A Regulation Designed to Protect You Created an Opportunity to Rob You
On 1 July 2026, the EU’s Markets in Crypto-Assets regulation reached full application. Firms without authorisation had to wind down or stop serving EU clients. The intent was simple: replace a patchwork of national registrations with a single, properly supervised licensing regime.
The side effect was not anticipated, and it is now the active threat.
More than 1,700 unlicensed crypto platforms were required to stop serving EU customers and direct them to licensed alternatives, while only around 250 firms held MiCA authorisation when the deadline passed — a number that late approvals pushed past 320 by early August.
That produced something scammers rarely get handed: a very large population of people who have been legitimately told, by a real company, that they must move their crypto somewhere else — urgently, and to an unfamiliar provider.
By early August, EU financial watchdogs were publicly warning about the consequences. The Financial Times reported that regulators had seen a rise in scams, with fraudsters impersonating both crypto firms and regulators to target users of exchanges that failed to secure authorisation.
What the Regulators Actually Said
This isn’t speculative. Named officials at named authorities described specific, observed fraud.
France (AMF). Stéphane Pontoizeau, an official at the Autorité des Marchés Financiers, said the regulator had encountered cases in which fraudsters impersonated AMF representatives and directed users to transfer assets through fake websites.
The European Securities and Markets Authority. ESMA stated it was aware of scammers misusing its identity and logo, including through falsified documents, and warned that criminals may target customers searching for an alternative licensed provider.
The Netherlands (AFM). The Dutch Authority for the Financial Markets warned that fraudulent actors may see an opportunity to target retail investors in the process of looking for an alternative licensed provider. It urged investors to verify any provider on the official ESMA register before transferring assets, and to treat unsolicited approaches requesting fund transfers with suspicion. The AFM directs investors to its own register alongside ESMA’s.
Austria (FMA) issued a comparable warning.
The UK (FCA) noted a related technique: screen-sharing software increasingly being used to help set up fake crypto accounts on victims’ behalf.
That last one deserves emphasis. If someone walks you through opening an account on a “newly licensed” platform over a screen share, they are not helping you comply. They are watching you do everything, including entering credentials, and in many cases controlling what you see.
The Three Shapes This Fraud Takes
1. The fake compliance notice
A message arriving by email, SMS or social media DM that appears to come from ESMA or a national regulator. Criminals have been documented misusing official logos, forged documentation and fake legal notices to deceive retail holders.
How to kill this instantly: official ESMA emails end in @esma.europa.eu, and ESMA does not ask investors to send cryptocurrency for regulatory checks or compliance. No regulator does. There is no circumstance, under MiCA or any other framework, in which a European financial authority requires you to transfer crypto to demonstrate compliance.
If a message asks you to move funds for a regulatory reason, the message is fraudulent. You do not need to analyse it further.
2. The fraudulent migration process
The most effective variant, because the premise is true.
Scammers copy the language of real migration notices and push users toward fake platforms before victims register the difference. Your actual exchange may genuinely be winding down EU services. You may genuinely need to move. A notice telling you so is not inherently suspicious — which is exactly what makes the fake ones work.
Defence: when an exchange tells you to migrate, do not click the link in the message. Open a fresh browser window, navigate manually to the exchange’s verified domain, and initiate any transfer from inside your authenticated dashboard. If the instruction is real, it will be waiting for you there. If it isn’t there, it wasn’t real.
3. The impersonated licensed exchange
A clone of a genuinely authorised platform, or an entirely invented platform claiming fresh CASP authorisation. Scammers can pose as the departing provider, a newly licensed exchange, or a public authority — and often move between all three roles in a single conversation.
The timing is deliberate: the moment a national authority publishes a warning about an unauthorised platform, scammers weaponise that news, approaching its users as either the regulator or a rescuing alternative.
How to Verify a Licence Yourself
Any list of licensed platforms — including one on this site — goes stale. The register doesn’t. Learn the check, not the list.
Step 1: Go to the official ESMA CASP register directly. Type the address or use a bookmark. Never reach a register through a link in a message, an ad, or a search result.
Step 2: Search the legal entity name, not the brand. This is where most verification fails. Global exchanges serve the EU through dedicated local subsidiaries, and the brand you recognise is frequently not the entity that holds the licence.
Step 3: Understand what a group licence does not cover. MiCA’s investor protections apply only when you are served by a regulated EU operation. A firm’s broader group brand holding a licence elsewhere does not cover all its subsidiaries. “We’re MiCA-licensed” can be literally true about a corporate group and entirely false about the entity actually holding your money.
