MiCA after the licence: what the first enforcement data shows, and what it cant

ESMA's first MiCA enforcement figures are small: 10 measures in 4 countries and one fine of EUR 600,000 in 2025. Read next to ESMA's own CASP register, they show a regime that spent its first year policing the perimeter. ESMA's opinion of 8 October 2026 points to the next phase, the supervision of what licensed firms do.

The data

On 15 October 2026, ESMA published its third consolidated report on sanctions and measures imposed across the EEA. 2025 is the first year with any measures under MiCA.

First, what counts as a “measure”? ESMA uses the word for any formal action a supervisor takes against a firm that transgressed the rules, where the firm has the right to challenge it. A fine is the obvious example. An order to stop an activity, the removal of a licence, or publicly naming the firm also count. Each action counts once, so a fine and a ban on the same firm count as two measures. 

Four supervisors reported 10 measures in total: Liechtenstein 5, Austria 2, Germany 2 and the Netherlands 1. The other 26 EEA states reported none. Five of the ten measures were imposed via settlement.

These are formal enforcement measures reported to ESMA. They are not a count of supervisory interventions. Supervisors also act through informal tools, such as warning letters, and under anti-money-laundering rules. Neither appears in this report.

There was one administrative fine: EUR 600,000 in Germany. The other nine were three cease-and-desist orders (Austria 2, Liechtenstein 1), one withdrawal of authorisation (Germany), one public statement (Netherlands) and four "other" measures (Liechtenstein). “Other” means a formal measure that does not fit ESMA’s standard list. Under other EU laws, ESMA gives examples such as an order to fix a breach within a deadline. It does not describe Liechtenstein’s four. 

For scale, supervisors imposed 955 measures and EUR 81.9 million in fines across all 12 EU laws in the report. MiCA accounts for about 0.7% of that fine total.

Year one policed the perimeter

ESMA says most MiCA measures rested on Article 59, the rule that only authorised firms may provide crypto-asset services. Its data table names the other two legal bases: Article 16, which requires authorisation to offer an asset-referenced token (ART) to the public, and Article 7, on marketing communications for an offer.

Two of these rules govern authorisation, that is, who may enter the market. The third governs how an offer is marketed. No entry in ESMA's table cites the obligations that apply to authorised CASPs once they hold a licence, such as the Article 66 duty to act honestly, fairly and professionally in clients' best interests.

That is the expected order for a new regime. Supervisors first stop firms that operate without a licence. Supervision of how licensed firms behave comes later.

ESMA's article table does not map one-to-one to measures. It holds eight article entries for ten measures, and ESMA notes that one measure can cite several articles.

The only fine concerned stablecoin authorisation

ESMA's article table ties both German measures, including the EUR 600,000 fine, to Article 16. So the only MiCA fine reported in the EEA for 2025 concerned an asset-referenced token offered without authorisation. It did not concern a CASP. ESMA itself groups ARTs and e-money tokens under the label "stablecoins".

The amount matches a public case. On 4 April 2025, BaFin set coercive fines totalling EUR 600,000 against Ethena GmbH, the Frankfurt issuer of the USDe token, which BaFin treated as an ART. On 14 April 2025 it ordered the company to wind down that business. Ethena had withdrawn its authorisation application on 3 April 2025.

We cannot confirm that ESMA's figure is this case. ESMA's data are anonymised. ESMA records its figure as an administrative fine, while BaFin described its sum as a coercive fine (Zwangsgeld) to enforce compliance, not a penalty for a past breach. BaFin also noted that Ethena objected to the orders.

Both the reported Article 16 measure and the separate, publicly documented Ethena proceedings concern authorisation rather than the ongoing reserve or redemption obligations of an authorised issuer. 

Most register entries came after the data

On 31 December 2025, ESMA's interim CASP register held 151 entries. On 15 October 2026 it held 362. These entries are authorised CASPs plus financial firms, such as banks, that notified under Article 60. They are not all new licences. So 58% of today's entries arrived after the year the sanctions report covers. ESMA's report itself counts 194 authorised CASPs in May 2026. You can search the same register by country, authority and service in the DEA MiCAR Tracker.

The steepest month was June 2026, with 75 new entries, just before 1 July 2026, the latest date on which national transitional periods could end.

