The EU MiCA regulation stopped being a future compliance project on 1 July 2026, and the register tells you how the sorting went: 325 authorised crypto-asset service providers across the European Economic Area as of mid-August 2026 (Source: ESMA MiCA register). Everyone else either wound down, went quiet, or is still waiting on a national regulator.
That number looks small next to the sprawl of firms that were serving European users two years ago. It is supposed to. MiCA replaced a patchwork of national registrations with one authorisation that passports across all 27 member states, and the price of that single passport is a level of documentation, capital, and governance that most offshore operators were never built to produce. The market that came out the other side is smaller, more bank-like, and easier to verify.
Key Takeaways
- MiCA’s transitional period ended 1 July 2026 with no extension
- Unauthorised providers must stop onboarding EU clients and wind down
- One national CASP licence passports across all 27 member states
- Binance withdrew its Greek application and suspended EU services
- The stablecoin cap applies to payments, not to trading
Table of contents
What Actually Changed on 1 July 2026
MiCA entered full application on 30 December 2024, but most member states used a grandfathering window that let existing nationally registered firms keep trading while they applied. Those windows closed. Germany ended its transition on 31 December 2025, the Netherlands ran to 1 July 2025, and the outer limit across the bloc was 1 July 2026.
ESMA published a statement on 23 June 2026 setting out what unauthorised firms are expected to do after that date. The instructions are blunt. Stop onboarding new EU clients immediately, stop marketing and solicitation, and limit service to whatever is needed for clients to sell, transfer, reallocate, or close positions. Custody can continue only for as long as an orderly exit takes. Firms have to tell clients repeatedly and clearly what is happening, including a date after which residual positions get closed automatically.
ESMA also closed the door that most non-EU platforms were quietly counting on. Firms established outside the EU cannot provide MiCA services to EU clients or solicit them, and that holds in business-to-business contexts too. Reverse solicitation survives, but only in the narrow form ESMA’s guidelines describe, which is not the workaround the industry hoped for. Outsourcing custody to an entity that is not itself an authorised CASP is prohibited outright.
For anyone tracking how regulations shape cryptocurrency markets, this is the part worth noting: the enforcement mechanism is not a fine arriving in the post. It is a register. Banks, payment partners, and institutional counterparties can now check a firm’s status in seconds, and a missing entry ends conversations before they start.
What a CASP Licence Requires
MiCA defines ten distinct crypto-asset services, and authorisation is granted per service rather than as blanket permission. They span custody, trading-platform operation, crypto-to-fiat and crypto-to-crypto exchange, order execution and transmission, placement, advice, portfolio management, and transfers. A firm authorised for custody is not automatically authorised to run a trading venue.
Minimum capital scales with what you do: roughly €50,000 for advisory and order-transmission work, €125,000 for custody and exchange, €150,000 for operating a trading platform. Capital is the easy part. The application file is where timelines stretch, since it needs named fit-and-proper management, an AML and KYC programme, ICT resilience aligned to DORA, a client-asset segregation policy, and a wind-down plan describing how you would exit without stranding customer funds.
Where firms are choosing to apply
Passporting is the whole point, so the choice of home regulator is a strategic one rather than a geographic one. The Netherlands, Germany, and Malta moved early and cleared volume. The Czech National Bank issued its first six authorisations in February 2026 and disclosed 248 applications in the queue behind them, which gives you a sense of how uneven national capacity is.
France has drawn attention for a different reason. French regulators pushed back publicly on the idea that a licence granted by a lighter-touch member state should automatically carry the same weight everywhere, which is a real tension inside a passporting regime and one that has not been resolved. If you are working through the crypto licensing process, assume your choice of jurisdiction will be looked at by counterparties, not just by your home authority.
The Binance Case and What It Signals
Binance applied for MiCA authorisation in Greece in January 2026. On 24 June, six days before the deadline, it withdrew the application before the Hellenic Capital Market Commission issued a decision. A Reuters report the previous week had indicated the regulator was preparing to reject it. Greek, Irish, and Latvian regulators had reportedly raised concerns about the company’s legal history and corporate structure.
Binance’s position is that it worked in good faith, that no formal decision arrived in time, and that it will seek authorisation in another member state, with reporting pointing to France. It says it is not leaving Europe and that user assets remain accessible.
The practical outcome was immediate. Binance emailed users in France, Italy, Poland, and Spain telling them it would stop providing crypto-asset services from 1 July, and it halted new EU registrations. The largest exchange in the world by trading volume went from serving millions of EU users to winding down, because of a licensing timeline.
Read that as a pricing signal rather than a scandal. Scale and market share do not carry a firm through MiCA authorisation. Regulators reviewing these files look at corporate structure and legal history, and a firm that cannot make those legible does not get the passport.
The Stablecoin Cap Almost Everyone Gets Wrong
MiCA sorts stablecoins into two buckets. E-money tokens are pegged to a single fiat currency. Asset-referenced tokens are backed by a basket of currencies, commodities, or other assets. Issuers of EMTs must be authorised credit institutions or electronic money institutions. Reserves have to be fully backed, bankruptcy-remote, and held with qualifying custodians, with redemption at par.
Then there is the provision that gets reported badly almost every time. Articles 23 and 58 do not impose a flat €200 million daily transaction cap on non-euro stablecoins. The threshold applies specifically to use as a means of exchange within a single currency area, and it is measured as a quarterly average across two conditions: more than one million transactions per day and more than €200 million in daily aggregate value. Cross the line and the issuer must stop issuing new tokens and file a plan to bring usage back down.
