Missed the MiCA licensing deadline? What now?

MiCA’s grandfathering period is over, and for crypto-asset service providers (CASPs) still without a license, “when to get licensed” is no longer the question. The question now is what happens to a firm that missed the window.

On July 8, 2026, Crystal Intelligence hosted “Not yet MiCA licensed? What now?”, a live panel moderated by Maksym Dragunov, Director of Policy and Advisory at Crystal Intelligence; with Clair Wermers, partner at CMS Amsterdam; Magnus Jones, blockchain regulatory consultant and Nordic Blockchain Association board member; Juraj Forgacs, co-founder and CEO of Fumbi Network, one of the first CASPs licensed in Slovakia; and Irina Gorbach, Compliance Advisory Manager at Crystal Intelligence.

Here is what they told attendees about the legal reality, the regulatory landscape, what licensing involves, and what changes the day a license is granted.

Key Insights:

• Operating without a MiCA license is now a regulatory breach, not a gap to close later. Unlicensed CASPs can wind down client positions but cannot onboard, market, or open accounts.
• Enforcement is uneven across the EU. Some regulators move quickly, while others have left firms without an answer for months.
• Even well-run, compliant firms hit real friction getting licensed. Prudential reserve rules, audited financial requirements and asset-segregation rules were written with bank-like structures in mind.
• A license is a starting point, not a finish line. Supervisors keep watching, and AML or monitoring failures can trigger action within months.
• Firms still holding client assets without a license have one practical option left: transfer the client base to an already-licensed provider.

Audience Polls conducted throughout the discussion were also revealing:

Compliance and AML professionals made up the majority of attendees, underscoring how squarely this topic sits with risk teams. Source: Crystal Intelligence

What does the end of grandfathering actually mean for unlicensed CASPs?

The European Securities and Markets Authority (ESMA) has been clear: Wermers told attendees that a CASP without a license must stop operating. No new clients, no new accounts, no marketing. The only activity still permitted is whatever is strictly necessary to wind down: client crypto must move to a licensed party or an unhosted wallet, and even custody is allowed only for a limited period, solely for that purpose. Firms still operating need to tell clients, retail and professional alike, exactly what happens next and by when.

Transitional periods were set nationally, not centrally, so the deadline timeline wasn’t uniform across the EU. In the Netherlands, where Wermers is based, the window closed a year before the EU-wide deadline, and the market has already adjusted: MiCA-licensed entities are being acquired, and client portfolios are shifting from unregulated CASPs to licensed ones. A single national license also carries an EU-wide passport. The Netherlands alone has granted 28 licenses so far, more than any country besides Germany and France.

Half of the attendees said MiCA doesn’t apply to their business, while firms that are fully licensed or not yet started tied at 19%. Source: Crystal Intelligence

How consistent is enforcement of MiCA compliance across the EU?

Not very, according to Jones. He pointed to Binance as a symptom of a bigger problem: if a firm is refused by several national regulators but could, in theory, be approved by one, that says something uncomfortable about how passporting is supposed to work. Some regulators, he argued, simply haven’t had the training or tooling to review applications on any reasonable timeline. His example: Kriptomat registered in Estonia and received no answer at all, pushing it toward wind-down, not because it failed the requirements, but because the regulator never responded.

Jones expects the next round of scrutiny to focus on fit-and-proper checks for boards and leadership, layered on top of other incoming rules: DAC8 and CARF tax reporting, the Travel Rule’s tension with data protection law, the AI Act, and DORA. Each adds cost, and a firm that runs compliance with one officer will likely need several. The European Banking Authority has an open consultation on related fines, with a response deadline of September 28.

He also questioned whether the EU’s approach is appropriate for the market’s actual size, noting that Binance has said the EU accounts for roughly 1% of its spot trading volume. On where MiCA goes next, Jones doesn’t expect a “MiCA 2.0” so much as a reframing aimed at bringing banks and traditional finance into regulated crypto use cases, rather than tightening rules on today’s CASPs.

Cost and complexity of licensing led all concerns at 39%, ahead of simply understanding what the regulation requires on 30%. Source: Crystal Intelligence

What does the licensing process actually look like for CASPs on the ground?

Forgacs offered the session’s first-hand account. Fumbi has operated in Slovakia for seven years and has held its MiCA authorizations since December 2025, having applied in April 2025, about eight months earlier. He credited the Slovak National Bank for staying responsive, unlike Estonia’s silence toward Kriptomat.

The friction was in the detail. Prudential reserve requirements are calculated as a share of the previous year’s fixed expenses, but it’s unclear what counts, including foreign-exchange costs, putting crypto firms at a disadvantage relative to securities and banking firms under clearer rules.

