for what they are looking for: mind and management. The question is where the firm actually thinks. Are the decisions that shape the business — which products to offer, which clients to onboard, what risk appetite to run, how to price, when to pull a service — taken in the authorising state, by people who live with the consequences there? Or are they taken in a group headquarters elsewhere and simply executed locally?
An application file can be complete and still answer that question badly. Board minutes that record approvals but no deliberation, a local entity whose committees never disagree with the parent, a risk framework lifted verbatim from a group manual — each is a signal that the substance sits somewhere other than where the licence is being sought. Reviewers probe it in ordinary language: who decided this, and where were they sitting?
Senior Accountability That Survives a Question
Fit-and-proper assessment of management is often read as a background-screening exercise. In practice it is also a capacity test. A senior manager who holds several roles across a group, spends most of the year in another time zone, and cannot describe the local firm’s controls without help is a weak answer regardless of how clean the record is.
The same applies to control functions. Responsibility for compliance, for AML and CFT, and for risk has to rest with identifiable individuals who have the authority and the resources to say no, and to be heard when they do. A compliance officer who can be overruled by commercial pressure from another entity is a job title, not a control. Supervisors are alert to the difference, because they will be dealing with those individuals for as long as the licence exists.
The Limits of Outsourcing Back to the Parent
Outsourcing is permitted and, for a group with real engineering capability, sensible. What outsourcing cannot do is transfer accountability. If development, treasury operations, transaction monitoring, customer support and core ICT all sit with a parent outside the EU, the authorised entity has to demonstrate that it can meaningfully oversee those arrangements — set requirements, monitor performance, audit, and exit if it must. An entity with a handful of staff and no technical depth cannot credibly supervise the systems its whole business depends on.
DORA sharpens this considerably. Its ICT and operational-resilience requirements include managing ICT third-party risk and maintaining a register of information covering ICT arrangements, which forces intra-group dependencies into the open rather than leaving them buried in a service agreement. Preparing these applications involves as much organisational design as drafting; firms such as FINHOLD ADVISORY, which advises crypto and fintech businesses on MiCA, DORA and corporate regulatory matters, are typically asked to test whether a proposed structure can be supervised at all before the intra-group contracts are signed. Once those contracts exist, unpicking them is a negotiation rather than a design choice.
Governance That Holds Under Stress
The most useful way to judge substance is to imagine a bad day. A custody incident, a prolonged ICT outage, a banking partner withdrawing a payment route, a cluster of suspicious transactions that needs a decision within hours. Who acts?
If the honest answer is that the EU entity gathers information and waits for headquarters to decide, the governance is decorative. Substance means delegated authority that is real, escalation paths that have been rehearsed rather than drafted, and local management able to suspend a service or freeze an account without permission from another continent. Resilience requirements point in the same direction: arrangements that have been tested tend to look different from arrangements that have only been written. Applications are read with that distinction in mind.
The Cost of Retrofitting
None of this is impossible to fix after the fact. It is simply expensive. Retrofitting substance means renegotiating group contracts, recruiting genuinely senior people under time pressure in a market where experienced compliance leadership is scarce, relocating functions that were deliberately centralised for efficiency, and rebuilding documentation that has already been submitted. Meanwhile, transitional arrangements that let firms operate under national regimes have been closing, and the resulting queue at national authorities means a file returned with substance questions does not simply resume where it left off.
There is a reputational cost too, harder to quantify but real in the judgement of most practitioners: the first impression a firm makes on a supervisor tends to shape years of interaction.
The lesson is unglamorous. Substance is not a section of the application, it is the operating model the application describes, and the two have to be the same thing. The entity is signage. The business behind it is what gets licensed.
