EU Warns MiCA's 1 July Cutoff Is Fueling Fake Licenses and Reverse-Solicitation Traps

MiCA's 1 July 2026 cutoff turns licensing checks into an immediate risk

MiCA's transition ended on 1 July 2026, and digital asset service providers are no longer permitted to operate in the EU without authorisation. For EU users, that shifts the focus from a broad regulatory story to a concrete risk: verify whether a platform is authorised before funds or access become the issue.

What changed after the deadline

ESMA made its expectations clear, calling on unauthorised providers to wind down their EU activities, stop onboarding new EU clients, and limit ongoing activity to closing positions or helping clients exit. The practical question is now straightforward: does this provider have the authorisation to serve users in the EU today?

Why the risk is broader than small offshore operators

The pressure is not limited to tiny offshore firms. Luxembourg says unauthorised providers may increasingly rely on the reverse-solicitation exemption, while many EU member states have opted for shorter transitional windows, creating a less uniform transition than investors may expect.

A useful rule of thumb is to treat any provider that is not clearly listed in the ESMA register as a client-protection risk. If a platform is still pushing activity instead of offering a clean, transparent exit, that is a warning sign.

Reverse solicitation is the loophole regulators say is being stretched

MiCA can reach beyond EU borders: a non-EU CASP that provides services to EU-based customers generally must be authorised under MiCA extraterritorial effect for non-EU CASPs. The main carve-out is reverse solicitation, under which EU clients can seek services from a non-EU provider on their own initiative. That exception is narrow and was not intended to become a marketing workaround.

How regulators say the exemption is being misused

According to Luxembourg's regulator, unauthorised providers are targeting EU customers through websites or social media and then arguing that the customer contacted them first. If that pattern is happening, the exemption is being used to disguise promotional activity as client-led initiative.

ESMA's guidance on supervision looks at the means of solicitation, who did the soliciting, and whether the client acted exclusively on their own initiative. Website language, outreach methods, and geo-blocking all matter in that assessment. A site that is still adapted for EU users can weaken a provider's claim that contact was purely client-led.

ESMA's wind-down message reinforces the same standard: unauthorised CASPs should stop onboarding new EU clients, cease marketing and solicitation, and limit activity to closing out positions and assets.

The cleanest verification step

The clearest check remains simple: see whether the platform is listed in the ESMA register of authorized CASPs, as Luxembourg specifically advised investors to do. Reverse solicitation may be a real carve-out, but the burden should be on the provider to show genuine client initiative. If the platform is not listed, treat "reverse solicitation" as a claim to question, not proof that the arrangement is compliant.