From rulebook to market architecture: MiCAR 1.0, the emerging MiCAR 2.0, MISP and the EU–UK–US divide

EU RegCORE Client Alert | EU Digital Single Market, financial services and crypto-assets

QuickTake

The Markets in Crypto-Assets Regulation (MiCAR) was designed to bring crypto-assets and crypto-asset services within a common European Union (EU) regulatory perimeter. The next stage goes beyond extending that perimeter to deciding how digital money, intermediated and decentralised services, tokenised financial instruments, market infrastructure and the failure of critical institutions fit together. As explored in our separate series of Client Alerts, the September and October 2026 consultations, opinions and supervisory programmes increasingly expose that second-order question.

Three recent developments are decisive. First, on 9 October 2026 the Council agreed the key elements of its position on the Market Integration and Supervision Package (MISP), ahead of a final legislative text. It rejected the Commission's proposed immediate ESMA supervision of every crypto-asset service provider (CASP) in favour of the “most significant cross-border CASPs”, while maintaining a more integrated model for selected trading and post-trading infrastructures. Secondly, the MiCAR review consultation closed on 30 September; responses from the European Banking Authority (EBA), European System of Central Banks (ESCB), European Securities and Markets Authority (ESMA), European Systemic Risk Board (ESRB), Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) and Single Resolution Board (SRB) converge around specific gaps, which MiCAR itself has yet to address. Thirdly, supervisory action is already moving under existing law: ESMA's 8 October opinion calls for CASPs to stop services involving non-compliant stablecoins and to remediate existing client exposures promptly.

Developments outside the EU have also moved. The United Kingdom (UK) authorisation gateway opened on 30 September 2026 for a regime principally commencing on 25 October 2027. In the United States (US), the enacted GENIUS Act is being populated by proposed prudential rules, notably the Federal Reserve’s 29 September 2026 notice; the Securities and Exchange Commission (SEC) proposed a cryptocustody regime for advisers and funds on 1 October 2026; and the Commodity Futures Trading Commission (CFTC) published an advance notice of proposed rulemaking (ANPRM) on market structure on 13 October 2026. The SEC’s September tokenised-stock exemption and the CFTC’s passive-software relief remain narrower, conditional routes under existing legislation.

Our central reading is that firms should stop organising implementation around a supposed single future “MiCAR 2.0”. A defensible operating model has at least four distinct legal layers: the token’s classification and holder’s rights; the issuer’s balance sheet and reserves; the service and the supervisor with jurisdiction; and the infrastructure through which ownership, collateral and settlement become legally effective. A token moving on a ledger does not, by itself, move each of those four legal relationships. This Client Alert examines those layers across the EU, UK and US and distinguishes binding law, supervisory expectations and policy proposals.