← Back to updates
CSSF

CSSF

Commission de Surveillance du Secteur Financier

High Impact

CSSF republishes ESMA call for unauthorised CASPs to wind down as MiCA transition ends

Published

Jun 24, 2026

Effective

Jul 1, 2026

Topics

MiCA, Crypto-asset service providers, CASP authorisation, Wind-down, Client asset safeguarding, Luxembourg, EU crypto regulation

Executive Summary

The CSSF has published a supervisory communication drawing attention to ESMA’s call for unauthorised crypto-asset service providers to wind down in an orderly manner while safeguarding clients’ interests as the MiCA transitional period ends. Under Regulation (EU) 2023/1114 on markets in crypto-assets, CASP authorisation became the EU regulatory basis for providing crypto-asset services, with a transitional route allowing certain existing providers to continue only until 1 July 2026, or until an authorisation decision where earlier. CSSF’s related MiCA communication states that providers without the appropriate authorisation must wind down their EU activities and that this may have concrete consequences for customers. For firms operating, distributing, using, or relying on crypto services in Luxembourg or the wider EU, the immediate business issue is not a new reporting template but a control and conduct obligation: confirm authorisation status, stop unauthorised activity, manage client communications, and ensure client assets and complaints are handled appropriately during exit or migration.

What Changed

modifiedMiCA transitional period has ended

Previous

Article 143 of Regulation (EU) 2023/1114 allowed certain providers already operating before 30 December 2024 to continue providing crypto-asset services during a transitional period, subject to applicable conditions.

New

CSSF states that the transitional period for virtual asset service providers ended on 1 July 2026; providers without appropriate authorisation must wind down EU activities.

modifiedAuthorisation status becomes a go/no-go control

Previous

Some providers could rely on national or transitional arrangements while seeking MiCA authorisation.

New

Unauthorised providers are expected to cease or wind down relevant EU activity rather than continue servicing the market.

newOrderly wind-down expectation

Previous

The source does not identify a separate wind-down template or filing newly introduced by this communication.

New

Unauthorised providers should wind down in an orderly manner and safeguard clients’ interests.

newClient consequences need active management

Previous

Clients may have been receiving services from providers operating under transitional or national arrangements.

New

Clients may need communications, transfer, withdrawal, account closure, or migration support where a provider is not authorised.

Business Impact

Who is affected

Directly affected

crypto-asset service providers, virtual asset service providers, and firms offering crypto-asset services in Luxembourg or elsewhere in the EU without appropriate MiCA authorisation.

Indirectly affected

clients, distributors, financial institutions, payment firms, custodians, trading venues, outsourcing providers, and counterparties relying on services from unauthorised or transitional crypto providers.

Jurisdictions

Luxembourg, European Union

Business processes

CASP licensing and authorisation governance, EU client onboarding and service eligibility controls, Wind-down planning and execution, Client communications and complaint handling, Client asset safeguarding, reconciliation, return, or transfer, Third-party and counterparty due diligence for crypto service providers

Estimated effort

Medium

Compliance risk

High

Affected Reports

CASP authorisation status and regulatory permissions registerEU crypto service eligibility and onboarding controlUnauthorised activity wind-down plan and governance trackerClient asset safeguarding, reconciliation, withdrawal, and transfer controlClient notification, complaints, and remediation log
FieldValidation rule

Recommended Actions

7 suggested next steps· derived from source analysis
  1. 1
    AI generatedStep 1 of 7

    immediately reconcile all EU crypto-asset services against MiCA authorisation status and stop any service line that cannot be mapped to an appropriate permission.

  2. 2
    AI generatedStep 2 of 7

    for any unauthorised activity, approve a board- or senior-management-owned wind-down plan covering cessation dates, client communications, asset return or transfer, complaints, and residual risk.

  3. 3
    AI generatedStep 3 of 7

    freeze onboarding, marketing, cross-border solicitation, and new product launches for EU clients where the providing entity lacks confirmed MiCA authorisation.

  4. 4
    AI generatedStep 4 of 7

    identify affected clients and counterparties, issue clear communications on service changes, withdrawals, transfers, complaints channels, and any deadlines set by the firm.

  5. 5
    AI generatedStep 5 of 7

    perform daily reconciliation of client crypto-assets and funds during wind-down and retain evidence that clients’ interests were safeguarded.

  6. 6
    AI generatedStep 6 of 7

    review distributors, introducers, custodians, exchanges, liquidity providers, and outsourcing arrangements to ensure the firm is not relying on or routing clients to unauthorised CASPs.

  7. 7
    AI generatedStep 7 of 7

    update compliance monitoring, breach escalation, and management information to track unauthorised activity risk until wind-down or authorisation is complete.

Timeline

publication

May 31, 2023

Regulation (EU) 2023/1114 on markets in crypto-assets was adopted.

implementation

Dec 30, 2024

MiCA provisions for crypto-asset service providers became applicable, with Article 143 transitional arrangements linked to providers already operating before this date.

effective date

Jul 1, 2026

CSSF states that the MiCA transition period for virtual asset service providers ended on 1 July 2026.

Sources

AI-generated analysis is based on the following primary sources. Always verify against the official publication.

Related Evidence

Verified source support for this analysis

The evidence agent checks whether the drafted finding is supported by official publications and relevant public source material.

Receive updates like this by email

Get AI-generated analysis for the regulators and topics you care about.

Pulse is built by Datox. Datox automates AIFMD Annex IV and SEC Form PF reporting end to end.

See the Datox platform