EU Warns: MiCA's 18-Month Gap Still Leaves Crypto Users Exposed

MiCA has reduced the rules gap, but protection gaps still matter

MiCA has already cut into the old "no rules" narrative. Since December 2024, it has established a supervisory regime for certain crypto-assets and crypto-asset service providers. But the EU's own warning is that legal protection, if any, may be limited depending on the asset and the service. In other words, the remaining weakness is not only a regulatory gap; it is also a consumer-protection gap.

That matters because consumers' interest in such products and services is on the rise. If users cannot easily distinguish between full MiCA coverage, partial oversight, and no coverage at all, compliance becomes harder to reward and scammers need only exploit that confusion.

The PSD2-to-MiCA handover creates the main confusion point

The clearest transition risk starts on 2 March 2026. That is when the EBA's transition period ends for some CASPs offering electronic money token services that qualify as payment services. The EBA advises national authorities to require CASPs that do not meet all of these conditions to discontinue the provision of such EMT services and to cooperate with MiCA or other enforcement bodies where necessary.

Two supervisory lanes can look like one to users

MiCA does not create a simple on-off switch. For larger ARTs and EMTs, the EBA assesses whether they meet the criteria for "significance". When that threshold is met, the EBA takes on direct supervisory responsibilities for significant ART issuers, while significant EMT issuers face joint supervision by the EBA and the national competent authority.

That split can blur the picture for users. A firm may still be moving through national decisions while only part of its activity falls under tighter EBA scrutiny. Users may see "some supervision" and assume "full protection," which is why the ESAs stress that legal protection, if any, may be limited depending on the crypto-asset and service involved.

Why that confusion can attract fraud

The authorities are explicit that users may face lack of access to comprehensive information or a transparent and uniform claims handling procedure. Scammers do not need a complete rules vacuum to benefit from that. They only need consumers to mistake regulatory activity for safety.

Compliance is becoming a market advantage

The EBA has also published a draft methodology for setting fines for significant issuers, showing that MiCA supervision is not only procedural. It is increasingly enforceable. That does not mean every transitional player will be pushed out immediately, but it does mean that ambiguous status is becoming more costly over time.

With the 28 September 2026 deadline for comments on that methodology, the next phase of enforcement detail is still being shaped. For investors, that points to a cleaner theme: favor businesses that can convert regulatory certainty into trusted volume rather than betting on generic crypto beta.

What likely benefits from clearer supervision

EU-authorized CASPs, regulated payment-token issuers, and custodians look better placed if MiCA keeps shifting the market toward documented compliance. In a landscape where legal protection, if any, may be limited for some users, verified status and clearer processes may matter more to customers and counterparties.

What to watch next

• The end of the PSD2 transition on 2 March 2026
• National authorities' actions on EMT activities that do not meet the EBA's conditions
• The EBA consultation on a draft methodology for setting fines, with comments due by the 28 September 2026 deadline
• Further direct supervisory responsibilities as the EBA identifies significant ARTs and EMTs