What happened
The Malta Financial Services Authority (MFSA) has relayed a statement from the European Securities and Markets Authority (ESMA) calling on unauthorised crypto-asset service providers (CASPs) to wind down their activities in an orderly manner, while safeguarding clients’ interests, as the MiCA transitional period ends. In short, the grandfathering window that allowed certain providers to continue operating while seeking full authorisation is closing, and ESMA expects firms without authorisation to stop providing in-scope services.
What it means in practice
The message is unambiguous: from the close of the transitional period, providing crypto-asset services in the EU without the required CASP authorisation under MiCA is no longer permissible. ESMA’s emphasis on an orderly wind-down and on safeguarding clients’ interests signals that supervisors expect more than a simple cessation of trading. Firms that have not secured authorisation are being directed to exit the market in a controlled way that protects customers — rather than abruptly shutting down or continuing to operate in a grey zone.
For Malta specifically, this matters because the jurisdiction was an early mover in regulating the sector and many operators have been navigating the shift from national arrangements to the harmonised MiCA regime. The MFSA’s decision to amplify ESMA’s call confirms that local supervisory expectations are fully aligned with the EU position. There is no parallel track: the path to legitimate operation runs through a MiCA CASP authorisation.
Two distinct populations of firms
- Authorised CASPs: Firms that have obtained authorisation can continue to operate and passport services across the EU. They should ensure ongoing compliance with their permissions and conduct obligations.
- Unauthorised providers: Firms still operating without authorisation as the transitional period ends are the direct subject of ESMA’s call. They must plan and execute an orderly wind-down, with client protection at the centre.
Implications for applicants and licensees
If your business is mid-application, the practical takeaway is that timing is now critical. Reliance on transitional arrangements is no longer a viable operating strategy once the period has elapsed. Where authorisation has not been granted, continuing to serve clients exposes the business to enforcement risk and reputational damage — and runs counter to the explicit expectations set out by ESMA and reinforced by the MFSA.
For firms that are already authorised, ESMA’s intervention is a reminder that supervisors are actively policing the perimeter. A cleaner, more clearly regulated market benefits compliant operators, but it also raises the bar: conduct, client-asset safeguarding, and ongoing reporting will remain under close scrutiny.
Concrete next steps to consider
- Confirm your status. Establish precisely whether your activities fall within MiCA’s scope and whether you currently hold the necessary authorisation.
- If unauthorised, plan an orderly wind-down. Map client positions, communicate clearly, return or transfer client assets responsibly, and document the process — consistent with ESMA’s emphasis on safeguarding clients’ interests.
- If you intend to remain in the market, prioritise authorisation. Assess your readiness against MiCA’s governance, capital, custody, and disclosure requirements, and engage with the regulator early. Specialist support in structuring and submitting an application for a crypto / VASP license in Malta can materially reduce execution risk.
- Strengthen client-protection arrangements. Whether continuing or exiting, ensure client assets are properly segregated and that communications are transparent and timely.
- Maintain an audit trail. Supervisors will expect evidence that decisions — to wind down or to continue under authorisation — were taken deliberately and in clients’ best interests.
The end of the MiCA transitional period marks a clear shift from accommodation to enforcement. For executives weighing their options in Malta, the decision is now binary: secure authorisation and operate with confidence, or wind down cleanly and protect your clients. Acting decisively — and early — is the most effective way to manage both regulatory and commercial risk.
