MiCA Enforcement Has Begun: Is Your Exchange on the EU Blacklist?

The deadline came and went. Now the enforcement starts. ESMA has named 164 crypto firms operating illegally in Europe. If your exchange is on that list, your money is sitting in an unregulated account with zero legal protection. The post-July 1 landscape is uglier than the buildup.

I wrote about the MiCA deadline twice before. Once about the self-custody exemption, once about the 92 percent of EU crypto firms that vanished overnight. Both of those pieces were about what was coming. This one is about what happened next. Because enforcement did not end on July 1. It started.

The blacklist you probably have not checked

On July 24, 2026, the ESMA register of non-compliant entities listed 164 crypto firms flagged by national regulators for operating in the EU without a MiCA license. ESMA calls this the NCASP register. Everyone else calls it the blacklist.

The uncomfortable part is this. Of those 164 flagged entities, 162 come from a single regulator. Italy's CONSOB is the only national authority reporting aggressively to the ESMA register. Every other EU regulator has been quiet. The French AMF has its own separate list of 38 unauthorized sites it flagged in 2026, but those do not all appear in the ESMA register. Luxembourg's CSSF published its own warning on July 2. The Dutch AFM flagged MEXC, one of the largest exchanges in the world by volume, back in September 2025.

The list is not short because the problem is small. The list is short because most regulators have not started reporting yet. A firm that is missing from the register is not necessarily licensed. The only positive proof that an exchange is legal in the EU right now is an entry in the MiCA CASP license list, which has roughly 295 authorized firms as of late July. If your exchange is not on that list and not on the blacklist, that does not mean you are safe. It means nobody has checked yet.

Binance is gone. MEXC is flagged. What about yours?

Binance withdrew its MiCA application in Greece on June 24 and suspended services for EU residents on July 1. No new registrations. No deposits. No staking. Withdrawals stayed open, which is the one decent thing about how they handled it. They say they will reapply in another member state. Until they do, Binance is not a legal exchange for EU customers.

MEXC is on the ESMA warning list, flagged by the Dutch regulator. MEXC is not some obscure platform. It regularly ranks in the top ten exchanges by trading volume. If you held bitcoin there, your account is with a firm that a European regulator has explicitly identified as operating without authorization.

The AMF, France's financial regulator, added 38 names to its own unauthorized list in 2026 alone. The CSSF in Luxembourg warned consumers on July 2 that firms are abusing something called the reverse solicitation exemption. That is the loophole where a non-EU company claims you, the customer, came to them first, so they are not actually soliciting EU business. Regulators are not buying that argument anymore.

Reverse solicitation in practice works like this. An exchange based outside the EU runs targeted ads on social media, localizes its website for European languages, and offers euro deposits. Then when a regulator asks why they are serving EU customers without a license, they say the customer approached them. ESMA published guidelines in February 2025 trying to close this. The CSSF warning in July confirms that firms are still trying it. If your exchange is not in the EU, does not have a MiCA license, and still lets you deposit euros, it is probably relying on this exemption. And the exemption is narrowing fast.

What happens to your money if your exchange gets caught

If you are still using an unlicensed platform, your money is in a precarious position.

ESMA's statement was direct. Clients of unauthorized CASPs, whether EU or non-EU entities, do not benefit from MiCA safeguards. No custody rules. No segregation of client assets. No complaint procedures. No regulatory supervision. If the exchange goes down, freezes your account, or simply refuses to process your withdrawal, you have no regulatory recourse. You are an unsecured creditor of an offshore company that your own government says is operating illegally.

The penalties for the firms are real. Under Article 111 of the MiCA regulation, regulators can impose administrative fines of up to 5 million euros or 12.5 percent of annual turnover, whichever is higher. In France, the AMF can push for criminal prosecution, with up to two years imprisonment and 30,000 euros in fines for individuals. But those penalties punish the firm. They do not recover your bitcoin.

The pattern is the same one I wrote about in the MiCA aftermath piece. The exchanges that could not meet the bar are gone. Their former customers are the ones scrambling. Some will get their funds out. Some will not. The difference between those two groups is whether they moved before the door locked.

The license list: who actually survived

Roughly 295 firms hold MiCA CASP authorizations as of late July 2026. Germany has the most with 57. France has 31. The Netherlands has 28. Malta has 22. Cyprus has 20. These are the firms that spent the money, hired the compliance staff, and waited the 12 to 24 months for approval.

The familiar names that made it through include Coinbase, Kraken, Bitstamp, Crypto.com, OKX, Bitpanda, and Revolut. Bybit and KuCoin got licenses in Austria. Gate got one in Malta. Blockchain.com is licensed. These are the firms that can legally serve you right now.

The list will grow. Binance says it will reapply. More firms are in the pipeline. But the pipeline is slow, and the firms that could not afford it are already gone. The market is more concentrated, less competitive, and more regulated than it was six months ago. I said that before and it is still true. The difference now is that regulators are actively hunting the firms that did not leave quietly.

What you should actually do right now

If you hold bitcoin on an exchange and you are in the EU, the steps are concrete and none of them are theoretical.

Check whether your exchange has a MiCA license. Go to the ESMA register or use a tracker like casptracker.eu. Search for your exchange by name. If it is not in the licensed list and not on the warning list, that does not mean you are safe. It means nobody has flagged it yet. Contact the exchange and ask for their MiCA authorization number and the member state that issued it. If they cannot answer, that is your answer.

If your exchange is on the warning list or you know it does not have a license, stop depositing. Withdraw what you can, immediately. I am not saying this to be dramatic. I am saying it because the ESMA statement was explicit that clients of unauthorized firms get no protections. If the exchange gets shut down tomorrow, you are an unsecured creditor in a jurisdiction you probably cannot easily sue in.

Move your long-term holdings to self-custody. I have said this in every MiCA piece and I will keep saying it. Recital 83 of the MiCA regulation puts non-custodial wallets outside the scope of the law entirely. Your hardware wallet, your seed phrase stamped on steel, the wallet on your phone where you control the keys. None of these are crypto-asset service providers. None of them need a license. None of them are on any blacklist. The regulation drew a line around the companies that hold your bitcoin. It left the act of holding your own keys completely untouched. Use that.

Keep a licensed exchange account only for buying and selling. A MiCA-licensed exchange is the right tool for converting euros to bitcoin and back. It is the wrong tool for storing bitcoin long-term. Buy on the exchange, withdraw to your hardware wallet, repeat. That is the stack that survives MiCA and the regulations that will come after it.

If your holdings have grown past what a single hardware wallet should carry, this is the moment to think about multisig and geographic redundancy. Not next year. Now. The firms that just disappeared from the European landscape each had customers who thought there was more time.

The European crypto market split into two camps on July 1. Licensed firms inside the regulatory wall, and everything else on the outside looking in. Regulators are now actively pushing firms from the gray zone into the illegal zone. Your bitcoin should already be in the one place none of this can reach. Your own keys, your own wallet, outside the perimeter entirely. The blacklist is growing. The license list is not growing fast enough. Move first, ask questions later.

Sources: ESMA NCASP register (verified Jul 24, 2026), ESMA public statement on MiCA transitional period (Jun 2026), Regulation (EU) 2023/1114 Article 111 and Recital 83 (EUR-Lex), CoinDesk (Jun 26, 2026), CSSF consumer warning (Jul 2, 2026), AMF unauthorized list (Jul 8, 2026), AFM warning against MEXC (Sep 2025), casptracker.eu ESMA data. CASP authorization figures from ESMA register as of late July 2026. This article is for education only and is not legal or trading advice.