By Lawfox | Algemeen | 19 November 2025 | 11 min. reading time
The crypto market has operated for years in a kind of legal no man’s land. What started as an experiment with bitcoin has grown into a sector handling billions of euros. National regulators tried using existing financial legislation to get a grip on technology that cares little about borders. That didn’t really work.
On December 30, 2024, that changed fundamentally. The Markets in Crypto-Assets Regulation (MiCAR) came into force in the Netherlands on that date. For the first time, there’s European legislation specifically written for cryptocurrencies and crypto services. For entrepreneurs active in this sector, this means a drastic change. The era of “let’s see how it goes” is definitively over.
From wild west to regulated sector
MiCAR isn’t Dutch law but an EU regulation with direct effect. That means concretely: no Dutch implementation law needed, no room for national exceptions. What was decided in Brussels applies directly in the Netherlands from December 30, 2024. The regulation targets issuers of crypto-assets (think Bitcoin and stablecoins) and providers of crypto services like trading platforms. These parties need a license to provide services.
There was a transitional arrangement for companies already registered with the Dutch Central Bank (DNB) as VASPs (Virtual Asset Service Providers). They could work on their MiCAR license until June 30, 2025. That transition period has now ended. Anyone currently offering crypto services without a license is operating illegally.
Twin peaks: two supervisors, different tasks
The Netherlands uses the twin peaks model. This means: two supervisors with separate responsibilities. For crypto, this means a division between the Dutch Financial Markets Authority (AFM) and DNB.
The AFM has the leading role. They grant licenses to new crypto service providers and supervise conduct rules. Think fair information provision, prohibition of misleading advertising, mandatory risk warnings to customers. Crypto service providers must provide consumers with “correct, clear and non-misleading information.” They also need to warn their customers about the risks associated with crypto-asset transactions.
The AFM takes enforcement seriously. Recently, the supervisor warned against MEXC, an exchange actively serving Dutch consumers through Dutch X-campaigns and sponsorship of a Dutch blockchain conference. However, MEXC has no license and is therefore offering crypto-asset services illegally in the Netherlands. These kinds of enforcement actions show: the supervisors mean business.
DNB is responsible for prudential supervision. This means: capital requirements, liquidity, solvency. DNB assesses whether your company is financially healthy enough to offer crypto services. DNB also evaluates proposed qualified participations.
A special responsibility of DNB concerns stablecoins. It’s expected that DNB has been responsible since June 30, 2024 for supervising issuers of so-called stablecoins. MiCAR distinguishes between two types: Electronic Money Tokens (EMTs) and Asset Referenced Tokens (ARTs).
The grey area: what remains outside supervision?
This is where it gets interesting. MiCAR regulates a lot, but certainly not everything. Within MiCAR’s limited scope, the AFM maintains critical supervision over providers of crypto-based services – like trading platforms – registered in the Netherlands. However, even after introducing the new legislation, a large part of the crypto sector remains outside supervision, such as derivatives and services like NFTs and decentralized trading platforms (DeFi).
This isn’t coincidental. European legislators struggled with the technical complexity of decentralized systems. NFTs (non-fungible tokens) fell outside scope because they’re difficult to capture in the definition of “crypto-assets.” DeFi (decentralized finance) evades supervision because there’s no central party to grant a license to. To whom do you grant a license when a protocol runs on thousands of computers without central management?
For entrepreneurs, this means an uneven playing field. Your competitor working with NFTs doesn’t need a MiCAR license for now. You, with a trading platform for bitcoin, do. That inequality is legally defensible but feels unfair to many market parties. And that’s accurate too.
License application: at least six months
The AFM urges registered providers to submit their applications promptly. Experience has shown that even in the best case, an application takes at least 5 to 6 months to process completely.
Read that sentence again. At least five to six months. And that’s in the best case, with a complete application that immediately meets all requirements. In practice, it takes longer. The AFM must assess per application whether the organization meets requirements for expertise and reliability of directors, adequate governance and internal control, financial solidity, operational AML/CFT procedures, ICT security, and transparent information provision to customers.
For a startup without a financial track record, that license is a serious challenge. For established parties with experience in financial services, it’s a costly but achievable process. Add preparation to that – setting up corporate governance, writing procedures, establishing compliance functions – and you’re quickly at nine to twelve months total.
Bitcoins: legal status clear since 2020
The legal status of crypto-assets in the Netherlands has been determined mainly by case law, not legislation. The Court of Appeal of The Hague ruled crystal clear about bitcoins in 2020.
Bitcoins are objects susceptible to human control with real value in economic transactions that can be transferred. Payment can be made with bitcoins. Actual and exclusive control lies with whoever has access to a wallet and is lost with a successful transaction to another wallet. Moreover, bitcoins are individually identifiable: the creation of each bitcoin and every transaction conducted with it is recorded in the blockchain.
The court’s conclusion: bitcoins are criminally a “thing” within the meaning of money laundering legislation. This has far-reaching consequences. Bitcoins can be seized. Trading in bitcoins of criminal origin constitutes money laundering. And – relevant for civil disputes – bitcoins are property rights that can be attached.
Money laundering risks: what case law examines
Crypto-asset service providers are under sharp supervision due to money laundering risks. From December 30, 2024, crypto companies must collect, store and include additional information when executing crypto transactions. This is stated in the implementing law Transfer of Funds Regulation (TFR). This makes transactions more transparent and helps combat illegal activities like money laundering and terrorism financing.
