MiCA in 2026: The Rulebook Is Live, and the Rewrite Fight Is On

Europe’s Crypto Rulebook Finally Went Fully Live

As Bitcoin trades around $85,000 and the market eases into another strong October, Europe passed a quieter milestone over the summer. The Markets in Crypto-Assets Regulation, the bloc’s single rulebook for digital assets and the law everyone simply calls MiCA, is now fully in force. The transitional periods that let existing firms keep trading while they applied for a licence have expired, and the grace period is finished.

MiCA is Regulation (EU) 2023/1114. It entered into force in 2023 and switched on in stages, and that staged rollout is now complete. For the first time, an exchange, a custodian, or a stablecoin issuer serving customers anywhere in the 27 EU member states, and across the wider European Economic Area, answers to one harmonised framework instead of a patchwork of national regimes.

The timing is almost ironic. In the same weeks that the final transitional deadlines passed and the rulebook became unavoidable, the European Commission closed a public consultation on whether MiCA should be rewritten, and the EU’s own supervisors, ESMA, the European Central Bank, and the European Banking Authority, filed submissions asking for substantial changes. Europe’s crypto rulebook is now the law of the land and a draft under revision at the same time. Here is the state of play.

What MiCA Regulates, and What It Leaves Out

MiCA governs three kinds of actor. It covers the issuers of asset-referenced tokens, the issuers of e-money tokens, and crypto-asset service providers, usually shortened to CASPs. A CASP is any firm that provides one of ten regulated services to clients in the EU.

• Custody and administration of crypto-assets on behalf of clients
• Operation of a trading platform for crypto-assets
• Exchange of crypto-assets for funds
• Exchange of crypto-assets for other crypto-assets
• Execution of orders for crypto-assets on behalf of clients
• Placing of crypto-assets
• Reception and transmission of orders on behalf of clients
• Providing advice on crypto-assets
• Providing portfolio management on crypto-assets
• Providing transfer services for crypto-assets

Issue a token to the European public with a white paper, or offer any of those services to EU clients, and you need authorisation from a national competent authority. There is no longer a quiet corner of the single market where a firm can operate unsupervised.

On the issuance side, the gateway is the white paper. Before offering a token to the public or seeking its admission to trading, an issuer has to publish a plain-language white paper, notify its regulator, and stand behind what it says, because getting it materially wrong carries liability. MiCA does carve some offers out of the full duty, including small raises under one million euros over twelve months, offers to fewer than 150 people per member state, and tokens handed out for free or distributed through mining or staking rewards. But the baseline is disclosure first, sell second.

Just as important is what MiCA deliberately leaves alone. It regulates identifiable intermediaries, not code, so a genuinely decentralised protocol with no operator falls outside the perimeter. It covers spot crypto-assets only; derivatives such as perpetual futures and options are financial instruments under a separate regime, MiFID II, supervised by national markets regulators rather than under MiCA. And unique, non-fungible tokens are carved out, though the carve-out is narrow, because issuing a large series or fractionalising a collection can pull NFTs back into scope.

Those gaps are not academic. They are exactly the areas the 2026 review is now circling, because that is where much of the growth, and much of the investor-protection risk, has moved.

From 2023 to the 2026 Deadline, a Rollout in Stages

MiCA did not arrive all at once. The stablecoin titles, covering asset-referenced and e-money tokens, applied from 30 June 2024. The CASP regime and the market-abuse rules followed on 30 December 2024. Then came the part that mattered most to the hundreds of firms already operating in Europe: the transitional, or grandfathering, window set out in Article 143.

Article 143 let member states give existing providers up to 18 months to keep trading while they applied for a full licence, which put the latest possible hard stop at 1 July 2026. States were free to shorten it, and the big markets did. Germany, France, Italy, Spain, Austria, Ireland, and Portugal all set 1 July 2026. Finland ended its window on 30 June 2025, one of the shortest in the bloc. Sweden required firms to have applied by 30 September 2025 or stop serving Swedish clients the next day. By the autumn of 2026, the grace period is over everywhere that matters.