Step 4: Check the authorised service scope. CASP authorisation covers ten distinct crypto-asset services. A firm licensed for custody is not necessarily licensed to operate a trading venue, which carries higher capital and technical requirements.
Step 5: Cross-check your national register. The AFM, for instance, maintains its own register alongside ESMA’s. National authorities also publish warning lists of firms identified as operating without authorisation.
Step 6: Confirm before you deposit, not after. The AFM’s guidance is to verify on the official register before transferring assets. Verification after a transfer is called a post-mortem.
What Happened to the Market
Context for why this transition is so exploitable.
Before MiCA, over 3,000 crypto service providers operated across Europe. At the deadline, fewer than 10% had entered the ESMA register. Licensing concentrated geographically — Malta became the hub for large exchanges, Luxembourg attracted global brands seeking fast EU-wide passporting, and the Netherlands retained a mix of crypto-native and payments businesses.
Among the notable absences: Binance, the largest exchange in the world by volume, missed the 1 July deadline without MiCA authorisation. It withdrew its Greek application on 24 June, restricted services in several member states including France, Italy, Poland and Spain, and says it will seek authorisation elsewhere. If you hold assets on a platform that didn’t make the register, you are precisely the population this fraud wave was built for.
Post-deadline supervisory activity continues — ESMA has since launched a review of crypto custody arrangements — so the landscape will keep shifting through 2027. That’s an argument for checking the register each time, not for memorising a snapshot.
One data point on the scale of deception generally: exchange WhiteBIT reported that nearly 41% of crypto incidents last year involved malicious actors deceiving victims through fake investment offers or impersonation. Impersonation isn’t a niche vector. It’s close to half the problem.
If You Need to Move Platforms Right Now
A practical sequence:
Confirm the wind-down independently. Log into your account directly. If the platform is genuinely exiting, the notice will be inside your account, not only in your inbox.
Pick your destination yourself, before you’re asked to. Don’t accept a recommendation that arrives with the migration notice. Choose from the ESMA register on your own.
Verify the destination entity, following the six steps above.
Consider self-custody as the intermediate step. Moving assets to your own hardware wallet while you evaluate platforms removes the deadline pressure entirely — and deadline pressure is the mechanism the fraud depends on. Related: Ledger vs. Trezor 2026: Which Hardware Wallet Should You Buy?
Never accept screen-sharing help, from anyone, for any reason connected to crypto.
Test with a small transfer first, exactly as you would with any new address.
The Pattern Worth Internalising
Every scam in this article runs on the same engine: a real deadline, a real obligation, and real urgency, with one fraudulent element inserted into an otherwise legitimate sequence.
That’s harder to defend against than an obvious fake, because scepticism feels unwarranted. You are supposed to be moving. The notice is plausible. The regulator does exist.
So the defence can’t be detecting falsehood. It has to be a procedural rule applied regardless of plausibility:
Verify every provider on the official register, navigate to every platform manually, and never transfer funds because a message told you to — only because your own authenticated dashboard did.
No regulator will ever ask you to send crypto. No legitimate migration requires a link from an email. No real support needs your screen.
Frequently Asked Questions
Is my crypto at risk if my exchange lost its licence?
Not automatically. Platforms are required to wind down and let customers withdraw. The risk is in the transition — move promptly through official channels and don’t act on unsolicited instructions.
How do I know if a platform is MiCA-licensed?
Check the official ESMA CASP register for the specific legal entity, and confirm the licence covers the service you’ll use. Cross-check your national regulator’s register.
Would a regulator ever contact me directly?
A regulator will not ask you to transfer crypto, send funds for compliance checks, or verify your holdings. ESMA’s official emails come from its own domain and it does not request cryptocurrency from investors.
My exchange says it’s licensed in another country — is that enough?
Only if the licence is a MiCA CASP authorisation held by the entity serving you. A group brand licensed elsewhere does not extend protection to all its subsidiaries.
What if my platform isn’t on the register at all?
Then it is not authorised to serve EU clients. Withdraw and move to a licensed provider — or to self-custody — without waiting.
Transparency: TrueToCrypto may earn affiliate commissions from links in articles. Recommendations are based on merit, not commission rates. This article is educational and is not legal, financial, or regulatory advice. Regulatory status changes frequently — always verify current authorisation in the official ESMA register before acting.
Contact: info@truetocrypto.com
Register figures in this article reflect ESMA data from late July and early August 2026 and will have changed. Verify current status directly. Regulator statements sourced from Financial Times reporting of 6 August 2026 and subsequent coverage.
