From the journal

MiCA Grandfathering Period Ends July 2026: Unauthorized CASPs Must Cease EU Operations

The maximum 18-month MiCA transitional period expired on 1 July 2026, closing the grandfathering window across all EU and EEA member states. Any crypto-asset service provider that operated under pre-MiCA national regimes must now hold MiCA authorisation or suspend services. ESMA confirmed that national competent authorities are expected to enforce compliance, with pending applicants permitted to continue only where an NCA issues an express individual determination.

2 min read

The Article 143(3) transitional period under Regulation (EU) 2023/1114 (MiCA) expired on 1 July 2026, closing the final grandfathering window. Any entity providing crypto-asset services under pre-MiCA national authorization after that date, without a MiCA authorisation as a crypto-asset service provider (CASP), is operating outside the law and must immediately suspend those services.

Article 143(3) of MiCA allowed member states to permit pre-existing service providers to continue operating for up to 18 months from 30 December 2024, the date CASP provisions entered application. ESMA's April 2026 Statement on the End of Transitional Periods under MiCA confirms the maximum period has elapsed and that national competent authorities (NCAs) must now enforce full MiCA compliance. Providers with pending authorisation applications may continue only where an NCA grants individual permission under the second subparagraph of Article 143(3).

Exchanges, custodians, transfer service providers, and portfolio managers without MiCA authorisation must halt new client onboarding. Where NCA guidance requires it, they must also wind down or transfer existing client positions. Providers that received MiCA authorisation before 1 July 2026 gain cross-border passporting rights to offer services across the EU without additional national licensing steps.

Member states that adopted grandfathering periods shorter than 18 months completed their transitions earlier, meaning some providers have operated under full MiCA obligations since 2025. The EBA's public CASP register and ESMA's central register reflect current authorisation status. Firms should verify their own status and that of counterparties before settling post-deadline transactions. Pending authorisation files do not extend operating rights unless an NCA issues an explicit individual determination.

We may advise on MiCA authorisation strategy and have a partner network of EU counsel with direct NCA experience. If your organisation needs to assess its post-1 July position or advance an authorisation application, we invite you to contact us. Work we undertake includes MiCA CASP authorisation filings, cross-border passport notifications, regulatory capital analysis, and NCA liaison.

Source: ESMA, Statement on the End of Transitional Periods under MiCA, April 2026

Crypto Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.