Since 1 July 2026, the MiCA transitional period has expired and providing crypto-asset services to EU clients without a valid CASP authorisation is unlawful across all EU member states. ESMA confirmed on 17 April 2026 that no extensions would be granted, and its public statement of 23 June 2026 set out specific obligations for unauthorised operators: cease onboarding and marketing immediately, restrict activity to helping clients sell, transfer or close existing positions, and wind down in an orderly manner. Firms that continue to offer services beyond those limits now face direct civil, administrative and potentially criminal liability exposure under MiCA and parallel national frameworks.
The Regulatory Threshold: What Changed on 1 July 2026
MiCA's full-scope application to crypto-asset service providers took effect on 30 December 2024 for most service categories, but member states were permitted to apply transitional or grandfathering arrangements until 1 July 2026. That date represented a hard legal cliff. ESMA's statement of 17 April 2026 left no ambiguity: competent authorities were not authorised to recognise informal extensions, and the Commission did not propose any legislative delay. For operators who had relied on grandfathering to continue trading under legacy national registrations, the cliff arrived on schedule.
The practical result is that any entity providing crypto-asset services – including the operation of a trading platform, execution of orders, custody, exchange services or portfolio management – to EU-resident clients must now hold a CASP authorisation issued by the competent authority of an EU member state, or benefit from a recognised third-country equivalence determination. No such equivalence decisions were in place as of the third quarter of 2026, meaning offshore operators effectively have no compliant pathway other than licensing.
ESMA's June 2026 Statement and the Wind-Down Perimeter
ESMA's public statement of 23 June 2026 deserves close reading. It did not simply restate the licensing obligation – it drew a precise boundary around what unlicensed CASPs may lawfully do during the period following expiry of their grandfathered status. Permissible activity is confined to three categories:
- Selling or transferring assets held in custody on behalf of existing clients;
- Closing open positions in a controlled manner; and
- Orderly wind-down of the business, including client notification and record preservation.
Everything outside this narrow perimeter – accepting new clients, running advertising campaigns, executing new trades for existing clients in categories beyond position closure, or collecting new custody assets – is now unlawful. ESMA's use of the phrase "must stop" in relation to onboarding and marketing is directive, not advisory. Competent authorities are expected to treat any breach as an immediate supervisory matter.
One open question the statement did not resolve is the precise treatment of ancillary services that a platform provides alongside core CASP activities: for example, staking rewards accruing on assets already in custody, or loyalty programmes. Firms navigating this grey area should obtain specific legal advice rather than assuming any ongoing benefit to clients is permissible.
Liability Exposure: The Layers of Risk
Operating without a CASP authorisation after 1 July 2026 exposes a firm – and in many jurisdictions its directors and beneficial owners – to overlapping liability frameworks. These operate independently of one another, and a single set of facts can trigger consequences across several simultaneously.
Administrative Sanctions Under MiCA
MiCA itself does not prescribe a single EU-wide tariff for sanctions; it instead sets minimum floors and requires member states to implement measures that are effective, proportionate and dissuasive. National competent authorities have broad discretion to impose administrative fines, require disgorgement of profits, suspend or prohibit the provision of services, and publish their decisions (the "naming and shaming" mechanism). The reputational dimension of public enforcement decisions should not be underestimated: once published, they are indexed across ESMA's databases and are visible to regulated counterparties, banks and institutional clients globally.
Importantly, MiCA extends liability exposure to individuals. Senior managers and, in some national implementations, persons exercising effective control or holding significant beneficial ownership interests may be held personally liable for violations committed by the firm. The beneficial owner identification angle creates particular risk for offshore holding structures that operate EU-facing platforms through intermediary entities.
AML/CFT Overlay
MiCA compliance does not substitute for AML/CFT obligations. CASPs are obliged entities under the EU's Anti-Money Laundering framework, and an unlicensed CASP that has been onboarding clients without conducting proper customer due diligence, verifying beneficial owner identity, or filing suspicious transaction reports is simultaneously in breach of AML law. In several member states, AML violations carry criminal rather than purely administrative consequences. This dual exposure – MiCA sanctions plus AML liability – significantly amplifies the risk profile of continued unlicensed operation. Firms assessing their position should treat AML compliance as a parallel workstream, not a downstream consideration.
If your firm is reviewing its AML/CFT posture alongside its MiCA positioning, our dedicated analysis of AML compliance frameworks for crypto businesses in Ireland may provide relevant context on how these obligations interact in a commonly used EU licensing jurisdiction.
Civil Liability to Clients
Clients who suffer losses while using an unlicensed CASP may have grounds for civil claims in multiple jurisdictions. The unauthorised provision of regulated services can, depending on national law, render contracts voidable, entitle clients to restitution of sums paid, or support claims in tort. The extent to which EU consumer protection principles apply to crypto-asset clients remains a developing area – the CJEU has not yet handed down definitive rulings on MiCA-specific civil liability questions – but national courts in several member states have been willing to draw on analogous financial services law when construing unlicensed activity cases. This jurisprudential uncertainty itself represents a risk: the direction of travel in EU courts is unlikely to favour unlicensed operators.
