Key takeaways
- Crypto firms serving clients in the European Union have needed a MiCA authorization or a valid exemption since 1 July 2026, when the last national transition period ended.
- EU member states gave existing crypto firms between six and 18 months to comply with MiCA, from six in the Netherlands to the full 18 in France, according to ESMA.
- A white paper listed on ESMA's MiCA register has not been reviewed or approved by any national regulator, so a listing is not a quality check on the token.
- Non-EU crypto firms may serve EU clients without a MiCA license only when the client makes the first approach, and ESMA's December 2024 guidelines treat promotion as solicitation.
- Stablecoin issuers came under MiCA first: Circle notified white papers for EURC and USDC on 1 July 2024, six months before the full regime applied on 30 December 2024.
The last national transition period for crypto firms in the European Union ended on 1 July 2026, according to ESMA's MiCA page. Here is MiCA explained in one line. The Markets in Crypto-Assets Regulation puts stablecoin issuers, token issuers, exchanges and custodians under one EU rulebook. Since that date, every firm serving EU clients has needed its license or a valid exemption.
The law itself is older. Regulation (EU) 2023/1114 was signed on 31 May 2023 and published in the Official Journal on 9 June 2023, according to the text on EUR-Lex. What took time was the handover from national regimes, because each member state chose its own transition window.
For anyone holding crypto in Europe, the useful question has become simple: is the firm holding your coins on ESMA's register?
MiCA Explained: Which Crypto Activities Does It Cover?
MiCA covers anyone who issues or offers crypto-assets in the EU, or seeks to have them traded there, and anyone who provides crypto services to EU clients. Article 2(1) says it "applies to natural and legal persons and certain other undertakings" doing those things. It then sorts tokens by what they promise. An e-money token, or EMT, "purports to maintain a stable value" by referencing one official currency. That is the shape of USDC or EURC. An asset-referenced token, or ART, holds its value against something else, such as a basket of currencies or a commodity. Every other token falls under a general regime.
Some assets sit outside MiCA entirely. Article 2(4) excludes crypto-assets that already qualify as financial instruments, which stay under securities law. Recital 10 keeps out tokens "that are unique and not fungible with other crypto-assets." Recital 11 narrows that exit. A unique identifier alone is not enough. Issuance in a large series counts as a sign of fungibility, so an NFT collection minted in bulk can still land inside the rules.
What Must Stablecoin Issuers Do Under MiCA?
A stablecoin issuer needs EU authorization and a published white paper before its token can be offered to the public in the bloc. A white paper, in MiCA's sense, is a disclosure document setting out what the token is and what rights its holders get. ESMA's interim register records each e-money token issuer and its authorization type, either an electronic money institution or a credit institution.
These were the first MiCA rules to bite. The register shows Paxos Issuance Europe notifying white papers for EUROe and eUSD on 29 June 2024. Circle followed with EURC and USDC on 1 July 2024, six months before the full regime applied on 30 December 2024.
The e-money token file linked from ESMA's MiCA page, checked on 9 October 2026, carries 49 rows. Remove two exact duplicates and that leaves 47 white papers from 24 issuers, with euro tokens the largest named group.
Do Token Issuers Without a Stablecoin Need Approval?
No, a project offering an ordinary token in the EU files a white paper and does not wait for a regulator to approve it. That catches out readers who treat ESMA's register as a seal of quality. ESMA's MiCA page states that the white papers in its register have not been reviewed or approved by any national competent authority. A listing shows that a document was filed. Judging the project is still your job.
Older tokens get some relief. Recital 113 explains that issuers of tokens other than ARTs and EMTs that were issued before the regulation applied are generally exempt from the white paper duty.
How Does MiCA Regulate Exchanges and Custodians?
Exchanges and custodians need authorization as a crypto-asset service provider, or CASP. The regulation defines one as a firm "allowed to provide crypto-asset services in accordance with Article 59." Article 3(1)(16) lists ten such services, and running a trading platform, exchanging crypto for money, executing orders and transferring crypto cover most of what an exchange does.
Custody comes first on that list. MiCA defines it as "the safekeeping or controlling, on behalf of clients, of crypto-assets" or of the means of access to them, such as private keys. Once a platform holds your keys, its authorization has to cover custody. A self-custody wallet, where you alone hold the keys, involves no CASP at all.
The license also travels. Passporting is the right to serve clients in other member states using the authorization granted at home. ESMA's 17 December 2024 statement on transitional measures notes that firms without MiCA authorization lack passporting rights. It works much like an EU driving license: issued by one country, recognized in the rest.
How Long Did Crypto Firms Get to Comply With MiCA?
