Zelcore

MiCA in Year Two: What Full Enforcement Looks Like for Users

8 min read
MiCA in Year Two: What Full Enforcement Looks Like for Users

On 15 March 2026, an EU-resident user opening Binance in Paris or Bitstamp in Luxembourg sees a clear market: USDC and EURC quote against bitcoin, Circle's MiCA-compliant pair is the default on-ramp, and USDT is missing from the order book. The user can still hold USDT in self-custody, but regulated venues they deal with daily will not quote it. That is what the second year of full MiCA enforcement looks like.

This piece opens a five-part series, the crypto regulation 2026 playbook, covering the year's major rulebooks — MiCA in year two, the US stablecoin framework, the SEC and CFTC jurisdiction fight, the global regulatory map, and the updated travel rule. Part one takes stock of MiCA, sixteen months after its core provisions became applicable. Readers new to the file can start with the Regulation 101 primer on MiCA and the GENIUS Act; the rest assumes that baseline.

From paper rules to hard deadlines

The Markets in Crypto-Assets Regulation, or MiCA, entered into force in June 2023 and became fully applicable on 30 December 2024. The 2026 calendar is now dominated by the end of its transitional regime. Under Article 143(3), member states could grant existing providers a grandfathering window of up to 18 months during which they could keep operating while their licence applications were processed.

Those windows were not uniform. Spain, facing a queue of applications and a cliff-edge risk, extended its grandfathering from 12 to 18 months in late 2025, becoming the only member state to revise its original communication. Bulgaria and Italy also extended to 18 months, ending 30 June 2026, and Lithuania extended from 5 months to 12.

The outcome is a hard industry-wide deadline of 1 July 2026. After that, no EU jurisdiction will recognise a legacy national registration as cover for providing crypto-asset services. The European Securities and Markets Authority (ESMA) — the EU-level regulator coordinating national competent authorities (NCAs) such as Germany's BaFin and the Netherlands' AFM — has said last-minute applications will face heightened scrutiny, and that non-authorised crypto-asset service providers (CASPs) must execute an orderly wind-down rather than drift past the cut-off.

The stablecoin reshuffle

MiCA's stablecoin rules became enforceable earlier than the broader CASP regime. Title III covers Asset-Referenced Tokens (ARTs) — tokens pegged to a basket or anything other than a single fiat currency — and Title IV covers E-Money Tokens (EMTs), single-fiat stablecoins such as a euro or dollar token. Both became binding on 30 June 2024, and from 31 March 2025 unauthorised EMTs cannot be offered to the public or admitted to trading in the European Economic Area.

As of January 2026, 17 EMT issuers have been authorised, covering 25 single-fiat tokens: 14 in euros, 9 in US dollars, one in Czech koruna and one in British pounds. Zero ART issuers have been authorised. Named licensees include Circle (USDC, EURC), Société Générale-Forge (EURCV, USDCV), Paxos, Fiat Republic, Quantz Payments, Schuman Financial, StablR, Stablemint, AllUnity and Alipay Europe. France leads with four approvals. Circle was the first global issuer to reach compliance, via an Electronic Money Institution (EMI) licence from France's ACPR.

The flipside is a visible clear-out of non-compliant tokens. Tether has publicly declined to seek MiCA authorisation, citing a preference for what it called more risk-averse frameworks. Coinbase Europe and Crypto.com moved to delist USDT for EEA users around the turn of 2024–2025, and in early 2025 Binance removed a basket of non-MiCA-compliant stablecoins — USDT among them — for EEA users. For a refresher on how stablecoins are supposed to hold their peg, the Academy has a standalone explainer.

One nuance matters. ESMA has confirmed that custody and peer-to-peer transfer of non-compliant tokens do not by themselves count as "offering to the public" or "seeking admission to trading" under MiCA. A user holding USDT in a hardware wallet is not acting illegally. Commentators have also flagged that EMT custody and transfer services may eventually require a second licence on top of MiCA authorisation — a PSD2 authorisation under the EU's Payment Services Directive 2 — with providers warning that stacking the two regimes could roughly double compliance costs, though the exact timing of any such requirement is not yet settled.

CASP licensing at the 16-month mark

A February 2026 study by the compliance firm LegalBison, updated on 23 March 2026, counts 174 authorised CASPs across the EU and EEA. The pool is heavily concentrated: Germany accounts for 51 licences (29 percent), the Netherlands for 23 (13 percent), France for 13 (7 percent), Malta for 12 (7 percent), Ireland for 11 and Cyprus for 10.

The headline hides what kind of licence each firm holds. Of the 174, only 14 hold trading-platform authorisation — the permission needed to run a centralised exchange. A further 21 are licensed for investment advice and 30 for portfolio management, the rest across custody, execution and related services.

