DA-03 - Regulating Digital Assets in the European Union and the United Kingdom MiCA, MiFID, FSMA and the Governance Gap

Evelyse Carvalho-Ribas

Abstract

The regulation of digital assets in the European Union and the United Kingdom is often analysed primarily through legislative texts, taxonomies, and formal regulatory perimeters. While statutory frameworks have become considerably more sophisticated — notably through the Markets in Crypto-Assets Regulation (MiCA), the Markets in Financial Instruments Directive (MiFID II), and the UK’s Financial Services and Markets Act 2000 (FSMA) and its post-Brexit amendments — significant legal uncertainty persists in practice. This paper addresses a central structural source of that uncertainty: regulatory outcomes in the digital asset domain are shaped less by the formal content of legal rules than by how those rules are interpreted, prioritised, and enforced by supervisory institutions operating within multi-layer governance systems.1

Digital asset regulation engages overlapping governance layers, including legislative design, administrative and supervisory discretion, inter-institutional coordination, and enforcement strategy. These layers interact dynamically and often asymmetrically across and within jurisdictions. As a result, similar or even functionally identical factual arrangements may produce divergent regulatory outcomes, even within broadly harmonised or convergent legal frameworks such as the EU’s single market for financial services or the UK’s FSMA-based perimeter.2

Adopting a comparative legal and institutional approach, this paper examines how MiCA, MiFID II, and FSMA are applied by European and UK authorities, with particular attention to token and product classification, perimeter assessments, and supervisory prioritisation. Drawing on applied professional practice across multiple jurisdictions, it illustrates how authorities assess governance arrangements, economic substance, and control structures, rather than relying solely on formal legal categories or token labels. The analysis applies the Multi-Layer Governance Framework for Blockchain and Digital Assets (Carvalho-Ribas) to integrate legislative, institutional, and governance perspectives into a single interpretative architecture.3

The practical implications of this analysis are significant for advanced professional audiences. For legal and tax advisers, it highlights the limits of text-based interpretation detached from governance and economic substance. For regulators and supervisory authorities, it offers a structured lens through which institutional practice, prioritisation choices, and cross-border coordination can be assessed and compared. For policymakers, it underscores the importance of aligning legislative design with the operational realities of supervision and enforcement. The paper is intended for an advanced, non-introductory audience, including lawyers, tax advisers, regulators, supervisory authorities, policy designers, and senior compliance officers engaged in the regulation, supervision, or governance of digital asset systems across the EU and UK.

MiCA · MiFID II · FSMA · Digital Assets · Regulatory Interpretation · Supervisory Discretion · Governance Gap · Enforcement Logic · Perimeter Assessment · ESMA · FCA · BaFin · NCA Coordination · Multi-Layer Governance

Definitions

This section establishes the operative definitions used throughout the paper to anchor regulatory interpretation within a coherent analytical framework, ensure continuity with preceding papers in this series, and prevent mischaracterisation of the analysis as compliance guidance, licensing instruction, or jurisdiction-specific regulatory advice. The definitions adopted are functional, governance-oriented, deliberately system-neutral, and designed for comparative institutional analysis across jurisdictions.4

Legislative Architecture vs Supervisory Reality

MiCA, MiFID II, and FSMA represent sophisticated legislative responses to financial innovation, yet each shares a common architectural feature: reliance on interpretation, institutional judgment, and administrative discretion for practical operation. None functions as a self-executing or exhaustive rulebook. Understanding their application to digital assets therefore requires examining how legislative design interacts with supervisory reality, rather than treating statutory text as determinative of outcomes.10

MiCA establishes a harmonised EU framework for crypto-assets and related services through directly applicable regulation, introducing common definitions (ARTs, EMTs, other crypto-assets), issuer and service provider obligations, and supervisory structures. Its architecture is deliberately layered: while core concepts and prohibitions are legislatively fixed, significant operational detail is delegated to Level 2/3 technical standards (RTS/ITS), ESMA guidelines, and national competent authority (NCA) implementation. ESMA published its first consultation package on MiCA implementing measures on 12 July 2023, covering RTS on CASP authorisation content, complaints handling, and conflicts of interest identification and prevention, followed by a second package on 5 October 2023 addressing business continuity, ICT security, and record-keeping requirements.11 MiCA’s effectiveness thus depends on coordinated supervisory interpretation across 27 Member States and ESMA.