Case law shows how seriously this is taken. In a 2020 case, the Court of Appeal of The Hague ruled on a bitcoin exchanger who offered cash for bitcoins. The case file shows the defendant applied a commission percentage ranging from 5 to 8 percent. According to his own statement, the defendant received on average about 4 percent of the transaction amount. Regular cryptocurrency exchanges apply a commission of maximum 1 percent.
The court concluded: this approach fits money laundering typologies. A substantially higher margin than regular exchanges, no customer identification, cash settlement in public places. These are red flags justifying suspicion of money laundering.
For bona fide crypto companies, the lesson is clear: know your customer, record transactions, ensure a plausible business case. Otherwise, you risk supervisors – or worse, the Public Prosecution Service – marking your approach as suspicious.
Smart contracts: freedom of contract also applies in code
Smart contracts have fascinated lawyers for years. A contract that executes itself once conditions are met, without human intervention. Legally, this raises questions.
Dutch legislation has no specific regulation for smart contracts. That’s not necessary either. Freedom of contract applies in the Netherlands: an oral agreement is a valid contract, just like an agreement on paper. The moment a customer agrees to an offer, there’s a contract. Freedom of contract means: parties may determine themselves how they record an agreement.
A smart contract can therefore be legally binding, provided there’s consensus on essentials. The technical execution – code on a blockchain – is merely the form in which that agreement is cast. Relevant though: a private deed can also be cast in a form other than paper, whereby the electronically secured document must meet security requirements. The document must be provided with an electronic signature (art. 3:15a Dutch Civil Code) to make the contract valid (art. 6:227a Dutch Civil Code).
For smart contracts, this means: ensure it’s clear who the parties are, that there’s consensus on what the code does, and that the identity of signatories is verifiable.
European passport: scaling across 27 countries
An advantage of MiCAR: the European passport arrangement. A license from the AFM grants the right to offer services throughout the European Union, whereas registration only grants the right to offer services in the Netherlands.
This is commercially interesting. One license application, access to 27 member states. No more applying for national licenses in Germany, France, Italy. The AFM license suffices. For companies with European ambitions, this makes scaling considerably easier.
Do watch out: the passport arrangement only applies to services covered by MiCAR. NFT platforms and DeFi protocols fall outside (for now), so the passport arrangement doesn’t apply to them.
DeFi: innovating in uncertainty
DeFi and smart contracts find themselves in a grey area. The reason: MiCAR was written for entities you can grant a license to. A DAO (decentralized autonomous organization) has no legal personality, no management, no physical address. To whom do you then grant a license? And how do you enforce rules against a protocol running on thousands of computers without central management?
European legislators acknowledged this problem but didn’t solve it. The result: innovative DeFi projects can continue developing without a MiCAR license, but operate in legal uncertainty. At what point does a DeFi protocol become license-requiring after all? When there are governance tokens with voting rights? When there’s a development team implementing updates? Nobody knows for sure.
For Dutch entrepreneurs working with DeFi: be careful offering services built on decentralized protocols. The AFM may argue that you – as intermediary between user and protocol – are indeed offering a crypto service. And if you do that without a license, you face enforcement risks.
What this means in practice
The crypto market is changing from unregulated frontier to regulated financial sector. For early adopters used to experimenting without supervision, this feels like loss of freedom. For professional parties wanting to build serious business, I believe it’s good news.
MiCAR creates a level playing field. Cowboys operating without licenses are tackled. Companies investing in compliance and licenses gain legal certainty and can scale with a European passport. With MiCAR come requirements to protect customers. Crypto companies may not make misleading advertisements or deliberately misinform buyers. They must also warn customers about risks in transactions.
That sounds like bureaucracy, but it’s business. Customers trust regulated parties more than cowboy exchanges. Banks prefer working with licensed companies. Investors prefer financing compliant-operating enterprises. Compliance isn’t a cost item. It’s an investment in credibility.
The coming years will clarify how supervisors apply MiCAR. Case law will further define contours. DeFi, NFTs and other innovations currently outside scope may come under a next version of the regulation.
Tips for crypto companies
1. Check your license requirement
Do you offer any of these services? Custody and management of crypto-assets for third parties, trading platform for crypto-assets, exchange of crypto-assets for fiat money or other crypto, execution of orders on behalf of clients, placement of crypto-assets, advice on crypto-assets, or crypto-assets portfolio management? Then you need a MiCAR license from the AFM.
2. Start at least six months in advance
Minimum 5-6 months processing time. Add preparation to that and you’re at 9-12 months total. So don’t start last minute.
3. Invest in AML/CFT procedures
Anti-money laundering and combating the financing of terrorism aren’t optional. You must identify customers, monitor transactions, report unusual transactions to the Financial Intelligence Unit. Without proper AML procedures, you won’t get a license.
4. Document everything from day one
From software development to customer interactions: record what you do and why. For a license application, you must demonstrate your processes are in order. For a supervisory investigation, you must prove you comply with rules. Without documentation, that’s impossible.
5. Build in compliance, don’t bolt it on
The era when you could “just start” and arrange compliance later is over. The AFM can take enforcement measures against parties without licenses: fines, penalty orders, criminal prosecution. The AFM actually uses those powers.
6. Be careful with DeFi and NFTs
Operating in the grey area? Be extra careful. The AFM may still argue you’re offering a license-requiring service, even if you think you fall outside scope.
LAWFOX has extensive expertise in crypto regulation. We recently published a comprehensive chapter on blockchain and crypto-assets in the Netherlands in the Legal 500 Country Comparative Guides. For specific questions about license applications, compliance or contractual issues: contact lawyer Wouter Dammers of LAWFOX at +31 13 207 7107 or w.dammers@lawfox.nl.
