MiCA Final Deadline: 60 Days for Crypto Firms to Get Authorized or Lose EU Access

What ESMA's April statement actually requires

The statement (ESMA75-113276571-1679, published April 17, 2026) sets out three categories of supervisory expectation that every CASP and competent authority should be working against right now.

First, unauthorized CASPs must have credible, operational, immediately executable wind-down plans in place by July 1, 2026. ESMA explicitly rejects letter-of-the-law compliance: a wind-down plan that exists on paper but cannot be operationalized does not meet the standard. National competent authorities are expected to verify the existence and adequacy of those plans, not just to accept their submission.

Second, authorized CASPs are required to actively manage the migration of existing clients before the deadline. ESMA expects authorized firms to onboard existing EU clients into their licensed entity with full AML and CFT compliance. The supervisory tolerance for migrations that arrive incomplete or non-compliant is described as "now over."

Third, third-country (non-EU) firms cannot serve EU clients except under the narrow reverse-solicitation exception. ESMA explicitly addresses outsourcing and delegation arrangements designed to route EU customer traffic through non-EU entities. Those arrangements are out of bounds under MiCA Article 33 and equivalent provisions, and ESMA has signaled it will scrutinize group structures for circumvention attempts.

The penalties for non-compliance are not modest. Article 111 of MiCA permits fines of up to €5 million or 5% of annual turnover, cease-and-desist orders, and effective bans on EU operations. National competent authorities have been instructed to be prepared to take action against unauthorized service provision after July 1.

Why so many firms still aren't authorized

A few patterns explain the long tail of unauthorized firms heading into the deadline.

The first is timing. The technical standards (RTS) and implementing standards (ITS) supplementing MiCA were not all finalized until early 2025. Many firms held their applications waiting for the final templates, then ran into authority backlogs. The Netherlands and Malta led the early issuance, with Germany following shortly after. As of late 2025, public reporting indicated more than 40 CASP licenses had been issued — concentrated in a handful of jurisdictions. The longer tail of applications is queued behind these.

The second is scope. MiCA's authorization regime requires evidence of governance, capital, IT security, custody safeguards, conflict-of-interest management, and operational continuity that many smaller crypto firms simply did not have on hand. Building that evidence into an authorization-ready submission is months of work, not weeks.

The third is the third-country question. Non-EU firms that have historically served EU clients through marketing reach or partnership arrangements are now confronting the choice: establish an EU subsidiary, exit the EU market, or rely on the reverse-solicitation exception (which ESMA has narrowly construed). Each of these is a strategic decision with material business consequences, not a compliance task.

What the 60-day push looks like operationally

For firms still inside the authorization process, the next 60 days are mostly about three workstreams.

Workstream one is the application file. The CASP application requires evidence of governance, fit-and-proper assessments for management, capital and reserve calculations, IT security architecture, AML and CFT program design, and customer asset segregation arrangements. Files arriving incomplete face delays that may push past the July 1 deadline.

Workstream two is the operational compliance program. The DORA digital operational resilience regulation overlays MiCA from January 17, 2025. Applicants need to demonstrate ICT risk management, incident reporting procedures, and third-party risk management compliant with DORA. The FATF Travel Rule (transferring originator and beneficiary data on crypto transfers) overlays as well, with EU-specific implementation under TFR (Regulation 2023/1113).

Workstream three is the client migration. For firms that obtain authorization, the existing customer base needs to be re-onboarded into the licensed entity with full KYC and AML compliance. ESMA expects this to be completed before the deadline, not after. Authorized CASPs that drag client migrations across the deadline are in non-compliant territory even if the firm itself holds a license.

The dual-licensing question for stablecoin issuers

Stablecoin issuers (specifically issuers of asset-referenced tokens or e-money tokens under MiCA) face a layered question that's worth flagging separately. The MiCA authorization for an EMT issuer overlaps with PSD2 e-money licensing in many member states. Issuers heading toward the July 1 deadline are confronting whether their existing PSD2 license is sufficient, whether MiCA EMT authorization is required in addition, or whether dual licensing is the only route. The answer varies by jurisdiction and by token design.

For the specific case of dollar-pegged stablecoins issued into EU markets, the dual-licensing question becomes a material commercial decision. EBA guidance has tightened on prudential requirements for significant ART/EMT issuers, and the supervisory bar for cross-jurisdictional stablecoin operations is meaningfully higher than for single-jurisdiction issuers.

What deepidv brings to the deadline

For CASPs racing the deadline, the verification, AML, and Travel Rule infrastructure deepidv runs is examination-ready by default. A single platform handles KYC, KYB with UBO resolution, sanctions and PEP screening (Arbiter agent fleet), Travel Rule message generation and consumption, and ongoing transaction monitoring. Each verification produces a cryptographic receipt that survives regulatory examination, which is exactly what the AMLA's outcome-effectiveness supervision approach (effective in 2027) will require. Luna, the AI compliance co-pilot, drafts the procedural compliance documentation that the application file demands. The combination compresses the runway from "months to assemble" to "weeks to demonstrate."