MiFID II, originally designed for traditional financial instruments and markets, maintains relevance to digital assets through its functional, activity-based approach that prioritises economic substance over formal labels. Its architecture assumes active supervisory judgment, particularly in perimeter questions about whether tokens constitute transferable securities under Annex I Section C, whether DeFi protocols constitute collective investment schemes, or whether token services amount to investment advice, portfolio management, or placement activities. The absence of digital asset-specific provisions does not limit MiFID’s reach; rather, it creates structured space for NCAs and ESMA to extend existing concepts to novel arrangements through guidance, Q&As, and enforcement practice.12

FSMA provides the UK’s principles-based statutory foundation, characterised by broad perimeter concepts (“carrying on regulated activities in the UK”) and extensive rulemaking powers delegated to the Financial Conduct Authority (FCA). Post-Brexit, FSMA’s architecture has been strengthened through the Financial Services and Markets Act 2023 (Royal Assent 29 June 2023), which transferred retained EU law (including MiFID implementing measures) to FCA rulemaking while maintaining activity-based tests. Section 69 and Schedule 6 of the 2023 Act provide the mechanism for bringing crypto-related activities within the FSMA regulatory perimeter through amendments to the Regulated Activities Order (RAO).13

Blockchain and Web3 systems intensify reliance on supervisory judgment because they challenge the categorical assumptions of traditional legislative design. These systems integrate multiple functions — settlement infrastructure, programmable money, governance participation, investment exposure, yield generation — within unified architectures while operating across borders in territorially ambiguous ways. Legislative instruments can delineate boundaries and prohibitions, but cannot comprehensively anticipate governance models, token designs, or DeFi configurations. Supervisory authorities must therefore interpret how concepts like “transferable security,” “financial instrument,” “crypto-asset service,” or “regulated activity” apply to arrangements without direct statutory analogues.14

This paper proceeds from the premise that EU and UK digital asset regulation is co-produced by legislative architecture and institutional practice. Statutory frameworks establish formal boundaries and competences, but supervisory reality determines how those boundaries are tested, contested, and enforced through guidance, supervision, and enforcement actions.

MiCA in Practice and MiFID Financial Instrument Spillover

III.A — MiCA: Classification, Scope, and Supervisory Latitude

The Markets in Crypto-Assets Regulation (MiCA) is frequently presented as a comprehensive, self-contained regulatory response to digital assets across the European Union. In practice, MiCA functions less as a prescriptive rulebook and more as a governance framework that allocates roles, priorities, and interpretative authority across multiple institutional layers — legislation, technical standards, national competent authorities (NCAs), and ESMA coordination. Its effectiveness and operational limits become visible only through supervisory application rather than legislative text alone.15

MiCA introduces formal token categories — asset-referenced tokens (ARTs, Title III, Arts 16–47), e-money tokens (EMTs, Title IV, Arts 48–58), and other crypto-assets including utility tokens (Title II, Arts 4–15) — alongside a harmonised regime for crypto-asset service providers (CASPs, Title V). However, classification under MiCA is not a discrete, mechanical exercise. Token categories interact continuously with the nature of activities performed, governance structures, economic functions, and service models. Supervisory practice assesses token qualification and CASP obligations holistically and concurrently, rather than sequentially, reflecting MiCA’s explicit recognition that token characteristics alone do not determine the regulatory perimeter.16

Supervisory latitude is structurally embedded in MiCA’s institutional design. The regulation establishes a distributed model where NCAs retain primary responsibility for authorisation, ongoing supervision, and enforcement, coordinated through ESMA’s oversight, peer review, and binding mediation mechanisms. This architecture accommodates market diversity and practical supervision limits while introducing interpretative variation, particularly where MiCA intersects with MiFID II, the second Payment Services Directive (PSD2), the Anti-Money Laundering Directives (AMLD5/6), or national consumer protection rules.17

