MiCA Enforcement
Executive summary
MiCA has crossed its most important operational threshold: the transitional 'grandfathering' era ended on 1 July 2026, and any firm providing crypto-asset services to EU clients without a MiCA authorisation is now in breach of the regulation. The stablecoin titles produced the most visible early enforcement — the USDT delisting wave completed in March 2025, and BaFin forced the wind-down of Ethena's German USDe business — while the CASP regime has scaled to 283 register entries (279 firms) as of 13 July 2026, led by Germany and France, with marked national divergence in throughput and supervisory style. The first supervisory-quality fight has also begun: ESMA's July 2025 peer review found Malta's authorisation of a major CASP only 'partially met expectations', and in December 2025 the European Commission proposed moving CASP supervision from national authorities to ESMA itself. The thesis-defining question is no longer whether the regime functions but who ends up running it — and whether enforcement against the long tail of unauthorised firms materialises now that the transition has ended.
Background and current state
MiCA's enforcement architecture activated in two distinct waves. The stablecoin titles, Titles III and IV, came into application on 30 June 2024, immediately binding existing and prospective issuers of asset-referenced and e-money tokens to authorisation, reserve, redemption and disclosure obligations. The CASP regime, Title V, came into application on 30 December 2024, requiring crypto-asset service providers operating in the EU to obtain authorisation from a national competent authority or to wind down EU operations. Member states adopted transitional 'grandfathering' provisions of varying length — Article 143 allowed up to eighteen months, and several states including Germany and France chose shorter windows — but the outer boundary has now passed: the last transitional periods expired on 1 July 2026, a cliff ESMA flagged in an April 2026 statement and again on 23 June 2026 when it publicly called on still-unauthorised providers to wind down EU operations in an orderly way. As of 13 July 2026 the ESMA interim MiCA register lists 283 CASP authorisation entries covering 279 firms — 4 granted in the final days of 2024, 148 through 2025, and another 130 in 2026 — 129 in the first half plus one notified on 1 July itself — as the deadline concentrated minds. The stablecoin side is thinner than early projections assumed: roughly twenty e-money token issuers are authorised across the EU (heavily euro-skewed, with around thirty EMTs between them), and no asset-referenced token issuer has been authorised at all. The regime is unambiguously functional. The harder questions are about depth and quality: how thoroughly NCAs supervise the entities they have authorised, how the regime is enforced against non-compliant or marginally-compliant actors, and how divergence in NCA practice is arbitrated.
Key actors and supervisory architecture
Direct supervision under MiCA is principally an NCA function. France's AMF and ACPR (jointly for stablecoin issuers), Germany's BaFin, Italy's CONSOB and Bank of Italy, the Netherlands' AFM and DNB, Luxembourg's CSSF, Ireland's Central Bank, Austria's FMA and the Spanish CNMV are the most operationally significant authorities. ESMA and EBA sit at the European level, with ESMA holding broad coordination and Q&A authority over MiCA generally, while EBA holds direct supervision over significant ART and EMT issuers. The European Commission retains the legislative pen — and used it in December 2025 to propose transferring CASP supervision to ESMA outright. National divergence has been substantial, and the register now quantifies it: Germany is the largest home state with 59 register entries, followed by France with 31 (also home to a leading cluster of authorised e-money token issuers, including Circle and Société Générale-Forge), the Netherlands with 28, Malta with 22 and Cyprus with 21 — the last two punching far above their weight as pre-MiCA hubs converted their populations. Malta moved fast — OKX announced a MiCA licence from its Malta hub in January 2025, its register notification landing on 27 January, the same day as the Crypto.com and Bitpanda Malta entities (eToro had already been notified from Cyprus on 16 January) — but that speed drew the regime's first supervisory-quality challenge: ESMA's fast-track peer review, published 10 July 2025, found the MFSA's authorisation of an unnamed CASP only 'partially met expectations', weeks after Malta's FIAU fined OKCoin Europe just over €1m for historic AML failings. Mid-tier home states include Spain and Ireland (12 entries each), the Czech Republic and Luxembourg (11 each), Austria (10) and Italy (9). The clearest casualty of the higher bar is Lithuania, a registration hub for hundreds of VASPs pre-MiCA, which now counts just six register entries.