Named venues cluster in specific hubs. Kraken is authorised in Ireland; Coinbase and Bitstamp chose Luxembourg; Bitpanda is supervised out of Austria. Other major platforms — including Binance, OKX, Gemini, Bybit, KuCoin, eToro, Revolut, Bitvavo and MoonPay — have similarly picked single home-state regulators across jurisdictions such as France, Malta, Austria, Cyprus and the Netherlands.

Once a firm clears authorisation in any one member state, the MiCA passport lets it serve customers across all 27. That passporting right is the core commercial payoff of compliance.

The DeFi carve-out: a recital, not a regime

MiCA is emphatic on paper about decentralised finance. Recital 22 states that "where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within the scope of this Regulation." Tokens with no identifiable issuer are similarly excluded from Titles II through IV.

The catch is that MiCA does not define "fully decentralised" and ESMA has not issued binding guidance that does. ESMA's October 2023 consultation conceded that "the exact scope of this exemption remains uncertain" and committed to a case-by-case, substance-over-form approach. Supervisors look at control across the DeFi stack, whether operators are identifiable, whether admin keys can modify smart contracts, and whether fees flow to an accountable party.

A January 2025 joint report from the European Supervisory Authorities (ESAs), under Article 142 MiCAR, took stock of DeFi, lending, borrowing, staking and self-custody and signalled each may warrant a bespoke regime rather than a stretched reading of MiCA. The Commission's full application report is due on 30 June 2027 — the earliest realistic window for formal MiCA expansion. Until then, EU-resident front-end operators sit in a multi-year grey zone.

What EU users actually feel in 2026

The cumulative effect is concrete. The menu of tradable stablecoins on regulated venues is narrower: USDC and EURC dominate, and most non-Circle dollar stablecoins are unavailable on EU-authorised centralised exchanges. Onboarding is heavier, because MiCA sits on top of the Transfer of Funds Regulation — the EU implementation of the travel rule — so verified identity and source-of-funds checks are standard even for modest retail deposits.

Some products are geo-fenced out for EEA users. Lending, staking and certain tokens are restricted platform-by-platform, either because their MiCA treatment is ambiguous or because a PSD2 authorisation is also needed. Self-custody remains explicitly legal: ESMA has repeatedly confirmed that holding or transferring non-compliant tokens in a personal wallet is outside MiCA's "offer to the public" definition. The on-ramps and off-ramps for those tokens, however, are narrowing.

Industry trackers and commercial analytics firms report that anonymous trading and peer-to-peer flows on European venues have fallen as users migrate to licensed platforms, though the specific magnitudes vary by source and should be read as estimates rather than official ESMA figures.

What to watch over the rest of 2026

Three dates structure the year. On 29 June 2026, the Commission's report on its delegated-acts powers is due; it will signal whether more Level-2 rules — the Regulatory and Implementing Technical Standards (RTS and ITS) — are coming. On 1 July 2026, all remaining national grandfathering periods terminate; trackers expect a wave of formal refusals and orderly wind-down orders in H2 2026. On 30 June 2027, the Commission must deliver its full MiCA application report to the European Parliament and Council — the earliest realistic trigger for expansion into DeFi, staking, lending or NFTs.

The Level-2 and Level-3 machinery keeps grinding. More than thirty RTS, ITS and supervisory guidelines are now live, with more in the pipeline. The iXBRL formatting requirement for MiCA white papers — the pre-issuance disclosure documents issuers must publish — entered into application on 23 December 2025, after the underlying XBRL taxonomy was published on 5 August 2025.

MiCA's second year is less about new rules and more about the cost of finally applying the existing ones. For EU users the trade-off is concrete: a narrower, better-policed menu of regulated venues, a shrinking set of compliant stablecoins, and a self-custody corridor regulators have so far chosen to leave open.

Sources

Further Reading

ETF Flows: Signal vs Noise

ETF Flows: Signal vs Noise

Daily bitcoin ETF flow numbers are the most-screenshotted data in crypto. Here is how to decode what a $500M print actually represents.

10 min read
Halvings, Burns, and Supply Events

Halvings, Burns, and Supply Events

A field guide to crypto supply events: issuance cuts, burns, and unlocks. With Bitcoin's 20M milestone, ETH's post-Dencun reality, and 2026's unlock wave.

9 min read
Protocol Upgrades: How to Evaluate a Hard Fork

Protocol Upgrades: How to Evaluate a Hard Fork

A framework for reading protocol-upgrade news: taxonomy, governance pathways per chain, contention signals, and the Taproot vs Bitcoin Cash case studies.

8 min read

Join Our Newsletter

Get a friendly update from us once a month. No spam, just the latest from Zelcore.

Join Our Newsletter
    MiCA in Year Two: EU Enforcement in 2026 | Zelcore