MiCA’s transitional provisions (Art 143) exemplify this latitude: Member States may grant existing crypto-asset service providers a transitional period of up to 18 months from 30 December 2024, during which they may continue operating without full CASP authorisation. The length and conditions of these transitional arrangements vary across Member States, producing a documented source of implementation divergence. France, operating its pre-existing PSAN (Prestataires de Services sur Actifs Numériques) registration under the loi PACTE (Loi n° 2019-486 du 22 mai 2019), adopted enhanced registration requirements from 1 January 2024 in anticipation of MiCA. Germany, which had introduced crypto custody licensing under the Kreditwesengesetz (KWG) since 1 January 2020, adopted a distinct transitional approach reflecting its existing supervisory infrastructure.18

III.B — MiFID and Financial Instrument Spillover

Despite MiCA’s introduction as a dedicated crypto-asset regime, MiFID II remains a central reference point in the EU regulatory landscape for digital assets. Its continued relevance reflects not regulatory inertia, but the structural limits of asset-specific legislation when confronted with blockchain and Web3 systems that perform financial functions across multiple layers. MiFID II’s functional, substance-over-form orientation ensures it operates as a spillover regime where crypto-asset arrangements intersect with traditional financial activities or exhibit security-like characteristics.19

MiFID II is not displaced by MiCA; the regimes coexist within a deliberately layered regulatory architecture. MiCA Art 2(4) explicitly excludes crypto-assets qualifying as “financial instruments” under MiFID II Annex I Section C (transferable securities, money-market instruments, units in collective investment undertakings, derivatives, emission allowances). This carve-out preserves MiFID’s jurisdiction and necessitates substantive interpretative assessment at regime boundaries, informed by token structure, governance arrangements, economic substance, and market function rather than preliminary technical classification.20

Interpretative overlap emerges because many crypto-assets exhibit characteristics resonant with MiFID financial instrument concepts. Profit participation through yield mechanisms, transferable rights to economic value or governance influence, common enterprise structures, and reliance on third-party managerial effort invite direct comparison with transferable securities. MiFID II’s principles-based framework — particularly Article 4(1)(44)’s definition of transferable securities as “those classes of securities which are negotiable on the capital market” — requires NCAs and ESMA to assess these features contextually. ESMA was mandated under MiCA Art 2(5) to issue guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments, addressing this classification boundary directly.21

Institutional incentives shape this interpretative process systematically. Investor protection-oriented NCAs prioritise economic substance and risk transfer when information asymmetries or retail exposure exist, extending MiFID’s reach to capture governance tokens resembling profit-sharing or DeFi yield products akin to collective investment schemes. Conversely, innovation-supportive authorities or those with capacity constraints may adopt narrower interpretations where functional utility predominates over investment characteristics.22

The UK Approach and the Governance Gap

IV.A — FSMA, Perimeter Control, and Regulatory Pragmatism

The United Kingdom’s regulatory approach to digital assets is anchored in a statutory architecture that prioritises perimeter control and supervisory judgment over detailed asset categorisation. FSMA 2000, as amended by the Financial Services and Markets Act 2023, provides a broad legal foundation where regulatory scope emerges through statutory concepts (“regulated activities”), secondary legislation, FCA rulemaking, and Perimeter Guidance (PERG). In structural contrast to the EU’s harmonised, taxonomy-driven MiCA regime, the UK model relies explicitly on institutional discretion to determine when and how regulation applies to novel arrangements.23

Central to this approach is the FCA’s activity-based perimeter logic. Regulation targets activities — dealing, arranging, advising, managing, safeguarding — not assets per se. The operative question is whether token-related conduct constitutes a “regulated activity in the UK by way of business,” assessed against economic substance (profit expectation, reliance on others’ efforts), governance realities (who controls outcomes), and consumer/market impact rather than token nomenclature. The FCA’s initial framework, set out in PS19/22 “Guidance on Cryptoassets” (July 2019), distinguished between security tokens (within the regulatory perimeter), e-money tokens (regulated under the Electronic Money Regulations 2011), and unregulated tokens (exchange tokens and utility tokens outside the FSMA perimeter but within AML scope).24

