What Happens to a Crypto-Asset Service Provider That Missed MiCA's 1 July 2026 Transitional Deadline?

There is no such thing as a "mid-application" crypto firm in Europe any more.

That status existed for eighteen months. It ended on 1 July 2026, and it did not roll over for anyone whose file was still sitting on a supervisor's desk.

Eleven weeks on, the useful question for a board is not when the authorisation lands. It is what the firm has been doing since the date passed, and what the supervisor can do about it.

What exactly did MiCA Article 143(3) allow, and what ended on 1 July 2026?

The transitional regime for crypto-asset service providers was one sentence with an outer limit and a trapdoor.

Article 143(3) says that crypto-asset service providers "that provided their services in accordance with applicable law before 30 December 2024, may continue to do so until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63, whichever is sooner."

The entry condition looks backwards. You had to have been providing services lawfully, under whatever national framework applied, before 30 December 2024. A firm that opened in January 2025 was never inside the regime.

The outer limit is a fixed calendar date. Not a renewal date, not a licence anniversary.

The trapdoor is "whichever is sooner". A refusal ends cover the day it is issued. So does a grant, because the Article 63 authorisation then replaces the transitional permission.

Then the part a lot of firms found late. The second subparagraph let Member States decide not to apply the transitional regime at all, or to reduce its duration, where they considered their national framework before 30 December 2024 less strict than MiCA. They had to notify the Commission and ESMA by 30 June 2024 whether they had used that option, and how long their regime would run.

So 1 July 2026 was the ceiling, not the answer. Your real cut-off was whatever your home Member State notified, and in some jurisdictions it fell earlier. MiCA does not tell you which one you are in. National law does.

Does a pending Article 63 application still cover you after 1 July 2026?

No.

This is the most expensive misreading of the provision. It imports an instinct that holds in other licensing regimes: file in time and the clock stops.

Article 143(3) has no such mechanism. It gives you the earlier of a date and a decision. It does not give you the later of the two. A complete application sitting with an authority still consulting supervisors in another Member State extends nothing.

Three outcomes, and only three.

Granted before 1 July 2026: you operate on the Article 63 authorisation, and Article 143(3) is spent.

Refused before 1 July 2026: cover ended on the refusal, earlier than the date.

Neither: the permission expired on the date and there is nothing underneath it.

What the firm falls back into is Article 59(1): a person shall not provide crypto-asset services within the Union unless authorised as a crypto-asset service provider in accordance with Article 63, or allowed to provide them under Article 60.

There is no third category. A firm in the "neither" bucket that kept serving clients on 2 July 2026 was providing crypto-asset services without authorisation, and still is unless the decision has since landed.

Why is the Article 143(6) simplified national route closed, and what does it not excuse?

Article 143(6) allowed Member States, by way of derogation from Articles 62 and 63, to run a simplified authorisation procedure. It was never open to everyone, and it is not open now.

Two conditions, both hard. The application had to be submitted between 30 December 2024 and 1 July 2026. The applicant had to have been, on 30 December 2024, authorised under national law to provide crypto-asset services.

Miss either and the route was unavailable from the start. Both windows have now shut, so anything filed from here runs through Articles 62 and 63 in full.

The point that matters more concerns firms that did use it. Simplified is a procedural derogation, not a substantive discount. The same paragraph requires that "the competent authorities shall ensure that Chapters 2 and 3 of Title V are complied with before granting authorisation pursuant to such simplified procedures."

Those two chapters are the whole operating book. Chapter 2, Articles 66 to 74, binds every provider: acting honestly, fairly and professionally in clients' best interests, prudential safeguards, governance, safekeeping of clients' crypto-assets and funds, complaints handling, conflicts of interest, outsourcing, orderly wind-down. Chapter 3, Articles 75 to 82, attaches per service: custody, trading platform operation, exchange, execution, placing, reception and transmission, advice and portfolio management, transfers.

