MiCA One Year On: What Enforcement Actually Looks Like

3. The compliant issuer cohort

The set of fully MiCA-compliant EMT issuers operating at meaningful scale is small. Circle's two products — USDC (issued via Circle Mint Europe, the French EMT-licensed entity) and EURC — are the largest by combined supply, with USDC at approximately $74B globally and EURC at €5.6B. Société Générale-FORGE's EURCV has crossed €1.8B and is the largest bank-issued euro stablecoin. Banking Circle, the Luxembourg-licensed payments bank, operates a multi-currency EMT product that is primarily institutional. Membrane Finance's EUROe is a smaller Finland-licensed product (€280M) targeted at retail and small-business use. Quantoz Payments operates EURQ and USDQ as Netherlands-licensed EMTs. Paxos's EU-domiciled affiliate (Paxos Issuance Europe) provides EMT services for a small group of distribution partners. The notable absence is any issuer attempting a fully decentralized, multi-jurisdictional EMT — MiCA's structure makes this functionally impossible because the EMT category requires a single legally identifiable issuer with capital, governance, and reserve obligations. MakerDAO/Sky has not pursued an EMT license; DAI and USDS are accessible to EU users only via informal channels and are not listed as compliant tokens on any MiCA-licensed CASP. This produces the structural outcome that the EU stablecoin market is materially less innovative than the US or offshore markets — a tradeoff the EU policy community has explicitly accepted.

4. CASP licensing and the passport problem

The CASP licensing regime under Title V has produced approximately 185 authorizations across 20 member states as of late April 2026. The largest cohort by far is in Germany (roughly 50 authorizations, under BaFin), followed by the Netherlands (around 23, under DNB), with France (around 13, under the AMF, building on its pre-MiCA PSAN regime), Malta (around 13, under the MFSA), and Ireland (around 11, under the Central Bank of Ireland) forming the next tier, ahead of a long tail of smaller member states. The major exchanges — Binance, Coinbase, Kraken, Bitstamp, Bitpanda, OKX, Crypto.com — have all been licensed, mostly in Germany, the Netherlands, Malta, or Ireland, and have notified passports across the EEA. The passport problem: in theory a license issued by one NCA grants the right to provide services across the EEA. In practice, host-state regulators have invoked local consumer protection law, marketing restrictions, and pre-licensing notification requirements to slow or effectively block passporting in at least 14 documented cases. Italy's CONSOB has been particularly active here, citing the Italian implementing legislation's additional disclosure requirements. The Spanish CNMV has imposed advertising restrictions that effectively prevent Irish-passported CASPs from marketing to Spanish retail users without local establishment. ESMA has flagged this fragmentation in its December 2025 supervisory convergence report but has not taken substantive action; the structural reality is that CASP passporting is more friction-laden than originally designed.

5. Enforcement: notices, settlements, sanctions

Formal enforcement under MiCA has been measured. ESMA, in its coordinating role, has issued nine supervisory letters to national competent authorities flagging enforcement priorities — most concerning marketing standards under Title VI and reserve attestation timeliness under Title IV. National competent authorities have collectively issued 37 formal notices to licensed entities since June 2024, of which 28 have been resolved through remediation without financial penalty, 6 are in active supervisory dialogue, and 3 have escalated to substantive enforcement actions with monetary sanctions. The three substantive actions: BaFin imposed a €4.2M penalty on a German CASP for inadequate AML controls in late 2025; the AMF imposed a €1.8M penalty on a French CASP for misleading marketing of yield-bearing products; the Central Bank of Ireland imposed a €3.5M penalty on an Irish CASP for material misstatement of reserve composition. The relative rarity of substantive enforcement is a feature, not a bug, of the supervisory model — NCAs prefer supervisory dialogue to enforcement when remediation is achievable, and the licensed cohort has been broadly cooperative. The harder enforcement question concerns unlicensed activity: ESMA estimates that approximately 12% of crypto trading volume by EU users still flows through unlicensed offshore venues, and the cross-border enforcement tools are limited. The expected response in 2026 is increased coordination with payments-system gatekeepers (banks, card networks) to constrain fiat on-ramps to unlicensed venues, rather than direct enforcement against the venues themselves.

