What is MiCA? The EU crypto regulation explained: licences, stablecoins and the 2026 review

Who this is for: Founders, compliance leads, fund managers and policy analysts who need to understand what MiCA requires, how the licensing and stablecoin rules actually bite, and what the 2026 review could change, so they can make jurisdiction, product and counterparty decisions with the current rules in view.

For most of crypto’s history, Europe was a patchwork: a BaFin registration for Germany, a PSAN registration for France, and a token that was a security in one member state and nothing in particular in another. The Markets in Crypto-Assets Regulation, shortened to MiCA, replaced that with one directly applicable rulebook for the 27 EU member states plus Norway, Iceland and Liechtenstein. It is the largest crypto regulatory regime in the world by population covered and the first to be fully in force.

It matters now for three reasons. The grace period is over: since 1 July 2026 a firm serving EU clients without a MiCA licence is operating illegally, and the first casualties, Binance’s EU retreat and AscendEX’s shutdown, arrived that month. The stablecoin provisions have reshaped which dollar and euro tokens Europeans can trade and have become a battleground between the ECB, Tether, Circle and the Commission. And Brussels is already drafting what the industry calls MiCA 2, including a December 2025 proposal to hand supervision of all CASPs to ESMA and a formal review that closed for comment in late summer 2026.

This guide covers what MiCA regulates, how licensing and passporting work, what it did to stablecoins, how it compares with the US GENIUS Act and the stalled Clarity Act, what it meant for the big exchanges, and where the reform debate stands, with a worked example of a US exchange choosing a European home regulator. New to stablecoins? Read What is a stablecoin? first; for the US side, see SEC vs CFTC crypto regulation.

MiCA by the numbers

What MiCA is and what it covers

MiCA is Regulation (EU) 2023/1114, published in the Official Journal in June 2023. As a regulation rather than a directive it applies directly in every member state. It does three jobs: disclosure rules for anyone issuing crypto-assets to the public, prudential and conduct rules for the businesses that hold, trade and move those assets, and a strict regime for stablecoins, which EU policymakers saw as a threat to monetary sovereignty after the Facebook-led Libra project in 2019.

The three token categories

• E-money tokens (EMTs). Tokens referencing a single official currency, such as a euro or dollar stablecoin. Only authorised credit institutions or e-money institutions may issue them, and holders can redeem at par at any time. Title IV governs EMTs.
• Asset-referenced tokens (ARTs). Tokens referencing anything else: a currency basket, commodities, other crypto-assets or a mix. Issuers need specific authorisation and an approved white paper under Title III. As of July 2026 no ART issuer had been authorised anywhere in the EU, according to the MiCA Crypto Alliance’s review of the ESMA register, which shows how unattractive the category has proved.
• Other crypto-assets. Everything else, including bitcoin, ether and utility tokens. Public offers require a notified white paper under Title II, but no regulator approves it; ESMA’s register warns that listed white papers have not been reviewed by any competent authority.

Two things sit outside MiCA. Crypto-assets that are financial instruments under MiFID II, including most tokenised real-world assets, stay under securities law and the DLT Pilot Regime. Unique non-fungible tokens are excluded too, though fractionalised NFTs and large collections can be pulled back in.

The ten regulated services

Title V defines a crypto-asset service provider as any legal person professionally providing one or more of ten services: custody and administration; operating a trading platform; exchange of crypto for fiat; exchange of crypto for crypto; execution of orders; placing; reception and transmission of orders; advice; portfolio management; and transfers. A firm must be authorised for each service it offers, and the services held determine its capital class.

Market abuse and conduct

Title VI extends a market abuse regime, modelled on the securities Market Abuse Regulation, to any crypto-asset admitted to trading. Insider dealing, unlawful disclosure and manipulation are prohibited for everyone, not just licensed firms, and trading platforms must run surveillance and report suspicious orders. Coordinated pumps and undisclosed team selling are now offences in the EU, not just bad form.

How licensing and passporting work

MiCA applied in two steps: the stablecoin titles on 30 June 2024 and everything else, including CASP licensing, on 30 December 2024, after which firms already operating under national law could continue under Article 143 grandfathering until authorised or until 1 July 2026 at the latest. Member states could shorten that window and several did.

