Sixty days to MiCA. Your marketing function is the riskiest line item.

Most of the noise about MiCA in the last twelve months has been about authorisation. Will the entity get a CASP licence in time. Which member state will be the home regulator. What happens to the white paper. The conversation has been a legal conversation, run by general counsel, with marketing waiting downstream for a copy of the licence so the website can change a footer.

Sixty days out, that ordering is wrong. The entity that has its CASP authorisation in hand on July 1 still has a marketing function that, on the same morning, becomes the part of the company most exposed to enforcement, and the part with the smallest pre-existing playbook for surviving it.

What ESMA actually said on April 17.

ESMA's Statement on the end of transitional periods under MiCA, published on 17 April 2026, did three things that materially change what the marketing function has to ship before July 1.

It removed the cliff-edge optionality. The transitional period ends uniformly across the EU on 1 July 2026, regardless of national variation. The countries that previously offered longer national run-offs no longer do. From day one, providing MiCA-regulated services to EU clients without a MiCA authorisation is a breach of EU law. There is no member-state arbitrage left.

It explicitly named branding and intragroup structure as a supervisory target. ESMA expects authorities to scrutinise intragroup outsourcing arrangements, delegation models, and branding strategies that could obscure which legal entity is actually providing the service. Translation: the marketing org that has cleverly moved the EU-facing creative to the non-EU sister entity, kept the brand identical, and assumed the regulator would not look — that is the org being looked at.

It told consumers to verify the ESMA Interim MiCA Register before transferring funds. Which means every consumer-facing piece of marketing copy now sits next to a register the consumer can check. The cost of a marketing claim that does not match the register is no longer abstract; it is a one-click confirmation in the consumer's hand.

Why marketing is the line item that fails first.

Inside a regulated firm, the functions exposed to a new authorisation regime fail in a predictable order. Compliance fails last because compliance is the function that wrote the answer. Legal fails second-last because legal has owned the gating conversation for twelve months. Operations fails in the middle because operations has been migrating systems on a known schedule. Customer support fails further forward because the script changed two weeks ago.

Marketing fails first. Five reasons, all structural.

Marketing assets have the longest shelf life. A campaign that shipped six months ago is still indexed, still in the ad inventory, still being served by the affiliate network, still on the partner sites. The legal team's email from yesterday telling marketing to swap out wording does not retroactively touch any of that. On July 1, the asset that violates the new regime was probably published before anyone in the firm had read the April 17 statement.

Marketing surface area is the widest in the firm. Paid-media accounts in eight countries. Influencers under contract in four. Affiliate networks with their own creative. Reseller partners that re-skin the brand. Twenty pieces of evergreen content. Three help-centre pages. A landing page per jurisdiction that nobody has audited since the second cycle of growth experiments. The legal team's audit unit is one person; the marketing surface they are auditing is twenty thousand assets.

Marketing-comms rules are scattered across three regimes. MiCA itself, the Commission Delegated Regulation on marketing communications, and country-specific overlays from each home regulator. The marketing copy that satisfies one of the three may not satisfy all three. Most marketing teams do not have a single document that maps the three regimes onto the firm's actual content inventory. Without that document, the audit before July 1 cannot run.

The risk-disclosure copy is a brand asset, not a footer. Under MiCA, the risk-disclosure language is not boilerplate; it is a defined regulatory artefact whose absence or misstatement is a breach. The brand team that has been treating the disclosure as a thing the legal team owns will find, on July 1, that the legal team has been treating the disclosure as a thing the brand team owns. Both teams are wrong about who owns it. The regulator does not care which.

The KOL contracts have not been read in this light. The influencer contract that the growth team signed in November obliged the influencer to a certain volume of content. It did not oblige the influencer to MiCA-aware risk disclosure inside the content. On July 1, the firm becomes liable for what the influencer publishes about its product — because the influencer is a marketing communication of the firm, not a third party. The contract did not solve this. The brief did not solve this. The influencer probably does not know.

