Inside MiCA's people problem: why board members are so hard to find

MiCA compliance now depends on people as much as on documents. For most crypto companies preparing CASP applications, the hardest part is finding the right people for the roles a regulator will approve.

What MiCA is

The Markets in Crypto-Assets Regulation (MiCA) is the EU's single rulebook for crypto-asset services. It replaced national Virtual Asset Service Provider (VASP) registrations with one EU-wide Crypto-Asset Service Provider (CASP) license.

The shift is significant. Europe held 2,747 VASP registrations in 2024. Most EU countries gave those companies transitional periods of up to 18 months to apply for a CASP license. Several windows have already closed, and ESMA confirmed in April 2026 that the final deadline is 1 July 2026 with no extensions. By mid-2026, only around 200 CASP licenses had been issued EU-wide.

What MiCA-compliant companies are expected to look like

The core requirements are familiar. Every applicant must show:

• a clear and transparent business model
• enough capital and own funds to support the business
• risk management for operational, market and ICT risk
• clear consumer protection and transparency
• compliance with AML and counter-terrorist financing rules
• clear and effective governance, oversight and organisational structure

Governance is where the real work begins. Regulators expect clear separation of duties: control functions such as compliance, MLRO, AML operations and risk sit with several people across a three lines of defense model. Regulators also evaluate the board as a single team, expecting it to cover strategic leadership, compliance and AML, risk, ICT and cybersecurity, and local market knowledge.

While the requirements for directors are largely the same across most jurisdictions, each country may have its own specific adjustments. Here is what we have come across in the Baltic market:

• A strong reputation, no conflict of interest, and the ability to pass a fit and proper assessment.
• In some jurisdictions, oversight must be carried out by a separate body – a supervisory board – while in others, this function can be assumed by the executive board of directors.
• The number of directors required differs by jurisdiction, but 4 areas must always be covered among them: AML and risk, business and strategy, ICT risk, and finance.
• Real board experience matters. A board member needs to know how to effectively oversee whether the company is progressing towards its goals, and most importantly, how to provide oversight of the executive team while maintaining effective and collaborative relationships with the business.

Local connection matters just as much. Regulators want board members who are professionally connected to the jurisdiction, well known in the market, and respected, and usually expect most of the board to be local. On a board of 3 directors, at least 2 should live in the country, speak the language, and have solid local experience.

The same expectations apply to executive top management. Regulators expect the CEO to know the product, regulation and strategy well enough to represent them confidently and protect the business model in regulatory communication. This is why the person needs to be deeply embedded in the industry. Most jurisdictions set no formal residency rule for the CEO, but a local candidate is a real advantage in practice – as local candidates from the industry tend to know the local regulator well, understand what they will focus on first, and how to avoid unexpected challenges.

Why the talent gap is so hard to close

The talent shortage is often described as a simple lack of qualified people. The reality is more layered. The rules shifted quickly, and expectations on both the company and the candidate side have not yet adjusted to the new market updates.

At the board level, the rules themselves create the shortage. A hiring paradox sits at the centre: candidates with the most hands-on crypto experience are often the ones a regulator will not accept for an oversight role, because an executive position at a similar company creates a conflict of interest. The most relevant operators are filtered out of the supervisory pool exactly when their experience would be most useful. Combined with the local residency expectations above, this collapses an EU-wide search into a small local pool where everyone competes for the same few names.

On top of those structural pressures, the company side adds its own complications. As Evotym, a fintech recruitment agency placing MiCA-regulated roles across the EU, we see three patterns come up in our day-to-day work:

1. Companies start hiring for regulated roles before they grasp how much time and money licensing will take. When reality hits, some pause or leave the EU. About half the senior specialists we screen now openly worry about ending up without a job in a year, and choose less exciting but more stable roles.
2. To look convincing to the regulator, some companies over-filter their talent pool by focusing exclusively on crypto-native profiles, excluding strong candidates from traditional fintech. Yet it’s precisely these candidates who have the experience and knowledge of how to operate in a strongly regulated environment. And given that MiCA is driving crypto companies into a regulated space, this expertise is the most valuable.
3. Many companies still work from an outdated picture of how regulators behave. Working with clients across jurisdictions, we have approached central banks directly, and the replies showed the requirements were softer in practice. Some regulators demonstrate flexibility – they are willing to discuss your candidates, provide feedback and consider candidacies before their formal submission.

Our recommendations for companies preparing for MiCA

From our work supporting MiCA licensing, the following approaches keep companies on track:

• Read the local labour market realistically before hiring starts, and widen the search to candidates from traditional finance as well. Crypto knowledge can be taught; regulated-environment expertise is harder to grow.
• Invest in onboarding so hires from outside crypto have time to learn the product.
• Talk to the regulator early and make the case for a candidate you believe in.
• Present the company as clearly as the role, including a credible plan B.

None of this removes the shortage, but together they make the process predictable and reduce stalled timelines.

Conclusion

MiCA has put talent at the centre of regulatory readiness. The companies that succeed treat hiring as part of their licensing setup from day one, because under MiCA, governance and talent are now the same challenge.

About Anna Hroza

Anna is an Executive Search Consultant & Talent Acquisition Partner at EVOTYM, specialising in senior and regulated hiring for fintech and crypto businesses across Europe. She advises companies on closing C-level, Board Member and regulatory roles, with hands-on experience building MiCA-compliant teams across the EU.

 

About Evotym

Evotym works with fast-growing fintech and crypto companies across Europe and beyond, providing structured hiring solutions that keep pace with a company's growth. Combining industry knowledge with flexible service models, the team helps with cross-border hiring, speed to hire, and team scaling. Compliance and regulatory hiring is a core strength, helping companies find specialists needed to secure licences and operate in regulated markets, with each solution shaped around how the company works.