Choosing a home regulator

MiCA is a single rulebook but, for now, 30 national competent authorities (NCAs) administer it. A firm applies to the regulator where it has its registered office and real management, and that NCA becomes its home supervisor. Article 63 gives the regulator 25 working days to check completeness and 40 to decide, but the clock stops whenever more information is requested. The private.law licensing guide updated 26 September 2026 puts a first-time application at 9 to 18 months in practice, with Luxembourg’s CSSF quoting 6 to 9 months of pre-application dialogue alone, France’s AMF about four months plus two or three clarification rounds, and the Dutch AFM around 105 working days.

Capital requirements

Annex IV sets minimum own funds by class of service. Article 67 then requires the higher of that figure and one quarter of the previous year’s fixed overheads, and an ESMA Q&A in February 2026 clarified that variable costs count in the overhead base, which raised the effective requirement for larger firms.

The headline figures understate the cost. Application fees run from roughly €5,000 to €25,000 in most states to a published €200 per hour capped at €100,000 at the Dutch AFM, and annual levies from about €7,500 to €60,000, according to the same September 2026 guide. The real spend is people and systems: compliance staff, a resident board, client asset segregation, ICT risk management under the parallel DORA regulation and anti-money-laundering controls. The guide estimates €195,000 to €505,000 for a pre-authorisation project and €400,000 to €900,000 a year for the ongoing compliance perimeter. Treat these as market estimates, not statutory figures.

Passporting

Once authorised, a CASP tells its home regulator which other member states it wants to serve, the regulator forwards the notification, and the firm can start there 15 calendar days later with no second licence and no local capital. This is MiCA’s biggest commercial advantage and the reason global exchanges each chose one small-to-medium state as a hub. The flip side is that host states have almost no say over who serves their residents, which is the main complaint behind the push for central ESMA supervision.

Where firms went

By 26 September 2026, according to the private.law analysis of the register, Germany had 92 active CASP records, France 35, the Netherlands 28, Cyprus 24, Malta 22, Luxembourg 13 and Ireland 12. Germany’s total is inflated by banks converting under Article 60, which lets already-licensed financial institutions notify rather than apply. Poland had zero because its implementing law was vetoed and no competent authority was designated. The MiCA Crypto Alliance’s July 2026 review counted 164 entries on ESMA’s separate non-compliant list, the firms NCAs have flagged for serving EU clients without authorisation.

Uneven supervision: the Malta peer review

The weakness of a 30-regulator model showed early. On 10 July 2025 ESMA published a peer review of the Malta Financial Services Authority, which had authorised several large exchanges quickly. ESMA found the MFSA had good expertise but had granted authorisation with material issues unresolved and had not assessed some risk areas adequately, and told all NCAs to look harder at growth plans, conflicts of interest, group structures, technology and promotion of unregulated products. No licence was revoked, but every Malta-licensed firm came under a cloud, and the review became the opening argument for centralisation.

The 1 July 2026 cliff

ESMA’s pre-deadline statements, including one relayed by the French AMF on 23 June 2026, set two expectations: firms that would not be authorised in time needed credible, immediately executable wind-down plans, and authorised CASPs needed onboarding ready to absorb migrating clients with full anti-money-laundering checks. ESMA also reminded firms that reverse solicitation, the exemption letting an EU resident approach a non-EU firm on their own initiative, is narrow and cannot be a business model, a point that became central to the Binance dispute within weeks.

Stablecoins: the rules that changed the market

MiCA’s stablecoin titles are its most consequential and most contested provisions. The goal was to make any stablecoin used widely in Europe behave like electronic money and not displace the euro.

Who can issue and what the reserve must look like

Only an EU-authorised credit institution or e-money institution may issue an EMT, with a white paper notified to its regulator. Reserves must be segregated, bankruptcy-remote and held in low-risk, highly liquid assets. At least 30 percent of EMT reserves must sit as deposits in EU credit institutions, rising to 60 percent for EMTs designated significant. Issuers may not pay interest to holders, and redemption is at par at any time.

