MiCA After July 2026: What Changed for Crypto Users in Europe?

The EU-wide transition under the Markets in Crypto-Assets Regulation (MiCA) is over. For crypto-asset service providers it could not run past 1 July 2026, and in several Member States it stopped earlier. A firm now needs a MiCA authorisation, or in some cases a notification, to serve EU clients. A national VASP registration alone no longer does that, and authorisation does not remove investment, fraud or operational risk.

Key takeaways

• 1 July 2026 was the outer limit of the transitional regime; the date that applied to a given firm depended on the Member States where it operated.
• A national VASP registration and a MiCA CASP authorisation are different legal statuses, and the first does not stand in for the second.
• A firm without authorisation generally has to stop regulated services, and a pending application does not extend the transition beyond its deadline.
• Authorisation attaches to one legal entity and a defined list of services, so users should check both.
• MiCA sets rules for how providers operate. It does not protect against price swings, scams or your own mistakes.

What changed on 1 July 2026?

The maximum transitional regime for crypto-asset service providers ended. Until then, firms that had provided services lawfully under national rules before 30 December 2024 could keep going without a MiCA authorisation. From 1 July 2026 they could not.

The rules arrived in stages. MiCA (Regulation (EU) 2023/1114) started applying to stablecoin issuers on 30 June 2024 and to crypto-asset service providers (CASPs) on 30 December 2024. Article 143(3) then allowed firms that were already active lawfully to carry on until 1 July 2026, or until the authority granted or refused their application if that happened earlier.

The "if that happened earlier" clause matters. Member States were allowed to shorten the period or not apply it at all, so the window varied. ESMA's list of grandfathering periods shows the Netherlands at six months, Germany at twelve, and France and Spain at the full eighteen months to 1 July 2026. ESMA's own warning was that a CASP could face different deadlines in each country where it was active.

In that statement, ESMA said that providers without a MiCA authorisation should not be serving EU clients after the deadline and expected them to have an orderly wind-down in place. ESMA's statement on the end of the transitional periods repeats the point for firms that had not yet moved.

Does an old VASP registration still count?

Not as MiCA authorisation. Before MiCA there was no common EU licence for crypto businesses; each country set its own rules. Many of those regimes were registers of virtual asset service providers built mainly around anti-money-laundering supervision, with different depth of review from one country to the next. A registration of that kind showed that a national authority knew about the firm. It did not show that the firm met MiCA's organisational, custody and conduct requirements.

Two nuances apply. Credit institutions, investment firms and e-money institutions, among others, may provide equivalent services by notifying their supervisor under Article 60, so they can be legitimate without holding a CASP authorisation. And a simplified route existed for some firms that held a national authorisation and applied by 1 July 2026. Neither makes an old registration count as authorisation.

What happens if a provider is still not authorised?

It depends on the transition that applied to it, but in general it has to stop regulated services for EU clients. The picture differs by Member State and by the firm's own history, so no single description fits every case.

Four points hold in most situations:

• A provider can rely on the transition only until the applicable deadline, or until its application is granted or refused. A pending application does not extend that deadline.
• ESMA expects unauthorised providers to wind down in an orderly way, which in practice means letting clients withdraw, sell or transfer their assets rather than taking on new business.
• Whether a particular firm is still active in a given country depends on that country's rules and on the exact legal entity, not on the brand.
• Supervisors, not users, decide enforcement. A firm that keeps operating is not thereby authorised.

If a platform you use tells you its authorisation is "in progress", ask for the register entry. If it has none, treat any new deposit with caution and consider moving assets to a provider you have checked. Our guide to checking whether a crypto platform is MiCA-authorised shows how to read the register.

What should users check now?

