Hiring for a MiCA Licence: Roles You Need Before You Apply
Last updated: 11 November 2026
Key takeaways
- MiCA licence hiring starts with the management body, which must be of good repute and have the right knowledge, skills and experience under Article 68(1).
- Plan for compliance, AML, risk and IT security roles before you apply; the regulator assesses the people named in the application.
- Article 59(2) requires the place of effective management in the EU and at least one director resident in the EU.
- DORA has applied to MiCA-authorised CASPs since 17 January 2025, so IT and information security is a key function.
- Outsourcing is allowed under Article 73, but the CASP stays fully responsible to its clients.
MiCA licence hiring is the part of the application that founders often start too late. The Markets in Crypto-Assets Regulation (MiCA) authorises crypto-asset service providers (CASPs) on the basis of documents and people, and the regulator looks closely at both. If the management body or key functions are weak, missing or based outside the EU, the application slows down or fails.
This guide is for founders and COOs of crypto firms preparing a MiCA CASP application. It covers the roles to have in place or committed, the suitability and EU presence rules, and how to plan the hiring.
The roles to have in place or committed
Smaller firms can combine some roles, but each combination should make sense for the firm's size and avoid conflicts. For combining compliance and AML, see Compliance Officer vs MLRO: Do You Need Both?.
The management body: good repute and competence
MiCA Article 68(1) requires members of the management body to be of sufficiently good repute and to have the appropriate knowledge, skills and experience, both individually and collectively, to perform their duties. People convicted of money laundering or terrorist financing offences, or other offences affecting good repute, cannot be members.
The joint EBA and ESMA guidelines on suitability under MiCA add that each member must be able to commit sufficient time to the role. Under Article 63, a competent authority must refuse authorisation if the management body does not meet the Article 68(1) criteria. For what regulators typically check, see Key Function Holders: What Regulators Check Before Approving a Hire.
EU presence: where your people must be
Article 59(2) requires a CASP authorised under Article 63 to have:
- a registered office in a Member State where it carries out at least part of its crypto-asset services;
- its place of effective management in the EU;
- at least one director resident in the EU.
The place of effective management is where the key management and commercial decisions are taken. A management body based mostly outside the EU, with one local director who does not take real decisions, is likely to draw questions. Plan where your key people will live and work before you name them in the application.
Compliance, AML and risk
The compliance and AML leads usually write or own the policies the regulator reviews. They need crypto-specific knowledge:
- The travel rule. Under Regulation (EU) 2023/1113, from 30 December 2024, information about the originator and beneficiary must accompany crypto-asset transfers between service providers.
- Market abuse. Under Article 92, any person professionally arranging or executing transactions in crypto-assets must have effective arrangements, systems and procedures to prevent and detect market abuse, and report reasonable suspicions without delay.
- Client protection. Article 70 requires CASPs that hold clients' crypto-assets or funds to protect clients' ownership rights and prevent their use for the CASP's own account, and Article 71 requires effective and transparent complaints-handling procedures.
For the compliance lead role, see Hiring a Head of Compliance for a Crypto Company Applying for a Licence.
IT and information security under DORA
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, has applied since 17 January 2025 and covers crypto-asset service providers authorised under MiCA. That makes ICT risk management, incident handling, resilience testing and third-party ICT risk part of the CASP's regulatory obligations. The person who owns IT and information security should have experience in a regulated environment, not only in product engineering.
Outsourcing is not a substitute for people
Article 73 allows CASPs to outsource services or activities under a written agreement and an outsourcing policy that covers contingency plans and exit strategies. The CASP remains fully responsible to its clients, and outsourcing cannot change its obligations or its authorisation conditions. In practice, a CASP can outsource parts of compliance, AML operations or IT, but it still needs competent people inside the firm who own and oversee that work.
Planning your MiCA licence hiring
The competent authority checks whether an application is complete within 25 working days of receiving it under Article 63. Weak or missing information on key people can stop the clock and delay the assessment. Work backwards from the target submission date:
- Fix the Member State and the location of effective management.
