The grandfathering window for crypto-asset service providers has closed across the EU. Unauthorised firms must wind down, and the protections clients get now depend on exactly which legal entity they deal with.
The Markets in Crypto-Assets Regulation, (EU) 2023/1114, began applying to crypto-asset service providers (CASPs) on 30 December 2024. Firms that were already providing crypto services lawfully under national law before that date could keep operating under a transitional regime while they applied for MiCA authorisation.
That regime has now ended everywhere. In ESMA’s words: “The MiCA transitional period will officially expire across the EU on 1 July 2026. After this date, any entity providing crypto-asset services to EU clients without a MiCA licence will be in breach of EU law and must cease offering such services.”
The 1 July 2026 date was the latest possible end. Member states could set shorter transitional periods, and ESMA points out that two groups of firms were never covered: entities that “did not provide crypto-asset services in accordance with applicable national law before 30 December 2024,” and entities active in member states “where the transitional period had already ended before 1 July 2026.”
In a public statement on 23 June 2026, ESMA set out what it expects of CASPs that did not obtain authorisation. They must:
Anti-money-laundering obligations continue throughout: customer due diligence, transaction monitoring, sanctions screening and suspicious activity reporting all still apply during a wind-down.
ESMA also acknowledged the scale of the problem. Some entities, “including significant providers currently servicing EU clients under national regimes, may not be authorised by the deadline.”
ESMA’s earlier statement of 17 April 2026 restated that entities outside the EU “are, outside the narrow exception of reverse solicitation, not permitted to provide crypto-asset services that qualify as MiCA services to EU investors or to solicit EU clients.”
The point that matters most for institutional readers: “this also applies in a business-to-business context, as MiCA specifically prohibits CASPs from outsourcing or delegating certain services, namely custody, to entities not authorised as CASPs themselves.”
ESMA’s warning to consumers applies equally to professional counterparties. MiCA protections “only apply to the specific authorised legal entity in the EU,” not to other companies in the same group and not to entities outside the EU. Providers “may operate under the same brand across multiple companies or countries,” so the contract, not the logo, shows who is providing the service.
Two of the largest exchanges illustrate how this looks in practice. Kraken’s EU business runs through Payward Europe Solutions Limited, which its own disclosures list as “licensed as a Crypto Asset Service Provider (CASP under MiCA)” by the Central Bank of Ireland. Coinbase’s EU business is authorised through Coinbase Luxembourg S.A. by Luxembourg’s CSSF, a licence reported in June 2025. Both groups also operate other entities under the same brand elsewhere.
ESMA’s instruction is simple: check that a provider “is listed as authorised in the ESMA Interim MiCA Register before you invest or transfer funds.” Our guide to verifying a licence covers the national registers as well. Firm-level licence details for the exchanges we cover are in our broker reviews.
A February 2026 statement tells firms that the commercial name of a leveraged derivative is irrelevant. What matters is whether it meets the definition of a CFD, and most perpetuals likely do.
A licence number on a website proves nothing on its own. Six checks, all on regulators' own registers, separate a regulated firm from a clone of one.
The UK's FSCS and Cyprus's ICF protect clients when a firm fails. Neither covers trading losses, and the limits differ by a factor of four.