Cross-Border Dimensions: Third-Country Operators
MiCA applies on the basis of where clients are located, not where the service provider is incorporated. A firm incorporated in Singapore, the British Virgin Islands, or any other non-EU jurisdiction that markets to or onboards EU-resident clients is within scope. The absence of physical presence in the EU does not limit the reach of MiCA's prohibition or the authority of competent authorities to take supervisory measures, issue public warnings, or coordinate with third-country regulators under existing memoranda of understanding.
ESMA's register, which listed 325 authorised CASPs as of 12 August 2026, is publicly accessible and updated. EU banks, payment processors and institutional partners are increasingly cross-referencing this register before establishing or maintaining relationships with crypto businesses. An entity not appearing on the register faces growing friction in accessing banking infrastructure and correspondent relationships within the EU, even before formal enforcement action is initiated.
The growth in registered CASPs – from approximately 210 by May 2026 to 325 by mid-August 2026 – reflects a significant acceleration of the licensing pipeline as the transitional deadline approached. This confirms that the pathway to authorisation is operational, and that delay is increasingly a choice with identifiable legal consequences rather than a response to structural unavailability of the process.
Strategic Options for Unlicensed Operators Post-July 2026
Firms in an unlicensed position as of July 2026 face a materially narrower set of options than they would have had twelve months earlier. The viable paths, and their respective considerations, are as follows.
Accelerated Licensing in a Responsive Jurisdiction
For firms that have already prepared their governance, risk, compliance and capital structures, an accelerated application to a competent authority that has demonstrated processing capability remains the most commercially sustainable path. Ireland, among others, has processed a number of CASP authorisations and has a competent authority (the Central Bank of Ireland) with established fintech supervisory practice. Once authorised in any EU member state, a CASP can passport its services across the bloc under MiCA's single licence framework.
Our team has detailed guidance on the MiCA licensing process in Ireland, including the procedural requirements and timeline considerations applicable to new applicants in the current supervisory environment.
Orderly Wind-Down of EU Activity
For firms that determine that EU licensing is not commercially viable, the ESMA statement of 23 June 2026 provides implicit guidance on how to exit without triggering aggravated enforcement risk. Executing a documented, client-notified, asset-repatriated wind-down – while retaining records of the process – is meaningfully different in a supervisory context from simply ceasing operations without notification. Competent authorities have consistently treated cooperative and transparent operators more favourably than those who abandon clients or obscure their wind-down.
Structural Reconsideration
Some operators are examining whether specific services they provide fall outside the MiCA definition of crypto-asset services – for example, because the tokens involved qualify as financial instruments under MiFID II rather than crypto-assets under MiCA, or because the activity is purely technical infrastructure without a client-facing service component. These boundary questions are legally complex and fact-specific. They are not a route to be pursued without formal legal analysis, but where genuinely applicable they may offer a compliant path that does not require CASP authorisation.
Similarly, the intersection of MiCA with stablecoin-related activities raises particular questions about which service categories are triggered and by whom. Our analysis of MiCA's impact on stablecoin delisting in the EU examines how the regulatory boundary operates in practice for token issuers and platforms alike.
Open Questions and Evolving Interpretation
MiCA is a framework regulation: it establishes principles and authorisation requirements, but significant interpretive work remains outstanding. ESMA and EBA are in the process of finalising technical standards and guidelines across multiple workstreams. Several areas of practical uncertainty persist:
- Reverse solicitation: MiCA permits third-country firms to serve EU clients who initiate contact at their own exclusive initiative, but the boundaries of this exemption are contested. ESMA has signalled a narrow interpretation, and reliance on reverse solicitation as a primary compliance strategy carries enforcement risk.
- DeFi and non-custodial protocols: The European Commission has indicated it will review the treatment of decentralised finance under MiCA, but no legislative proposal had been published as of the date of this analysis. Operators in this space face ongoing uncertainty.
- Enforcement divergence across member states: Competent authorities differ in their supervisory philosophy, resourcing and enforcement appetite. This creates practical variation in enforcement risk that is not yet fully mapped.
- Interaction with national criminal law: In some member states, providing unauthorised financial services is a criminal offence under provisions that predate MiCA and that national prosecutors may invoke in parallel with administrative proceedings.
These open questions do not reduce the core obligation: provide services without a CASP authorisation after 1 July 2026, and the exposure is real. But they do affect the precise contours of risk and the strategic choices available to firms in ambiguous positions.
Outlook: Enforcement Trajectory
Based on the public statements of ESMA and the stated supervisory priorities of several national competent authorities, enforcement activity against unlicensed CASPs is likely to intensify through the remainder of 2026 and into 2027. The combination of an operational ESMA register, active data-sharing between competent authorities, and increasing cooperation with payment service providers and banking supervisors creates a structural environment in which unlicensed operation is progressively harder to sustain without detection.
The EUR-Lex database provides public access to the full text of MiCA and its implementing measures, and ESMA's website maintains the live CASP register. Firms should treat these as primary reference points rather than secondary commentary, and should ensure their internal legal and compliance teams are monitoring both for updates.
If your organisation is assessing its exposure under MiCA's post-transitional enforcement regime, or is considering a licensing application, restructuring of EU-facing services, or a documented wind-down, the team at Ferraz & Whitmore is available to discuss the specifics of your situation. You can reach us at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.