The bank-deposit rule is what drove Tether away. Tether, which holds most USDT reserves in US Treasury bills, argued in 2024 that parking a majority of reserves in European banks would add bank-run exposure rather than remove it, pointing to the €100,000 deposit insurance cap. It did not seek EMT authorisation and instead invested in two licensed European issuers, Quantoz (EURQ and USDQ) and StablR (EURR and USDR), the latter issuing on Tether’s Hadron platform.

The central banks have since half agreed with Tether’s diagnosis. On 22 September 2026, as covered by Crypto Coin Show, the European System of Central Banks asked the Commission to scrap the fixed deposit floors, arguing that heavy redemptions could drain deposits from lenders at the worst moment, and proposed instead that reserves be held in assets maturing within one to five working days.

Significant tokens and the means-of-exchange cap

An EMT or ART becomes significant, and moves from national to EBA supervision, when it crosses thresholds set in Article 43 and Delegated Regulation (EU) 2024/1506, including more than 10 million holders, a reserve above €5bn, or more than 2.5 million transactions worth over €500m per day. Significant issuers face higher capital, liquidity stress tests and the 60 percent deposit rule. Separately, Article 23 restricts any non-EU-currency ART or EMT from wide use as a means of exchange: above 1 million transactions or €200m a day in payments for goods and services, the issuer must stop issuing and submit a plan to bring usage back under the cap. Trading and investment use do not count, but the cap is the clearest expression of the monetary sovereignty concern behind the law and one the industry wants removed in the review.

The USDT delistings

ESMA told NCAs in January 2025 that CASPs should stop offering non-compliant ARTs and EMTs and wind down remaining services by 31 March 2025 at the latest. Coinbase had already removed USDT and seven other tokens for EEA users in December 2024. Crypto.com began delisting on 31 January 2025, and Kraken announced on 1 February 2025 that it would remove USDT, PYUSD, EURT, TUSD and UST for European clients in stages, moving to sell-only on 27 February, halting spot trading on 24 March and converting remaining balances to a compliant stablecoin on 31 March 2025. Europeans can still hold USDT in self-custody, but it has been absent from regulated venues for 18 months.

Who filled the gap

Circle, which secured an e-money licence from France’s ACPR in July 2024 and was the first global issuer authorised under MiCA, became the default compliant dollar and euro issuer in Europe. As of 1 October 2026 the ESMA register showed 25 EMT issuers with 50 white papers across 14 countries, including Societe Generale Forge (EURCV), Banking Circle (EURI), Monerium (EURe), AllUnity (EURAU), Quantoz, StablR and Paxos (USDG), with France hosting the most. The euro stablecoin market is small but growing fast: Gokhshtein Media reported on 28 September 2026 that total euro stablecoin capitalisation had reached a record roughly $900m, up from a prior peak of $721m in early 2022, with EURC at about $526m (62.6 percent) and EURCV at about $171m. Against a global stablecoin market well above $250bn, euro tokens are still under half a percent of the total.

Who supervises: ESMA, EBA and the national regulators

MiCA splits supervision three ways. NCAs authorise and supervise CASPs and non-significant stablecoin issuers. The EBA directly supervises significant ART and EMT issuers, runs their supervisory colleges and has drafted the penalty methodology: a June 2026 EBA consultation, closing 28 September 2026, proposed fines of up to 12.5 percent of annual turnover for ART issuers and 10 percent for EMT issuers, or twice the profit from the breach, whichever is higher. ESMA writes most technical standards, maintains the register, runs peer reviews and pushes convergence through Q&As, but has no direct supervisory power over any CASP.

That is what the Commission wants to change. On 4 December 2025 it published the Market Integration and Supervision Package, which would make ESMA the direct supervisor of all CASPs, leaving NCAs only firms for which crypto is not the main activity, and would let authorised CASPs operate DLT trading and settlement systems under the DLT Pilot Regime. The ECB backed the shift in a formal opinion on 9 April 2026, arguing it would reduce fragmentation and cross-border risk, and asked for more ESMA funding, a seat at ESMA’s proposed executive board for CASP matters and stricter controls for significant CASPs. The proposal still needs Parliament and Council approval; law firms tracking it expected at least a year of negotiation, so direct ESMA supervision is unlikely before 2027.

