MiCA after the transitional period: what changed on 1 July 2026

The transitional period under the Markets in Crypto-Assets Regulation ended on 1 July 2026. There was no extension, and ESMA said so publicly in April, three months before the deadline. For firms that were waiting to see whether the date would move, the answer arrived and it was no.

What actually changed

MiCA began applying to crypto-asset service providers on 30 December 2024. The regulation allowed member states to let firms that were already operating under a national regime continue for a transitional period while they applied for authorisation. Different member states set different windows; the outer limit was 1 July 2026.

That limit has now passed. The practical consequence is narrow and severe: the national regimes that firms were relying on no longer provide cover for serving EU clients. There is no residual category of “operating while we apply”. Either a firm holds a CASP authorisation, or it is providing crypto-asset services in the EU without authorisation.

Supervisors have not been ambiguous about the consequences. France's AMF has warned that operating without a licence can lead to blacklisting and criminal penalties. Others have been quieter but not more permissive.

Who is affected

The obligation attaches to the provision of crypto-asset services to clients in the EU. That includes custody and administration, operating a trading platform, exchanging crypto-assets for funds or for other crypto-assets, executing orders, placing, receiving and transmitting orders, advice, portfolio management and transfer services.

Two groups are more exposed than they realise.

• Firms that applied late and are still under review. A pending application is not an authorisation. If your national window has closed and the decision has not arrived, the activity has to stop or be restructured — an uncomfortable conversation that is considerably better held before a supervisor initiates it.
• Firms established outside the EU that serve EU clients. Reverse solicitation exists as a concept and is far narrower than the marketing material suggests. ESMA has consistently treated it as an exception to be construed strictly, not a business model.

The three routes back in

For a firm that is now outside the perimeter, there are three honest options and one dishonest one. The dishonest one — continuing quietly and hoping — is not analysed here, beyond the observation that the register is public and so is the absence of an entry in it.

1. Apply for authorisation

The clean route. Choose a member state, build the file, file it, answer the questions. It is the slowest option from a standing start and the only one that leaves you with an asset rather than a dependency.

2. Passport in from an authorised entity

Authorisation in one member state passports across the EEA on notification. If the group already holds a CASP licence somewhere, extending it may be a notification exercise rather than a new application. This is frequently overlooked by groups whose entities were built to serve different markets.

3. Acquire an authorised firm

The fastest post-deadline route, because due diligence substitutes for a multi-month application. Two cautions: the change of control itself requires regulatory approval and is not instantaneous, and you inherit the target's supervisory history, including findings that are not visible from the register. Price the second point properly.

As of early August 2026 the ESMA register showed a few hundred authorised CASPs across most member states, with Germany, France and the Netherlands holding the largest numbers. Only a small minority are authorised to operate trading platforms — worth knowing if that is the service you need, because the acquisition pool is correspondingly thin.

What authorisation requires

Capital depends on which services you provide.

Beyond capital, the file has to demonstrate effective management in the member state of authorisation, at least one EU-resident director, governance arrangements proportionate to the services, an AML/CFT framework, ICT and business continuity arrangements, complaints handling, conflict-of-interest management and — for trading platforms — market abuse controls.

How long it really takes

The statutory framework is clear and, on its own, misleading. The competent authority acknowledges receipt within five working days, assesses completeness within twenty-five working days, and then has forty working days to decide, extendable.

What that omits is that the clock restarts if the application is incomplete, and that requests for further information suspend it. Counting preparation, the completeness check, at least one round of questions and the authority's internal process, four to six months from engagement to decision is a realistic planning assumption for a well-prepared file. Novel business models take longer. Poorly prepared files take considerably longer, and some never conclude.

Four mistakes we are seeing

1. Choosing the member state by application fee. The fee is the smallest number in the project. Supervisory posture, review throughput, language of proceedings and the willingness of local banks to serve authorised CASPs matter far more.
2. Applying for every service “to be safe”. Each additional service adds capital, obligations and questions. Apply for what you will actually provide in the next eighteen months and extend later.
3. Treating the AML framework as an annex. It is examined as a primary document, and a generic one signals that the rest of the file may be generic too.
4. Leaving the travel rule to the technology team. Originator and beneficiary information obligations, and the treatment of self-hosted wallets, are legal design decisions with technical consequences — not the reverse.

What to do now

If you are serving EU clients without authorisation, the first step is a written assessment of exposure: which services, which clients, which member states, and what the realistic remediation path is. That document is also what you will need if a supervisor makes contact, and it is far better to have written it in advance.

We prepare that assessment as a fixed-fee piece of work. See licensing for what an application involves, or write to us with a description of the services you provide and where your clients are.