The MiCA transitional (grandfathering) period ended on 1 July 2026, meaning that any crypto-asset service provider operating in the European Union without a valid CASP authorisation is now acting unlawfully. ESMA confirmed in its statement of 23 June 2026 that unauthorised firms must immediately cease onboarding new clients and marketing their services, restrict activity to orderly wind-down operations, and stop providing crypto-asset services to EU clients. International companies that have not yet obtained authorisation face material regulatory, reputational and legal risk and must act without delay.
What Changed on 1 July 2026
Under Regulation (EU) 2023/1114 – the Markets in Crypto-Assets Regulation, commonly known as MiCA – member states were permitted to allow previously registered or exempted crypto-asset service providers to continue operating under national regimes during a defined transitional window. That window closed definitively on 1 July 2026. No extension was granted: ESMA's public statement of 17 April 2026 expressly confirmed that no extension to the transitional period would be available.
From that date, the full MiCA authorisation framework applies uniformly across all EU member states. Any entity providing crypto-asset services to clients located in the EU – whether from within the EU or from a third country – must hold a valid CASP licence issued by a competent authority in an EU member state, or must have ceased those activities.
Who Is Affected
The impact is broad. MiCA defines crypto-asset services to include custody and administration of crypto-assets on behalf of clients, the operation of a trading platform, exchange services, execution of orders, placing, transfer services, advice, and portfolio management. Any entity performing one or more of these activities for EU clients falls within scope, regardless of where the entity is incorporated.
The following categories of business should treat this alert as directly relevant:
- Non-EU exchanges and brokers that actively solicit or serve EU retail or professional clients without a passportable EU authorisation.
- Firms that relied on national transitional registration in one or more member states but did not complete the MiCA CASP authorisation process before 1 July 2026.
- Crypto-asset service providers in the process of applying whose application was not yet determined by the relevant competent authority before the deadline.
- Group structures where a licensed entity provides services but related entities within the group carry out activities that independently qualify as crypto-asset services without their own authorisation.
- DeFi-adjacent businesses that may fall within MiCA's scope depending on the degree of decentralisation and the nature of services offered – a question that competent authorities are beginning to assess on a case-by-case basis.
The Current Authorisation Landscape
According to the ESMA register as of 12 August 2026, there are 325 authorised CASPs across the EU. Earlier data from May 2026 indicated approximately 210 full authorisations had been granted at that point, reflecting the significant acceleration in approvals during the final weeks of the transitional period. Despite this growth, many applicant firms remain pending or were not approved before the deadline, and a substantial number of market participants that had been operating under national transitional rules are no longer permitted to provide services.
This concentration of authorised providers creates both a competitive advantage for licensed firms and a compliance gap that regulators across the EU are actively monitoring. Competent authorities have made clear that they intend to enforce the post-transitional regime rigorously.
ESMA's Guidance on Wind-Down Obligations
ESMA's public statement of 23 June 2026 set out specific expectations for unauthorised CASPs still holding client assets or open positions as at 1 July 2026. The statement made three things clear:
- Unauthorised CASPs must stop onboarding new clients and halt all marketing directed at EU persons immediately.
- Services must be limited strictly to enabling clients to sell or transfer their assets, or to close open positions – no new exposure should be created.
- Firms must wind down in an orderly manner, prioritising client asset protection and clear communication to affected clients about the timeline and process.
Firms that ignore these obligations risk enforcement action by national competent authorities, potential criminal or administrative sanctions depending on the member state, and exposure to civil claims from clients who suffer loss during an unmanaged wind-down. AML/CFT obligations under the applicable anti-money laundering framework – including beneficial owner identification and transaction monitoring – remain fully in force throughout any wind-down period and are not suspended by the absence of a CASP licence.
If your business is currently in wind-down mode or is assessing whether its activities require a CASP licence, Ferraz & Whitmore can assist with regulatory analysis, competent authority correspondence, and structuring an orderly exit. Please write to us at info@ferrazwhitmore.com or visit our contacts page.