What MiCA has meant for exchanges

The map below is drawn from the ESMA register as compiled by casptracker.eu on 1 October 2026 and from the exchanges’ own announcements. Trackers do not all agree on exact dates, and the register records legal entities rather than brands.

The pattern: small, multilingual states with experienced financial regulators (Malta, Luxembourg, Ireland, Austria, the Netherlands) won the hubs, while Germany’s large count is mostly banks.

Binance: the deadline’s biggest casualty

Binance spent about 18 months pursuing a licence through the Hellenic Capital Market Commission in Greece. Its application was reportedly complete by April 2026, but, according to a Wall Street Journal report cited by CoinDesk on 3 July 2026, ESMA privately advised national regulators not to approve it over financial-crime compliance concerns, and Binance withdrew days before the 1 July 2026 deadline. Europe head Gillian Lynch disputed the sanctions-related allegations and said MiCA should be judged by how many firms it brings inside the regulated perimeter. Binance stopped accepting new EU registrations; DefiLlama data cited by Cryptonomist showed daily net outflows of roughly $1.5bn to $2.5bn in the days around the late June 2026 announcement, while Coinbase and OKX ran deposit-matching campaigns for departing users.

The story continued. As Crypto Coin Show reported on 2 October 2026, Binance has kept serving existing EU customers by treating the relationships as reverse solicitation, and regulators in France, Germany and Greece along with ESMA are examining whether that is legitimate. ESMA has meanwhile asked for stronger powers to freeze assets and shut down unlicensed platforms. The episode exposes the gap between MiCA’s licensing regime, which is complete, and its enforcement machinery, which is still being built.

Smaller exits

AscendEX ceased trading, deposits and account creation on 1 July 2026 after a liquidity deal fell through, then moved all withdrawals to manual review on 6 July with a warning that unresolved balances could end up in insolvency, as CCS reported on 10 July 2026. With roughly 360 authorised CASPs against well over a thousand pre-MiCA national registrations, most firms consolidated, exited or went dark.

2026: the review, MiCA 2 and the enforcement test

The Article 140 review

Article 140 requires the Commission to report on MiCA’s functioning by 30 June 2027 with any legislative proposals. DG FISMA opened a targeted consultation on 20 May 2026 with responses due by 31 August 2026. It asked whether multi-issuance stablecoin structures, where the same token is issued inside and outside the EU, should be permitted; whether an equivalence regime should admit third-country stablecoins; whether DeFi front-ends should carry obligations; whether staking and lending should become regulated services in their own right; and how to classify prediction markets and hybrid tokens. The ECB had already said in a 10 April 2026 non-paper that MiCA should not permit third-country multi-issuance, echoing a September 2025 ESRB recommendation, while the Commission’s view was that MiCA does not currently prohibit it.

ESMA’s wish list

On 30 September 2026 ESMA published its response. It asked for stricter marketing rules, especially for influencer promotions; proportionate requirements for staking, lending and borrowing; stronger powers to block fraudulent websites and act against third-country firms soliciting EU clients; a bar on regulated firms offering services in non-compliant stablecoins; clearer criteria for what counts as decentralised; a new regulated service category for providing access to DeFi protocols; authority to issue binding token classification opinions; and simplified white paper and authorisation procedures. Several of these ideas were floated earlier in 2026 and covered by CCS.

Enforcement

The first year of full application produced few formal penalties. The non-compliant register, the Malta peer review, the Binance intervention and the EBA’s penalty methodology are the enforcement story so far. The real test comes in late 2026 and 2027: whether NCAs fine or revoke licences of authorised firms, whether reverse solicitation is tightened, and whether the centralisation proposal survives a Council in which several member states are reluctant to give up supervisory fees and influence.