Between six and 18 months, depending on the member state. Article 143(3) let firms already serving clients under national law before 30 December 2024 continue "until 1 July 2026" or until their MiCA application was decided, according to ESMA. Each country could shorten that window. Recital 114 gives the reason: states with weaker national prudential rules could impose stricter requirements sooner. ESMA's list of grandfathering periods shows how the 27 EU states split:
- Six months: Finland, Hungary, Latvia, the Netherlands, Poland and Slovenia
- Nine months: Sweden
- 12 months: Austria, Germany, Ireland, Lithuania and Slovakia
- 18 months, to 1 July 2026: the remaining 15, including France, Italy, Spain, Cyprus and Malta
Here is what that meant in practice. Take two exchanges registered under national rules on 30 December 2024, one Dutch and one French. The Dutch firm's six months ran out at the end of June 2025. The French firm could keep operating without a MiCA license until 1 July 2026, 12 months longer. Cross-border firms had it harder. ESMA's statement told them to meet each host country's deadline. It also warned that an authorization arriving after a host state's cut-off "would create an interim period (of up to 6 months)" with no valid license. A Cyprus firm with 18 months at home still had to stop or comply for its Dutch clients after six.
What Changed When the Transition Ended in July 2026?
Since 1 July 2026, the national grandfathering routes have been closed, so a firm serving EU clients needs a MiCA authorization or a lawful reason to operate without one. ESMA's interim MiCA register is the main check. It holds five CSV files: white papers, ART issuers, EMT issuers, authorized CASPs and non-compliant entities. ESMA updates it weekly, and withdrawn authorizations stay on file with their effective date.
The permanent version has not arrived. ESMA's page said the register would stay a set of CSV files "until mid-2026," then move into ESMA's IT systems. At the page's update of 7 October 2026, it was still published as CSV files.
Can Exchanges Outside the EU Still Serve EU Users?
Only when the customer makes the first move, and ESMA reads that exception tightly. Under Article 61, a firm based outside the EU may serve an EU client without authorization when the service starts on the client's "own initiative," the phrase recital 75 uses. Any solicitation ends the exemption. ESMA's reverse solicitation guidelines of 17 December 2024 put it plainly: "The solicitation of clients by third-country firms should be construed broadly and in a technology-neutral way." Solicitation "includes the promotion, advertisement or offer of crypto-asset services," and brand advertising aimed at the public may count too.
The same guidelines say crypto-assets of the same type "should be understood narrowly." A client who approached a foreign exchange for one product has not invited marketing of unrelated tokens. For a non-EU firm, the realistic options are an EU authorization or no EU marketing at all.
What MiCA Means for You as an EU Crypto User
For most EU users, MiCA turns the choice of platform into something you can check. Before moving funds, search the CASP file on ESMA's register for the firm's legal name, its home regulator and the countries listed under its passported services. If your country is missing, the firm has no passport to serve you there. Do the same for any euro or dollar stablecoin you hold, since the e-money token file names each issuer and its authorization type.
MiCA governs the firms and their disclosures, and price risk stays with you. Coins kept in your own wallet sit outside the CASP regime, so no regulated firm stands behind them.
None of this is legal or financial advice.
What Does MiCA Still Leave Outside Its Rules?
Fully decentralized services are the largest carve-out. Recital 22 says that "where crypto-asset services are provided in a fully decentralised manner without any intermediary," they fall outside the regulation. The test turns on the absence of an intermediary, so a protocol whose front end or admin keys are run by a company has a harder case to make. Tokens that count as financial instruments stay out through Article 2(4), and ESMA published guidelines in December 2024 on telling the two apart.
Frequently asked questions
When did MiCA come into force?
MiCA entered into force in June 2023, after the regulation was signed on 31 May 2023 and published in the EU's Official Journal on 9 June 2023. Entering into force and applying are separate steps. The stablecoin rules applied from mid-2024, the full regime from 30 December 2024, and national transition periods ran on top of that until 1 July 2026 at the latest.
Who supervises crypto firms under MiCA?
A national regulator in the firm's home country, called the national competent authority, handles day-to-day supervision. ESMA's register names it for each authorized firm, for example BaFin in Germany or CySEC in Cyprus. ESMA coordinates across the bloc and publishes the central register, and member states had to tell ESMA which authorities they designated. A complaint about a firm usually starts with its home regulator.
Does MiCA apply in Norway, Iceland and Liechtenstein?
Yes, the three countries of the European Economic Area outside the EU appear in ESMA's list of MiCA grandfathering periods. Iceland and Liechtenstein chose 18 months and Norway chose 12. Firms from these countries also show up in the register: Monerium, based in Iceland, notified a white paper for its EURe e-money token on 9 January 2026. Residents there can use the same ESMA files to check a firm.
What does the non-compliant entities file on ESMA's register mean?
It is one of the five files in ESMA's interim MiCA register, and it lists firms flagged for providing crypto-asset services in the EU without the authorization MiCA requires. A name on that list is a strong reason to keep your money away. The reverse does not hold, because a firm missing from the file is not automatically licensed. Confirm authorization in the CASP file itself.
Is MiCA the same in every EU country?
Mostly, because MiCA is an EU regulation and its text applies directly in all 27 member states. National choices sit at the edges. Each country designated its own regulator and set its own administrative penalties, which it had to notify to ESMA by 30 June 2025. Each also picked a transition period between six and 18 months, so the date firms had to comply differed from one country to the next.