Mechanism and the enforcement toolkit
MiCA's enforcement toolkit is broad. NCAs have powers to require information, conduct on-site inspections, suspend or withdraw authorisations, impose administrative penalties up to specified ceilings (the higher of fixed amounts or percentages of turnover), order public statements, prohibit marketing or trading of specific assets, and impose temporary or permanent bans on individuals from holding management functions. ESMA can intervene under specific circumstances on consumer-protection grounds, including emergency product-intervention powers. The escalation pattern observed in 2025-2026 mirrors traditional financial-services supervision: supervisor letters and informal feedback first, formal warnings and remediation requirements next, monetary penalties and temporary suspensions thereafter, and full authorisation withdrawal as the terminal sanction. The economic logic of MiCA enforcement is also distinctive. Because authorisation is a passport into the entire EU single market, the threat of withdrawal is materially more significant than under fragmented pre-MiCA national regimes — a withdrawn authorisation in one member state means losing access to all 27 EU member states plus the EEA. This raises the stakes for both supervisors (who carry reputational risk for granting authorisations that later require withdrawal) and authorised firms (who have a single regulatory relationship to manage rather than 27 separate ones).
Recent milestones (2024-2026)
The verified milestone sequence runs as follows. 30 June 2024 — Titles III and IV come into application; stablecoin issuers face authorisation, reserve and redemption obligations, and EU venues begin restricting non-compliant tokens. 30 December 2024 — Title V comes into application; the first CASP authorisations land the same day (BitStaete, MoonPay, ZBD and Hidden Road — all Netherlands entities, per the ESMA register). 27 January 2025 — OKX, Crypto.com and Bitpanda receive Malta CASP authorisations the same day (per the ESMA register), each claiming an early-mover MiCA licence. 31 March 2025 — the USDT delisting wave completes: Binance and other venues remove non-MiCA-compliant stablecoin spot pairs for EEA users. March-April 2025 — the first hard stablecoin enforcement: BaFin prohibits new USDe business (21 March), imposes a €600,000 coercive fine plus a ban on payments and sales (4 April), and orders Ethena GmbH to wind up its USDe business (14 April) after the firm withdraws its MiCAR application; USDe secondary-market trading becomes impermissible in the EU. 3 April 2025 — Malta's FIAU fines OKCoin Europe just over €1m for AML failings identified in a 2023 examination. 10 July 2025 — ESMA's fast-track peer review finds Malta's MFSA only 'partially met expectations' on a CASP authorisation, the first public supervisory-convergence test. Full-year 2025 — 148 CASP authorisations granted (ESMA register). 4 December 2025 — the European Commission's Market Integration and Supervision Package proposes moving CASP supervision from NCAs to ESMA. H1 2026 — a pre-deadline rush adds 130 register entries in six months; the register also records its first exits (a voluntary revocation in the Netherlands effective March 2026 and a Cypriot authorisation ended in April 2026). 23 June 2026 — ESMA publicly calls on unauthorised CASPs to wind down EU operations in an orderly way. 1 July 2026 — the transitional period ends in every member state; unauthorised provision of crypto-asset services to EU clients is now a breach of the regulation.
Key risks and open questions
The first risk vector is supervisory convergence. NCA divergence on capital, AML, governance and disclosure standards creates forum-shopping incentives, and the machinery for arbitrating it is now being tested in public: ESMA's Malta peer review was a shot across the bows of fast-authorising NCAs, and the Commission's December 2025 proposal to centralise CASP supervision at ESMA — a move publicly backed by the French, Italian and Austrian authorities — is the structural answer on the table, with trilogue negotiations running through 2026. The second is the DeFi perimeter. MiCA's exclusion of fully decentralised activity is in principle clear but in practice fluid: front-ends and aggregators with identifiable operators are widely read as inside the regime, while pure smart-contract execution sits outside — but no landmark grey-zone enforcement action had been publicly reported as of July 2026, so the boundary remains untested. What BaFin's Ethena case did establish is that anything shaped like token issuance is squarely inside. The third is the interaction with sectoral legislation, particularly MiFID II for tokenised securities, the Transfer of Funds Regulation for AML and the Digital Operational Resilience Act for ICT risk. Authorised firms are managing a thicket of partially-overlapping obligations, and ESMA and EBA are still publishing clarifying guidance.
Regulatory landscape and Level 2 / Level 3 instruments
The regulatory stack supporting MiCA enforcement has filled in substantially through 2025 and into 2026. Regulatory technical standards finalised include those covering authorisation requirements, reserve-asset composition for stablecoins, complaint handling, conflicts-of-interest management, business continuity, white-paper content, market-abuse procedures and significance designation. Implementing technical standards on supervisory cooperation, information exchange and notification procedures have similarly progressed. Level 3 guidance and Q&A from ESMA and EBA covers a growing list of topics, including the interaction between MiCA and the Travel Rule, the boundaries between MiCA and MiFID II for hybrid instruments, and expectations for marketing communications and consumer disclosures; ESMA has also used public statements as an operational tool, most recently its April and June 2026 statements on the end of the transitional period. The cumulative effect is that the operational rulebook is now broadly stable, with ongoing refinement rather than fundamental new requirements — the open structural question being the Commission's December 2025 proposal to re-plumb supervision itself.