The financial promotions regime for crypto-assets, finalised in PS23/6 (June 2023, effective 8 October 2023), extended section 21 FSMA 2000 to qualifying cryptoassets — imposing risk warnings, cooling-off periods for first-time investors, bans on referral incentives, and requirements for clear and fair promotions. This represents a significant expansion of the regulatory perimeter through FCA rulemaking rather than primary legislation, illustrating the UK’s reliance on institutional discretion to calibrate regulatory intensity.25

The EU/UK contrast is structural rather than merely stylistic. MiCA pursues ex ante harmonisation through detailed token categories and technical standards, managing complexity through ESMA/NCA coordination across 27 Member States. The UK accepts legislative indeterminacy, concentrating regulatory intelligence in FCA supervisory judgment supported by PRA prudential oversight. MiCA redistributes uncertainty to regime boundaries and Level 2/3 implementation; FSMA embeds it in perimeter interpretation and ongoing supervision. Neither eliminates uncertainty; each channels it differently.26

IV.B — The Governance Gap: Where Regulation and System Design Diverge

The governance gap captures the structural divergence between the assumptions embedded in legislative frameworks and the operational governance realities of blockchain and Web3 systems. Both EU and UK regulatory regimes — MiCA, MiFID II, FSMA — are constructed around identifiable legal persons, accountable decision-making structures, and allocable responsibility, underpinning licensing, disclosure, and enforcement mechanisms. Blockchain systems, however, frequently distribute governance across foundations, DAOs, developer collectives, service intermediaries, and token-weighted voting, often without clear authority hierarchies or legal personality.27

Legislative frameworks implicitly assume governance mapping onto familiar organisational forms: authorised entities for MiCA CASPs, investment firms under MiFID II, or “persons carrying on regulated activities” under FSMA. Blockchain arrangements challenge this model by fragmenting decision rights across protocol parameters (upgrade keys), economic resources (treasuries), technical infrastructure (validator sets), and social coordination (off-chain developer signalling), producing governance that is simultaneously distributed and concentrated.28

Decentralisation claims frequently exacerbate this mismatch. Projects asserting “permissionless,” “trustless,” or “community-governed” status suggest diminished regulatory relevance or diffused accountability. Supervisory authorities assess such claims pragmatically through control diagnostics: who possesses admin/upgrade keys, multisig signers, or parameter change authority; who curates front-ends or oracles; who coordinates emergency responses. Where influence concentrates — formally through foundations or informally through developer coordination — accountability expectations persist irrespective of narrative framing.29

The UK’s Property (Digital Assets etc) Bill, introduced in the House of Lords on 11 September 2024 following the Law Commission’s 2023 report (Law Com No 412), addresses a specific dimension of this governance gap by confirming that digital assets can constitute personal property — a “third category” beyond things in possession and things in action. While the Bill does not resolve the broader governance gap in regulatory architecture, it provides foundational legal clarity for ownership, custody, and enforcement that current UK common law had left uncertain.30

Supervisory Discretion, Enforcement Logic, and the Multi-Layer Framework

V.A — Supervisory Discretion and Enforcement Logic

Supervisory discretion and enforcement logic are central to understanding how digital asset regulation operates in practice across the European Union and United Kingdom. Legislative frameworks establish powers and objectives, but regulatory meaning emerges through discretionary supervisory action within institutional constraints. In structurally complex domains like blockchain and Web3, enforcement functions not as exceptional remedy but as routine governance through which authorities clarify expectations, assert jurisdictional competence, and shape market conduct.31

Authorities intervene through mechanisms extending beyond formal non-compliance. Actions are triggered by perceived threats to core objectives: consumer safeguarding (retail losses from scams, platform failures), market integrity (insider trading, market manipulation), financial stability (systemic runs on stablecoins), and institutional legitimacy (unregulated actors undermining authorised markets). The FCA has been notably stringent in its approach to crypto firm registration under the Money Laundering Regulations: by early 2022, over 80% of crypto firm applications had been refused or withdrawn, signalling consumer risk thresholds far exceeding formal AML/CTF requirements.32

Enforcement serves critical signalling functions. High-profile actions articulate interpretative positions where legislation or guidance remains underdeveloped: FCA registration suspensions signal consumer risk thresholds; BaFin’s enforcement against firms conducting unauthorised crypto-custody business (classified as a financial service under s.1(1a) sentence 2 no. 6 KWG since 1 January 2020) clarifies licensing boundaries; AMF warnings against unauthorised crypto-asset offerings and its maintenance of a blacklist of non-compliant platforms establish activity-based perimeter tests for the French market.33