How we got here: a timeline

Worked example: a US exchange picks a MiCA home

How to evaluate a MiCA-regulated firm or token: a checklist

• Is the entity on the ESMA register, and which entity? MiCA protections attach to the authorised EU legal person, not its non-EU affiliates. Confirm the entity you contract with matches the register entry.
• Which services is it licensed for? A Class 1 broker cannot legally custody your assets. Match the ten service categories to what you actually use.
• Who is the home supervisor? A Malta licence is valid everywhere, but the July 2025 peer review means a Malta-licensed firm’s governance deserves a closer look than a Luxembourg or Dutch one.
• Is the stablecoin an authorised EMT? Only tokens whose issuer appears in the register’s EMT section may be offered to EU clients. USDT is not one. Check the white paper for reserve composition and redemption terms.
• How much of the reserve is in bank deposits, and where? The 30 or 60 percent rule concentrates risk in a few European banks. A good issuer discloses counterparties and maturities monthly.
• Does the firm rely on reverse solicitation? If a non-EU platform is serving you after 1 July 2026, ask how. ESMA has said the exemption is narrow and is investigating its use.
• Is there a credible wind-down plan? Ask any smaller counterparty what happens to client assets if its licence is refused or revoked.
• Is it preparing for ESMA direct supervision? Firms that treat the December 2025 proposal as likely will have EU-wide governance rather than a thin local shell.

Risks and open questions

Enforcement is unproven. MiCA has a full set of rules and almost no record of sanctions. The Binance reverse-solicitation dispute will show whether NCAs and ESMA can act decisively against a large non-EU platform. If the perimeter leaks, licensed firms that spent seven figures on compliance face unlicensed competition, which undermines the whole bargain.

The stablecoin rules may be too strict, or too loose, and nobody agrees which. The deposit floors kept Tether out, and the ECB now wants them replaced with maturity limits. The means-of-exchange cap has never been tested because no non-euro EMT is near 1 million daily payment transactions in Europe. Multi-issuance remains ambiguous, with the Commission saying it is not prohibited and the ECB and ESRB saying it should be. A euro stablecoin market under $1bn also raises the question of whether MiCA protected the euro or simply kept dollar liquidity offshore.

Centralisation could stall, and the US is catching up. Moving supervision to ESMA requires member states to give up fees, staff and leverage, and earlier ESMA-powers negotiations took years. Meanwhile the GENIUS Act gives the US a lighter stablecoin regime with Treasuries as the core reserve asset and no bank-deposit floor, effective by January 2027. The 2027 review is the EU’s chance to recalibrate before its first-mover advantage narrows.

What to watch next

Glossary

MiCA

The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, the EU’s single rulebook for crypto-asset issuers and service providers.

CASP

Crypto-asset service provider: any firm authorised under MiCA to provide one or more of the ten regulated crypto services.

EMT

E-money token: a crypto-asset that references a single official currency, such as a euro or dollar stablecoin, issuable only by credit institutions or e-money institutions.

ART

Asset-referenced token: a crypto-asset that references a basket of assets, currencies or other crypto-assets rather than a single currency.

Significant token

An EMT or ART that crosses thresholds such as 10 million holders or a €5bn reserve and therefore moves to direct EBA supervision with higher requirements.

NCA

National competent authority: the member state regulator (BaFin, AMF, CSSF, MFSA, AFM and others) that authorises and supervises CASPs under MiCA today.

ESMA

European Securities and Markets Authority: writes MiCA technical standards, maintains the register and coordinates NCAs; proposed to become direct supervisor of CASPs.

EBA

European Banking Authority: supervises significant stablecoin issuers and drafts the penalty framework for issuers.

Passporting

The right of a firm authorised in one EEA state to serve clients in all others after a 15-day notification, with no second licence.

Reverse solicitation

A narrow exemption allowing a non-EU firm to serve an EU client who approached it entirely on their own initiative; cannot be used to market to EU residents.

Transitional period

The grandfathering window under Article 143 that let firms operating under national law on 30 December 2024 continue until authorised or until 1 July 2026.

Article 23 cap

The limit of 1 million transactions or €200m per day for non-EU-currency stablecoins used as a means of exchange within the EU.

