MiCA’s Grace Period Is Over: What Crypto Businesses Need to Know After 1 July 2026

For the last eighteen months, crypto firms in the EU have lived with a comfortable grey zone. The Markets in Crypto-Assets Regulation (MiCA) was in force, but businesses already operating under national regimes could keep serving clients while their licence applications worked their way through the system.

That grey zone is gone. On 1 July 2026, the last of MiCA’s transitional (“grandfathering”) periods expired. From that date, any company providing crypto-asset services to clients in the EU needs to be authorised as a crypto-asset service provider (CASP) under MiCA, or be an authorised financial entity that has notified its regulator. There is no longer a national licence to fall back on.

Here is what changed, what regulators now expect, and what crypto businesses, their partners and their compliance teams should be doing next.

How we got here: a quick MiCA timeline

• June 2023 – MiCA enters into force, giving the industry a single EU rulebook for crypto-assets.
• 30 June 2024 – the rules for stablecoins (asset-referenced tokens and e-money tokens) start to apply.
• 30 December 2024 – MiCA applies in full, including the CASP licensing regime. The EU’s crypto “travel rule” under the Transfer of Funds Regulation also applies from this date.
• December 2024 – July 2026 – member states may let firms operating under existing national regimes keep serving clients while they apply, for a maximum of 18 months.
• 1 July 2026 – the outer limit of every transitional period. Grandfathering ends everywhere in the EU.

Not every firm had until July 2026

The 1 July 2026 date was a ceiling, not a common deadline. Each member state chose how long its own transitional period would last. The Netherlands and Poland closed theirs in mid-2025, and Germany, Ireland, Austria and Lithuania did so around the end of 2025. Only a handful of jurisdictions, including France, Malta, Luxembourg, Estonia and Cyprus, used the full 18 months.

In practice, this means many firms that planned for a July 2026 deadline had already lost the right to operate in some markets months earlier. If your business or your counterparties serve clients in several EU countries, the relevant question was never “when does MiCA’s transition end?” but “when did it end in each country where we have clients?”

What ESMA expects now

On 23 June 2026, the European Securities and Markets Authority (ESMA) issued a public statement setting out what it expects from firms that did not secure authorisation in time. The message was blunt: unauthorised CASPs should

• immediately stop onboarding new EU clients, opening new accounts or marketing their services in the EU;
• limit themselves to actions needed to close positions, sell or transfer crypto-assets and return assets to clients, with custody allowed only temporarily as part of the exit;
• communicate clearly, promptly and repeatedly with retail and institutional clients about how their assets are being safeguarded and how the wind-down will work; and
• continue to meet their AML/CFT obligations — customer due diligence, transaction monitoring and sanctions screening — throughout the wind-down.

ESMA also reminded clients that they do not benefit from MiCA’s safeguards, including client-asset protections, when they use an unauthorised provider. Its advice to consumers is to check the provider against the ESMA register and consider moving assets to an authorised CASP or a self-hosted wallet.

“Reverse solicitation” is not a back door

Some non-EU platforms hoped to keep serving EU customers by arguing that the customer approached them first. MiCA does allow services provided at the client’s own exclusive initiative, but regulators have repeatedly said this exemption is narrow. It does not cover firms that market to EU residents, run EU-language campaigns or use affiliates and influencers to reach EU audiences. For compliance and legal teams, a business model that relies on reverse solicitation for EU revenue should now be treated as a serious red flag.

What this means for different players

Authorised CASPs

Authorisation is the start of supervision, not the end of the project. Authorised firms can passport their services across the EU, but they are now subject to ongoing conduct, governance, safeguarding and reporting requirements. Board accountability, complaints handling, conflicts-of-interest policies and outsourcing arrangements will all be tested in supervisory reviews.

Firms still waiting for a licence

If your application is still pending and your transitional period has ended, you must follow the wind-down expectations above for EU clients. Keep a documented, dated record of what you stopped doing and when, and of how clients were informed. Regulators will want to see it.

Banks, fintechs and institutional counterparties

Onboarding and ongoing due diligence on crypto counterparties should now include a simple, non-negotiable check: is the firm on the ESMA register as an authorised CASP, and for which services? A national VASP registration is no longer enough for a firm serving EU clients.

Law firms, compliance teams and investigators

Expect more work on licensing gap analyses, wind-down planning, client communications and disputes with platforms that exited the EU market. For fraud and asset-recovery cases, authorisation status is also a useful first signal: a platform actively targeting EU users without MiCA authorisation is either operating illegally or is not what it claims to be.

Everyday users and investors

Before depositing funds with any platform, check whether it is authorised under MiCA. If a platform tells you it is “registered” but you cannot find it in the ESMA register, treat that as a warning sign.

Beyond MiCA: the compliance stack keeps growing

MiCA is only one layer of the EU’s crypto rulebook. Three other regimes matter just as much for day-to-day operations:

• The travel rule (Transfer of Funds Regulation). Since 30 December 2024, CASPs must collect and transmit originator and beneficiary information with crypto transfers, and apply extra checks to transfers involving self-hosted wallets.
• DAC8 tax reporting. Since 1 January 2026, reporting crypto-asset service providers must collect data on reportable transactions of EU-resident users. The first reports are due between 1 January and 30 September 2027. DAC8 is the EU’s implementation of the OECD’s Crypto-Asset Reporting Framework (CARF).
• The EU Anti-Money Laundering Regulation (AMLR). From 10 July 2027, a single, directly applicable AML rulebook replaces much of today’s national AML legislation, with the new EU AML Authority (AMLA) overseeing the system. CASPs are obliged entities under the new framework.

A practical checklist for the next 90 days

1. Map your client footprint by country, and confirm the authorisation or notification that covers each market and each service.
2. Verify your counterparties — exchanges, custodians, liquidity providers and payment partners — against the ESMA register, and document the check.
3. Review marketing and onboarding flows to make sure you are not soliciting clients in markets where you are not authorised.
4. Test your travel-rule process end to end, including transfers to and from self-hosted wallets.
5. Confirm your DAC8 data collection is capturing what you will need to report in 2027.
6. Start your AMLR gap analysis now, so the July 2027 changes do not become another last-minute project.
7. Train the people who apply the rules. Policies only work when onboarding, operations and customer-support teams understand them.

This article is for general information only and does not constitute legal advice. Requirements vary by member state and by service. Always check the current position with your national competent authority or legal adviser.

Sources: ESMA public statement on the end of MiCA transitional periods (23 June 2026); European Commission – DAC8.