What the next sixty days actually look like.

Pulled out of the firms that have already done it once: a sixty-day MiCA-marketing programme has six work-streams, run in parallel, with one operator owning the schedule.

Inventory. Every live marketing asset, by jurisdiction, by channel, by language, by date last edited. Most firms discover that the actual inventory is two to three times the size of the inventory the marketing team thought it had. The discovery itself takes a week. Without it, every later step is theatre.

The MiCA-comms rules-as-code. One document, mapped to the inventory. Forty rules, give or take, depending on which member state is the home regulator and which countries are passported into. The document exists once and is referenced in every brief from now until the regime evolves. Drafting it from scratch is a two-week piece of work; there are open-source baselines that cut it to one.

The disclosure architecture. Not a copy task. An information-design task. Where in the user journey the risk disclosure appears, in what hierarchy, with what optionality, in what languages, with what audit trail. The firms that will pass scrutiny in July have already tested the architecture with the home regulator informally; the firms that will fail it have a single-line footer.

The KOL and affiliate re-papering. Every active influencer contract reopened, with a MiCA-aware addendum. Every affiliate network's creative re-issued, with a one-page brief on what the network can and cannot publish. The agencies that have been running KOL programmes on a volume basis discover, in this step, that they do not have the contractual relationship that would let them do this; the firm's lawyer ends up doing it directly. That is six weeks of legal time the legal team did not budget.

The paid-media policy review. Each platform — Google, Meta, TikTok, X, the regional networks — has its own crypto-promotion regime that interacts with MiCA in non-obvious ways. The platform may permit a piece of copy that MiCA does not. The firm's account manager at the platform is not the firm's compliance officer. The audit needs the second category, not the first.

The post-July-1 incident process. What the team does on July 2 when an indexed asset in Lithuania is reported by a consumer and the home regulator emails. The runbook for the first ten such incidents. Drafted now, kept on the shelf, used in week two of the new regime. Without it, the response to the first incident is improvised, on a Sunday, by whoever is on chat.

What the agencies are not saying.

The eighteen large crypto-marketing agencies in the public set, on May 1, have collectively zero published content addressing this sixty-day window in operator-grade terms. The sample includes the US-centric performance shops, the Israeli PR distributors, the Asia/Dubai KOL networks, the AI-search-first specialists, and the agency that owns the InfoFi narrative. None of them has a live page titled "What your marketing function ships before July 1." A few of them have a generic MiCA explainer published in late 2024 that has not been refreshed since.

This is not a failure of effort. It is a structural reflection of where the agencies sit. KOL volume is not regulated marketing-comms strategy. AEO citations are not regulated disclosure architecture. PR placements are not the rules-as-code mapping.

The buyer that recognises this in the next two weeks has a very specific profile. A licensed (or about-to-be-licensed) CASP entity in the EU. A marketing team between three and twenty-five people. An incumbent agency relationship that is delivering volume but not regulatory coverage. A general counsel who has noticed the gap and is asking, internally, where the marketing-side equivalent of the legal team's MiCA programme actually lives. The answer, in most firms, is that it does not yet live anywhere. That is the seat being hired.

The shorter version.

Sixty days. Marketing fails first. The agencies are not writing the operator-grade content because they were not built for it. The firms that ship the audit, the rules-as-code, the disclosure architecture, the KOL re-papering, the paid-media review, and the incident runbook before July 1 will spend the second half of 2026 growing inside a regime where most of their competitors are spending it negotiating with regulators. The firms that did not will spend it the other way.

The seat that runs this work is a seat. It has a name. It is not the head of growth and it is not the legal team. It is a CMO with the gate-stack reps to recognise the work as marketing operations rather than as a legal favour. Most firms do not have one in the building. Some of them have sixty days to find one.

— Jukka Blomberg, Helsinki, 1 May 2026