Precedent accumulation shapes evolving enforcement logic. While continental EU systems lack strict stare decisis, supervisory decisions, ESMA opinions, FCA Final Notices, and EBA Reports function as quasi-binding reference points influencing future practice. Discernible patterns emerge: concentrated treasury control, developer upgrade dominance, retail yield products lacking investor safeguards — these governance and economic configurations become enforcement prioritisation indicators across both EU and UK jurisdictions.34

Selective enforcement reflects unavoidable institutional reality. Finite capacity, competing mandates, and cross-border coordination costs necessitate prioritisation. Intervention concentrates on visible, scalable, redressable cases: registered firms operating crypto ATMs without adequate safeguards; EU-targeting platforms lacking CASP authorisation; governance hubs with identifiable legal personality. Pseudonymous developers or truly diffuse DAOs prove less accessible, shifting enforcement toward intermediaries (exchanges, wallets, front-ends) and controllers with jurisdictional nexus.35

V.B — The Multi-Layer Governance Framework Applied

The Multi-Layer Governance Framework for Blockchain and Digital Assets (Carvalho-Ribas) provides structured methodology for understanding how supervisory authorities prioritise and engage different structural layers when interpreting legislation and shaping enforcement strategy. In EU and UK practice, regulatory interpretation does not proceed uniformly across layers. Authorities selectively privilege dimensions according to mandate, risk materiality, and competence.36

Governance layer centrality dominates supervisory reasoning across regimes. Authorities systematically assess decision loci — who controls upgrades, multisigs, parameter changes, emergency intervention; who coordinates off-chain developer action; who vetoes proposals despite formal DAO voting. Both ESMA’s MiCA CASP governance requirements and FCA’s application of accountability expectations to crypto firms treat governance realities as preceding formal classification, directly informing authorisation decisions, enforcement targeting, and remedial orders.37

Economic layer privilege follows closely. Value flows — incentive misalignment, treasury extraction, yield asymmetries, governance token economics — provide concrete evidence for economic substance tests under MiFID transferable security analysis, MiCA investor protection triggers, and FCA “collective investment scheme” determinations under s.235 FSMA 2000. The CIS test — requiring (i) arrangements with respect to property, (ii) purpose of enabling participation in profits, (iii) no day-to-day control by participants, and (iv) pooling of contributions — directly captures DeFi yield products where liquidity is pooled and managed by protocol operators or governance token holders.38

Jurisdictional layer delimits practical regulatory reach. Enforcement attaches through governance nexus (foundation domicile, controller residence), economic touchpoints (EU/UK treasury beneficiaries, service targeting), and effects doctrine (retail investor harm), not network node geography. FCA’s “in the UK” tests, MiCA’s reverse solicitation carve-out (Art 61), and ESMA’s cross-border coordination presuppose pragmatic jurisdictional assertion where intervention capacity exists.39

High-Value Domain for Global Practice

Interpretative literacy in EU and UK digital asset regulation constitutes a high-value professional domain because it directly corresponds to how regulatory authority is exercised in practice. As legislative frameworks such as MiCA and FSMA expand in scope and technical complexity, institutional demand increasingly favours professionals who can operate beyond formal rule identification and compliance mapping. Regulatory effectiveness hinges less on exhaustive rule knowledge than on understanding how institutions interpret, prioritise, and enforce provisions within multi-layer governance environments where governance realities often diverge from legislative presuppositions.40

For regulators and supervisory authorities, governance-grade interpretative reasoning enables coherent oversight of systems that evolve faster than legislative cycles. NCAs and the FCA confront arrangements — hybrid DeFi protocols, governance tokens with yield, DAOs interfacing retail — that defy established organisational or financial models. Professionals capable of analysing control structures, economic incentives, and accountability gaps contribute to consistent decision-making, reduce ad hoc enforcement, and support internal alignment between investor protection, market integrity, and innovation facilitation mandates.41

For cross-border advisers, EU/UK interpretative competence provides unifying analytical discipline. Rather than jurisdiction-specific checklists vulnerable to supervisory evolution, governance-oriented reasoning enables defensible classification across permeable regime boundaries. Advisers can articulate why identical token arrangements trigger FCA consumer intervention but ECB stablecoin scrutiny, or BaFin ART authorisation alongside AMF DeFi perimeter tests, grounding risk assessment in convergent institutional logic despite divergent formal triggers.