One Passport, 361 Licences, and a Very Uneven Map

The promise of MiCA was the single passport. Get authorised once by your home regulator and you can serve all 30 EEA markets by notifying the host authorities, without re-applying country by country. That mechanism is meant to turn 27 fragmented regimes into one market.

A year into the CASP regime, the map is live but lopsided. According to the industry tracker CASPTracker, 361 firms held MiCA authorisation across the EEA as of 1 October 2026, overseen by 27 national regulators. Germany leads by a wide margin, with 96 licences, followed by France with 36, the Netherlands with 29, Cyprus with 25, Malta with 23, Spain with 15, and Luxembourg with 13. Several member states have authorised none at all. Among the large exchanges, Bybit, Kraken, OKX, and Austria’s Bitpanda hold licences, while Binance and MEXC did not appear on the register.

That concentration is the single-market ideal colliding with the fear that drove the whole review: regulatory arbitrage. A 2025 ESMA peer review of how Malta authorised its early CASPs found a good level of resources but flagged that some material issues were not fully resolved, which is supervisor-speak for the worry that a licence from one light-touch authority becomes a passport everywhere. Close that loophole, and the single market works as intended. Leave it open, and the lowest bar sets the standard for the whole bloc.

The Stablecoin Regime: Full Reserves, No Yield, and a Dollar Problem

MiCA’s most consequential, and most contested, chapter is the one on stablecoins. The rules split them in two. An e-money token tracks a single official currency, so Circle’s USDC and EURC are EMTs. An asset-referenced token points at a basket of currencies, commodities, or other assets. Either way, the issuer must be a licensed bank or e-money institution, must back the token fully with segregated reserves, must redeem at par on demand, and, crucially, may not pay interest or yield to holders.

Scale brings extra scrutiny. Once a token passes certain thresholds, by number of holders, value in issue, or daily transactions, it is designated significant and moves under the direct supervision of the EBA rather than a single national regulator, with tougher capital and liquidity demands attached. Issuers also have to keep reserves segregated from their own money and publish regular attestations, the running proof that every token in circulation is genuinely backed by assets a holder can claim.

There is also a cap aimed squarely at the dollar. A non-euro e-money token used widely as a means of payment must halt new issuance once it crosses roughly one million transactions a day, or 200 million euros in daily payment volume. The intent is written into the law: stop dollar stablecoins from becoming Europe’s default payment rail.

The market shows why Brussels worried. The global stablecoin supply sits near $293 billion, and more than 99% of it is dollar-denominated. Tether’s USDT alone is around $184 billion, and USDC around $74 billion. The largest euro stablecoin, EURC, is under $500 million. Euro tokens, taken together, are a rounding error, well below 1% of the market. The single rulebook built to protect European savers governs a market that is, in practice, priced in dollars.

The clearest proof that the rules bite came on 1 July 2026, when regulated EEA venues finished delisting USDT for retail users. Tether chose not to seek MiCA authorisation; Circle, the first global issuer to comply with MiCA, through a French e-money licence back in 2024, absorbed much of the displaced volume. Tether CEO Paolo Ardoino, explaining why the company refused to apply for a MiCA licence, argued the reserve rules are themselves a risk, because “a bank deposit is not equivalent to immediately available cash.” That objection, as the review would soon show, found an unexpected ally.

Supervision Was Always the Hard Part

Writing the rulebook turned out to be the easy part. Enforcing it the same way across 27 jurisdictions is the real test, and MiCA hands day-to-day supervision to national competent authorities, which is exactly where the fragmentation worry lives. Two developments in 2026 show the EU trying to close the gap.

First, in July 2026 ESMA launched its first Common Supervisory Action under MiCA, a coordinated review of how CASPs handle custody and digital operational resilience. National regulators are now examining the same six areas, from key and storage management and transaction controls to incident response and third-party dependencies, against a shared template, with findings due to ESMA in 2027. It is the first time the EU has looked at crypto custody in lockstep rather than in 27 separate ways, and the failures it is built to catch, exchange hacks, lost keys, and the quiet operational holes that drain user funds, are the ones that have cost the market the most.

Second, and far more political, the Commission’s December 2025 Market Integration and Supervision Package proposed moving authorisation and oversight of the largest CASPs away from national regulators and to ESMA directly. The European Central Bank backed the idea. France, Austria, and Italy had jointly pushed for it. Ireland, Luxembourg, and Malta, the jurisdictions that benefit most from the passport, pushed back. The shorthand in Brussels is blunt: would ESMA become Europe’s version of the United States Securities and Exchange Commission? That question, unresolved, sits underneath every line of the 2026 review.

MiCA also does not sit alone. A compliant CASP has to satisfy a stack of overlapping rulebooks at once: the Digital Operational Resilience Act, known as DORA, for its technology and third-party risk; the Transfer of Funds Regulation, which brings the crypto travel rule into force so that sender and recipient details follow a transaction; and the EU’s broader anti-money-laundering regime, soon to be policed by a new central authority, AMLA, in Frankfurt. For a mid-sized exchange, the licence is only the first of several hurdles, which is part of why so few of the firms that once operated under national regimes made it through to full authorisation.

Market Abuse, Finfluencers, and Fraudulent Websites

MiCA brought a market-abuse regime to crypto for the first time, covering insider dealing, unlawful disclosure of inside information, and market manipulation, with the final tranche of ESMA guidelines applying from July 2026. On paper it mirrors the regime that governs listed securities. In practice, applying it to a market that trades around the clock, full of anonymous wallets, wash trading, and manipulated price feeds, is a different problem. Manipulation that works by feeding a lending protocol a bad oracle price, for example, has already jumped across multiple chains and is hard to pin on any licensed intermediary.

It is also where some of the review’s sharpest requests land. ESMA wants the power to detect, block, and deactivate fraudulent websites and to freeze crypto assets where it suspects market abuse or terrorist financing. It wants stricter marketing rules aimed at influencer promotion, the finfluencer problem, and full cost disclosure before anyone invests. Those are not abstract concerns. Networks of fake trading sites, and the romance-and-investment scams that funnel victims into them, have grown into an industrial business, and today’s rulebook gives supervisors few fast tools to pull a site offline before the money is gone.

Brussels Reopened MiCA on Its Own Schedule

MiCA was built to be reviewed. Article 140 requires the Commission to report on how the regulation is working to the European Parliament and Council by 30 June 2027, and Article 142 asks specifically about market developments the original text did not capture. To feed those reports, the Commission opened a targeted consultation on 20 May 2026, with 86 questions across four blocks, then pushed the deadline from 31 August to 30 September. It closed at 23:59 CEST on 30 September 2026.

The consultation sits inside a wider Brussels drive on competitiveness and simplification, the agenda shaped by the Draghi report on European competitiveness, so two opposite pressures bear down on the same window. Industry wants the compliance burden eased. Supervisors want the gaps closed. Coinbase’s head of policy for Europe, Katie Harries, put the industry view plainly, saying the review should bring “targeted improvements to ensure Europe can combine its strong safeguards with global competitiveness, not a reopening of first principles.”

ESMA Chair Verena Ross has long framed the other side of that argument. Her standing point, made since MiCA’s earliest days, is that rules on the page are not enough on their own: “The MiCA rulebook will only protect investors if it is effectively applied.” The 2026 submissions are where “effectively applied” gets turned into a concrete list of new powers.

What the EU’s Own Regulators Just Asked For

On the final day of the consultation, ESMA filed a 16-page response, reference ESMA75-113276571-1721, under the title “ESMA calls for changes to make MiCA clearer, safer and ready for emerging services.” It is the clearest map yet of where the supervisor thinks the framework falls short.

The asks cluster into five areas. Stronger investor protection: limits on influencer marketing, full cost disclosure, and specific disclosure for staking, lending, and borrowing. Reinforced supervision: the power to block fraudulent websites and freeze suspect crypto assets, tougher action against third-country firms soliciting EU investors, and a bar on regulated firms offering non-compliant stablecoin services. Clearer DeFi and token-classification rules: a new regulated category for providing access to decentralised finance, plus binding ESMA opinions on how a given token is classified. Simplification: streamlined white-paper procedures and fewer duplicate authorisations. And a framework for tokenised securities and on-chain settlement. ESMA argued that the disclosure measures “would provide clearer information on costs, risks, rewards, collateral arrangements, and potential losses” before an investor commits.

The Stablecoin Fight: Even the ECB Wants a Rewrite

The loudest submissions came from the central-banking side. On 22 September the European System of Central Banks, which is the ECB together with the 27 national central banks, filed a 57-page response that went after two of MiCA’s core stablecoin rules.

The first target is the reserve rule. MiCA forces large, “significant” e-money tokens to hold a big share of their reserves, up to 60%, as deposits in banks. The ESCB wants that fixed percentage scrapped and replaced with a liquidity-bucket approach, under which a minimum share of reserves must mature within one working day and a further minimum within five. Its argument is that a fixed deposit block ties a flighty token to a single bank and can transmit a redemption run straight onto bank balance sheets. The irony is hard to miss: this is close to the complaint Tether made when it refused to apply, so the institution that most distrusts private stablecoins is now asking Brussels to loosen the very rule Tether objected to.

The second target is the yield ban. MiCA already bars issuers from paying interest to holders. The ESCB wants that extended to lending, borrowing, staking, and any indirect-return mechanism, and it wants the ban to reach “unregulated services, such as crypto borrowing, lending and staking,” with circumvention “through, for example, tri-party schemes” explicitly closed off. In other words, close the ban on paper and the yield just reappears somewhere MiCA does not look; close every route to it, and a large part of the crypto business model goes with it.

The EBA, which supervises the biggest tokens, filed its own priorities on 24 September. It called third-country multi-issuer schemes, where the same token is issued by both an EU entity and a non-EU one, a source of “significant to very significant risks.” It urged rules for crypto lending, including lending that routes users into DeFi through a licensed firm. And it warned that inconsistent token classification can “result in avoidable costs and delays for firms in product roll-out, impeding innovation and undermining the competitiveness of the EU market.” Crucially, it judged the core token requirements “broadly appropriate,” so the message from the EBA is a tune-up, not a teardown.

The DeFi, Staking, and Lending Gaps

The thread running through every submission is the part of the market MiCA does not yet reach. Decentralised finance is the clearest case. MiCA’s text exempts services provided in a fully decentralised manner without any intermediary, but ESMA and the EBA both note how rarely that is literally true. A front-end, an admin key, a concentrated governance token, a fee switch, or an upgradeable contract usually points back to an identifiable operator. So the carve-out is narrow in theory and close to empty in practice, yet no one is clearly accountable when an oracle is gamed or a protocol is drained.

Staking and lending sit in the same grey zone. Custodial staking offered by an exchange already counts as an ancillary service inside MiCA; non-custodial staking does not. Lending and borrowing are not standalone regulated services at all. That matters, because the yields on those products are what drew retail money in the first place, and because the economics shifted hard in 2026. Once risk-free rates stayed high, much of the premium that made restaking and similar yield products look attractive simply melted away, leaving the risk without the reward. ESMA now wants disclosure duties written specifically for staking, lending, and borrowing, spelling out collateral terms and the plain fact that MiCA’s custody protections vanish the moment an asset is lent out.

MiCA vs the United States, Two Models Diverging

MiCA’s real export value was always the “Brussels effect,” the idea that a first-mover rulebook becomes the global template by default. 2026 tested that, because the United States spent the year pulling in a different direction and then stalling.