Outlook and probable enforcement trajectory through 2027
The trajectory through 2027 has three parallel tracks. The first is the post-deadline reckoning: with grandfathering over as of 1 July 2026, the large population of nationally-registered firms that never converted — industry analyses put EU national registrations north of a thousand, against 283 register entries — must exit, relocate or face enforcement, and ESMA has signalled that coordinated action with EBA and the EU's new anti-money-laundering authority AMLA is the approach for actors that keep serving EU users. Public warnings, blocking orders and cooperation with non-EU regulators are the likely instruments; the early sanctions on the books (BaFin's €600,000 coercive fine against Ethena GmbH, the FIAU's €1m-plus AML fine in Malta) suggest six-to-seven-figure penalties will be the routine tier. The second track is the supervision fight: trilogue on the Commission's December 2025 proposal to move CASP supervision to ESMA runs through 2026-2027, and its outcome determines how much the register's home-state concentration — Germany 59 entries, France 31 — still matters by 2028. The third track is stablecoin supervision deepening. The EBA's significance framework — which escalates own-funds and reserve requirements, including a 60% deposit floor, for tokens crossing usage thresholds — had produced no publicly announced significant-EMT designation as of July 2026, but the supervisory plumbing is being laid: the EBA signed a cooperation memorandum with the New York DFS in June 2026 covering cross-border stablecoin supervision. By 2027 MiCA will be judged on outcomes — whether consumer protection, market integrity and a genuinely single market justify the compliance cost — and the early evidence, from the Ethena wind-down to the Malta peer review, is that the regime bites, but unevenly.
Watch points
- Post-1-July-2026 enforcement against firms that kept serving EU users without authorisation
- Trilogue outcome on the Commission's December 2025 proposal to move CASP supervision to ESMA
- First EBA significance designation of a major EMT and the resulting 60% deposit-reserve escalation
- Whether register exits (revocations, withdrawals) accelerate beyond the first two 2026 cases
- Further ESMA peer reviews of fast-authorising NCAs after the Malta precedent
- The ART gap: whether any asset-referenced token issuer is ever authorised at scale
TL;DR
MiCA's transitional era is over: grandfathering ended on 1 July 2026, the ESMA register holds 283 CASP entries (279 firms, led by Germany with 59 and France with 31) as of 13 July 2026, roughly twenty EMT issuers and zero ART issuers are authorised, and enforcement is real — BaFin wound up Ethena's German USDe business, Malta's FIAU fined OKCoin Europe over €1m, and ESMA's peer review challenged Malta's licensing — while the Commission's December 2025 proposal to centralise supervision at ESMA will decide who runs the regime next.
Get DeFi Intel research in your inbox
Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.
Sources & verification
- CASP counts and distribution (283 entries / 279 firms; Germany 59, France 31, Netherlands 28, Malta 22, Cyprus 21; 4 authorisations in 2024, 148 in 2025, 130 in 2026 — 129 in H1 plus one notified July 1; first end-dated entries in March-April 2026; latest authorisation July 1, 2026): ESMA interim MiCA register, CASPS.csv downloaded July 13, 2026 and re-checked against the July 14, 2026 snapshot (totals unchanged)
- End of MiCA transitional periods (hard boundary July 1, 2026): ESMA statement, April 2026; ESMA public statement, June 23, 2026; Elliptic
- BaFin measures against Ethena GmbH (prohibition March 21, 2025; €600,000 coercive fine and payments/sales ban April 4, 2025; wind-up order April 14, 2025; USDe secondary trading impermissible in the EU): BaFin
- FIAU fine of ~€1.05m on OKCoin Europe (announced April 3, 2025); OKX Malta MiCA licence announced January 2025 (register notification January 27, 2025 — the same day as the Crypto.com and Bitpanda Malta entities): CoinDesk
- ESMA fast-track peer review of CASP authorisation in Malta ('partially met expectations', July 10, 2025): ESMA peer review report
- European Commission Market Integration and Supervision Package proposing ESMA supervision of CASPs (December 4, 2025): Taylor Wessing; ESMA
- Binance removal of non-MiCA stablecoin spot pairs for EEA users by March 31, 2025: Binance
- EMT/ART issuer tallies (roughly 20 EMT issuers, ~30 tokens, no ART issuers; Q1-Q3 2026 trackers): Micahub register tracker; EBA — ARTs and EMTs under MiCA
- EBA-NYDFS memorandum on cross-border stablecoin supervision (June 2026): CoinGeek
Register counts computed from the ESMA interim MiCA register (CASPS.csv) downloaded July 13, 2026; per-country licensee lists are on our jurisdiction pages. Enforcement-trajectory characterisations and forward scenarios are editorial analysis.