July 1 deadline freezes unlicensed crypto

From 1 July, any firm offering crypto services to European customers without a licence under MiCA (the Markets in Crypto-Assets Regulation, the EU's first comprehensive crypto rulebook) must stop taking new clients. ESMA, the EU's securities markets authority, has ordered unauthorised providers to halt onboarding, stop marketing and protect client assets during an orderly exit (AMF/ESMA). The deadline closes an eighteen-month transition that began when MiCA's broader rules took effect in December 2024 (EUR-Lex).

The regulation passed in 2023. What arrives now is enforcement. And enforcement turns on a mechanism that will reshape the market: compliance costs are high enough to shut out smaller operators, while a single licence can be "passported" across the entire EU. The result is consolidation. Large, well-funded platforms that invested early in legal teams, capital buffers, custody systems and audit infrastructure now face fewer competitors across a single market of roughly 450 million people.

One rulebook, twenty-seven gatekeepers

MiCA is directly applicable EU law, so it doesn't need to be written into each country's statute book the way directives do. But every member state still decides who issues licences, checks governance and punishes violations. That turns national supervisors into both gatekeepers and competitive assets.

Portugal published its implementing law just days before the deadline. Law 69/2025 gives Banco de Portugal the job of licensing crypto firms, while the CMVM (the securities regulator) polices market conduct and abuse (Chambers, Leite Borges). Banco de Portugal's investigation director told parliament the bank would be "very demanding," because the old regime checked mainly for money laundering while MiCA adds requirements on capital, governance and conduct (Executive Digest).

Spain is narrowing access sharply. CNMV expects roughly 20 operators to receive authorisation, with 14 already approved and six files advanced (Cinco Días). Before MiCA, the registered population was far larger. Germany's BaFin had a head start: German firms already operating under a national crypto-custody regime built compliance systems years ago, giving incumbents an edge over newcomers (BTC-ECHO).

Ireland shows the other side of the coin. A MiCA licence from the Central Bank of Ireland can serve customers across the entire EU without a separate application in each country. Kraken holds its MiCA authorisation there and presents it as the basis for EEA-wide operations (Kraken Blog). If Dublin authorises well, it attracts business. If it authorises carelessly, it exports risk to every other member state.

Who pays, who gains

Large licensed platforms win the most. A MiCA licence is expensive to get and expensive to keep, but it creates a barrier that smaller rivals struggle to cross. For them, compliance is a cost. For the big firms, it's a filter.

Consumers gain disclosure rules, complaints procedures and authorised-provider lists, but not a safety net. Portugal's CMVM warned that crypto services are not covered by the country's investor compensation system and that total loss of value remains possible (Jornal PT50). MiCA regulates the provider, not the price.

Smaller operators face the steepest climb. Firms that ran on a light anti-money-laundering registration now need governance structures, capital reserves, custody safeguards and ongoing supervision. Portugal's sanctions regime makes the stakes concrete: fines for operating without authorisation can reach €5 million for companies, and market-abuse offences can carry penalties of up to 15% of turnover (ECO).

Polish firms face the messiest position. A presidential veto on 11 June stalled the national bill that would have given KNF (the financial supervisor) the operational machinery to process crypto licence applications (TVN24 Biznes). MiCA still applies directly as EU law, but without domestic procedures, Polish firms have no clear path to apply for authorisation at home. The government has acknowledged the deadline (gov.pl), but acknowledgement without working procedures leaves them stuck.

The question MiCA can't answer

The regulation can force unauthorised firms to wind down. It cannot control where users go next. Some will migrate to licensed European platforms. Others may shift to offshore exchanges or self-custody wallets beyond any supervisor's reach. Portugal's CMVM already counts 103 licensed providers from other EU countries that can passport into the Portuguese market alone (Jornal PT50). Whether stricter rules pull users into safer venues or push the riskiest traders out of sight is the test MiCA cannot answer by design.