On July 1, 2026, the last national transitional window under MiCA closed. There is no grace period left, anywhere in the EU. If your firm was still providing crypto-asset services under a legacy national registration and hasn't secured CASP authorization, the legal basis for that activity is gone.
That's not a scare tactic — it's just where things stand. ESMA confirmed in April that enforcement is expected to begin immediately once each jurisdiction's window closes, and the message has been consistent: a pending application is not authorization, and there are no further extensions on the table.
The Pattern Nobody Wants to Admit
Compliance commentator Yana Afanasieva has described a cycle many compliance teams know all too well: study the regulations, find a long list of gaps, draft a remediation plan, watch it stall, have the auditors find the same gaps a year later, commit to fixing them again — and repeat. Meanwhile, product and engineering teams next door are shipping, testing, and iterating in weeks, not years.
It's a sharp diagnosis, and it explains a lot about why so many CASPs are on the wrong side of the MiCA deadline today. The firms now scrambling aren't, for the most part, firms that didn't know the rules existed. They're firms that treated MiCA as a one-time paperwork exercise — a box to tick — rather than as a shift in how the business needs to operate going forward. When compliance is run as a project with an end date, it's almost guaranteed to be overtaken by a regulation that keeps evolving.
What Actually Changed on July 1
A few things are worth being precise about, because a lot of firms have been operating on assumptions that are no longer true:
- The deadline was never uniform. The 18-month transitional period under Article 143(3) MiCA was a maximum, not a default. The Netherlands, Finland, Latvia, Hungary, and Slovenia closed their windows at six months (mid-2025). Germany and Ireland closed at the end of 2025. Only a handful of countries — France, Malta, Luxembourg among them — used the full 18 months, which ran out July 1, 2026.
- An application in progress is not a license. Article 63 authorization is what permits continued service. Firms that filed but haven't received a decision have no more legal cover than firms that never applied.
- This also affects firms that thought they were fine. Legacy VASP registrations, late filings, and EU clients being routed through non-EU entities are all now squarely in scope for enforcement — reverse solicitation is a narrow legal exception, not a workaround.
- The consequences are concrete. Administrative fines, public censure, suspension of activity, and forced withdrawal are all on the table, alongside the operational chaos of an unplanned wind-down or client migration.
Where Agile Compliance Actually Helps
What does compliance actually look like? Please find a description of what a durable compliance function looks like versus a fragile one:
- Dashboards and continuous monitoring, instead of a static policy binder that gets dusted off once a year for an audit.
- Iterative reviews, so gaps get caught and closed in weeks, not rediscovered by auditors twelve months later.
- Treating regulatory change as a permanent condition of the business, not a discrete event with a deadline you can put behind you once authorization is granted — MiCA's technical standards, guidelines, and ESMA clarifications will keep coming.
- Training and education of your staff. Understanding Tokenization, conceptual token frameworks, risk management of processes and the KYC/AML requirements.
CASPs that pass through this deadline "quietly," as some regulatory commentators have put it, tend to be the ones that built this kind of operating model early rather than the ones that treated the license application as the finish line.
What to Do This Week
If you're not certain where your firm stands, three things are worth doing immediately:
- Check your actual status against the ESMA Interim MiCA Register — not your internal assumption of where your application is.
- Map the real gap, not a theoretical one. What specifically stands between where you are and full authorization or an orderly wind-down?
- Decide what "agile compliance" means operationally for your firm — what would it take to stop running compliance as an annual fire drill and start running it as a continuous function?
That's exactly the shift 2tokens.academy's compliance training is built around: not just getting a firm to the finish line of authorization, but building the operating model that keeps it there.
For more information: 2tokens.academy.
Sign up for the MiCA Compliance training to get your staff up to speed.
