Shot of a young businessman and businesswoman using a digital tablet during a late night at work

MiCAR: from transition to enforcement – supervisory expectations and key recommendations

By 1 July 2026, the European crypto market will reach a point of no return. On that date, the MiCAR transitional period expires across the EU, bringing an end to the regulatory grey zone in which many crypto‑asset service providers have operated for years. Any firm offering crypto‑asset services to EU clients without a MiCAR license after that deadline will be acting unlawfully and will be expected to stop.  

Supervisory expectations 

1) If your firm will not be authorized by 1 July 2026, prepare the orderly wind-down  

ESMA expects unauthorized CASPs to have operational, credible, immediately executable wind‑down plans, designed to protect clients and avoid undue economic harm. That means, inter alia:

  • Client offboarding must be organized (e.g., transfer client crypto-assets to an authorized CASP or to a self-hosted wallet) 
  • Advance notice to clients before executing the wind-down 
  • Plans must comply with conduct, prudential and AML/CFT obligations 

2) If your firm will be authorized, client migration must be proactively managed 

ESMA expects authorized CASPs to actively manage migration of clients ahead of the deadline. This includes onboarding EU clients before the transitional period ends and applying robust onboarding and AML/CFT processes. 

3) Reminder about outsourcing and delegation 

A key ESMA message is that firms must ensure outsourcing and delegation do not result in services being provided to EU clients via unauthorized third-country entities. Many operating models rely on group hubs, technology stacks, wallet infrastructure, customer support, and execution venues outside the EU. Under MiCAR, supervisors will look through contractual structures and assess whether the regulated service is effectively performed by an unauthorized entity, which can trigger enforcement, forced remediation, or a requirement to cease servicing EU clients. 

CSSF expectations for IFMs with crypto exposure 

Luxembourg IFMs managing AIFs with meaningful crypto exposure face specific CSSF expectations. If an IFM intends to manage an AIF investing >10% of NAV in crypto-assets, the IFM must obtain prior CSSF authorization for the strategy “Other‑Other Fund‑Crypto-assets” (and the initiator is expected to present the project to the CSSF beforehand). IFMs should also analyze whether their performed services map to activities listed in Article 60(5) of MiCAR. For indirect exposure via target funds (TFs), the CSSF does not require the “Other-Other Fund-Crypto-assets” license, but still expects robust risk assessments. 


Key recommendations to firms 

  • Lock in a board‑level MiCAR decision now, clearly committing either to authorization or to an orderly exit well before the July 2026 deadline 
  • Manage client migration combining robust onboarding and AML/CFT refresh avoiding compressed timelines and last‑minute execution risks 
  • Embed orderly wind‑down as a standing capability, ensuring client assets, communications and compliance can be managed without disruption if authorization is not achieved 
  • Reassess outsourcing and delegation through a substance lens, ensuring no EU‑facing crypto services are effectively delivered by unauthorized third‑country entities 
  • Strengthen crypto governance and early supervisory engagement, particularly for IFMs, with clear control over keys, risks and MiCAR‑relevant activities 

How EY can help 

In Luxembourg, we are proud to have among our clients some of the most important players in the digital commerce industry. We provide support on a range of topics, spanning our assurance, consulting and tax service lines. Some of our services include the following:

  • Assurance 
    • External assurance for Virtual Asset Service Providers (VASPs) / Crypto-Asset Service Providers (CASPs) 
    • Internal audit “as-a-service” for VASPs/CASPs 
  • Consulting 
    • Strategy definition and product development (e.g., tokenization, development of ARTs)  
    • CASP licensing and MiCAR regulatory compliance 
    • Preparation and/or review of white papers 
    • MiCAR top-up and gap analysis 
    • Cybersecurity, DORA and outsourcing assessments 
    • Compliance/crypto-related training to staff members 
  • Tax/Legal 
    • Tax reporting including CARF gap analysis and implementation 
    • VAT support  
    • Support in the corporate setup of Luxembourg VASPs/CASPs 
    • Transfer pricing support and documentation 

Summary 

By 1 July 2026, the European crypto market will reach a point of no return. On that date, the MiCAR transitional period expires across the EU, bringing an end to the regulatory grey zone in which many crypto‑asset service providers have operated for years.

About this article

Authors

Related articles

If you’re not exploring digital identity, you’re already behind.

Across Europe, a new digital chapter is taking place. It begins with a simple promise: proving your identity online shouldn’t feel like an obstacle course! EU Digital Identity (EUDI) Regulation—the EU’s updated framework for trusted electronic identification—sets new, unified rules so citizens and businesses can authenticate securely across all Member States.

Circular 26/906: a comprehensive overhaul of governance and risk management for payment and e‑money institutions

On 20 January 2026, the Commission de Surveillance du Secteur Financier (CSSF) published Circular 26/906, consolidating in a single document the requirements related to governance and risk management framework applicable to payment institutions and electronic money institutions. The circular applies from 30 June 2026, and repeals and amends multiple legacy texts.

Securitization in Pan-Europe: key drivers in 2025 and outlook for 2026

Securitization is transitioning from a specialized financing technique into a mainstream pillar of Europe’s capital markets. In 2025, structural trends — shifting policy priorities, regulatory reform, market innovation, and the rise of new asset classes — are converging to elevate securitization’s role in channeling savings into productive investment.