The MiCA transitional period ended on 1 July 2026, and crypto-asset service providers operating in France without full CASP authorisation are now acting unlawfully under EU law. The AMF and ACPR – France's joint competent authorities under MiCA – may take enforcement action against any entity continuing to offer regulated crypto-asset services to EU clients without authorisation. Companies that have not yet secured their licence must act immediately to limit their exposure and begin an orderly wind-down or accelerate their authorisation process.
What Changed on 1 July 2026
MiCA – Regulation (EU) 2023/1114 – introduced a transitional (grandfathering) window that allowed crypto-asset service providers already operating under national registration regimes to continue their activities while pursuing full CASP authorisation. In France, this meant that entities holding a PSAN (Prestataire de Services sur Actifs Numériques) registration with the AMF were permitted to keep offering services to clients during the transitional period without having yet obtained the MiCA licence.
That window closed on 1 July 2026. ESMA confirmed on 17 April 2026 that no extension would be granted. Any ambiguity about whether regulators might exercise forbearance was removed by ESMA's public statement of 23 June 2026, which set out a clear framework for unauthorised CASPs: stop onboarding new clients, stop all marketing, limit residual services strictly to selling or transferring assets or closing open positions, and wind down operations in an orderly manner.
France-Specific Context: AMF and ACPR as Joint Gatekeepers
France has a dual-authority structure under MiCA. The AMF is the lead competent authority for CASP authorisation and market conduct supervision, while the ACPR retains a supervisory role with respect to AML/CFT compliance and prudential oversight for certain service categories. This arrangement reflects France's pre-MiCA approach, where both bodies were already involved in the PSAN framework.
In practice, this means that a crypto-asset service provider seeking or maintaining authorisation in France must satisfy two parallel regulatory tracks. AML/CFT requirements – including robust procedures for identifying the beneficial owner, transaction monitoring, and suspicious activity reporting – are assessed with ACPR involvement, not solely by the AMF. Businesses that treated their pre-MiCA PSAN registration as satisfactory preparation may find that ACPR's MiCA-era expectations around AML/CFT controls are materially more demanding.
If your business is navigating the AMF/ACPR dual-track authorisation process, Ferraz & Whitmore can assist with structuring your application and compliance framework. Contact us at info@ferrazwhitmore.com or visit our contacts page.
Who Is Affected in France
The obligation to hold CASP authorisation applies to any entity providing one or more crypto-asset services to clients located in the EU, regardless of where the provider is incorporated. French-incorporated entities are directly subject to AMF/ACPR jurisdiction. Non-EU entities – including those incorporated in third countries but marketing or servicing French clients – are equally caught: MiCA does not grant a general third-country exemption.
The following categories are most immediately at risk:
- Former PSAN-registered entities that filed a MiCA authorisation application but have not yet received a decision – these may continue operating only if the application was submitted before the transitional deadline and national law permits interim continuation; the position under French national rules should be verified directly with the AMF.
- PSAN-registered entities that did not apply for CASP authorisation and are still active – these are now operating unlawfully and must cease regulated services immediately.
- Third-country crypto-asset service providers with French retail or professional clients, whether solicited or unsolicited, who do not hold CASP authorisation in any EU member state.
- Group structures where a non-EU parent or affiliate routes services to French clients through a thin local presence that does not itself hold CASP authorisation.
The Enforcement Landscape: What Unauthorised Providers Face
ESMA's register recorded 325 authorised CASPs as of 12 August 2026, following a period in which approximately 210 full authorisations had been issued by May 2026. The gap between those figures and the far larger number of entities that were operating under transitional arrangements illustrates the scale of the compliance challenge across the EU.
In France, the AMF has established enforcement tools commensurate with the significance of MiCA. Civil and administrative sanctions may include public reprimands, fines, and prohibition orders. The AMF can publish enforcement decisions, which carries reputational consequences in addition to financial penalties. The ACPR has parallel powers with respect to AML/CFT breaches, including the ability to withdraw authorisation where AML/CFT obligations are not met. French courts – including the Cour de cassation at the apex of the civil and commercial hierarchy – have historically given weight to regulatory determinations when private disputes arising from unlicensed activity are litigated.
Beyond regulatory action, client-facing consequences are significant. Contracts for crypto-asset services entered into by an unauthorised provider may be subject to challenge. Where clients suffer loss, claims under French civil law are plausible. French procedural tools such as the injonction de payer (a summary debt enforcement procedure administered through the courts and served by a commissaire de justice) can be used by creditors against service providers with a French nexus, adding a layer of civil litigation risk on top of regulatory enforcement.
Immediate Actions for International Companies
Whether you operate from France or serve French clients from abroad, the following steps should be taken without delay:
- Audit your service footprint. Map every crypto-asset service you currently provide and identify which are regulated under MiCA. Confirm whether any clients are located in France or elsewhere in the EU, regardless of how the relationship was originated.
- Verify your authorisation status. Check the ESMA CASP register. If your entity – or the group entity through which you operate – does not appear as authorised, assume you are not covered and take immediate steps to restrict services in line with ESMA's 23 June 2026 statement.
- Implement ESMA's wind-down framework. If full authorisation is not imminent, halt new client onboarding and all marketing directed at EU persons. Limit remaining activity to enabling clients to exit positions, transfer assets, or close accounts. Document every step taken and the rationale.
- Accelerate your CASP authorisation application with the AMF. If you intend to continue operating in the French market, engage directly with the AMF's authorisation process and, in parallel, ensure your AML/CFT programme meets ACPR's requirements – including beneficial ownership identification, enhanced due diligence procedures, and internal controls documentation.
- Seek legal advice in France. The interaction between MiCA's EU-level requirements and French national procedural law – including the AMF/ACPR dual-track structure and the civil liability exposure under French law – makes France-specific legal input essential. Generic EU MiCA guidance is not a substitute for advice tailored to the French regulatory environment.
Our team advises international crypto-asset businesses on CASP authorisation in France and across the EU. For details of our approach to MiCA authorisation in France, see our MiCA licensing service page for France. You may also find our case analysis on CASP authorisation in France a useful reference point.
AML/CFT Compliance: A Separate but Linked Obligation
CASP authorisation and AML/CFT compliance are legally distinct requirements, but in France they are evaluated together. The ACPR applies the EU AML framework as transposed into French law, and its assessment of an applicant's AML/CFT programme forms part of the overall authorisation decision. Post-authorisation, AML/CFT supervisory inspections continue independently of market conduct oversight by the AMF.
For businesses that have focused primarily on the licensing track and not yet fully built out their AML/CFT infrastructure, this is an area requiring urgent attention. Key requirements include documented risk assessment, procedures for identifying the beneficial owner at onboarding and on an ongoing basis, transaction monitoring calibrated to the risks of the specific crypto-asset services offered, and clear escalation and suspicious activity reporting procedures.
AML/CFT requirements for CASPs share structural features across EU member states, though national supervisory expectations differ in emphasis. Our AML compliance service overview provides a comparative perspective that may be useful for groups operating across multiple EU jurisdictions.
Next Steps
The end of the MiCA transitional period is not a procedural formality – it is a hard legal cut-off with direct enforcement consequences in France and across the EU. For businesses that are not yet authorised, the window for an orderly response is narrowing. The AMF and ACPR are operational as MiCA competent authorities, and the regulatory and civil litigation risks of continued unauthorised activity are live.
If you are uncertain about your current status, the scope of the wind-down obligations that apply to you, or the steps required to pursue CASP authorisation through the AMF, we encourage you to contact Ferraz & Whitmore for a structured assessment of your position. Reach our team at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.