MiCA Is Two Years Old and the European Commission Is Already Asking If It Needs Replacing

The ink on MiCA was barely dry before the cracks started showing. The Markets in Crypto-Assets Regulation came into full effect in late 2024. By May 2026, the European Commission has opened a formal consultation asking whether the framework needs a revamp. That is not normal. Regulatory frameworks do not usually get questioned two years after implementation unless something has gone wrong, or unless the people who built them have realised the world moved faster than their drafting process.

For operators in crypto, payments, and adjacent high-risk sectors, the instinct will be to treat this as background noise. That would be a mistake. A live consultation on whether the foundational rules governing your business are fit for purpose is not abstract policy. It is a direct signal about where your compliance exposure sits right now and where it is heading.

This is what you need to understand about what is happening, why it matters, and what it means for how you operate.

Why Brussels Is Reviewing MiCA Now

The European Commission framed the consultation as a proactive check. Do not believe that. Regulators do not spend political capital revisiting legislation they are proud of. They do it when the complaints from industry, member states, or internal enforcement teams have reached a volume that cannot be ignored.

The practical problems with MiCA are well documented at this point. The passporting framework looked clean on paper. In practice, operators trying to passport a CASP licence from one member state into others have found wildly inconsistent interpretations of the same rules. What satisfies BaFin in Germany does not always satisfy AMF in France. What CBI in Ireland accepts as adequate AML controls can be challenged in the Netherlands.

Stablecoin rules under MiCA are a separate problem entirely. E-money token and asset-referenced token classification has created compliance overhead that small and mid-size operators cannot absorb. Several firms that entered the EU market on the strength of MiCA's supposed clarity have quietly restructured their token models or pulled products altogether.

Add to that the rapid growth of DeFi, tokenised real-world assets, and AI-driven trading systems, none of which MiCA was designed to address, and you have a framework that is already showing its age.

What the Consultation Is Actually Asking

The Commission's consultation covers several specific areas. Operators should not skim the summary documents. The questions being asked are consequential.

First, whether the CASP authorisation requirements are proportionate. This is a direct response to lobbying from smaller operators who found the capital requirements and governance obligations closer to those of a traditional financial institution than a tech-forward payment or exchange business.

Second, whether the stablecoin provisions are working as intended. Given that several major stablecoin issuers have avoided EU authorisation entirely, and that USDT and USDC continue to dominate European trading volumes despite regulatory ambiguity, the answer is probably no.

Third, whether MiCA needs to be extended to cover asset classes and activity types it currently excludes. DeFi protocols, NFT platforms with financial characteristics, and crypto lending arrangements are all in scope for potential future coverage.

Fourth, and most relevant for payments operators, whether the interaction between MiCA and the Payment Services Directive framework creates unnecessary duplication or conflict for firms that touch both regulated spaces.

The Passporting Problem Is Worse Than It Looks

If you built your EU strategy around registering in a single member state and passporting across the bloc, this consultation should concern you directly.

Passporting under MiCA has not delivered the single market access it promised. Cyprus, Lithuania, and Malta attracted significant volumes of CASP applications partly on the basis that their regulators were more pragmatic. That has worked in some cases. In others, operators holding a valid CASP licence from one of those jurisdictions have found their services challenged, restricted, or subject to additional local requirements in higher-scrutiny member states like Germany, France, and the Netherlands.

The Commission is now looking at whether to tighten the conditions under which passporting operates, which means increasing the baseline requirements at point of authorisation. If that happens, the jurisdictional arbitrage that several operators have relied on disappears. Your licence costs go up. Your operational obligations increase. And the timelines for getting authorised in the first place extend further.

Operators who have not yet locked in their EU structure need to make that decision in the next six to twelve months, before any revised framework comes into effect and before regulators in the more accessible jurisdictions start tightening their own application processes in anticipation of new Commission requirements.

What This Means for Payments Firms Specifically

Payments businesses that handle crypto-adjacent flows have been living in a grey zone since MiCA came into force. If you are an EMI or PI that processes settlements involving crypto assets, moves funds between fiat and digital currencies, or supports clients who operate exchanges or custodial wallets, you have been exposed to regulatory ambiguity that neither MiCA nor PSD2 fully resolves.

The consultation's focus on the MiCA and PSD2 interaction is relevant here. There is a meaningful chance that any revised framework will draw a clearer line between payment service activity and crypto-asset service activity, which could mean that your current licence structure no longer covers the full scope of what you do.

Firms that have been operating on a read of the rules that favours their existing licence structure should get proper legal review of that position now. Not when a revised regulation is published. Not when an enforcement action lands. Now, while there is still time to adjust the structure, the product offering, or the jurisdictional base.

The Travel Rule compliance picture is also unresolved under the current framework, particularly for smaller payment processors that handle crypto flows but are not classified as CASPs. If the revised MiCA tightens those boundaries, firms that assumed they were outside the CASP perimeter may find themselves inside it.

The Timeline Operators Should Be Planning Around

Consultations of this type have a predictable rhythm inside the EU legislative machine.

The consultation period runs through mid-2026. Commission staff will digest responses and produce a report, likely by late 2026 or early 2027. If the Commission decides formal amendments are warranted, a legislative proposal would follow in 2027 at the earliest. Actual implementation of any revised framework would then be two to three years out from that point.

That might sound like a comfortable runway. It is not.

Regulators in individual member states are not waiting for the Commission to finish its process. BaFin, AMF, and the FCA, which is running its own parallel review of the UK's crypto regulatory framework under the Financial Services and Markets Act 2023, are all taking increasingly active positions on enforcement and authorisation standards right now. The formal rules may not change for three years. The way those rules are applied is already shifting.

Operators should also account for the possibility that the consultation produces a narrower outcome than expected: not a wholesale revision of MiCA, but targeted amendments to specific provisions. That kind of partial update creates its own compliance complexity, because it means your legal analysis of the original framework has to be reassessed piece by piece rather than wholesale.

What to Do Before the Framework Shifts

The window between a consultation and a legislative change is the most useful period you have. After that, you are reacting to rules that are already written.

Audit your current structure against MiCA as it stands today, not as you understood it when you first set up. If your passporting strategy depends on a member state whose regulatory posture is likely to harden, identify your fallback now. If you are a payments firm with crypto-adjacent flows, get clarity on whether your current licence classification will hold under a tighter framework.

Engage with the consultation if you have a legitimate position to put forward. Responses from operators who can demonstrate practical, operational experience with MiCA's shortcomings carry weight. This is one of the few moments in the regulatory cycle where your input can actually influence the outcome.

And stop treating regulatory consultation as something your lawyers read and summarise once it is over. The firms that navigate framework changes without serious damage are the ones that tracked the signals early, made structural decisions before the rules locked, and did not wait for an enforcement action to tell them their position was wrong.