The requirement for audited financial statements from the prior year was more stringent: Fumbi’s operating company couldn’t meet it, so the firm acquired a dormant, one-year-old shelf company with audited statements, moved its infrastructure in, secured the license under that entity, and migrated clients at the end of grandfathering. Separately, the rule requiring client crypto to sit at a different address than a firm’s own assets creates friction for brokers, since moving crypto per trade means fees that can eat deep into the trade’s value.

Jurisdiction choice isn’t the open shopping exercise some firms assume. A firm must apply where at least 10% of clients and management substance are based. Fumbi had close to 90% of its clients in Slovakia, so the Czech Republic was its only alternative. Firms without genuine local substance are turned away outright. Denmark, meanwhile, requires a domiciled presence and Danish nationals on the board.

For firms still stuck without a license, Forgacs was direct: arrangements where a smaller firm fronted for a licensed partner are no longer available. The remaining option is a transfer of the client base and assets to a licensed provider, for a fixed price or revenue share, which Fumbi is doing now for a firm in Bulgaria.

A quarter of firms are already licensed and operating, while an equal share is still weighing an EU exit. Source: Crystal Intelligence

What changes once you’re MiCA licensed, and where do CASPs underestimate the work?

Gorbach opened with an analogy: passing a driving test doesn’t make someone a good driver; it means they’re now expected to drive safely every single day. A MiCA license works the same way: a starting point rather than a finish line, and supervisors don’t stop watching once authorization is granted. Some firms licensed earlier this year have already faced supervisory action over AML failures, a reminder that a license doesn’t guarantee ongoing compliance.

Once licensed, obligations kick in immediately: risk-based customer due diligence, transaction monitoring, sanctions screening, Travel Rule compliance, governance, staff training, and ongoing reporting to financial intelligence units. Gorbach flagged three areas Crystal sees firms consistently underestimate: transaction monitoring, since criminal typologies evolve faster than static rules; counterparty and on-chain risk across blockchains, including exposure to high-risk VASPs, unhosted wallets, and bridges; and governance, meaning the ability to show why a decision was made and how alerts get calibrated over time.

She also pointed to ESMA’s public register of non-compliant CASPs as a meaningful shift: supervision moving from reactive enforcement toward proactive market transparency, giving consumers, institutions, and regulators a way to see who is operating without authorization. Specifically regarding reverse solicitation, she noted that on-chain activity is visible to supervisors in near real-time, unlike traditional finance’s reliance on self-reported filings, which puts pressure on licensed and unlicensed firms alike.

Jones added that the EU’s new Anti-Money Laundering Authority now requires firms to individually risk-assess clients arriving from unauthorized providers and predicted compliance headcounts across the industry will keep climbing. He pointed to Tether’s compliance headcount climbing toward roughly 150 people to satisfy US regulators, unless firms lean harder on the tracing technology already built for this market.

Frequently asked questions

Can a firm rely on reverse solicitation to keep serving EU clients without a license?
No, except in genuinely exceptional circumstances. Wermers advised seeking legal advice before relying on this basis at all, and Jones expects enforcement to become stricter, particularly where local marketing or staff suggest that a firm solicited EU clients rather than being approached by them.

What can a firm still holding client assets without a license actually do now?
Forgacs’s advice: talk to the regulator about how it wants the wind-down handled and consider transferring the client base and its assets to an already-licensed provider for a fixed price or a revenue share, as Fumbi is doing for a firm in Bulgaria. Being silent is the riskiest path.

Does getting a MiCA license mean a firm is safe from enforcement?
No. Gorbach’s view: a license is a starting point, and supervisors keep assessing firms afterward. The firms that succeed in the long term are the ones that demonstrate daily that their controls actually work, not simply the ones that obtained authorization.

The bottom line

Grandfathering has ended, enforcement is uneven but tightening, and licensing is achievable but operationally demanding, even for firms with nothing to hide. The panel’s advice converged on a few points: take compliance seriously regardless of where a firm sits today, get legal and regulatory advice early, and talk to the regulator rather than going quiet. For firms with no realistic path to a license, arranging a clean transfer of clients and assets to a licensed partner is a far better outcome than drifting into non-compliance.

Missed the live session? The full recording is available here. Crystal encourages robust discussion among our webinar panelists and welcomes questions – regardless of how probing – from our audience about all aspects of our industry. Statements made by individual guests and panelists, including characterizations of specific legal, regulatory, enforcement or other matters, reflect their own personal views and understanding, are not fact-checked or endorsed by Crystal, and do not represent Crystal’s opinions, positions, or factual assessments.