EU MiCA enforcement and the reality of crypto compliance

The end of the transition period

The July 1, 2026, deadline for MiCA authorization forced unlicensed crypto firms to stop serving EU clients. ESMA stated that companies without a license must exit the market or transfer assets to authorized providers. The transitional period allowed companies operating under national rules to continue until July 1, 2026. By the end of the transition, 244 crypto service providers obtained authorization in the EU and EEA, with several companies in Italy, France, Malta, and Spain securing licenses in the final days. I see clearly that this regulatory hard stop makes the previous period of ambiguity irrelevant. Companies like Kraken, Coinbase, and Bitstamp already hold approved status. MiCA implements tiered capital requirements for CASPs, ranging from 50,000 EUR to 150,000 EUR depending on the services offered.

Bybit EU operates through a legal entity with MiCA authorization and requires a separate account to access its products. While some firms like Binance withdrew applications in Greece to seek permission elsewhere, others face forced exits. Nexo AG is seeking $3 billion in damages from Bulgaria after prosecutors dropped a criminal investigation into the company. Nexo, co-founded by Antoni Trenchev, alleges that the investigation, which began in January 2023, destroyed shareholder value. I find the Nexo litigation a stark reminder of how regulatory friction can disrupt business operations.

Data sharing and stablecoin risks

The Travel Rule, which became mandatory on December 30, 2025, requires providers to share sender and recipient data. The EU applies this rule to all transfers regardless of the amount. FATF reported that 83 percent of 109 jurisdictions passed travel rule legislation by July 16, 2026, an increase from 73 percent in 2025. If you are managing high-frequency transfers, you must account for this constant data requirement. The rule requires the originator’s name, account number, address, and identity number. Receivers must also hold the name and account number of the beneficiary. This rule applies to transfers involving a traditional wire transfer or a virtual asset transfer between a VASP and another obliged entity.

Most illicit on-chain activity now involves stablecoins. The European Commission launched a public and a targeted consultation to assess whether MiCA remains fit for purpose given the recent market developments and the increasing importance of stablecoins in global payments. Of the 91 jurisdictions that passed the legislation, 55 or 60 percent had not yet issued findings or taken enforcement action on travel rule compliance as of July 16, 2026. Do regulators have enough tools to stop this?

The Malta regulatory advantage

Malta has become the preferred base for firms seeking EU-wide access through passporting. OKX, the world’s second-largest cryptocurrency exchange, moved its European hub from France to Malta to use the more favorable regulatory environment. OKX also secured a Payment Institution license in December 2024 to provide stablecoin services. The company is recruiting a head of compliance, an operations lead, and a head of internal audit to strengthen its presence. Crypto.com is another major player in Malta, operating through Foris DAX MT Limited. This entity holds a license from the Malta Financial Services Authority to provide services such as exchange, transfer, and custody of crypto assets. Foris DAX MT Limited specifically handles the exchange of crypto assets for fiat, the exchange of crypto assets for other crypto assets, and the execution of orders for customers.

The single-license model allows these firms to serve 400 million Europeans without seeking separate permissions in every country. MiCA mandates a minimum of 125,000 EUR in own funds for core infrastructure like custody. I believe this centralization in Malta creates a clear hierarchy between compliant giants and smaller, struggling players.