The MiCA transitional (grandfathering) period ended on 1 July 2026, and crypto-asset service providers that had been operating in Malta under national exemptions without a full CASP authorisation are now required to have ceased or wound down unauthorised activities. The Malta Financial Services Authority (MFSA) is the competent authority responsible for supervising compliance, and continued service provision to EU clients without a valid CASP licence is unlawful from that date. Businesses that have not yet secured authorisation face immediate regulatory exposure and must act without delay.
What Changed and When
MiCA's transitional provisions allowed crypto-asset service providers already operating under national law to continue doing so for a defined period while seeking full CASP authorisation under the new EU-wide framework. That window closed on 1 July 2026. In a public statement issued on 17 April 2026, ESMA confirmed that no extensions to this deadline would be granted. The position was reiterated and sharpened in a further ESMA public statement on 23 June 2026, which set out specific behavioural expectations for unauthorised CASPs in the lead-up to, and following, the end of the transitional period.
According to that June statement, unauthorised CASPs were required to stop onboarding new clients and cease all marketing of crypto-asset services. They were permitted to continue only to the limited extent necessary to allow existing clients to sell or transfer assets, close open positions, and otherwise exit in an orderly way. Since 1 July 2026, any ongoing provision of crypto-asset services to EU clients without authorisation is unlawful.
The Malta-Specific Angle: MFSA as Competent Authority
Malta was an early and active MiCA jurisdiction. The MFSA has been designated as Malta's competent authority for CASP authorisation and supervision under MiCA, and it engaged with the framework at an early stage. Businesses that had previously operated under Malta's Virtual Financial Assets (VFA) framework and applied for CASP authorisation may be at different stages of their regulatory journey depending on when and how their applications were submitted and processed.
The MFSA has the power to take supervisory and enforcement action against unauthorised providers operating from or through Malta. The authority can also coordinate with other EU national competent authorities where cross-border services are involved. Businesses incorporated in Malta but serving clients across the EU should be aware that both MFSA scrutiny and the oversight of other member states' regulators may apply simultaneously.
If your business is incorporated in Malta and you are uncertain whether your current authorisation status is compliant, or whether your activities fall within the scope of MiCA at all, this is the moment to obtain a precise legal assessment. You are welcome to contact our team at info@ferrazwhitmore.com or via our contacts page to discuss your situation.
Who Is Affected
The end of the transitional period affects a broad range of market participants. Those most directly at risk include:
- Providers operating under previous VFA licences who have not completed the migration to a CASP authorisation under MiCA.
- International companies using Malta as a gateway to EU clients that relied on grandfathering provisions and have not yet obtained a licence.
- Entities offering exchange, transfer, custody, portfolio management, or advisory services in relation to crypto-assets, all of which fall within the MiCA CASP definition.
- Businesses that assumed their activities fell outside MiCA scope but have not obtained a formal legal opinion confirming that position.
As of 12 August 2026, the ESMA CASP register listed 325 authorised providers across the EU. The scale of authorised entities relative to the number of active market participants suggests that a significant portion of previously active businesses remain unlicensed. Operating without authorisation now exposes a business and its senior management to enforcement action, potential civil liability, and reputational harm.
AML/CFT Obligations Run in Parallel
CASP authorisation under MiCA does not replace or satisfy AML/CFT obligations. In Malta, AML/CFT compliance for crypto-asset businesses remains subject to separate requirements, including the identification and verification of beneficial owners and the maintenance of adequate controls and reporting mechanisms. The MFSA and the Financial Intelligence Analysis Unit (FIAU) both play roles in this framework, and deficiencies in either the licensing or the AML/CFT dimension can give rise to independent regulatory consequences.
Businesses should therefore treat compliance as having two parallel tracks: securing the CASP authorisation, and ensuring that the AML/CFT programme is robust, documented, and current. Details of how we support businesses with the AML/CFT dimension are available at our AML compliance service page for Malta.
Immediate Action Items for International Companies
Given the urgency of the position, the following steps should be considered without delay:
- Confirm your authorisation status. Check whether your entity appears on the ESMA CASP register or holds a valid MFSA authorisation. Do not assume that a previous VFA licence or an exemption opinion continues to cover your current activities.
- Suspend new onboarding if you are unlicensed. In line with the ESMA statement of 23 June 2026, continuing to onboard clients or market services without authorisation is now specifically identified as a breach. Stop these activities immediately and document the decision.
- Assess scope carefully. Not all crypto-related activities are CASP services under MiCA. A structured scope analysis by a lawyer in Malta familiar with both MiCA and the MFSA's application practice can identify whether your services require authorisation, and on what timeline.
- Engage with the MFSA proactively if an application is in progress. If you submitted a CASP application before 1 July 2026, clarify its current status with the MFSA and understand what interim conduct expectations apply while it is being assessed.
- Review AML/CFT documentation. Update your beneficial owner registers, risk assessments, and internal controls to reflect the current regulatory position. Gaps in AML/CFT compliance may be identified in the course of any regulatory review triggered by licensing issues.
Passporting and Cross-Border Considerations
One of MiCA's significant features is the EU passporting mechanism, which allows an authorised CASP in one member state to provide services across the EU without needing separate authorisation in each country. Malta, as a small but highly active financial services jurisdiction, has historically been a common base for passporting strategies. However, passporting is only available to fully authorised CASPs. Businesses that anticipated using Malta as a passporting hub must hold a valid MFSA CASP licence before any cross-border services are extended or resumed. Our analysis of the passporting framework and its strategic implications is available in our MiCA passporting strategy briefing for Malta.
Practical Next Steps
The end of the transitional period is not a soft regulatory milestone. ESMA's April and June 2026 statements leave no ambiguity: the framework is now fully operative, and national competent authorities including the MFSA are expected to enforce it. For businesses incorporated in Malta or using Malta to service EU clients, the combination of MFSA supervisory capacity, EU-level coordination, and the clarity of the post-transitional legal position means that delay in addressing any outstanding compliance gap carries material risk.
Further details on the CASP authorisation procedure in Malta, including what the MFSA requires at each stage of the application, are set out on our MiCA licensing service page for Malta.
If your business needs a structured review of its current position under MiCA, guidance on how to approach the MFSA, or support in preparing or progressing a CASP application, the Ferraz & Whitmore team is available to assist. Please reach out at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.