6. The DeFi ambiguity

The most consequentially unresolved question in MiCA's operational life is the treatment of DeFi protocols. Recital 22 explicitly states that 'fully decentralised' crypto-asset services should not be in scope, but the operative provisions of Title V do not define decentralisation, and the 2025 ESMA guidance on the question is non-binding. In practice, three positions have emerged among national competent authorities. The French AMF takes the view that any protocol with identifiable governance — a token with voting rights, a foundation, a development team capable of upgrading contracts — is potentially in scope as a CASP if it provides services to EU users. The German BaFin takes a more permissive view but has indicated that front-end interfaces operated by identifiable entities are in scope even if the underlying protocol is decentralised. The Central Bank of Ireland has been notably hands-off, which has made Ireland the de facto home of EU-active DeFi front-ends. The Spanish CNMV has issued informational notices to several front-end operators without formal enforcement. The structural problem: every DeFi protocol of meaningful size has at least some identifiable points of centralisation (governance tokens, foundations, named developers, front-end maintainers), and the question of whether those points trigger CASP obligations is unresolved. ESMA is expected to publish more detailed guidance in Q3 2026, but a fully clarifying outcome before the planned 2027 MiCA review is unlikely. The practical effect is that EU-active DeFi front-ends operate in a regulatory grey zone, with most major protocols geo-blocking EU IPs from front-ends as a precaution while leaving the underlying contracts accessible.

7. NFT scope and the residual ambiguity

NFTs were carved out of MiCA's main scope on the theory that genuinely unique, non-fungible assets are not crypto-assets in the regulated sense. But the carve-out is qualified: tokens that are 'fungible in practice' even if technically non-fungible are in scope, and the assessment is to be made by national competent authorities. In practice, the assessment has narrowed: PFP collections (10,000+ units of broadly equivalent assets), generative art at scale, and gaming items with active secondary markets are increasingly being treated as crypto-assets, requiring marketplaces that deal in them to hold CASP licenses. One-of-a-kind digital art and genuinely unique tokens (a single tokenised real-world asset, a unique gaming achievement) remain out of scope. The major NFT marketplaces — OpenSea, Blur, Magic Eden, LooksRare — have responded by either obtaining CASP licenses (OpenSea has a Dutch license, Magic Eden has a French license) or restricting EU access for collections that are likely to be classified as fungible-in-practice. The aggregate NFT trading volume from EU users has declined approximately 40% from its 2023 peak, partially regulatory-driven and partially reflecting the broader contraction in the NFT market.

8. What's still open and the 2027 review

MiCA contains a built-in review mechanism: the European Commission is required to assess the regulation's operation by mid-2027 and propose amendments where warranted. The expected agenda for that review: clarification of DeFi treatment, possibly a new title or sub-title; reconsideration of the prohibition on EMT yield-bearing (which is preventing EU users from accessing products like sUSDe and is widely seen as a competitive disadvantage versus US and offshore frameworks); refinement of the ART framework (which has effectively gone unused); and harmonisation of cross-border CASP supervision to reduce passporting friction. The political economy of the review is contested: a coalition of member states (France, Germany, the Netherlands) generally favours tightening, while others (Ireland, Luxembourg, Cyprus) generally favour permissiveness or status quo. Industry positioning is split between large compliant issuers (who broadly support the current framework as it disadvantages competitors) and DeFi-adjacent voices (who advocate for a clearer carve-out). Our base case is that the 2027 review produces incremental amendments rather than substantive overhaul; the EMT yield prohibition is the single provision most likely to be materially relaxed, given the visible competitive disadvantage it creates.

Conclusions

Eighteen months into MiCA's operational life, the regulation has done more than its critics warned and less than its proponents promised. It has successfully created a regulated EU stablecoin market with measurable transparency improvements; it has licensed the major venue cohort and produced workable cross-border distribution despite friction; it has driven non-compliant tokens out of the regulated retail venue stack. It has not — yet — produced a coherent treatment of DeFi, has not made meaningful use of the ART framework, and has accepted a competitive disadvantage on yield-bearing products that the 2027 review will need to address. The deeper lesson is methodological: MiCA's bite came not from headline enforcement actions but from licensed venues anticipating supervisory exposure and adjusting their listing decisions accordingly. This is the model regulators in other jurisdictions — including the GENIUS Act framework in the US — are studying closely, and it suggests that the future of crypto regulation lies less in direct enforcement against non-compliant issuers and more in supervisory architecture that aligns the incentives of licensed intermediaries with the policy objective.