Europe's regulator tells unlicensed crypto firms to wind down as the MiCA clock hits zero

The clock has run out. July 1, 2026 marks the hard expiry of MiCA's transitional period across the European Union, and the European Securities and Markets Authority (@ESMAComms) has been unambiguous: any entity providing crypto-asset services to EU clients without a MiCA licence is now in breach of EU law and must cease operations. In an April 17, 2026 statement that set out the regulator's expectations, ESMA confirmed that no further grace periods or extensions are available under the current regulation text.

What Unlicensed Firms Must Do Now

ESMA's expectations for firms that failed to secure authorisation are immediate and detailed. Unlicensed providers must stop taking new EU clients, halt all marketing activity, and restrict operations solely to helping existing users sell, transfer, or close out their positions. Custody of client assets is permitted only for as long as it takes to complete an exit in good order. Critically, compliance obligations do not pause during a wind-down: firms must maintain anti-money laundering and counter-terrorism financing controls throughout, including customer due diligence, transaction monitoring, sanctions screening, suspicious transaction reporting, and record-keeping.

The rules extend beyond EU-based operators. Non-EU firms serving EU clients, including on a business-to-business basis, fall within the same scope. ESMA also expects firms to communicate clearly and promptly with clients, covering the wind-down timeline, what protections are in place, what will happen to residual positions if no action is taken, and a stated deadline for automatic position closure.

The Scale of the Compliance Gap

The licensing shortfall heading into the deadline is significant. According to industry reporting, only around 210 of the 1,200-plus VASP entities that held pre-MiCA national registrations had converted to full CASP authorisation by May 2026, a conversion rate of roughly 17%. Multiple sources tracking the ESMA interim register also confirm that ten EU jurisdictions had produced zero public CASP authorisation records as of that date, with Poland the most acute case: its parliament twice vetoed domestic MiCA implementation legislation, leaving the national regulator with no legal basis to process applications.

Major exchanges including Kraken, Coinbase, Bitstamp (authorised by Luxembourg's CSSF in May 2025), Bitpanda, OKX, and Crypto.com have secured licences. But the firms that did not are now legally required to stop serving EU clients. The consequences of non-compliance are serious: unlicensed CASPs face significant fines, cease-and-desist orders, and bans on EU operations. France's AMF has warned that operating without authorisation after the deadline will expose firms to criminal prosecution.

@ESMAComms also directed retail investors to act. Clients of unlicensed providers receive none of MiCA's investor protections. EU clients were advised to verify whether their provider holds authorisation by consulting the ESMA Register, the public database of licensed CASPs. ESMA also cautioned that MiCA protections apply only to the specific authorised EU entity, not necessarily to other companies operating under the same brand.

Sources:
ESMA: Statement on the end of transitional periods under MiCA (April 17, 2026)
Bitstamp: Bitstamp Secures CASP License Under MiCA
Yahoo Finance: July 1 MiCA Deadline Looms: More Than 80% of EU Crypto Firms Still Unlicensed