Why it matters

MiCA is the first large-economy experiment in regulating crypto comprehensively rather than by enforcement, and the results after one full year are mixed in instructive ways. The licensing regime worked: about 360 firms cleared a demanding bar, the largest global exchanges bar one chose to comply, and European users now have a register they can check. The stablecoin regime achieved its narrow goal of keeping unregulated dollar tokens off regulated venues, but euro stablecoins remain tiny, Tether simply routed around the rules, and the ECB itself now wants the deposit floor rewritten. The supervisory architecture is the weakest part, which is why Brussels is already proposing to centralise it two years after launch.

For anyone building or investing in this market, the practical lesson is that Europe now has rules that are stable enough to plan around and fluid enough that the 2027 review will matter. The US, having passed stablecoin law but not market structure law, is watching how MiCA handles DeFi, staking and enforcement. Whatever Brussels decides in the Article 140 report will shape the template other jurisdictions copy. The interviews in the Crypto Coin Show archive with exchange executives, issuers and policymakers track that debate as it unfolds, and our research hub covers the stablecoin data behind it.

Sources

1. ESMA: Markets in Crypto-Assets Regulation (MiCA), accessed October 6, 2026
2. ESMA: ESMA calls for changes to make MiCA clearer, safer and ready for emerging services, September 30, 2026
3. ESMA: ESMA identifies opportunities to strengthen MiCA authorisations, July 10, 2025
4. AMF: End of MiCA transitional period: ESMA sets out its expectations of professionals and warns retail investors, June 23, 2026
5. Federal Register: GENIUS Act Regulations on Payment Stablecoin Issuance, Offer, and Sale, August 18, 2026
6. Latham & Watkins: MiCA Regulation Tracker, all texts, accessed October 6, 2026
7. Latham & Watkins: US Crypto Policy Tracker, legislative developments, accessed October 6, 2026
8. Norton Rose Fulbright Regulation Tomorrow: Commission proposes legislative package aimed at market integration and EU-level supervision, December 4, 2025
9. Skadden: Fit for Purpose? European Commission Launches Review of MiCA, June 2026
10. Notabene: Is MiCA 2 coming? What the EU’s 2026 consultation means for stablecoins, CASPs and DeFi, May 22, 2026
11. private.law: The MiCA CASP Licence: Procedure, Cost and Choosing a Jurisdiction, updated September 26, 2026
12. casptracker.eu: Crypto exchanges with a MiCA (CASP) license, October 1, 2026
13. casptracker.eu: MiCA stablecoin list 2026: all e-money tokens in the ESMA register, October 1, 2026
14. outrun.at: MiCA CASP Tracker, September 30, 2026
15. MiCA Crypto Alliance: ESMA’s register keeps moving: 14 new CASPs bring the post-transition total to 294 entries, July 23, 2026
16. CoinDesk: Binance pushes back on reports that EU regulators tried to block it, July 3, 2026
17. CoinDesk: U.S. Treasury Department proposes GENIUS Act stablecoin rule, August 17, 2026
18. AMINA Bank: CLARITY Act September 2026: why the Senate vote failed and what regulates US crypto now, September 16, 2026
19. CoinGeek: ECB backs centralized oversight of major crypto firms, April 2026
20. Cointelegraph: Kraken to delist USDT and four stablecoins in Europe, February 1, 2025
21. Cointelegraph: OKX secures MiCA pre-authorization in Malta, January 23, 2025
22. The Paypers: Tether exits EU market as MiCA rules block USDT from exchanges, July 7, 2026
23. Gokhshtein Media: Euro stablecoin market cap hits $900M; EURC commands 62.6% share, September 28, 2026
24. Cryptonomist: MiCA penalty framework sets strict EU crypto fines, June 29, 2026
25. Crypto Coin Show: ECB-led central banks urge removal of MiCA’s 60% stablecoin reserve rule, September 22, 2026
26. Crypto Coin Show: Binance exploits MiCA loophole to retain EU customers months after license rejection, October 2, 2026
27. Crypto Coin Show: AscendEX shuts down after MiCA miss and warns some withdrawals may not be processed, July 10, 2026

Disclosure: This guide is for education only and is not investment, legal or tax advice.