The distinction matters operationally. If someone pays for goods with USDC, that counts toward the threshold. If someone swaps USDC for bitcoin on an exchange, that is an investment operation and does not count. Trading, custody, and on-chain settlement between businesses sit outside the cap entirely. Coverage that describes MiCA as capping USDT and USDC at €200 million a day is describing a rule that does not exist.
What did happen is a market split. Circle secured French EMI authorisation and kept USDC and EURC listed across the EEA. Tether declined the compliance route, and most EU exchanges delisted USDT for retail users or restricted it to professional clients. Euro-denominated tokens picked up ground as a result, which was the stated policy goal.
Compliance Costs and Real Penalties
Customer due diligence, transaction monitoring, sanctions screening, suspicious activity reporting, and five-year record retention all apply, and ESMA has been clear these obligations continue through a wind-down rather than lapsing when a firm decides to exit. Transfer traceability rules sit alongside them, with extra scrutiny on transfers involving self-hosted wallets above €1,000.
Penalties are tiered rather than a single headline number, and national implementation varies, which is why published figures disagree. MiCA sets minimum ceilings member states must provide for. Operating without authorisation exposes a legal person to fines of at least €5 million or 3% of total annual turnover, whichever is higher. Serious breaches scale toward 12.5% of turnover, and market-abuse violations higher still. Individuals face up to €700,000. Regulators can also withdraw authorisation, ban management-body members, freeze assets, and publish the breach.
That last power is underrated. Public censure against a firm whose entire business depends on banking relationships and institutional trust does more damage than the fine attached to it.
Who Gained Ground
Traditional financial institutions did well out of this. Banks and established payment firms already had the governance documentation, the capital, and the AML infrastructure MiCA asks for, so the application extended existing compliance rather than rebuilding it. Their visibility in the authorisation data grew steadily through 2026.
Mid-sized regional exchanges and custodians that started early also came out ahead, because they now compete in a market where much of the offshore field cannot serve EU users at all. Scarcity has value.
The losers are the firms that assumed enforcement would slip. It did not. Also squeezed: small teams doing interesting work who could not carry six figures of capital plus a compliance function.
One quieter shift sits underneath all of this. MiCA’s identity-verification burden is part of why self-sovereign identity moved from research topic to roadmap item at European financial institutions, since reusable credentials attack the most repetitive part of onboarding. The EU Digital Identity Wallet timeline and the MiCA timeline are converging on the same problem.
What to Do Now
If you use a crypto service in the EU, check whether your provider appears in the ESMA register. If it does not, ESMA’s guidance is to act promptly rather than wait, either by moving assets to an authorised CASP or to a self-hosted wallet. Clients of unauthorised firms do not get MiCA’s client-asset protections, which is the entire point of the register.
If you run a business touching crypto in Europe, three things deserve attention this quarter. Confirm which service categories your activity falls under, since firms routinely discover they need an authorisation they assumed did not apply. Check the status of every counterparty you rely on, custody providers first, because MiCA bars delegating custody to unauthorised entities and your exposure runs through them.
And if you settle in stablecoins, work out whether your volume counts as payment or investment activity, because only one of those hits the Article 23 and 58 thresholds.
Conclusion
MiCA did what it was designed to do, which was force a choice. Firms that could produce audited reserves, real governance. A wind-down plan got a passport into a market of roughly 450 million people. Firms that could not are gone from the EU, including the largest exchange in the world, at least for now. The regulation traded some openness for verifiability. And, whether that was worth it depends on whether you value permissionless access or the ability to check that your counterparty exists.
For the next stretch, watch three things: whether Binance secures authorisation elsewhere and how quickly, France’s objections to passporting harden into something that fragments the single licence, and whether euro-denominated stablecoins keep taking share now that the dollar alternatives face structural limits on payment use. None of those are settled, and each one changes the shape of the European market if it breaks the wrong way.
Read Next
More coverage on European crypto regulation and compliance:
- How to Get a Fintech or Crypto License: The Complete 2025 Guide
- Top White-Label Crypto Exchange Providers
- DeFi’s $351 Billion Boom: Top Investment Opportunities
Frequently Asked Questions
The MiCA regulation is Regulation (EU) 2023/1114, the European Union’s single rulebook for crypto-assets. It sets licensing, conduct, disclosure, and reserve requirements for crypto-asset service providers and stablecoin issuers across all 27 member states. It entered full application on 30 December 2024, with transitional periods for existing firms ending no later than 1 July 2026.
Any legal person providing crypto-asset services professionally to clients in the EU needs a CASP authorisation under the MiCA regulation. That covers exchanges, custodians, brokers, trading platforms, portfolio managers, and advisers. It applies regardless of where the company is headquartered, so non-EU firms serving EU customers are in scope.
The MiCA regulation does not ban USDT outright. It requires e-money token issuers to be authorised credit institutions or electronic money institutions with fully backed, segregated reserves. Tether has not pursued that authorisation, so most EU exchanges delisted USDT for retail clients or limited it to professional clients rather than face compliance exposure.
Firms without MiCA authorisation must wind down EU activities in an orderly way. ESMA expects them to stop onboarding clients and marketing immediately, restrict service to closing or transferring positions, and communicate deadlines clearly to clients. Continuing to serve EU users without authorisation exposes a firm to fines starting at €5 million or 3% of annual turnover, plus public censure and management bans.
Yes. A CASP authorisation granted by one national competent authority passports across all 27 member states without a second application, and the passporting notice appears in ESMA’s public register. French regulators have questioned whether every home-state approval should carry equal weight, so the practical strength of a passport may depend on where it was issued.