A firm authorised through the simplified route carries the same obligations as one that went the long way. If the file was assembled for speed, the difference does not show at authorisation. It shows at the first supervisory review.

Which firms never relied on the transitional regime at all under Articles 59 and 60?

Part of the market watched 1 July 2026 pass without exposure, because it was never inside Article 143(3).

Article 59(1)(b) names them: credit institutions, central securities depositories, investment firms, market operators, electronic money institutions, UCITS management companies and alternative investment fund managers. They provide crypto-asset services under Article 60, not under an Article 63 authorisation.

Article 60 is a notification route. Each entity type notifies the competent authority of its home Member State at least 40 working days before providing the services for the first time, submitting the Article 60(7) information: programme of operations, AML internal controls and risk assessment framework, business continuity plan, ICT systems and security documentation, client asset segregation procedure, and the service-specific descriptions.

Scope is bounded by the existing licence. An investment firm may provide crypto-asset services equivalent to the investment services for which it is specifically authorised under Directive 2014/65/EU. A central securities depository is confined to custody and administration on behalf of clients. An electronic money institution is confined to custody, administration and transfer services, and only for the e-money tokens it issues.

Article 60(8) then gives the authority 20 working days to assess whether the notification is complete, and states that the entity "shall not begin providing the crypto-asset services as long as the notification is incomplete". A notification sent is not a notification effective.

Article 60(10) exempts these entities from Articles 62, 63, 64, 67, 83 and 84. But Article 60(11) revokes the right the moment the underlying authorisation that enabled it is withdrawn. That dependency belongs mapped against the rest of your licence estate on the platform, not in a separate spreadsheet.

What must an Article 62 application contain, and how long does Article 63 give the competent authority to decide?

Article 62(2) is a build, not a form. Nineteen items, including a programme of operations, proof of the Article 67 prudential safeguards, governance arrangements, proof that management body members are of sufficiently good repute with the appropriate knowledge, skills and experience, the identity and repute of direct and indirect qualifying holders, internal control and risk management including money laundering risk, business continuity, ICT systems and security documentation, client asset segregation, and complaints handling. Then a service-by-service layer: custody policy, trading platform operating rules and market abuse detection, commercial policy and pricing methodology, execution policy, adviser competence evidence, and transfer service arrangements.

Article 62(3) sets the proof standard for the people: absence of criminal record and of penalties under commercial, insolvency and financial services law, or relating to anti-money laundering, counter-terrorist financing, fraud or professional liability.

One clause saves real time. Article 62(4) stops competent authorities requiring information they already received under Directive 2009/110/EC, 2014/65/EU or (EU) 2015/2366, or under national law applicable to crypto-asset services prior to 29 June 2023, provided it is still up to date. Firms that held a national crypto registration can point at what the regulator already holds. Most do not, because nobody mapped what was filed where.

The Article 63 clocks are precise.

→ 5 working days to acknowledge receipt in writing → 25 working days to assess whether the application is complete → 40 working days from a complete application to a fully reasoned decision granting or refusing → 5 working days from that decision to notify the applicant → 2 working days from a grant to communicate the register information to ESMA

The 40 working days runs from completeness, not from filing. Article 63(3) lets the authority refuse to review an application still incomplete after the deadline it set. Article 63(12) allows one further information request, no later than the 20th working day of the assessment period, suspending it for up to 20 working days.

Stack those and a smooth application is months. A contested one is longer. That arithmetic was the whole argument for filing early, and it is why eleven weeks of exposure is not a rounding error.

What can a competent authority do under Article 94 to a firm still providing crypto-asset services without authorisation?

The most direct power is Article 94(1)(h). Where there is reason to assume that a person is providing crypto-asset services without authorisation, the competent authority may order the immediate cessation of the activity "without prior warning or imposition of a deadline".

Read the trigger. Reason to assume. Not proof, not a finding, not a concluded investigation.

The surrounding powers fill in the rest. Article 94(1)(b) allows an authority to suspend, or require a provider to suspend, crypto-asset services for a maximum of 30 consecutive working days on any single occasion where there are reasonable grounds for suspecting an infringement. Article 94(1)(c) allows outright prohibition where an infringement is found. Article 94(1)(e) allows the authority to make public the fact that a provider fails to fulfil its obligations.

Administrative penalties sit one layer down. Article 111 requires Member States to give competent authorities the power to impose administrative penalties and other measures, and Article 111(1)(d) lists infringements of Articles 59, 60, 64 and 65 to 83 among the triggers. The figures live in national law, so the exposure is jurisdiction-specific and has to be read locally.

There is also a quieter breach firms walk into while waiting. Article 59(5) states that a person who is not a crypto-asset service provider shall not use a name, or a corporate name, or issue marketing communications or undertake any other process suggesting that it is one. A website still describing the firm as a regulated crypto-asset service provider is its own problem, separate from the services question.

Once authorised, what keeps the file current under Articles 59(4), 59(8) and 65?

Authorisation is a state, not an event.

Article 59(4) requires providers authorised under Article 63 to meet the conditions for their authorisation at all times. Article 59(2) locates the firm: registered office in a Member State where it carries out at least part of its services, place of effective management in the Union, at least one director resident in the Union.

Article 59(6) requires the authorisation to specify which services the provider may provide, so adding a service is a regulatory act, not a product launch. Article 59(8) requires a firm adding services to request an extension from the authority that granted the initial authorisation, by complementing and updating the Article 62 information. That request is processed under Article 63, so the same clocks apply again.

Cross-border has its own file. Article 65(1) requires a provider intending to operate in more than one Member State to submit the list of Member States, the services concerned, the starting date, and a list of all other activities it provides that MiCA does not cover. Article 69 requires notification of management body changes without delay, before any new member exercises activities. Article 73 keeps the firm fully responsible for its obligations where operational functions are outsourced, which makes third-party risk part of the authorisation file rather than a separate discipline.

The authorisation can also go the other way. Article 64(1) requires withdrawal where a provider has not used its authorisation within 12 months, has not provided crypto-asset services for nine consecutive months, obtained authorisation by irregular means such as false statements in the application, or no longer meets the conditions and has not taken the remedial action requested within the specified timeframe.

Every one of those is a dated obligation with an owner. Holding them as a list of article numbers is how firms lost the transitional window in the first place. Holding them as live risk and obligation state, each traced to the clause that creates it, is the difference between knowing your position and reconstructing it after a supervisor asks.

At Aigis GRC every obligation is traced to a verbatim quote from the legal text, across 295+ regulations in 34 jurisdictions. One organisational profile, deterministic mapping, and a posture you can defend in front of a regulator, a board, or a plaintiff.

Answer once. Assess everything. → agrc.ai

FAQ: MiCA CASP authorisation after the transitional regime

Did filing an Article 62 application before 1 July 2026 extend the transitional regime?

No. Article 143(3) allowed continued provision until 1 July 2026 or until authorisation was granted or refused under Article 63, whichever is sooner. A pending application is neither a grant nor a refusal, and the date applied regardless.

Could my cut-off have been earlier than 1 July 2026?

Yes. Article 143(3) let Member States decline the transitional regime or reduce its duration where they considered their pre-30 December 2024 national framework less strict than MiCA, and required notification to the Commission and ESMA by 30 June 2024. Check your home Member State rather than assuming the outer limit.

Is the MiCA simplified procedure still available?

No. Article 143(6) limited it to applications submitted between 30 December 2024 and 1 July 2026 by entities authorised under national law to provide crypto-asset services on 30 December 2024. Both conditions are now impossible to satisfy.

How long does a competent authority have to decide an Article 63 authorisation?

40 working days from receipt of a complete application, preceded by a 5 working day acknowledgement and a 25 working day completeness assessment, with one permitted information request no later than the 20th working day that suspends the clock for up to 20 working days.