The European Union’s Markets in Crypto-Assets Regulation (MiCA), which fully took effect on July 1, 2026, has coincided with a significant contraction in the number of crypto-asset service providers (CASPs) legally operating within the bloc. Previously, over 3,000 companies were serving EU crypto clients. Today, fewer than 300 hold the necessary CASP authorization, forcing many to wind down operations, transfer clients, or relocate.
The stringent requirements of MiCA mean that only companies holding a CASP authorization can legally serve EU clients. Firms that previously operated under national registrations had until the deadline to convert, and a substantial number failed to do so. Companies continuing to serve EU clients without authorization face severe penalties, including a minimum fine of €5 million per day for breaches under Article 111 of MiCA, and potential criminal liability in jurisdictions like France.
Navigating the path to CASP authorization has proven to be a complex and varied undertaking across the EU. Ivan Nevzorov, an expert in the field, notes that the implementation of MiCA was not uniform, resulting in twenty-seven different versions of the process across member states, each with distinct speeds and appetites for granting authorization. This jurisdictional variance has created an uneven playing field.
For instance, Germany’s regulator, BaFin, has stringent requirements, including a German entity, resident directors, and paid-up capital at the time of filing. In contrast, France’s AMF offered a more streamlined path for firms already registered under its national regime prior to MiCA. Major exchanges like Coinbase, Kraken, OKX, and Crypto.com secured authorizations through jurisdictions such as Luxembourg, Ireland, and Malta, respectively, indicating that the maturity of the regulatory process in a given member state was a critical factor.
Nevzorov emphasizes that obtaining authorization requires more than just a technically correct application. Regulators assess a company’s understanding of its own risk model, accountability structures, and client base. A compliance policy copied from a template is insufficient. Furthermore, the choice of jurisdiction is paramount; companies must establish a real office, have staff on the ground, and present a credible plan for that specific market, rather than simply choosing a jurisdiction with the shortest queue.
The EU’s MiCA regulation has also closed off traditional operational models seen in the payments sector, such as agent or white-label arrangements. Articles 59 and 60 of MiCA draw a clear line around who can provide crypto services, meaning unlicensed providers cannot operate under someone else’s license in their own name. However, supplying a licensed CASP with technology or marketing services is permissible. This has coincided with the emergence of ‘grey-label’ approaches, where the licensed partner holds all client transactions and financial infrastructure, while other companies provide the underlying technology or marketing.
For firms unable to secure authorization, the options are an orderly wind-down or client transfer. An orderly wind-down, as outlined by ESMA, involves ceasing onboarding and marketing into the EU and restricting operations to settling existing trades. Transferring clients to an authorized CASP is another route, though it requires full AML and KYC re-verification for each client, a process that can be resource-intensive. Some authorized CASPs are banks offering crypto as a secondary service, not necessarily equipped to absorb large volumes of new clients.
Staying licensed is presented as the true test for crypto firms. This requires continuous active risk assessment, ongoing AML monitoring, and timely reporting to regulators. Economic factors, such as marketing spend, partner bank compliance screening, and offered tariffs, can also critically impact a business’s survival, as demonstrated by a case where a company failed due to unstress-tested economics, despite having a solid compliance framework.
AI is beginning to influence compliance monitoring, potentially reducing the need for large teams and making processes more efficient. However, this does not negate the fundamental requirement of maintaining regulatory compliance. The window for companies to execute their chosen strategy—whether it’s winding down, relocating, or restructuring—before the first wave of regulatory checks is shrinking. The Netherlands has already issued significant fines to Kraken, Crypto.com, and OKX under previous regimes, signaling the proactive enforcement stance that can be expected under MiCA.
Uncertainties remain regarding the exact number of companies that have successfully relocated or are operating solely through reverse solicitation, the long-term impact of MiCA on innovation, and the extent to which regulators may continue to interpret or apply requirements beyond the explicit text of the regulation. The future capacity of EU regulators to manage the ongoing monitoring of licensed firms is also a point of consideration.
Why This Matters
The materials describe a narrow update: The EU’s Markets in Crypto-Assets Regulation (MiCA), effective July 1, 2026, requires companies serving EU crypto clients to hold a Crypto-Asset Service Provider (CASP) authorization. The exact number of companies that have successfully relocated or are operating solely through reverse solicitation.
Broader Context
Source materials place the factual news in this context: The Markets in Crypto-Assets Regulation (MiCA), which took full effect across the European Union on 1 July 2026: from that date, only a company holding Crypto-Asset Service Provider (CASP) authorisation — granted by a regulator in one EU member state and passported across the rest of the bloc — can serve EU clients.