Governance-grade reasoning demonstrates durability and transferability distinguishing it from transactional compliance. Checklist approaches map static requirements but fail against supervisory expectation shifts or enforcement logic evolution. Structural literacy equips professionals to engage regulatory systems as living institutions, adapting to ESMA Q&As, FCA Dear CEO campaigns, or NCA innovation hub feedback without foundational recalibration.42

Knowledge and Practice Continuity

This paper forms part of a structured doctrinal system dedicated to the legal, regulatory, and governance analysis of blockchain, Web3, and digital asset systems across multiple jurisdictions and institutional contexts. Within this system, each paper performs a distinct analytical function while remaining structurally interdependent with the others. The series examines how blockchain and digital asset-based systems are shaped, constrained, and governed through the interaction of multiple governance layers — national, supranational, and international — and through the analytical lenses of structural decomposition, institutional assessment, and comparative regulatory practice.

From a knowledge and practice architecture perspective, this Authority PDF constitutes a foundational layer, establishing the interpretative concepts, institutional frameworks, and governance diagnostic methods that are then deployed through structured professional training, advanced coursework, and implementation cohorts. Each tier builds on prior analytical clarity and institutional literacy, ensuring continuity between doctrine, interpretation, and professional practice.

Conclusions

This paper has examined EU and UK digital asset regulation not as static collections of legal rules, but as institutional governance systems through which regulatory meaning emerges in practice. While MiCA, MiFID II, and FSMA establish formal frameworks, concrete regulatory outcomes arise from how supervisory authorities interpret, prioritise, and enforce these instruments within multi-layer governance environments shaped by mandate constraints, resource realities, and institutional cultures. Persistent legal uncertainty in the digital asset domain reflects not primarily legislative deficiency, but structural complexity and the interpretive discretion inherent to supervising rapidly evolving, multi-functional systems.43

Across jurisdictions, regulatory interpretation privileges governance realities and economic substance over formal classification. Authorities consistently assess decision loci, control mechanisms, value flows, and risk allocation before applying statutory categories. Legislative taxonomies provide analytical reference points, but institutional practice reveals their insufficiency against hybrid arrangements integrating infrastructure, yield generation, governance participation, and programmable settlement.

Enforcement constitutes integral interpretive practice, not exceptional remedy. Supervisory intervention clarifies contested boundaries, signals institutional risk thresholds, and corrects governance gaps through patterned action driven by mandate-driven logic — investor protection against yield scams, market integrity against insider parameter changes, stability against uncollateralised stablecoin runs — rather than formal breach alone.44

The Multi-Layer Governance Framework for Blockchain and Digital Assets (Carvalho-Ribas) provides structured methodology for this complexity. Layer separation clarifies institutional prioritisation — governance control preceding token qualification; economic substance informing perimeter tests — while interaction mapping reveals enforcement flashpoints: treasury opacity triggering accountability breaches; developer influence satisfying “efforts of others” tests; jurisdictional targeting via foundation domicile.45

This analysis reaffirms structural diagnosis as prerequisite to credible regulatory engagement. Absent governance-oriented reasoning, market participants risk formal compliance misaligned with supervisory reality; institutions risk siloed analysis missing cross-layer risk; policymakers risk legislative ambition disconnected from implementation capacity. By integrating legislative architecture with institutional practice, this paper establishes analytical foundation for subsequent diagnostic work examining regulatory stress concentrations and their remediation across EU/UK digital asset supervision.

Frequently asked

This paper is published through MoroAK Professional Knowledge Infrastructure. All courses, cohorts, trainings, papers, and digital toolkits are available through ECR's educator profile on moroak.com. Advisory mandates and mandate scoping are handled through ECR's practice entity — contact via evelyse@moroak.com.

Endnotes

References