The Markets in Crypto-Assets Regulation (MiCA) has applied in full since 30 December 2024, and the Dutch transitional period for existing providers ended on 30 June 2025. Operating a crypto service in the Netherlands without authorisation from the AFM is now a criminal offence, and public token offers without a compliant white paper are prohibited. At the same time, plenty of ordinary business activity involving bitcoin and other crypto-assets needs no licence at all. This checklist draws the line and lists the steps if you are on the regulated side of it.
Usually no authorisation needed
Accepting bitcoin or stablecoins as payment for your own goods or services, typically through a licensed payment processor that converts to euro. Holding crypto on your own balance sheet as treasury. Building software such as a non-custodial wallet where you never control the keys, or analytics tools, provided you do not intermediate transactions. Fully decentralised protocols without an identifiable intermediary, although the perimeter here is contested and the front-end operator is often the one regulators look at. Even here, two things still apply: tax and accounting treatment, and the Wwft if you are already an obliged entity for other reasons.
Authorisation needed: crypto-asset service providers
You need a MiCA authorisation from the AFM, with DNB involvement on prudential matters, if for clients you exchange crypto for fiat or other crypto, provide custody and administration, operate a trading platform, execute orders, place crypto-assets, receive and transmit orders, give advice, manage portfolios or provide transfer services. The application requires a programme of operations, governance and fit-and-proper tests for management and shareholders, capital between EUR 50,000 and EUR 150,000 depending on the services, ICT and security arrangements, client-asset segregation, complaint handling, conflict-of-interest and market-abuse procedures, and a Wwft programme. Once authorised, you can passport the services across the EU.
White paper needed: offering a token to the public
Offering a crypto-asset to the public or seeking admission to trading requires a white paper that is notified to the AFM and published, with mandatory content on the project, the rights attached, the technology and the risks, plus marketing rules and a 14-day withdrawal right for retail buyers. Utility tokens that give access only to an existing service, and free airdrops, have exemptions, but the conditions are narrow. If the token references other assets or a single fiat currency, it is an asset-referenced or e-money token, and issuance requires an authorisation (or a credit or e-money institution licence) with reserve, redemption and governance rules. Large stablecoins fall under direct EBA supervision.
The two layers people forget
The travel rule. Under the recast Transfer of Funds Regulation, every transfer by a crypto-asset service provider must carry originator and beneficiary information, including for transfers to and from self-hosted wallets above a threshold, with verification duties. Your transaction flow and your choice of travel-rule vendor are part of the authorisation file. The Wwft. Customer due diligence, beneficial-owner identification, transaction monitoring, sanctions screening and reporting of unusual transactions to FIU-Nederland apply from day one, and the new EU AML Regulation tightens them from July 2027.
In what order
First, a perimeter analysis: map each planned activity to MiCA, PSD2 and the Wwft and decide what to do, what to outsource to a licensed partner and what to redesign. Second, the governance and control framework, because the policies are most of the file. Third, the application or white paper. Fourth, contracts with custody, travel-rule and liquidity partners that reflect the regulatory allocation. If you want the perimeter analysis for your product, send us a short description of what users can do with it.