Check the legal entity, the regulator, the register entry, the services, the website and any warnings. Six steps cover it:

1. Find the legal entity. The name that owes you duties sits in the terms of use, not in the app store listing.
2. Identify the competent regulator. It is the authority of the entity's home Member State, such as the AMF, BaFin, the CNMV or the MFSA.
3. Check the authorisation. Look for the exact entity in ESMA's interim register or on the regulator's list, with an authorisation date and no withdrawal.
4. Check the covered services. Custody, exchange for funds, crypto-to-crypto exchange and transfers are separate permissions.
5. Verify the website and domain. The register lists a website; the address you use should match it.
6. Check notices and restrictions. ESMA's file of non-compliant entities and your regulator's warnings list problems that a licence number will not show.

For a worked version of each step, including how to read the register's columns, see what a CASP is and the full guide linked above.

What MiCA protects

MiCA sets standards for the firms that provide crypto-asset services and for issuers. Authorised providers have to meet requirements on governance, internal organisation, conflicts of interest and complaint handling. Providers that hold clients' assets face rules on keeping them separate from their own, and ESMA's consumer material points users to the protections that attach to an authorised EU entity.

Issuers of crypto-assets, other than the cases the regulation excludes, must publish a white paper and follow disclosure and marketing rules. Stablecoin issuers face additional requirements on reserves and redemption. None of that makes a token a safe investment; it makes the terms easier to read and compare.

What MiCA does not protect

MiCA does not guarantee that you will not lose money. It works on how providers behave, not on how markets move or how users act.

Crypto balances are not bank deposits, and the usual deposit protection does not apply to them. Our explainer on what MiCA protects and does not protect goes through the same question for everyday holders.

Does MiCA apply to every crypto service?

No. MiCA covers crypto-assets and services that other EU financial rules do not already cover, and it has a defined list of crypto-asset services.

• Financial instruments. Tokens that qualify as financial instruments are regulated under financial markets law, not MiCA.
• Unique, non-fungible assets. NFTs in the strict sense of unique assets sit outside MiCA, although issuing them in large series or fractions can change the analysis.
• Fully decentralised services. The recitals say that services provided in a fully decentralised way without any intermediary fall outside the regulation, while services controlled or run by a business do not.
• Central banks. A central bank digital currency is not a MiCA crypto-asset, and central banks acting in their monetary role are outside the regulation.
• Other regimes. Transfers carry their own information duties under the travel rule, tax reporting follows DAC8, and anti-money-laundering rules apply on top. See what data a platform reports under DAC8.

What changed for users of non-EU exchanges?

A non-EU exchange cannot, as a rule, offer MiCA services to EU clients unless it does so through an authorised EU entity. A foreign licence does not substitute for MiCA authorisation.

The exception is narrow. Under Article 61, a firm can serve an EU client who approaches it entirely on their own initiative. ESMA's guidelines on reverse solicitation treat advertising and promotion aimed at EU clients as solicitation, so a platform that markets itself to EU residents cannot lean on the exception as a business model.

The practical lesson is about entities. A global group may have one authorised EU company and several others that are not. MiCA status belongs to the company that provides the service, so the contract should tell you which one that is.

What Quppy users should know

Quppy is a software product, not a regulated provider in itself. According to Quppy's legal notice, QUPPY EUROPE OÜ, an Estonian company, develops and provides the Quppy software and related services, and Quppy is not a bank or financial institution and does not open accounts.

The regulated services sit with named partners. Crypto-asset exchange and wallet-related services are provided by Payhound Limited, a Malta-registered company that is authorised by the Malta Financial Services Authority and licensed as a crypto-asset service provider under MiCA. Its authorised services include transfer services, execution of orders, custody and administration, exchange of crypto-assets for funds, and exchange of crypto-assets for other crypto-assets. Euro SEPA transaction processing is provided by 2PAYAPP LIMITED, which the notice describes as registered with FINTRAC in Canada as a money services business; that registration is not an EU licence.

That split is the pattern this article asks you to look for. Before using any service, compare these names against the register yourself. Quppy's MiCA and providers page lists the entities behind each service, while the regulation and availability pages explain the relevant status and country access. The euro and crypto sides should still be checked separately because they may be provided by different legal entities.

See how Quppy brings euro payments and crypto services together in one app: Quppy Personal.