MiCA Is Fully Enforceable Now. The Review Is Already Asking About Your Wallet

A week ago, the Wall Street Journal reported how Christine Lagarde personally killed Binance's application for a European license. The president of the European Central Bank has no formal seat in the MiCA licensing process. She called around anyway. Greek regulators got the message. Binance missed the July deadline, and Europe's answer was no. The largest crypto exchange in the world now services the EU's 450 million people from the outside.

I have written about MiCA's deadline, its aftermath, and its blacklist before. This is not another deadline piece. The deadline passed on July 1, and none of what has happened since has anything to do with dates. Enforcement is here, and it has turned out to be real in a way the buildup never was.

Enforcement has teeth

Start with the registers. As of the start of September, 331 firms hold MiCA authorization, up from 244 in mid-July. On the other register, the one ESMA keeps for entities that national regulators flag as operating without a license, there are 167 names. The authorized list grows every week. The non-compliant list grows too, and most of those names come from a single regulator, Italy's CONSOB. The rest of Europe is still on the reporting curve.

The first penalty is already on the record. In August, Austria's FMA fined Bitpanda seventy thousand euros. Read that sentence twice, because the details matter. Bitpanda is licensed. The fine was for the timing and form of a marketing disclosure around the crypto-asset white paper. A fully authorized exchange drawing a published penalty for paperwork, six weeks into the enforcement phase, tells you how the rest of this will go. The license is not the finish line. Supervision starts the day it lands.

ESMA launched its first common supervisory action on July 8, aimed at the digital operational resilience of custody providers. AMLA, the EU's anti-money laundering authority, has been coordinating cross-border crypto supervision since mid-2025. The Czechs have fines on the books up to about five and a half million dollars. The machinery is running, and it is running toward the firms that hold your bitcoin.

For the customer the math is unchanged, only harsher. ESMA's wind-down statement was explicit that clients of unauthorized providers get none of the MiCA safeguards. No client asset protection. No complaint procedure. No supervisor. If a flagged exchange freezes your account, you are an unsecured creditor of a company your own government has named as operating illegally. The difference since July is that the fines give unlicensed firms a reason to close the doors themselves, and when they do, the withdrawal window closes with them.

Sweden already lives in this world

Sweden closed its transitional window early, before the rest of Europe. Finansinspektionen, the Swedish authority, posted its own winding-up notice on July 1, telling companies without a license to shut down in an orderly manner and telling consumers to check the register before they deposit. The register is a short read for Sweden. Exactly one firm, Safello, holds a local authorization. Seventy-seven companies licensed elsewhere in the EU may passport in and serve Swedish consumers. Two Swedish applications, from QB Europe and Ijort Invest, were rejected, and both firms are appealing.

Now stack the tax side on top. Skatteverket takes thirty percent on disposal, there is no holding period exemption, and the average cost method applies to everything. DAC8 has been collecting your exchange transactions since January, and the first automatic handover of that data to Skatteverket lands in September 2027. Every trade on a licensed exchange now carries a reporting trail and a tax bill that arrive without you lifting a finger.

Here is the part I keep coming back to. In that July notice, Finansinspektionen told affected customers their options in writing. Move the assets to a licensed firm, close the position, or move them to a wallet you own. A regulator listing self-custody as a destination in an official consumer notice is not something you see in every member state. The Swedish supervisor pointed its own citizens at the hardware wallet. That road exists because MiCA and DAC8 both stop at the point where you take custody of your keys. The same boundary I described in the piece on Sweden and Skatteverket still holds, and Sweden knows it.

The review has already decided who to look at

On September 30 the European Commission's consultation on the MiCA review closes. The deadline was pushed a month to give the industry room to answer, which tells you how much rides on the responses. They feed the report Europe owes under Article 140 of the regulation, due by the end of June 2027, and that report may carry a legislative proposal. The market already has a nickname for it. MiCA 2.0.

