MiCA after 1 July 2026: crypto service providers now need a licence
The MiCA grandfathering period is over. What authorisation and passporting mean, how to use the ESMA register, and what to check about your providers.
Since 1 July 2026, any firm providing crypto-asset services to clients in the EU needs a MiCA authorisation, and the national grandfathering windows are closed [1]. If your company holds crypto with an exchange, custodian or broker that serves the EU, confirm that the legal entity you contract with is on ESMA's register.
What changed on 1 July 2026
MiCA, Regulation (EU) 2023/1114, applied its rules for crypto-asset service providers (CASPs) from 30 December 2024. Firms that were already operating lawfully under national law before that date could keep going until 1 July 2026, or until their MiCA application was granted or refused, whichever came first. Member States could also shorten that window or not offer it at all [2].
ESMA confirmed in April 2026 that the transitional period would end across the EU on 1 July 2026, and that any entity serving EU clients without a MiCA licence after that date breaches EU law and must stop [1]. It added that some firms were barred earlier: those that never qualified for the transitional regime, and those in Member States whose shorter window had already closed [1].
In a June 2026 statement, ESMA set out what an unauthorised firm must do: stop onboarding new EU clients and marketing, limit activity to helping clients sell, transfer or close positions, keep custody only as long as strictly needed for an orderly exit, and tell clients the deadline after which remaining positions will be closed automatically [3].
Who needs an authorisation
Under Article 59 of MiCA, only two kinds of firm may provide crypto-asset services in the EU: a legal person authorised as a CASP under Article 63, or an already-regulated institution, such as a bank, investment firm, e-money institution or fund manager, that is allowed to provide those services by notifying its regulator under Article 60 [2]. An authorised CASP must have its registered office in a Member State, its place of effective management in the EU and at least one EU-resident director [2].
Firms based outside the EU cannot solicit EU clients. The only exception is reverse solicitation, where the client approaches the firm entirely on its own initiative, and MiCA says a contract clause claiming otherwise does not count [2]. ESMA has stressed that this exception is narrow and also applies business to business: MiCA stops a CASP from outsourcing custody to an entity that is not itself authorised [1][3].
How passporting works
One authorisation covers the whole EU. A CASP that wants to serve clients in other Member States sends its home regulator a list of those countries, the services it plans to offer and a start date. The home regulator passes this to the host countries, ESMA and the EBA within 10 working days. The firm may start once it is told this has happened, or at the latest on the 15th calendar day after it submitted the information [2].
Using the ESMA register
Article 109 requires ESMA to publish a register of CASPs and of white papers and stablecoin issuers [2]. Until that is built into ESMA's IT systems, ESMA publishes an interim register as downloadable CSV files, updated weekly, including a list of authorised CASPs and a separate list of non-compliant entities [4]. Each CASP entry shows the home regulator, the legal entity name and identifier, the services authorised and the countries it may serve [5].
When we downloaded the CASP file on 16 October 2026 it held 378 entries across 27 home states, with Germany the largest at 109 [5]. That count mixes full Article 63 authorisations and Article 60 notifications by already-regulated firms, so treat it as a rough indicator, not a headline figure.
ESMA's consumer warning is a useful test for corporate treasuries too. MiCA protections attach to the specific authorised EU legal entity, not to other companies in the same group or to non-EU affiliates trading under the same brand, so check which entity is named in your contract [1].
What authorisation gives you as a client
A CASP that holds client crypto-assets must have arrangements that protect clients' ownership rights, especially if the CASP becomes insolvent, and must not use client assets for its own account. Client cash, other than e-money tokens, must be placed with a credit institution or central bank by the end of the next business day in a separately identifiable account [2]. Custodians must also sign a custody agreement with each client and keep a register of positions per client [2].
What comes next
The rulebook is still moving. In its 30 September 2026 response to the European Commission's consultation on reviewing MiCA, ESMA proposed binding opinions on token classification, a clearer and narrower definition of DeFi, a new regulated service for CASPs that give clients access to DeFi, targeted rules for staking, lending and borrowing, and fuller cost disclosure [6]. It also noted a separate Commission proposal that could move CASP supervision from national regulators to ESMA [6]. None of these is law yet.
What to do
- List every exchange, broker and custodian the company uses for EU activity, and record the exact contracting legal entity for each.
- Check each entity against the current ESMA interim register CSV, and keep a dated copy of the result with your audit evidence.
- If a provider is not authorised, plan an orderly move to an authorised CASP or to self-custody and track the transfer as an internal movement, not a disposal.
- Ask custodians for their custody agreement and confirm how client assets are segregated and what happens on insolvency.
- Watch the MiCA review and any shift of supervision to ESMA, as it may change who you deal with for complaints and reporting.
Sources
- Statement on the End of Transitional Periods under MiCA (ESMA75-113276571-1679) (ESMA)
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) (EUR-Lex)
- Public Statement: ESMA calls on unauthorised crypto-asset service providers to wind down orderly (ESMA75-113276571-1710) (ESMA)
- Markets in Crypto-Assets Regulation (MiCA) — interim MiCA register (ESMA)
- Interim MiCA register: authorised crypto-asset service providers (CASPS.csv) (ESMA)
- ESMA Response to the EC Consultation on the review of Regulation (EU) 2023/1114 (MiCA) (ESMA)
General information for finance teams, current as of publication. Not legal, tax or accounting advice.