MiCA Reset the Market. The Licensed Minority Captures the Transition.

MiCA is usually described as the moment Europe gave crypto a rulebook. That is true, but it understates what actually happened. The Markets in Crypto-Assets Regulation did not simply write rules for the firms already operating. It reset the population of firms permitted to operate at all. The market that existed before MiCA and the market that exists after it are not the same market with better paperwork. They are two different markets, and most of the first one did not make it into the second.

That transition, from a crowded field to a short authorized list, is the single most important fact about the European digital asset market today. It decides who captures the wave of institutional tokenization now arriving.

The number that tells the story

Before MiCA, thousands of firms operated across the EU under a patchwork of national registrations of varying rigor. After MiCA, the picture is far narrower. Of more than 1,200 firms that held pre-MiCA registrations, roughly 210 have secured MiCA CASP authorization across the Union, according to the ESMA register. Approximately one in six.

The instinct is to read that as attrition, a sector shrinking. It is the opposite. The authorized firms are not a smaller version of the old market. They are the firms that could meet a standard the old market never had to. The five out of six that did not clear the bar were not unlucky. They were operating models that the new regime does not permit. The gap between 1,200 and 210 is not a loss. It is the moat.

What the bar actually filters for

A MiCA authorization is not a registration you file for and receive. It is a standard you have to meet and keep meeting. It requires real capital, defined governance, and a set of control functions staffed by individuals who are themselves vetted and approved: risk, compliance, information security, internal audit, anti-money-laundering, and the senior executives accountable for all of it. Regulators assess the people, not just the entity.

This is where the depth is easy to underestimate. It is one thing to describe a compliance function on a slide. It is another to have each control-function role individually assessed and approved by a national competent authority under a fitness-and-probity standard, before the firm is authorized to operate. That process takes years and cannot be compressed with capital alone, because the regulator sets the pace. It is precisely the kind of work that does not photograph well and cannot be skipped.

That is the real reason the authorized list is short. The bar was never the application. It was the institution behind it.

Why the timing makes this decisive

A scarce authorization would matter less if demand were flat. It is not. The institutions now entering tokenization, the banks and asset managers moving real assets on-chain, need licensed rails, and they need them faster than they can build them. Building an authorized European operation from scratch is a multi-year process even for a large institution, and it runs at the regulator’s speed rather than the market’s.

Set that against the demand curve. Boston Consulting Group projects tokenized real-world assets growing from roughly 30 billion dollars today toward as much as 88 trillion dollars by 2035 in its progressive scenario. Whatever the precise figure, the direction is not in doubt, and the capital behind it is institutional. So the market is arriving at a moment when demand for compliant infrastructure is accelerating and the supply of firms authorized to provide it is, by design, small and slow to grow.

Scarce supply, rising institutional demand, a passport that turns one authorization into access across 27 markets. That is the structure of the opportunity, and it favors the firms already inside the authorized list rather than those still queuing to join it.

Replacement cost, not revenue multiple

The right way to value a position in this market is not by projecting near-term revenue. It is by asking what it would cost a competitor to replicate the regulatory standing, in years and in capital, assuming they could get the vetted people at all. A MiCA authorization is not a product feature. It is a replacement-cost asset. Its scarcity is enforced by the regulator, which is the most durable moat there is, because no amount of funding lets a competitor move faster than the authorization process allows.

This reframes what the licensed minority actually owns. It is not a head start on a product. It is a position that the majority of the market is structurally barred from occupying.

Where COSIMO sits in this

We built for this regime deliberately, and we did the work before it was required. Within the group, Black Manta Capital Partners operates as a BaFin-regulated Financial Services Institution (WpIG), with MiFID II passporting across the EEA, which is the authorization that governs tokenized securities. Fortuna Digital Custody is progressing through authorization with the Central Bank of Ireland, which has indicated it is minded to authorize the firm for MiCA CASP status and as a payment institution under PSD2. Those authorizations are pending and not yet effective, and we describe them that way because the difference between granted and pending is the whole point of a regime like this one.

The relevant fact is directional. The group is positioned inside the licensed layer, not waiting outside it, at a moment when that layer is where the transition concentrates.

The takeaway

MiCA did not slow the European market. It concentrated it. The firms that treated regulation as a feature rather than an obstacle, and did the long, unglamorous authorization work ahead of the deadline, now sit in a short list that the arriving institutional capital has to go through. The transition belongs to the licensed minority. That was always the design, and it is now the reality.

Ciarán Hynes is Managing Partner and Co-Founder of COSIMO Digital.