Now read the part that matters to anyone who self-custodies. The consultation asks, in the stablecoin section, whether euro-denominated token holdings inside the EU can be measured with sufficient accuracy and frequency, and it asks respondents for specific remarks with regard to tokens held in unhosted wallets. It lists, as a supervisory challenge, the difficulty of measuring EU holdings, especially holdings in self-custodial wallets. And it puts to a vote a measure that would restrict direct redemption rights to clients of authorized CASPs, so that holders keeping stablecoins in their own wallets would lose the redemption right MiCA guarantees.

None of that touches bitcoin directly. Bitcoin has no issuer, no reserve, no redemption right to reallocate. Recital 83 of the regulation keeps hardware and software providers of non-custodial wallets outside its scope entirely. ESMA itself, in its June statement, told clients of unauthorized firms to transfer their assets to an authorized provider or, in the regulator's own words, to a self-hosted wallet. Two months ago the sharpest supervisor in Europe named your hardware wallet as the safe destination.

But read the direction of travel. The questions about unhosted wallets and self-custodial holdings sit in the same document that decides the perimeter of the next rulebook. First they measure, then they ask about rights, then they decide. The consultation does not propose to change the fully decentralised exclusion, but it asks what fully decentralised actually means, what factors should decide it, and who should assess it. That question is aimed at DeFi protocols. It is also the question that defines where your wallet sits.

What to do before the consultation closes

Check your exchange against the ESMA register this week, not next. The authorized list is 331 names. The non-compliant list is 167. If your exchange is on the second list, or on neither list, the only safe reading is the one from July. No license entry means no verified protections. Buy on a licensed venue and withdraw to your own hardware wallet. The exchange layer is being walled and monitored by design, and the honest job of that layer is buying and selling, not storage. I named the firms to watch in the July blacklist piece. Nothing on that list has changed for the better.

If you hold stablecoins, the redemption question in the consultation is aimed at you directly. Read what the option actually says before you react to the headline. The measure would tie the MiCA-guaranteed right to redeem to being a client of an authorized CASP, and leave self-custodied holders outside it. That is a reason to understand what redemption really is, who promises it, and what happens to your position if the promise becomes contractual rather than regulatory. It is not a reason to hold stablecoins on an exchange to feel safer. The redemption right is the issuer's promise, not your wallet's.

For Swedish clients the practical list has not changed, only the stakes, and it is the same list I gave in the aftermath piece. Keep the K4 habit if you have it, build it if you do not, because 2026 is the first reported year and the DAC8 exchange lands next September. Moving bitcoin between your own wallets is not a disposal, and Skatteverket is clear about that. The regulator that taxes your trades is the same regulator that pointed you at your own wallet. Take the road it left open.

The wall went up around the exchanges in July. The first fines followed in August, and the measuring questions arrived in September, on paper, in the review that will write the next rulebook. The consultation closes in a week and a half. The report lands in 2027. And the one address in Europe that still has no register entry and no reporting requirement is the wallet where you hold your own keys. It was outside the wall before the wall existed. Keep it there.

Sources: ESMA public statement on end of MiCA transitional period (June 2026) and interim MiCA register (CASPS.csv and NCASP.csv, latest update August 21, 2026, verified via casptracker.eu on September 2, 2026), European Commission targeted consultation on the review of MiCA (consultation document, opened May 20, 2026, deadline extended to September 30, 2026, Questions 35 and 38), Finansinspektionen news release July 1, 2026 (fi.se), Regulation (EU) 2023/1114 Recitals 22 and 83 and Article 140, Austria FMA penalty notice against Bitpanda (August 2026, via CryptoNexa and sb-sb.com), Wall Street Journal via Dow Jones Newswires (September 17, 2026), Czech National Bank fine ranges as reported by ainewscrypto.com, Skatteverket crypto guidance and Council Directive (EU) 2023/2226 (DAC8). This article is for education only and is not legal or tax advice.