5 Mistakes CASPs Make When Trying to Satisfy MiCA Prudential Requirements
Published by Mintara Labs | March 10, 2026
We've talked to dozens of CASPs across Europe about their MiCA compliance strategies. The same mistakes keep coming up. Here are the five most common ones and how to avoid them.
1. Assuming Your Existing Insurance Already Covers It
A lot of CASPs already have some form of business insurance. Maybe a cyber policy, maybe D&O, maybe a general professional indemnity policy they bought when the company was set up.
None of these automatically satisfy Article 67.
MiCA lists exact risk categories that need to be covered, and they go well beyond what standard policies address. A compliant policy has to cover acts and omissions resulting in breach of legal obligations, failure to act honestly and fairly towards clients, confidentiality breaches, conflicts-of-interest failures, business disruption, system failures, and gross negligence in safeguarding client assets [1]. Your standard cyber policy covers data breaches and system intrusion. It doesn't cover failure to maintain conflict-of-interest procedures.
On top of that, the regulation requires the insurance to have an initial term of at least one year, a cancellation notice period of at least 90 days, and it has to come from a third-party insurer authorised under EU or national law [1].
What to do instead: Get a specialist broker to review your existing coverage against MiCA's specific requirements, line by line. You might need a purpose-built policy, or you might need endorsements added to what you already have.
2. Underestimating the Deductible Problem
This catches more CASPs off guard than anything else. You arrange a MiCA insurance policy with a EUR 75,000 deductible because it keeps your premium down. Then your NCA tells you they want you to hold EUR 75,000 in own funds to cover that retention.
MiCA doesn't spell this out explicitly. But the regulatory logic is pretty clear: if there's a claim within the deductible range, who pays? You do. And if you don't have the capital to pay, the consumer protection purpose of Article 67 isn't being served.
Several NCAs are taking this conservative position.
What to do instead: When you're structuring your policy, model different deductible levels and how they affect both your premium and your own funds requirement. A lower deductible costs more in premium but means less capital sitting in reserve.
3. Waiting Until the Application Is Ready to Start Insurance Placement
Insurance placement takes time. A straightforward Article 67 policy typically takes four to eight weeks from first conversation to signed policy. But a lot of CASPs treat insurance as the last box to tick, only turning to it in the final weeks before they submit.
The problem: carriers need information before they'll give you a quote. ESMA's regulatory technical standards require applicants to provide a description of their prudential safeguards, including forecast calculations and a copy of the signed insurance agreement [2]. Gathering the data carriers need (service descriptions, custody arrangements, security setup, financials, AUM) takes time. Carrier review takes time. Negotiation takes time.
What to do instead: Start the insurance conversation in parallel with your other MiCA prep. Don't do it sequentially. The information your broker needs overlaps a lot with what your NCA will ask for anyway.
4. Going to a Generalist Broker
Your company probably has an existing broker for office insurance. Maybe employer's liability, maybe fleet coverage. The natural thing to do is call them and say "we need MiCA insurance."
Most generalist brokers have never placed a crypto-specific insurance policy. They don't have relationships with the specialist carriers that underwrite this risk. Marsh, for example, built their MiCAssure product specifically through Marsh Specialty working with Lloyd's and London market insurers [3]. Those aren't relationships that a regional commercial broker typically has access to.
What to do instead: Go directly to a broker with a track record in digital asset insurance. Ask which carriers they work with for MiCA policies specifically. Ask how many Article 67 policies they've placed. If the answer is "none, but we're looking to get into this space," keep looking.
5. Treating Insurance and Own Funds as Either/Or
Article 67(4) presents two options: own funds or an insurance policy or comparable guarantee [4]. A lot of CASPs read this as a binary choice and go all in on one path.
In practice, the combination approach is usually the strongest. The safeguard requirements can be met through own funds (CET1 items), through insurance, and many jurisdictions allow a blend of both [5]. Having some own funds shows financial stability. Adding insurance on top signals good risk management and frees up capital.
NCAs tend to look more favourably on applications that demonstrate multiple layers of financial resilience.
What to do instead: Run the numbers on a combined approach. You might find that holding 40-60% of your safeguard requirement in own funds and covering the rest with insurance gives you the best mix of NCA confidence, capital efficiency, and operational flexibility.
The Common Thread
All five of these mistakes come from the same place: treating prudential safeguards as a compliance checkbox instead of a strategic decision.
How you structure your Article 67 compliance affects your capital allocation, how your NCA views your application, your operational flexibility, and your ability to grow. The CASPs that get this right are treating it as a business decision, not just a regulatory one.
Mintara Labs helps European CASPs structure their Article 67 compliance, including insurance placement through Lloyd's and London market brokers. Contact us at sree@mintaralabs.xyz.
Sources
-
Regulation (EU) 2023/1114, Article 67(5) and (6) - Full text via mica.wtf
-
Law Firm Poland, "MiCA in Poland: Guidance on Capital Requirements" (September 2025)
-
Marsh, "Marsh Creates Unique Insurance Solution for Crypto-Asset Service Providers to Comply with Forthcoming EU Regulation" (May 2024)
-
White & Case LLP, "MiCA Regulation: New Regulatory Framework for Crypto-Assets Issuers and Crypto-Asset Services Providers in the EEA"
-
Ramparts, "MiCAR Implementation Update" (November 2025)