MiCA record-keeping under Article 68: what your finance team owns

Most of the MiCA conversation over the past two years has been about licensing. Who needs authorisation, which member state grants it, what the capital and governance conditions look like. That work sits with legal and compliance teams, and for a lot of crypto businesses it is now mostly done.

The part that lands on finance and accounting teams is quieter and lasts longer. MiCA expects a crypto-asset service provider to keep a complete, reconstructable record of everything it does, and to keep it for years after the transaction clears. A license proves you were allowed to operate. Records prove what you actually did. Those are different jobs, and the second one never really ends.

Here is what Article 68 asks for, why 2026 raised the stakes, and where a subledger does (and does not) help.

What changed, and when

MiCA became fully applicable to crypto-asset service providers on 30 December 2024. Article 143 then gave member states room to grant a transitional period of up to 18 months for firms already operating under national law. That clock ran out on 1 July 2026. There is no extension mechanism, so from that date a firm serving EU clients either holds a MiCA authorisation or it does not. Several member states, including Germany, chose windows shorter than the full 18 months, so plenty of teams hit the wall earlier than the outer deadline.

The reason this matters for record-keeping is timing. A firm that spent 2025 and early 2026 getting authorised now has to show it kept proper records through that whole period, including the messy stretch when it was migrating tools, switching custodians, or onboarding under a new legal entity. The obligation is retroactive in effect. You cannot backfill a five-year audit trail after the fact.

Article 68 in plain language

Article 68(9) is the core rule. A CASP has to keep records of “all crypto-asset services, activities, orders, and transactions” it undertakes. The retention period is five years, and a competent authority can require you to hold them for up to seven if it asks before the five years are up. Clients can request their own records too.

The standard those records have to meet is reconstruction. A supervisor should be able to pick any transaction and rebuild it: what happened, when, for whom, in what asset and amount, at what value, with what fees. A monthly PDF export or a portfolio screenshot does not clear that bar. You need the underlying ledger, transaction by transaction, tied back to the wallet or venue it came from.

Article 68(10) points to the detail. The granular specification lives in Commission Delegated Regulation (EU) 2025/1140, the regulatory technical standard adopted in February 2025 that spells out exactly which records a CASP keeps. If your compliance team has not mapped your current data against that RTS, that is the gap to close first.

Sitting next to this is Article 70, which requires you to segregate client crypto-assets and funds from your own. Custodians keep a register of each client's positions and hold client assets on separate on-chain addresses. Segregation is an accounting reality as much as a legal one: your books have to show, at any moment, what belongs to clients and what belongs to the house. That is hard to prove without a subledger that tracks holdings per entity and per client.

DAC8 turned records into a tax-reporting problem

Record-keeping under MiCA would be demanding on its own. DAC8 made it sharper.

DAC8, the EU directive that brings the OECD's Crypto-Asset Reporting Framework into European law, applies from 1 January 2026. That means 2026 is the first year reporting crypto-asset service providers collect user and transaction data for tax purposes. The first reports are due to national tax authorities by 30 September 2027, and authorities then exchange that data across borders automatically. For anyone who has followed US reporting, it is the European counterpart to the Form 1099-DA shift.

The practical effect is that your internal records and what a tax authority receives about your users now have to reconcile. If your subledger says one thing and your DAC8 submission says another, that gap is visible to a regulator who can compare both. Clean, transaction-level records stop being a nice-to-have and become the source of truth two different regimes read from. We cover the reporting mechanics in more depth in our CARF and DAC8 guide.

Who is on the hook

Directly, the obligations fall on CASPs: exchanges, custodians, brokers, and the firms issuing asset-referenced or e-money tokens. If you hold an authorisation, Article 68 is yours.

Indirectly, a wider group feels the same pressure. A company holding crypto in its treasury is not a CASP and does not file under Article 68, but it deals with the same custodians and exchanges, and it faces its own audit and tax-reporting expectations. When your venue tightens its records to satisfy MiCA, the data you receive from it changes, and your own books have to keep up. The record-keeping bar rises across the whole chain, not just at the licensed firms.

A records checklist for the rest of 2026

If you own the finance side of this, a short list of things worth doing before year-end:

• Map every venue and wallet you use against the ESMA register, and confirm each counterparty is authorised or winding down.
• Export full transaction histories from any platform you are leaving, before you lose access. Vendor exits are where audit trails go missing.
• Reconcile your subledger to your general ledger on a regular cycle, not once a year at audit time.
• Document your cost basis method and your valuation sources, so a reviewer can see how each figure was derived.
• Confirm your records survive a tool migration. If moving off a vendor breaks your five-year trail, the trail was never really yours.

Where a subledger fits, and where it does not

Two things are worth being straight about.

No software makes you MiCA compliant. Authorisation, governance, client-asset segregation as a legal matter, these are decisions and controls your firm owns. A tool does not grant them.

What a subledger does is hold the records layer that Article 68 describes. A crypto subledger ingests activity across chains, exchanges, and custodians, normalises it into transaction-level entries, and keeps that history in a form you can query, reconcile, and export years later. That is the difference between “we have the data somewhere” and “we can reconstruct any transaction on request.”

This is the layer Kryptos Enterprise is built for. It syncs across chains, exchanges, and custodians, applies cost basis consistently (FIFO, LIFO, ACB, HIFO, and Shared Pool), tracks holdings per entity for segregation, and pushes reconciled journals into the accounting stack through Xero, QuickBooks, and SoftLedger. The records that MiCA asks you to keep for up to seven years are the same records DAC8 asks you to report. Keeping them in one place, rather than stitching them together at audit time, is the whole point.

If you are an accounting firm working with crypto clients, the record review moves earlier in the engagement. It is worth adding a transaction-history check to client intake so you know what you are signing up to before the audit, not during it. Our guide for accountants goes into how that fits a practice workflow.

This article is general information from an accounting and product perspective, not legal advice. Confirm your obligations with your own advisers and your national competent authority.

About the author

Sukesh Tedla

Founder & CEO