Immediate Action Items for International Companies
Firms that have not yet acted should treat the following steps as urgent priorities:
- Conduct a services audit. Map all activities currently provided to EU-resident clients against the MiCA list of crypto-asset services. Identify which entities within your group are performing those activities and whether any authorisation covers them.
- Confirm the status of pending applications. If an application was submitted before 1 July 2026, establish directly with the relevant competent authority whether a transitional permission to continue operating during the assessment period applies under national rules. This varies by member state and is not guaranteed.
- Assess jurisdiction of authorisation. MiCA authorisation in any EU member state carries a passport allowing services across the entire EU. Firms that have not yet chosen a licensing jurisdiction should evaluate options based on regulatory timelines, supervisory culture, and the scope of services required. Our detailed comparison of EU licensing jurisdictions is available at MiCA Jurisdiction Comparison.
- Review AML/CFT compliance frameworks. MiCA authorisation does not stand alone; firms must simultaneously satisfy AML/CFT obligations including customer due diligence, beneficial owner identification, and transaction monitoring. These requirements must be embedded in policies and procedures before an application can succeed. For guidance on Germany-specific AML compliance, see our AML compliance in Germany service page.
- Protect client assets and communications. If you are in wind-down mode, document all steps taken to notify clients, segregate assets, and restrict new activity. This record will be material if a competent authority investigates your conduct during the post-1 July period.
Selecting a Licensing Jurisdiction: Key Considerations
For firms that have decided to seek CASP authorisation, the choice of home member state carries long-term consequences. MiCA establishes a harmonised framework, but the competent authority responsible for your authorisation will remain your primary supervisory contact, and supervisory practices, processing timelines, and expectations around governance and capital vary in practice across member states.
Factors that international companies should weigh include the regulator's existing familiarity with crypto-asset business models, the availability of pre-application engagement processes, the language of correspondence, and the regulatory track record of the jurisdiction in financial services more broadly. For businesses seeking Netherlands-specific CASP licensing guidance, our team can advise on local requirements and engagement with the Dutch competent authority – see our MiCA licensing in the Netherlands service page.
Choosing a jurisdiction primarily on the basis of perceived leniency carries its own risk: ESMA maintains supervisory convergence oversight and the European Commission retains powers to address divergent national practices under MiCA's architecture.
Ongoing Regulatory Developments to Monitor
The MiCA framework continues to evolve. ESMA and EBA are issuing technical standards, guidelines, and Q&A documents on an ongoing basis, covering areas such as the classification of crypto-assets, the treatment of stablecoins (asset-referenced tokens and e-money tokens), reverse solicitation, and marketing communications. Firms should establish a process for monitoring EUR-Lex and the ESMA and EBA websites for updates that may affect their compliance obligations.
The CJEU has not yet issued major rulings interpreting MiCA's core provisions, but questions of scope – particularly regarding decentralised protocols and cross-border third-country access – are likely to generate preliminary references in due course. Monitoring relevant case law from national courts will also be important as enforcement actions begin to produce decisions.
Ferraz & Whitmore advises international clients on MiCA authorisation strategy, application preparation, and ongoing compliance across multiple EU member states. To discuss your specific situation, contact us at info@ferrazwhitmore.com or visit our contacts page.
How Ferraz & Whitmore Can Assist
Our team supports clients at each stage of the CASP authorisation process: from initial scope assessment and jurisdiction selection through the preparation of regulatory business plans, governance frameworks, and AML/CFT policies, to submission management and ongoing post-authorisation compliance. We also advise firms navigating the wind-down obligations applicable to unauthorised CASPs under ESMA's June 2026 guidance.
For clients with multi-jurisdictional operations, we coordinate with local counsel across EU member states to ensure that group-level strategies are consistent with the requirements of each relevant competent authority. Given the pace of regulatory development in this area, early engagement with specialist counsel significantly reduces the risk of procedural delays or substantive deficiencies in an application.
To begin a conversation about your regulatory position under MiCA, please reach out to our team at info@ferrazwhitmore.com or use the form on our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.