- Confirm the management body and at least one EU-resident director.
- Hire or commit the compliance and AML leads early enough to write the policies.
- Add risk and IT security leads with regulated experience.
- Prepare each person's fit and proper documents in parallel with the application.
Interview questions for MiCA roles
- For directors: "Which decisions will you take personally in the EU, and how will you show the regulator that effective management is here?"
- For compliance: "Which documents did you write for your last EU application, and what did the regulator ask about them?"
- For AML: "How would you meet the travel rule for transfers to a provider that does not support it?"
- For risk: "What would market abuse monitoring look like in our first year, and who would review the alerts?"
- For IT security: "What would you need in place on day one to meet DORA's incident reporting and third-party ICT risk expectations?"
Answers that name concrete steps, documents and owners are a good sign. Answers that describe frameworks only in general terms suggest the candidate has not done the work in a regulated crypto firm.
What we recommend
- Map every role the application needs and where each person will be based.
- Prioritise people with experience of an EU financial services application.
- Test crypto-specific knowledge, not only general compliance or AML.
- Treat IT and information security as a key function from the start because of DORA.
- Use outsourcing for capacity, not as a replacement for accountable people.
For the full order of first hires for a licence application, with interview questions and a planning worksheet, see our free First Hires Playbook.
The bottom line
MiCA licence hiring is part of the application itself: the regulator assesses the management body's repute and competence, expects effective management and an EU-resident director in the EU, and looks for real ownership of compliance, AML, risk and IT security. Start hiring before you start drafting. Hirexel recruits management, compliance, AML, risk and operations hires for crypto firms preparing MiCA applications.
Sources
- ESMA, MiCA interactive single rulebook, Article 59 (Authorisation): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-59-authorisation
- ESMA, MiCA interactive single rulebook, Article 62 (Application for authorisation): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-62-application-authorisation-crypto
- ESMA, MiCA interactive single rulebook, Article 63 (Assessment of the application): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-63-assessment-application
- ESMA, MiCA interactive single rulebook, Article 68 (Governance arrangements): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-68-governance-arrangements
- ESMA, MiCA interactive single rulebook, Article 73 (Outsourcing): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-73-outsourcing
- ESMA, EBA and ESMA publish guidelines on suitability of management body members and shareholders for entities under MiCA: https://www.esma.europa.eu/press-news/esma-news/eba-and-esma-publish-guidelines-suitability-management-body-members-and
- Regulation (EU) 2022/2554 (DORA): https://eur-lex.europa.eu/eli/reg/2022/2554/oj
- FIAU Malta, Travel Rule Guidelines (December 2024): https://fiaumalta.org/app/uploads/2024/12/Dec-2024-Travel-Rule-Guidelines.pdf
Free first hires plan · 60 seconds
Starting a business or expanding to a new country? See who to hire first.
Answer three questions and get your plan for a new licence or a new market in crypto, fintech or iGaming: which roles, in what order, and what your regulator checks.
Hiring for your team?
See the roles we hire, the searches we have closed and how we screen candidates in your industry.
iGamingiGaming recruitmentAccount managers, VIP and CRM, affiliate, promo, payments Crypto and Web3Crypto recruitmentMLRO and compliance, business development, operations FintechFintech recruitmentCompliance, fraud and payments risk, sales, C-level Compliance and AMLCompliance recruitmentMLROs, heads of compliance, compliance officers, legal
Recruitment for fintech, crypto, blockchain and iGaming companies: commercial, account management, marketing, compliance, payments, operations and executive roles.
Send us the job descriptionSiliconSea LP (SL036312), 5 South Charlotte Street, Edinburgh, doing business as Hirexel HR Agency.
Proxima Eight FZE LLC, Business Centre, Sharjah Publishing City Free Zone, United Arab Emirates. Hirexel is a recruitment brand by Proxima Eight.
© 2026 Hirexel