The MiCA transition is over. Is your payment provider still allowed to serve you?

By Venly Finance | July 6, 2026

The MiCA transitional period ended July 1, 2026. Only ~17% of VASP-registered firms became authorized CASPs. Here's what it means for your payment stack — and the diligence questions to ask any provider.

On July 1, 2026, the MiCA transitional period ended. Of the 1,200+ firms that operated under national VASP registrations, only around 210 — roughly 17% — held a full CASP authorization when the window closed, according to Elliptic. Everyone else must stop providing crypto-asset services to EU clients and execute a wind-down plan.

If your payout or settlement provider was one of the other 83%, that's now your problem too.

What ESMA actually said

ESMA's April 17, 2026 statement was unusually direct. Firms without authorization must cease EU services. National regulators are expected to enforce, with penalties reaching €5 million or 5% of annual turnover. Non-EU firms cannot serve EU clients through B2B arrangements that route around the requirement, and ESMA specifically flagged outsourcing and delegation structures that push EU activity through non-EU entities.

One distinction matters most for operators: ESMA drew a line between pass-through arrangements — where an unauthorized firm effectively provides the service and a licensed entity just fronts it — and genuine commercial partnerships, where the authorized institution is the actual contracting party, carries the regulatory obligations, and performs the regulated activity. The first doesn't survive scrutiny. The second does.

The diligence questions to ask this month

If you move meaningful volume through any crypto-asset service provider, ask these five questions now:

Who is my contract with? If the answer is an unauthorized entity with a licensed partner "somewhere in the stack," ask how the roles are split. The regulated activity must sit with the authorized institution.

Which entity holds client assets? Custody of crypto-assets for EU clients is a CASP activity. Get the entity name and its authorization status in writing.

What happens to in-flight funds if the provider winds down? Wind-down plans are now mandatory for unauthorized firms. Ask to see the client-asset provisions.

Is my provider's authorization pending, and where? A pending application is not an authorization. But a provider that is transparent about its status, names its licensed partners, and can show you the contractual structure is in a different category from one that goes quiet when you ask.

Does the marketing match the paperwork? If the website says "regulated" and the contract says otherwise, believe the contract.

Where we stand

We'll apply our own test to ourselves. Venly Finance's Polish VASP registration no longer authorizes operations on its own — that regime ended with the transition. Our MiCA authorization is in progress. Today, regulated services on our platform are delivered through genuine partnerships with licensed financial institutions: they are the contracting party for the regulated activity, and we provide the technology — wallet infrastructure, settlement software, and the API layer.

For customers who hold their own permissions (CASP, MSB, PI), the model inverts: you're the regulated entity, we're your technology provider, and wallets run self-custody on your keys.

We think that transparency is the only sustainable position after July 1. The firms that spent the transition period blurring the line between "registered" and "authorized" are the ones ESMA wrote its statement about.

FAQ

What happened on July 1, 2026? The MiCA transitional ("grandfathering") period ended in the last member states. Firms without CASP authorization must cease providing crypto-asset services to EU clients.

Can a non-EU provider still serve EU businesses? Not for in-scope crypto-asset services. ESMA stated the prohibition applies even to B2B arrangements.

Is a partner-based model compliant? It can be — if the authorized partner genuinely provides the regulated service and is the contracting party. Pass-through white-labeling of an unauthorized provider's service is what regulators have flagged.

Does Venly have a MiCA license? Our authorization is in progress. Regulated services are currently delivered through licensed partner institutions; technology-provider and self-custody models are available for licensed customers.

This article is general information, not legal advice. Assess your own arrangements with counsel.