Only 281 of 1,343 crypto service providers operating across the European Economic Area have secured MiCA authorization after the EU’s final transition period expired on July 1, leaving more than 1,000 firms without approval under the bloc’s licensing regime.
According to blockchain intelligence firm TRM Labs, 1,062 firms in its dataset had not obtained authorization under the Markets in Crypto-Assets Regulation by the deadline and must now leave the market, restructure their operations or transfer customers to an authorized provider.
The gap extends beyond licensing. TRM found that 12% of firms without authorization carry a High or Severe risk rating, compared with 2% of authorized providers, while every firm assigned a Severe rating belonged to the unauthorized group.
Most providers in both groups have little direct contact with illicit funds. However, TRM identified a small number of unauthorized firms sending between 1% and 12% of their volume directly to illicit addresses. No authorized provider recorded direct illicit exposure above 1%.
MiCA authorization has left more than 1,000 firms outside the regime
Before MiCA, crypto companies operated under separate registration or licensing systems maintained by individual European countries, creating major differences in the requirements firms faced depending on where they registered.
TRM identified 383 operating firms under Lithuania’s previous registration system and 241 in Poland. Poland’s official register contained more than 1,800 entries, although the blockchain intelligence firm said most showed no observable crypto activity.
At the other end, Slovenia had three identified providers and Belgium had two. TRM cautioned that its figures track firms it could identify as actually providing crypto services rather than every entry on national registers, meaning countries without public registers may be undercounted.
MiCA replaced the national systems with a common authorization framework. Companies legally operating before Dec. 30, 2024, could continue under Article 143(3) while seeking authorization during the transition period, with July 1 serving as the final EU-wide cutoff.
As crypto.news explained shortly before the deadline, individual member states were allowed to set shorter transition periods, but none could extend the grandfathering system beyond July 1. Firms without the required authorization after their applicable deadline could no longer legally provide covered crypto services in the EU.
Licensing numbers had already shown how much the market could contract. In May, the ESMA register contained 204 authorized CASPs, including 51 approved during the first five months of 2026. Germany accounted for 55 at the time, followed by the Netherlands with 25 and France with 17.
A separate June report found that more than 3,000 crypto firms had been registered across Europe before MiCA, while only 194 had secured authorization by May. Hogan Lovells estimated at the time that roughly 75% of firms registered under the previous systems could lose their status as national transition periods expired.
Germany and smaller EU states have taken more firms through MiCA
Authorization has been uneven across individual European jurisdictions, according to TRM’s July 1 dataset.
Germany authorized 55 firms, while France and the Netherlands each authorized 29. Malta approved 20 and Cyprus 19, compared with nine home authorizations issued by Italy despite 145 firms operating there.
Malta, Cyprus, Ireland and Luxembourg together accounted for 63 of 272 home authorizations identified by TRM, even though only 101 operating firms came from their previous registers.
Lithuania produced a very different conversion rate. Eight firms obtained authorization from a previous register containing more than 400 providers, while Poland issued none despite its old register exceeding 1,800 entries. Greece and Portugal also issued no home authorizations in TRM’s dataset.
The figures also show how MiCA’s passporting system can separate where a provider operates from which regulator supervises it. Germany’s BaFin authorized 55 of the 57 licensed providers operating in the country, while Italy hosted 37 licensed firms but issued nine home authorizations. Spain hosted 34 and authorized 12.
Under MiCA, a CASP approved in one member state can use passporting rights to provide covered services elsewhere in the bloc. For example, B2C2 secured Luxembourg authorization in May, allowing the liquidity provider to offer regulated over-the-counter spot crypto trading across all 27 EU member states and three additional EEA markets.
The same system has allowed firms including Coinbase, Bitpanda and Kraken to operate from different regulatory bases while serving customers across multiple European markets.
By July 3, ESMA’s interim register had expanded to 300 authorized crypto-asset service providers after 57 additional firms were added around the July 1 deadline, including Standard Chartered and FalconX.
