MiCA digital-assets regulatory counsel.

Why the reverse-solicitation line is the one that keeps people awake

Of the four duties, the exemption in Article 61 is the one most often mistaken for a commercial arrangement. It is not. ESMA’s final report of 17 December 2024, issued under Article 61(3), confirms that only authorized providers, or certain EU-authorized financial entities acting by notification, may provide crypto-asset services in the Union, that third-country firms are otherwise prohibited, and that the sole exception is a service initiated at the client’s own exclusive initiative — an exception ESMA says cannot be assumed and cannot be used to circumvent the regulation. The AMF restated the point in its own notice of 23 June 2026 and the CSSF in its notice of 2 July 2026, both naming email, advertising, banners and social media as solicitation.

Read as a legal question it is settled in a paragraph. Read as an operational question it is a permanent records problem, because the burden of proof runs the wrong way and the proof has to survive turnover. A chief compliance officer at an authorized custodian told Sartori that the difficult part of the license had not been obtaining it, but demonstrating eighteen months later that a client in another member state had made first contact — a fact that lived in a former colleague’s inbox. Across the same Paris interview cohort, 27 of the 61 respondents inside regulated financial, payments and digital-asset institutions, over a 24-month window, said the evidence duty sat with a function that had no dedicated headcount attached to it.

The second duty that resists delegation is disclosure. Paul Hastings, writing on the white-paper regime, makes the mechanical point that no supervisor reviews a white paper for accuracy before publication, which means the disclosure standard is self-executing from the moment of publication and the liability in Articles 15 and 26 attaches to the issuer and its management body without a contractual escape. Issuers whose tokens were already trading had until 23 December 2025 to bring existing white papers up to the new standard or face removal from licensed EU venues, with revision required on material change thereafter. A head of legal at a Paris-headquartered payment institution described being handed a white paper drafted by a product team for signature, and refusing until the sign-off route was written into the legal mandate rather than assumed.

The third is resilience. DORA has applied to licensed providers since 17 January 2025, which adds an ICT and third-party register obligation on top of the conduct rulebook, and the AMF put cyber-risk management and DORA implementation first among the three post-authorization supervisory priorities it published for 2026, ahead of promotional-communication compliance and prudential requirements. That is a specific, published statement of what a French supervisor intends to look at, and it maps directly onto what a company should be hiring for.

What the published specifications actually ask for

One compensation band for this work is public in the sources this article uses. A large exchange advertised an Associate General Counsel, Institutional Legal role covering the EU and UK regimes at £159,120 to £176,800 a year plus bonus and equity, asking for seven or more years at a financial-services institution or a firm serving one, and naming MiCA alongside MiFID, EMIR and AIFMD as required regulatory ground. The listing has since closed. That is one data point at the senior end, and it should be read as one.

The shape of the seat is better read from the specifications themselves. A stablecoin issuer’s French entity advertised a Paris-based compliance director whose stated job was to be the primary liaison with regulators and auditors for the French company and to ensure compliance with MiCA, DORA and other EU frameworks, requiring fifteen or more years in cybersecurity, technology risk or IT governance within financial services and fluency in both French and English. A Vienna-headquartered exchange advertised a regulatory compliance team lead at seven or more years, with a degree in law, finance or business, MiCAR and MiFID II subject-matter expertise, market-abuse and trade-surveillance experience, full fluency in English and German, and the role described as a strategic partner to senior management and part of the second line of defense. Neither posting is a lawyer specification in the traditional sense. Both are descriptions of an accountable owner.

The payments rulebook is being rewritten on its own timetable, and the PSD3 package is a separate file with a separate perimeter that touches this one at e-money tokens — which is the single clearest reason payments regulatory lawyers convert into this seat more readily than any other adjacent group. Sartori’s Paris in-house telemetry puts counter-offer incidence at 29 percent across the trailing three years and the median offer to acceptance at 15 working days. On the digital-asset and payments subset of those closed searches, the counter-offer that mattered was rarely money: in three of the six, the employer came back with an expanded remit — sign-off authority, a direct line to the board, a headcount — because the candidate had told them the seat as scoped could not carry the liability it was being handed. Sartori’s quarterly survey has run since 2019; in three of the four most recent Paris waves, heads of legal at supervised institutions ranked a named internal owner of the license above headline compensation when scoping this hire.