ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The MiCA transitional period is over, and that changes the legal position of every crypto-asset service provider that serves clients in the European Union. Since 1 July 2026, a firm offering covered services without MiCA authorization is operating unlawfully, regardless of how far its application has progressed in a particular Member State.
This guide explains what the end of the MiCA transitional period means for unauthorized providers, for authorized providers taking on clients and for anyone running compliance for a crypto business. It is based on the ESMA statement on the end of transitional periods and on the regulation itself. It is not legal advice; if your status is uncertain, get advice from a qualified lawyer in the Member State concerned today, not next week.
The Markets in Crypto-Assets Regulation created a harmonized licensing regime for crypto-asset service providers, issuers of asset-referenced tokens and e-money tokens, and others. To avoid a cliff edge, the regulation allowed Member States to let providers that were already operating under national rules continue for a limited time while they sought authorization. The maximum length of that period was set by the regulation and runs out on 1 July 2026 at the latest.
ESMA published a statement in April 2026 on the end of the transitional periods. It says that the EU-wide period expires on 1 July 2026 and that the expiry applies whatever the implementation status in individual Member States. For the wider regulation, see our overview of MiCA regulation.
According to the ESMA statement, providers that have not obtained authorization should have orderly wind-down plans ready before the end of the period. The plans should limit harm to clients, for example by helping them transfer assets to authorized providers or to self-hosted wallets, and should include notifying existing clients before the wind-down starts. The wind-down should be complete by 1 July 2026.
If your firm is in this position now, the priority is to stop unauthorized activity, protect client assets and communicate clearly. Speak to your national competent authority and your lawyers about the right steps and any exposure arising from services provided after the deadline.
Authorized CASPs may see a flow of clients from providers that have stopped. ESMA indicates that national authorities will monitor how authorized providers onboard clients from unauthorized ones. That means your onboarding must still meet MiCA and anti-money-laundering rules, even if the client is arriving in a hurry. Do not relax due diligence, suitability or disclosure steps for speed.
Review your authorization scope, conduct of business, conflicts policies, complaint handling and outsourcing arrangements. Our MiCA compliance checklist and CASP authorisation guides cover the requirements. Check your market abuse controls too; see MiCA market abuse.
| Situation | What it means after 1 July 2026 | Action |
|---|---|---|
| Authorized CASP | May provide services across the EU under its authorization | Maintain ongoing compliance, onboard clients carefully |
| Applied, awaiting decision | No right to continue serving clients without authorization | Follow the authority’s instructions and the wind-down plan |
| Never applied | Services cannot continue | Execute orderly wind-down or stop serving EU clients |
| Client of an unauthorized provider | Provider should have transferred or returned assets | Verify the provider on the official register |
| Group affiliate of an authorized firm | Authorization applies to the specific legal entity | Confirm which entity provides the service |
Consumers and businesses should confirm that any provider they use is authorized. ESMA advises checking its interim MiCA register and confirming which legal entity provides the service, because being part of a group with an authorized firm does not mean that the specific entity is authorized. If a provider lacks authorization, clients should consider moving assets to an authorized provider or to a self-hosted wallet.
Businesses that use crypto providers, such as payment firms and treasury teams, should run the same check on vendors and document it in vendor due diligence.
The transitional period for service providers is only one part of MiCA. Stablecoin issuers have separate rules, described in ART vs EMT, and offers of crypto-assets to the public generally require a white paper; see crypto-asset white paper. If you serve US customers as well, compare the rules in GENIUS Act vs MiCA. Transfers of funds and crypto-assets also involve information requirements; see the crypto travel rule guide.
Use this sequence as a practical plan.
Authorization is a significant project: governance, capital, policies, systems, staff and legal work. See MiCA compliance cost for the main cost categories. For authorized firms the costs now shift from getting licensed to staying compliant: monitoring, reporting, audits and training. A documented compliance calendar prevents surprises.
Also keep in mind the wider regulatory environment. Our page on financial services compliance provides context for firms that operate across several regimes.
Whether you are authorized or preparing to apply, the policies and records are the evidence supervisors ask for: governance, conflicts, complaints, outsourcing, custody, safeguarding, market abuse controls, business continuity and client communications. The MiCA Toolkit includes editable templates across those areas, so your team can adapt a structured set.
For the regulator’s own words on the end of the transition, see the ESMA statement on the end of transitional periods under MiCA. Templates help with documentation, but the authority will look at how the firm actually operates.
National authorities verify, not just accept, claims of compliance. Prepare a short evidence pack that you can hand over within a day. For authorized providers, this typically includes the authorization decision and scope, the governance structure and the list of key function holders, policies on conflicts of interest, complaints, outsourcing and custody, the client onboarding procedure and records of how clients from winding-down providers were assessed, and the latest internal audit or compliance monitoring reports. For firms winding down, it includes the wind-down plan, the client notices sent, records of asset transfers or returns and the log of decisions taken and approvals obtained.
Keep everything dated and version controlled. A supervisor reading your file should be able to reconstruct what you did, when and why, without chasing individual employees. If something went wrong, such as a delayed client notice, record the cause and the correction. Candid records are far better than a file that looks tidy but cannot be reconciled with what clients experienced.
Clients need clear, timely information. Explain what is changing, what the client must do and by when, where their assets are and who to contact. Avoid marketing language. If assets are being moved, describe the destination and any costs. If a service is being discontinued, say so plainly and give enough notice for the client to make alternative arrangements. Keep copies of every communication and the dates they were sent, because complaints and supervisory questions often turn on what a client was told.
Authorization is the start of supervision, not the end of it. Expect ongoing reporting, inspections, changes to technical standards and new guidance from ESMA and national authorities. Assign an owner for regulatory change, maintain a calendar of obligations and review the program at least annually. Firms that build this routine early spend less time reacting to each new requirement and more time running the business. The end of the MiCA transitional period is best seen as the moment the market moved from preparation to permanent supervision.
Ask which legal entity in your group holds, or should hold, authorization. Ask whether any service you offer falls outside the scope of your current permission. Ask how your national authority expects firms to handle clients who were served before authorization, and whether reverse solicitation arguments are realistic for your business. Ask what records you should preserve in case of later supervisory questions. Write down the advice and the date you received it, and revisit it whenever your services, clients or group structure change.
The biggest mistake is assuming a pending application permits continued service. Another is relying on a group affiliate’s authorization. Authorized providers sometimes relax onboarding checks for clients from winding-down firms. Others ignore communication duties to clients. Keep your status under review, document decisions and seek legal advice when facts are unclear.
ESMA states that the EU-wide transitional period for crypto-asset service providers expired on 1 July 2026.
Not after the transitional period ended, according to the ESMA statement. Unauthorized providers should follow orderly wind-down plans and speak to their national authority.
ESMA advises using its interim MiCA register and confirming which specific legal entity provides the service.
No. Authorization applies to the specific legal entity, not to the whole group.
Keep compliance current, apply full onboarding checks to incoming clients and document decisions for supervisors.
October 1, 2026