Unauthorized firms carry higher risk ratings and sanctions exposure
Looking beyond license numbers, TRM found a clear difference in the risk profiles of the two groups.
About 12% of unauthorized firms received a High or Severe rating, six times the 2% recorded among authorized providers. Severe ratings were found exclusively among firms that failed to obtain authorization.
Direct exposure to illicit or high-risk counterparties was much closer when measured across each group as a whole. Unauthorized providers recorded 0.09% of outgoing volume directly involving such counterparties, compared with 0.07% among licensed firms.
High-risk exchanges and gambling services accounted for the largest exposures. Unauthorized firms sent $19 billion to high-risk exchanges and $15.3 billion to gambling services, while authorized providers recorded $14.2 billion and $13.4 billion, respectively.
Sanctions exposure produced a larger difference. TRM calculated that unauthorized firms sent $5 billion directly to sanctioned counterparties, roughly three times the $1.7 billion recorded among authorized firms.
Risk within the unauthorized group was heavily concentrated. Half of the firms showed no measurable direct illicit exposure, while a limited number sent between 1% and 12% of their volume directly to illicit addresses. TRM calculated that direct illicit exposure among the offboarding firms was about four times higher because of those outliers.
The unauthorized cohort also included HTX, which TRM described as a designated exchange, and Huione Pay, which has been named under U.S. special measures. Entities affected by EU measures restricting dealings connected to Russia were also among firms that held national registrations but did not obtain MiCA authorization.
The composition of the two groups differed as well. Exchanges accounted for 42% of unauthorized providers compared with 29% of authorized firms, while payment companies represented 16% and 9%, respectively.
Financial and investment service providers were more common among authorized CASPs, making up 25% and 21% of the group, compared with 9% and 7% among unauthorized firms. TRM’s High-Risk Exchange category appeared only among providers that did not obtain authorization.
Customer transfers are creating a new supervisory test
With more than 1,000 firms outside the authorization regime, the EU’s Anti-Money Laundering Authority has focused on what happens when their customers and assets move elsewhere.
AMLA said the end of the transition period would cause unauthorized virtual asset service providers to leave the market, customer relationships to be transferred or terminated, and crypto activity to become concentrated among fewer authorized CASPs.
During wind-downs, compressed exit schedules can place pressure on anti-money laundering controls and make it harder to track where customers and funds move, according to the authority. Receiving CASPs can simultaneously face changes in their customer risk profiles and additional demands on transaction monitoring systems.
AMLA has therefore asked supervisors to prioritize oversight of exit plans and customer transfers while coordinating with regulators in other jurisdictions when customers move across borders.
TRM identified 30 unauthorized providers with High or Severe risk ratings, giving receiving firms and supervisors a group that can be screened before customer migrations take place.
The firm also cautioned against treating all customers leaving unauthorized providers as equally risky. Most firms that failed to secure authorization still carried Low risk ratings and recorded negligible direct illicit exposure.
For receiving CASPs, TRM said entity-level screening can distinguish customers arriving from a Low-rated payment provider with little illicit exposure from those leaving a Severe-rated entity where a measurable share of transaction volume has moved directly to illicit addresses.
Regulators have also started examining authorized providers after completing much of the initial licensing work. In July, ESMA launched a review of a sample of MiCA-authorized crypto custodians, examining areas including custody controls, private-key management, incident response and risks tied to third-party providers.
TRM separately examined whether regulators issuing more licenses were also supervising firms with higher illicit exposure. Across 23 jurisdictions where licensed providers carried measurable transaction volume, it found no identified correlation between the number of authorizations issued and the illicit exposure of firms supervised there.
For financial institutions assessing counterparties, TRM said the number of CASP licenses granted by a firm’s home jurisdiction therefore provides little information about the individual provider’s risk. Its analysis instead found the differences at entity level, including individual risk ratings and direct exposure to illicit, sanctioned and other high-risk counterparties.
