For years, buying crypto in Europe meant dealing with a patchwork of national rules. A platform could be registered in one country, barely supervised in another and completely unregulated in a third. That has changed. The Markets in Crypto-Assets Regulation, better known as MiCA (Regulation (EU) 2023/1114), is now the single rulebook for crypto-assets across the European Union.

This guide explains, in plain language, what MiCA is, what it means for you as an ordinary crypto user, and, just as important, what it does not do.

What is MiCA?

MiCA is an EU regulation, which means it applies directly in all 27 member states without each country having to write its own version. It was adopted in 2023 and came into force in two steps:

• 30 June 2024: rules for stablecoins (in MiCA terms, “asset-referenced tokens” and “e-money tokens”) started to apply.
• 30 December 2024: the rest of the regulation started to apply, including the rules for crypto-asset service providers (CASPs) such as exchanges, brokers and custodial wallet providers.

MiCA also allowed a transitional period (“grandfathering”) for firms that were already active under national rules before 30 December 2024. Member states could shorten it; the Netherlands chose a short period of six months. The longest possible period ended across the whole EU on 1 July 2026. Since that date, a firm that offers crypto services to people in the EU without a MiCA authorisation is, in the words of the European Securities and Markets Authority (ESMA), in breach of EU law and should have wound down its EU business.

Who is covered?

MiCA covers three main groups:

• Crypto-asset service providers (CASPs): businesses that, for example, hold crypto on behalf of clients (custody), operate a trading platform, exchange crypto for euros or other crypto, execute or transmit orders, give advice on crypto-assets or manage portfolios.
• Issuers of stablecoins: companies that issue tokens pegged to a currency or a basket of assets.
• Issuers and offerors of other crypto-assets: anyone offering a new token to the public or asking for it to be admitted to trading generally needs to publish a crypto-asset white paper with specific information.

Some things fall outside MiCA. Truly decentralised services without an identifiable provider, most NFTs that are genuinely unique, and crypto-assets that already qualify as financial instruments (such as tokenised shares) are covered by other rules or not at all.

What MiCA means for you as a user

1. Licensed providers and one EU passport

A CASP needs an authorisation from a national competent authority, in the Netherlands the Autoriteit Financiële Markten (AFM). Once authorised in one member state, a provider can “passport” its services to the rest of the EU. In practice this means an exchange licensed in, say, Luxembourg or Ireland can legally serve customers in the Netherlands, and vice versa.

For you, the key question before opening an account becomes simple: is this exact legal entity authorised under MiCA? We explain how to check this in our guide on checking whether a crypto exchange is licensed in the EU.

2. Rules on how your crypto is held

Authorised providers that hold crypto for clients must keep client assets separate from their own assets, keep records of client positions and have clear custody policies. Client crypto must not be used for the provider’s own account. The aim is that, if a provider fails, client assets can be identified and returned more easily.

3. Governance, capital and complaints

CASPs must meet minimum capital requirements, have fit and proper management, manage conflicts of interest and operate a complaints procedure. If something goes wrong, you should be able to file a complaint with the provider and, if needed, escalate to the national regulator or a dispute body.

4. Clearer information and fair marketing

Marketing communications about crypto-assets must be fair, clear and not misleading, be clearly identifiable as marketing and be consistent with the white paper. Providers must give information about costs and risks. Under MiCA, the white paper must also carry warnings, for example that the crypto-asset may lose its value in part or in full.

5. Stablecoin rules

Issuers of stablecoins referencing an official currency (e-money tokens) must be authorised as a bank or electronic money institution, hold reserves and give holders a right of redemption at par value at any time. Non-compliant stablecoins can be restricted on EU platforms.

6. Market abuse rules

MiCA prohibits insider dealing, unlawful disclosure of inside information and market manipulation involving crypto-assets. That includes certain forms of “pump and dump” schemes and spreading false or misleading information. This also matters for people who talk about crypto online: undisclosed promotion while holding a position can be a problem.

Related EU rules you will notice

MiCA does not stand alone. Two other sets of rules affect crypto users in practice:

• Transfer of Funds Regulation (the “travel rule”): since 30 December 2024, providers must attach information about the sender and receiver to crypto transfers. When you withdraw to or receive from a self-hosted wallet, your provider may ask you to confirm that you own the wallet.
• DAC8: since 1 January 2026, crypto service providers must collect information about their customers’ transactions for tax purposes. The first reports, covering 2026, are due in early 2027, and tax authorities will exchange data within the EU. In the Netherlands the first report to the tax authority is due by 31 January 2027.

What MiCA does NOT do

This part is essential, because MiCA is sometimes presented as if it makes crypto “safe”. It does not.

• It does not protect you against price falls. Crypto-assets can drop sharply in value, and a licence says nothing about whether a crypto-asset is a good or bad purchase.
• There is no deposit guarantee. Crypto held at a CASP is not covered by the deposit guarantee schemes that protect bank savings.
• There is generally no investor compensation scheme of the kind that exists for some investment firms.
• It does not cover everything. Many decentralised finance (DeFi) protocols, unhosted wallets and non-EU platforms operating illegally are outside the protections.
• It does not stop scams. Fraudsters often claim to be “MiCA licensed” or “EU regulated”. Always verify in the official registers yourself.

ESMA has explicitly reminded consumers that clients of unauthorised providers, whether EU or non-EU entities, do not benefit from MiCA safeguards, including the protections for client assets.

What should you do now?

• Check your provider. Look up the provider’s exact legal name in the ESMA register of authorised CASPs or the AFM register. A brand name alone is not enough; large groups often have several legal entities.
• Read the provider’s warnings and fee information. Under MiCA these should be easy to find.
• If your provider is not authorised, ESMA advises acting promptly, for example by moving your crypto-assets to an authorised provider or to a self-hosted wallet you control.
• Be sceptical of marketing. Fair marketing rules apply to providers and to people who promote them. Anything that promises returns or claims risk-free profits is a red flag.
• Keep records. With DAC8 reporting starting, it is sensible to keep your own overview of holdings and transactions for your tax return.

The bottom line

MiCA gives crypto users in the EU something they did not have before: a single set of rules on who may offer crypto services and how they must behave, plus a public register to check. That makes it easier to avoid unlicensed operators. But MiCA regulates providers, not prices. The risks of crypto-assets themselves remain, and you can still lose all of the money you put in.

Sources: Regulation (EU) 2023/1114 (MiCA), ESMA statements on the end of the MiCA transitional period (2026), ESMA Interim MiCA Register, Belastingdienst information on DAC8. Information as of October 2026.