MiCA after the deadline: what an authorisation tells an allocator, and what it does not

MiCA has applied to crypto-asset service providers since 30 December 2024, but it gave firms already operating under national rules time to adapt. Under Article 143(3) they could continue 'until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63, whichever is sooner'.

Member States were allowed to shorten that period or not to apply it at all, and many did. ESMA's list of national choices runs from six months — the Netherlands, Poland, Hungary, Latvia, Slovenia and Finland — through nine in Sweden and twelve in Germany, Ireland, Austria, Lithuania, Slovakia and Norway, to the full eighteen elsewhere, including Luxembourg, Malta, France, Spain and Italy. 1 July 2026 was therefore not the deadline. It was the last of them. ESMA warned in December 2024 that the patchwork could leave a provider authorised in one Member State but, for a period, without the authorisation it needed to serve clients in another.

Since 1 July the position is simple. Article 59 provides that a person 'shall not provide crypto-asset services, within the Union' unless it has been authorised as a crypto-asset service provider, or is a bank, investment firm, fund manager or other regulated entity permitted to provide those services under Article 60. The wording of the transitional rule also settles a point that was widely misread: the right to continue ended on 1 July whether or not an application was still being decided.

ESMA publishes the authorisations that national authorities report to it in an interim register, a set of files it updates weekly. At its 30 September 2026 update, the file of authorised providers held 364 entries from 27 EEA states.

Three features stand out. The market is concentrated: Germany alone accounts for 99 entries, and Germany, France, the Netherlands, Cyprus and Malta together for close to six in ten. The deadline produced a queue: more authorisations are dated June 2026 than any other month — 76, against 44 in the next busiest. And authorisation continued after the deadline, with more than sixty entries dated after 1 July. Where those were firms that had been operating under the transitional regime, the date matters: between 1 July and their authorisation they had no basis on which to serve clients in the Union.

Of the 364 entries, 227 include custody and administration of crypto-assets on behalf of clients, and 22 include the operation of a trading platform. Far more firms hold client assets than run venues.

The register is an index, not a certificate. ESMA notes that information reported by national authorities 'will not be immediately displayed'; the file carries a handful of entries whose authorisation dates fall after its own update, one of them in 2028; and three Member States have no entry at all. ESMA's parallel list of entities providing services without authorisation is dominated by a single country — 164 of its 173 entries are Italian — so absence from it says little about any firm. The national authority's own register remains the record to check.

For an allocator, the value of MiCA is not the word 'authorised'. It is a set of specific obligations that change what happens to client assets if something goes wrong — several of which address directly the problem of a single entity acting as exchange, broker and custodian at once.

Authorisation is a threshold, not an assessment. It does not say that a provider is well capitalised relative to its exposures, well run, or appropriately sized for an institutional client. Two authorised providers can differ as much as two authorised banks.

The protections also have edges, and they are written into the text. Custody liability is capped 'at the market value of the crypto-asset that was lost, at the time the loss occurred', and excludes incidents the provider shows occurred independently of its service, 'such as a problem inherent in the operation of the distributed ledger that the crypto-asset service provider does not control'. Legal segregation is required 'in accordance with applicable law' — so how well it holds in an insolvency remains a question for the national law and the courts where the provider sits.

Scope matters as well. MiCA does not apply to crypto-assets that qualify as financial instruments, deposits or funds, nor to those that are unique and not fungible (Article 2(3)–(4)). The own-account prohibition applies to the platform a provider operates, not to every entity in its group. And a firm outside the Union may serve a client in the Union without authorisation only where that client acted 'at its own exclusive initiative' — a basis Article 61 draws narrowly: any solicitation in the Union defeats it, 'notwithstanding any contractual clause or disclaimer purporting to state otherwise'.

None of this replaces operational due diligence. It gives it sharper questions. For each venue, broker and custodian a manager relies on: