ESMA tells unauthorised crypto firms to wind down as MiCA window closes

What happened

On 23 June 2026, ESMA (the European Securities and Markets Authority) called on unauthorised crypto-asset service providers (CASPs) to wind down their EU activities in an orderly manner. The trigger is a hard date. The transitional period under MiCA (the EU Markets in Crypto-Assets Regulation) ends on 1 July 2026.

ESMA set clear expectations for the wind-down. Unauthorised CASPs should immediately stop onboarding new EU clients, open no new client relationships or accounts, and cease all marketing and solicitation. Services should be limited to what clients need to sell or transfer crypto-assets, reallocate assets, or close positions.

The wind-down is not a compliance holiday. ESMA expects these firms to keep AML (anti-money laundering) and CFT (countering the financing of terrorism) controls fully operational throughout. That means continued customer due diligence, transaction monitoring, screening against sanctions and restrictive-measures lists, suspicious transaction and activity reporting, recordkeeping, and Travel Rule traceability. The Travel Rule requires firms to attach and pass on originator and beneficiary information when crypto-assets move between providers, so transfers stay traceable.

ESMA also addressed clients directly. Customers of unauthorised CASPs do not benefit from MiCA safeguards, including client-asset protections. ESMA invited them to check the ESMA Register and to act promptly, moving crypto-assets to an authorised CASP or a self-hosted wallet.

Why it matters

Read this as an AML event, not just a licensing one. A firm being pushed out of the market still holds client funds and crypto-assets, and the moment of exit is exactly when those assets move. Wind-downs concentrate outflows into a short window, which is precisely the condition that strains a monitoring team.

The risk sits at the boundary. A winding-down CASP transferring client positions creates a surge of outbound transfers, some to authorised firms, some to self-hosted wallets that sever the audit trail. ESMA’s insistence on Travel Rule compliance during the wind-down signals where it expects traceability to break. That is the analytical tell worth noting.

A supervisory backdrop reinforces the timing. From 1 January 2026, EU-level AML and CFT tasks moved from the EBA (European Banking Authority) to AMLA (the EU Authority for Anti-Money Laundering), which will directly supervise the largest cross-border crypto firms. A public statement with a fixed deadline tends to precede coordinated action. Firms still operating without authorisation after 1 July should expect attention.

Practitioner angle

• Identify which of your CASP counterparties are unauthorised, and map your exposure to each before 1 July. Treat the list as a live screening input, not a one-off check.
• Watch the fiat off-ramp. A winding-down CASP moving client funds will route value back into the banking system, so flag inbound flows from firms you know are exiting and apply enhanced scrutiny.
• Confirm that every CASP you rely on appears in the ESMA Register. If a counterparty is not listed, escalate it now rather than after the deadline.
• Tune transaction monitoring for the wind-down pattern: clustered outbound transfers, large reallocations, and movements to self-hosted wallets where the Travel Rule trail ends.
• Expect coordinated supervisory action after 1 July, and keep your records clean enough to show you spotted the exposure early.

Before 1 July, name your unauthorised CASP counterparties and price the exposure. That single step turns a regulatory deadline into a managed risk.