MiCA Transition Is Over: Is Your Exchange Licensed?

The EU's MiCA rules let existing crypto firms keep serving clients under old national rules until 1 July 2026 at the latest, and many countries cut that grace period much shorter. That period is now over everywhere in the EU. A firm that serves EU clients without a MiCA authorisation is in breach of EU law, and ESMA tells users to check their provider in its interim MiCA register.

What the transitional period was

MiCA is Regulation (EU) 2023/1114. It has applied in full since 30 December 2024.^[1] Article 59 says nobody may provide crypto-asset services in the EU unless they are an authorised crypto-asset service provider (CASP), or a bank or other financial firm allowed to do so under Article 60.^[1]

Article 143(3) gave existing firms time to adapt. A firm that provided services under applicable national law before 30 December 2024 could continue until 1 July 2026, or until it was granted or refused a MiCA authorisation, whichever came first. Member States could also shorten this period or not apply it at all.^[1]

Many did. ESMA published the periods that Member States reported:^[2]

• 6 months: the Netherlands, Poland, Latvia, Hungary, Slovenia and Finland.
• 9 months: Sweden.
• 12 months: Germany, Ireland, Lithuania, Austria and Slovakia (and Norway in the EEA).
• 18 months: most others, including France, Spain, Italy, Malta and Cyprus.

ESMA noted that some of these periods were national expectations and may not yet have been in national law when it shared the list. Some countries also required firms to apply by a set date to benefit at all.^[2] ESMA warned that a firm licensed in one country could have a gap of several months in another country whose period ended earlier.^[3]

What changed after 1 July 2026

In April 2026 ESMA said the transitional period expires across the EU on 1 July 2026. After that, any entity serving EU clients without a MiCA licence is in breach of EU law and must stop.^[4] In Belgium, for example, the FSMA said existing firms had until 30 June 2026 at the latest, and that firms without authorisation must stop offering their services in Europe.^[5]

In June 2026 ESMA set out what unauthorised firms must do. They must:^[6]

• stop onboarding new EU clients and stop marketing;
• limit services to what clients need to sell, transfer or close positions;
• hold client crypto only as long as strictly needed for an orderly exit;
• tell clients the deadline after which remaining positions will be closed automatically.

ESMA also said these firms must keep full AML/CFT controls during the wind-down. That includes sanctions screening and the crypto transfer traceability rules.^[6] Our Travel Rule guide explains those transfer rules.

Firms based outside the EU cannot serve EU clients or solicit them. The only exception is reverse solicitation, which ESMA calls narrow.^[6] MiCA itself says a service does not count as the client's own initiative if the firm solicited EU clients, whatever any contract disclaimer says.^[1]

Why the legal entity matters

ESMA warns that MiCA protections apply only to the specific authorised legal entity in the EU. They do not cover other companies in the same group or non-EU entities. One brand can run several companies in several countries.^[4]

So "Exchange X is licensed" is not enough. Check which company your contract is with. Clients of unauthorised firms, EU or non-EU, do not get MiCA safeguards, including protections for client assets.^[6]

This is not legal advice. If a large balance is involved, ask a lawyer in your country.

How to check an exchange in the ESMA register

ESMA keeps an interim MiCA register on its MiCA page as downloadable CSV files. There are five files: white papers, issuers of asset-referenced tokens, issuers of e-money tokens, authorised CASPs and non-compliant entities.^[7]

For an exchange, open the Crypto-asset service providers file. Each record shows, among other things:^[7]

• the competent authority and home Member State;
• the legal name, LEI and commercial name;
• the website and, where relevant, the trading platform website;
• the authorisation date and any withdrawal date;
• the list of authorised services;
• the Member States where the firm intends to provide them.

MiCA requires the register to show the authorising authority, the services and the dates of authorisation and withdrawal.^[1] ESMA says a withdrawn authorisation stays in the file with the withdrawal date. So a listing alone is not proof. Check that the withdrawal field is empty.^[7]

ESMA updates the register weekly. A new licence may appear in a national register first.^[7] If you do not find a firm, check the national regulator's register too.

The Non-compliant entities file lists firms that authorities say provide services without authorisation. MiCA calls it non-exhaustive.^[1] A firm missing from that list is not automatically safe.

What to do

1. Find the legal entity. Look at your terms of service or account contract. Note the company name and country.
2. Search the ESMA CASP file. Download the latest version from the ESMA MiCA page. Search by legal name and website, not only the brand.^[7]
3. Check the details. Confirm the withdrawal date is blank, the services cover what you use, and your country is in the list of host states.
4. Check the national register if the firm is missing. ESMA's file can lag behind.^[7]
5. Look at the non-compliant list as well, but do not treat absence as a clean result.
6. Act early if the firm is not authorised. ESMA suggests moving crypto to an authorised CASP or a self-hosted wallet, and contacting the provider first if you have problems.^[6]
7. Expect checks on the way in. The receiving CASP must run customer due diligence and other AML/CFT checks on transferred clients.^[6] Check your coins first with an AML checker so a flagged deposit does not hold up the move.

If a deposit is held during a migration, see our guides on exchange deposit holds and what to do when an exchange freezes funds. Our high-risk exchange category explains how AML tools score exposure to unlicensed platforms.