ESMA Orders 1,000 Unlicensed EU Exchanges to Wind Down

What Happened

On June 23, 2026, ESMA issued a formal public statement titled 'Statement on the end of transitional periods under MiCA,' directing unauthorized crypto-asset service providers to immediately begin winding down EU operations. The statement requires unlicensed platforms to stop onboarding new EU clients and stop marketing to EU residents, limit services to actions strictly necessary for clients to sell, transfer, or reallocate crypto-assets, communicate clearly and repeatedly with clients about wind-down timelines and asset protection measures, and disclose a deadline by which residual positions will be automatically closed if clients have not acted.

France's AMF published a parallel advisory the same day warning that operating a crypto-asset service without authorization after July 1 could constitute a criminal offense under French law.

MiCA's transitional regime, established by Article 143(3) of Regulation (EU) 2023/1114, allowed VASP entities that held national crypto registrations before December 30, 2024 to continue operating while their CASP authorization applications were processed. The transitional window was set to run for up to 18 months.

ESMA confirmed in April 2026 that no member state may extend the transitional period beyond July 1, 2026, and the June 23 statement is the formal enforcement communication telling firms that the window has closed. Only approximately 210 of the 1,200-plus VASP entities that entered the transitional period have converted to full CASP authorization, a conversion rate of roughly 17 percent.

The post-July 1 EU crypto market is a supervised market. Every licensed exchange has agreed to monitor transactions, verify identities, and file reports. Private keys opted out of that arrangement before MiCA was written.

Why 83 Percent of EU Platforms Did Not Convert

Full CASP authorization under MiCA requires compliance infrastructure that most pre-MiCA national registrations did not demand. The package includes capital requirements scaled to the category of services offered, professional indemnity insurance covering client asset losses, cybersecurity governance with mandatory incident reporting, prudential safeguarding requirements for client assets with segregated custody obligations, and a complete AML and KYC compliance stack.

That stack means ongoing transaction monitoring, Suspicious Activity Report filing with the national financial intelligence unit, EU and OFAC sanctions screening, and Travel Rule compliance requiring transmission of originator and beneficiary data on all transfers above EUR 1,000.

This is functionally the compliance architecture of a nationally regulated bank applied to a crypto exchange. Many national registration regimes, particularly in smaller EU member states, had required only a one-time filing and a basic AML policy document.

The gap between pre-MiCA national registration and full CASP authorization is not primarily a timeline problem. Conversion rates have been below 20 percent across most EU member states for the entire 18-month transitional window, suggesting that many platforms chose not to pursue CASP authorization because the compliance cost exceeds the revenue available from EU clients.

The larger licensed competitors, Coinbase, Kraken, Binance, and OKX, established first-mover network effects during the transitional period, making the market increasingly difficult for smaller unlicensed entrants to recapture after July 1. The deadline converts what had been a business calculation into a legal one: firms that could not justify the compliance cost must now also comply with the exit requirement or face enforcement.

The Surveillance Stack Inside a CASP License

Every exchange that survives the July 1 cutoff does so because it has agreed to operate as a regulated financial institution for its EU customers. The CASP license is not a permission slip; it is a contract with EU regulators to maintain documented AML programs with formal risk assessments, verify the identity of every customer using government-issued identification, monitor transactions for patterns associated with money laundering and sanctions evasion, file Suspicious Activity Reports with national financial intelligence units when thresholds are met, screen every client and counterparty against EU consolidated sanctions lists, and transmit sender and receiver data on all transfers above EUR 1,000 under MiCA's transfer-of-funds provisions.

The market that emerges after July 1 is not the EU crypto market minus some smaller platforms. It is a supervised market in which every operating participant maintains the same surveillance obligations as a bank applied to crypto services. EU users who remain on licensed exchanges do so inside a transaction-monitoring architecture that logs, flags, and reports activity to national financial intelligence units by design.

A single CASP license from any EU member state passports across all 27 countries and the broader EEA, which has concentrated the licensed market in jurisdictions with historically streamlined authorization processes, particularly Ireland, Luxembourg, and Malta. The platforms that did not convert to CASP authorization are not being removed because they were noncompliant in any prior sense.

They are being removed because MiCA raised the compliance floor to a level the transitional regime explicitly promised to enforce.

What This Means for You

If you have accounts on EU exchanges, verify CASP authorization status before July 1. The licensed platforms that will continue operating EU services include Coinbase (Ireland), Kraken (Ireland and Luxembourg), Binance (full EU passport), OKX (Malta), Crypto.com (Malta), Bitstamp (Luxembourg), Bitpanda (Austria), Bitvavo (Netherlands), and Revolut.

National registers from the AMF in France, BaFin in Germany, and the Central Bank of Ireland are the authoritative source. If the exchange you are using does not appear on a national CASP register, ESMA's June 23 statement requires it to limit services to wind-down activities starting immediately.

If your current exchange is unlicensed, withdraw or transfer your assets before July 1. Some platforms will communicate a specific exit date; others may not. Exit schedules are at the platform's discretion, constrained only by the requirement to give clients reasonable notice before auto-closing residual positions.

Moving assets now eliminates access risk. Waiting until the deadline means competing with every other client on the same platform for processing capacity during the same window.

Self-custody of native Bitcoin in a hardware wallet is entirely outside the CASP framework. Bitcoin has no issuer. Holding BTC in your own private keys is exercising key control over a native protocol asset, not using a crypto-asset service. MiCA attaches its CASP obligations to service providers who hold client assets or operate trading infrastructure.

There is no CASP authorization for a hardware wallet to lose, no wind-down procedure to comply with, and no EU regulatory authority that can order your private key arrangement to stop operating.

Self-custody does not erase every exposure here. Your fiat on-ramp and off-ramp still pass through a licensed EU exchange. Sovereignty over the asset once it reaches self-custody and sovereignty over the exit from self-custody back to euros are two different things. A hardware wallet eliminates CASP exposure for the asset.

It does not eliminate the need for a licensed exchange when you need to convert back to fiat. That licensed exchange is inside the surveillance architecture described above. The architecture around the on-ramp and the off-ramp is not a detail.

What to Watch

Watch for unlicensed platform exit announcements over the next six days. France's AMF and Germany's BaFin are the member state regulators most likely to initiate early enforcement actions against significant unlicensed firms continuing to service EU clients after July 1. ESMA's June 23 statement signals coordination across member state competent authorities, so enforcement may come in parallel rather than sequentially.

Check public CASP registers for last-minute authorizations through June 30; a small number of applications may clear before the deadline. In the United States, the GENIUS Act CIP comment period closes August 21 and the CLARITY Act Senate floor vote is expected before the August recess.

Watch whether Senate debate on CLARITY references MiCA's passporting model as a structural template for a US federal framework.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.