This limits what the 2025 figures can tell us. They describe a year in which most of today's register entries did not yet exist, and transitional regimes still ran in most EEA states. They say little yet about how supervisors treat licensed firms.

Where register entries sit, and where enforcement happened

At the end of 2025, five home states held 98 of the 151 register entries: Germany 45, the Netherlands 22, France 11, Ireland 10 and Malta 10.  Germany and the Netherlands reported MiCA measures, but of different kinds. Germany’s two measures, the EUR 600,000 fine and a withdrawal of authorisation, both cite Article 16 on ART authorisation, not CASP rules. The Netherlands reported one public statement under Article 59, the CASP authorisation rule.  France, Ireland and Malta reported none. Liechtenstein, with 3 entries, reported half of all MiCA measures in the EEA.

Two cautions apply before reading this as a league table.

First, as noted above, the report counts formal measures only. ESMA itself warns that sanction counts do not measure supervisory quality.

Second, transitional periods differed. France, Malta and Cyprus gave legacy providers 18 months, so firms without a MiCA licence could still operate lawfully there through 2025. That leaves less room for Article 59 cases. It does not explain the whole map: Liechtenstein also had 18 months and reported five measures, while five states with six-month periods (Finland, Hungary, Latvia, Poland and Slovenia) reported none.

From the perimeter to the licence

One week before the sanctions report, on 8 October 2026, ESMA published an opinion addressed to national supervisors. It sets the next test.

ESMA says authorised CASPs should not provide crypto-asset services in relation to ARTs or e-money tokens (EMTs) that do not comply with MiCA. The expectation covers every CASP service: trading platforms, exchange, order execution, reception and transmission of orders, placing, advice, transfers, custody and portfolio management.

The legal basis is Article 66(1), the duty to act honestly, fairly and professionally in clients' best interests. ESMA states that its conclusion does not depend on whether each service counts as an offer to the public or an admission to trading. It also states that warnings, disclosures or client acknowledgements are not enough.

Where supervisors find legacy exposures, they should require remediation as soon as possible and no later than three months after publication, which is 8 January 2027. During a wind-down, only limited services such as sell-only, conversion, transfer or withdrawal may continue.

This moves the focus from who may enter the market to how licensed firms behave inside it. The remediation deadline is 8 January 2027, so enforcement of this opinion would show mainly in the 2027 data. If ESMA keeps its October publishing pattern, those data appear in autumn 2028. The 2026 data, due in autumn 2027, may show earlier conduct cases.

What to watch in the 2026 and 2027 data

1. Whether any MiCA measures cite the ongoing obligations of authorised CASPs, including Article 66.
2. Whether France, Ireland, Malta and Cyprus report MiCA measures now that their transitional periods have ended.
3. How supervisors enforce the 8 October opinion after the 8 January 2027 deadline (mainly 2027 data), and whether ESMA publishes the results of its monitoring.
4. Whether the data let readers link measures to licences. Today ESMA reports anonymised counts of measures, not cases.

Method and sources

• Sanctions. Figures are from section 3.12 of ESMA's report (pages 71 to 73) and its Excel data table. ESMA counts each measure separately, even when two measures stem from one case. Figures are as national supervisors reported them.
• Register. ESMA interim MiCA register, CASP file, last updated 7 October 2026 and read on 15 October 2026. We counted unique LEIs active on each date, by authorisation or notification date. The file includes credit institutions and other financial entities that notified under Article 60. The DEA MiCAR Tracker presents the same ESMA data and updates weekly. We excluded one record with no date and two dated after 15 October 2026, one of them in 2028.
• Transitional periods. ESMA's list of national periods under Article 143(3) MiCA.

Sources:

• ESMA, Report on sanctions and measures imposed in Member States in 2025 (15 October 2026)
• ESMA, Consolidated sanctions report: table of sanctions reported for 2025
• ESMA press release on the third sanctions report
• ESMA, Opinion on crypto-asset services for non-MiCA-compliant ARTs and EMTs (8 October 2026)
• ESMA interim MiCA register, CASP file
• ESMA, List of MiCA grandfathering periods under Article 143(3)
• BaFin, Ethena GmbH: wind-down order for USDe business (15 April 2025, updated 16 May 2025)