The EU Crypo-Asset Regulation and Crypto Asset-Service Providers: July 1, 2026 Deadline
July 1, 2026 is the final date by which crypto-asset service providers established in the European Union (“EU”), or providing crypto-asset services to clients in the EU, must be authorised by their competent national authority in order to continue providing such services. Failure to do so may result in the imposition of criminal sanctions or administrative fines, in addition to restrictions on access to their websites and applications.
The EU Markets in Crypto-Assets Regulation (EU 2023/1114 - "MiCA") is a regulatory framework for issuers and offerors of crypto-assets and for crypto-asset service providers. It is binding in its entirety and directly applicable in all Member States of the EU subject to limited scope for national divergence.
According to the MiCA, a crypto-asset is a digital representation of a value or rights, which may be transferred and stored electronically, using distributed ledger technology.
A crypto-asset service provider ("CASP") can offer services such as operation of a trading platform, exchange of crypto-assets for funds or for other crypto-assets and providing custody and administration of crypto-assets on behalf of clients, on the condition that it is authorized by its national competent authority of its home Member State.
I. Deadline for Compliance
The full authorisation regime for CASPs under the MiCA became applicable on December 30, 2024. As a transitional measure, however, MiCA permits CASPs that were providing crypto-asset services in accordance with applicable national law prior to December 30, 2024, to continue operating until July 1, 2026, or until their application for authorisation is granted or refused, whichever occurs first.
The MiCA further allows Member States to shorten this transitional period. While the majority of Member States have retained the maximum duration, several jurisdictions have opted for shorter periods, Germany, Austria and Lithuania, for example, limited the transitional period to 12 months, whereas Latvia, Hungary and The Netherlands reduced it to six months. Consequently, the grandfathering period expired in those jurisdictions on December 30, 2025 and June 30, 2025, respectively.
For the remaining Member States that maintained the full transitional period, including Italy, France, Spain and Greece, the grandfathering regime came to an end on July 1, 2026, marking a significant milestone in the implementation of MiCA across the EU crypto-assets market.
II. Implications of Non-compliance
After July 1, 2026, any person providing crypto-asset services within the EU without holding a MiCA licence will be in breach of EU Law. This applies regardless of whether MiCA has been implemented in a given Member State.
While the MiCA confers temporary intervention powers on the European Securities and Markets Authority (“ESMA”) and the European Banking Authority (“EBA”) to prohibit or restrict certain crypto-asset-related activities or practices in exceptional circumstances, primary enforcement powers remain vested in Member States and their competent authorities. In particular, the authority to impose criminal sanctions and administrative penalties rests at a national level.
To this end, the MiCA requires Member States to ensure that their competent authorities are empowered to impose appropriate administrative sanctions and other administrative measures in cases of unauthorised provision of crypto-asset services. Such sanctions must, at a minimum, meet the thresholds prescribed in the MiCA. Member States may decide not to lay down rules for administrative penalties where the unauthorised provision of crypto-asset services was already subject to criminal penalties in their national law by June 30, 2024.
Operating without a MiCA licence after July 1, 2026 can expose an operator to administrative fines of up to EUR 5 million or 5% of its total annual turnover. National competent authorities may also order the immediate cessation of the activity and restrict access to the online interface, which means that access to any software, including a website, part of a website or an application can be restricted.
Under the framework of the MiCA, certain Member States have introduced their own criminal penalties or administrative fines and measures to prevent the unauthorised provision of crypto-asset services in their jurisdictions. For example:
- In France, unauthorised crypto-asset service providers are liable to a two-year prison sentence and a fixed fine of EUR 30,000. Additionally, the Autorité des Marchés Financiers (“AMF”) may publish a black list of unregistered service providers, together with a warning to the public and, if necessary, take legal action to block access to the websites of unauthorised service providers.
- In Germany, operators providing crypto-asset services without a MiCA licence will be liable to a term of imprisonment not exceeding five years or to a fine of up to EUR 700,000. In addition, the Bundesanstalt für Finanzdienstleistungsaufsicht (“Bafin”) may block access to the web sites of unauthorised CASPs.