On stablecoins, Washington has a law. The GENIUS Act, signed in 2025, built a federal-and-state regime with reserves in cash, insured deposits, and short-dated Treasuries, no yield to holders, and a hard effective date in early 2027, with federal rule-writing still racing to catch up. On market structure, though, the US came up short. The CLARITY Act, which would have divided oversight of crypto between the Securities and Exchange Commission and the Commodity Futures Trading Commission, failed a Senate procedural vote 49 to 50 on 15 September 2026, eleven votes short of the 60 it needed. It was sunk not by the agency split but by a fight over ethics provisions tied to presidential crypto holdings. Prediction markets that had put its chances near 82% earlier in the year collapsed to single digits.

The contrast is now stark. Europe has a comprehensive, binding rulebook that it is choosing to refine. The US has one stablecoin statute, two agencies feeling their way through a March 2026 joint interpretation that payment stablecoins are not securities, and no market-structure law at all. That difference shapes everything from how a token is classified to how an ordinary investor gets exposure: European retail mostly buys crypto through regulated exchange-traded products rather than the US-style spot ETFs, a gap with real custody and tax consequences.

The Road to MiCA 2.0

What happens next is a slow clock, not a switch. The consultation is closed, and the Commission now has to turn thousands of pages of responses into the Article 140 and 142 reports due by 30 June 2027. Those reports may come with a legislative proposal, the thing the industry already calls MiCA 2.0. If they do, it then has to pass the Parliament and Council, which for the original MiCA took years, so any genuinely new rules would realistically land somewhere around 2028 to 2030.

In the meantime the live rulebook keeps biting. The CASP register keeps growing, ESMA’s custody review runs into 2027, the market-abuse guidelines are fully switched on, and the digital euro, the public-money answer to private stablecoins, grinds through its own legislative track toward a possible first issuance near the end of the decade. One theme has run through the whole debate: proportionality, the principle that a small startup should not carry the same compliance load as a global listed exchange, a concern that members of the European Parliament and smaller crypto firms have pressed since the review began. Whether MiCA 2.0 delivers that, or simply bolts on the DeFi, staking, and website-blocking powers its supervisors are asking for, is the fight that just opened.

For now, the headline is simple. After three years of phase-ins and grace periods, MiCA is no longer coming. It is here. And the first thing Europe did once the rulebook was fully live was start arguing about how to change it.

Frequently Asked Questions

Is MiCA fully in force in 2026?

Yes. MiCA’s stablecoin rules for asset-referenced and e-money tokens applied from 30 June 2024, and the rules for crypto-asset service providers from 30 December 2024. The transitional grandfathering period ended by 1 July 2026 in most large member states, so any firm serving EU clients now needs a CASP authorisation or must wind down.

What is the difference between an EMT and an ART under MiCA?

An e-money token (EMT) tracks a single official currency, such as USDC for the dollar or EURC for the euro. An asset-referenced token (ART) references a basket of currencies, commodities, or other assets. Both must be issued by a licensed entity, fully backed by reserves, redeemable at par, and may not pay interest to holders.

Why did Tether’s USDT leave EU exchanges?

Tether chose not to seek MiCA authorisation, in part over the reserve rules, so regulated EEA venues delisted USDT for retail users from 1 July 2026. Circle’s USDC and EURC, which are MiCA-compliant, absorbed much of that displaced trading volume.

What is the MiCA review and when could it change the rules?

The European Commission ran a targeted consultation that closed on 30 September 2026. It must report to the Parliament and Council by 30 June 2027, and that report can carry a legislative proposal, often called MiCA 2.0. Any actual rule change would take effect later, most likely around 2028 to 2030.

Does MiCA cover DeFi and crypto derivatives?

Mostly no. MiCA regulates identifiable intermediaries, so fully decentralised protocols fall outside it, and crypto derivatives such as perpetual futures are financial instruments under MiFID II rather than MiCA. ESMA has asked for new rules to cover access to DeFi, staking, and lending in the next revision.

Anneke de Vries is HOGE Wire’s regulation lead, covering MiCA, EU crypto supervision, and the stablecoin rulebooks on both sides of the Atlantic.