- In Spain, an operator providing crypto-asset services without a MiCA licence will be subject to a fixed fine of EUR 5,000,000 or five percent of its total turnover during the preceding financial year, whichever is higher.
III. ESMA Announcement
On April 17, 2026 ESMA confirmed that the July 1, 2026 deadline is definitive, and will not be subject to any further extension. ESMA also cautioned unauthorised CASPs regarding the regulatory consequences of failing to comply with the applicable requirements by that date. ESMA noted that:
- Unauthorised EU-based CASPs must cease providing crypto-asset services to EU clients and implement their wind-down plans by July 1, 2026,
- Entities established outside the EU are, unless the activity falls within the reverse solicitation exemption, not permitted to provide crypto-asset services to EU investors or to solicit EU clients with a view to providing MiCA services to them.
A wind-down plan should facilitate a controlled and orderly cessation of activities while minimizing adverse impacts on clients. The plan must include establishing arrangements for the offboarding of the clients, such as transferring crypto-assets held on their behalf to an authorised CASP or to a self-hosted wallet. Existing clients must be duly notified of the implementation of the plan.
The reverse solicitation exemption provided for in the MiCA came into effect as of December 30, 2024. According to this exemption, if a client in the EU, upon its own exclusive initiative, receives crypto-asset services from a CASP provider located in a non-EU country , the requirement for authorisation of the CASP will not apply to the provision of those crypto-asset services to that client.
IV. ESMA’s Reverse Solicitation Guidelines
The reverse solicitation exemption is limited to third-country firms. As a result, firms established within the EU are not entitled to invoke this exemption to avoid compliance with the MiCA’s authorisation or notification obligations.
ESMA previously underlined that this exemption should be understood narrowly and as such, must be regarded as the exception; and it cannot be assumed, nor exploited to circumvent the MiCA.
After consulting with stakeholders, ESMA introduced guidelines on reverse solicitation on December 17, 2024. According to these guidelines:
-
Third-country firms cannot solicit clients in the EU by any means including the promotion, advertisement or offer of crypto-asset services or activities to clients or prospective clients. Even a third-country firm's website or part of a website in an official language of the EU (especially one that is not customary in the sphere of international finance) can be considered as a red flag.
-
The third-country firm can market the same type of crypto-assets or crypto-asset services to the client who has initiated upon its own exclusive initiative the provision of a crypto-asset service or activity, but not different or new ones.
-
Promotions, advertisements, marketing and offers of a general nature such as brand advertisements, and which are addressed to the public (with a broad and large reach) may also constitute solicitation.
-
The third-country firm may take precautionary measures to make sure that it does not breach the authorisation requirements under the MiCA, by refraining from providing any crypto-asset services or activities to EU clients. To do so, the third-country firm may geo-block the means of access to its crypto-asset services or activities, or not accept any new EU clients’ accounts. When geo-blocked, EU clients with an IP address originating in the EU should not be able to access the third-country firm’s website and the third-country firm’s mobile application should not be available for EU countries in mobile application stores.
-
Educational materials, training, and industry events must be purely educational or focused on sharing knowledge in order not to be considered as solicitation.
-
Activities carried out by influencers acting on behalf of a third-country firm, or by persons having close links with such a firm, may fall outside the scope of the reverse solicitation exemption. This may be the case, for example, where they direct their audience to a third-country firm’s website, facilitate access to the services offered by the firm, promote special offers or incentives, or display the firm’s logo as part of their communications.
ESMA further expects third-country firms to maintain and, upon request, provide records to substantiate reliance on the exemption, as well as to implement appropriate safeguards to avoid being regarded as operating in breach of EU law. These expectations underscore the need for non-EU CASPs, including operators that are winding down their local CASPs in EU after July 1, 2026, to exercise heightened vigilance when offering their services on a cross-border or global basis.
Onur Irmak
SWOT Legal Collaborator
July 1, 2026