MiCA, the EU’s Markets in Crypto-Assets Regulation, gave crypto firms already registered under national anti-money laundering rules a transitional period to obtain a licence. Each country chose its own length, from six to 18 months, and the last of these periods ended on 1 July 2026. In May 2025, VASPnet’s report on the landscape of legacy VASPs in Europe identified 3,389 regulated virtual asset service provider (VASP) legal entities in EEA countries subject to MiCA that would need a MiCA licence to keep operating after their transitional period, with the largest numbers in Poland, the Czech Republic and Lithuania.
To see what happened to these legacy VASPs once their transitional periods ended, we reviewed their operational status in 23 EEA countries. On 29 September 2026, 141 of the 276 firms whose current status we could verify were still operating without a MiCA licence of their own, 110 had stopped operating and 25 had paused while waiting for authorisation. Some still served EU customers through another legal entity in their group, while others had changed the services they offered or moved their operations outside the EU.
What happened to the old registrations?
Before MiCA, Poland, the Czech Republic, Lithuania, Estonia and Bulgaria held 3,659 national VASP registrations between them, and by 13 October 2026 those five countries had recorded 26 MiCA licences.[1]
Registrations and licences also count different things, because a VASP group could hold several national registrations and later obtain fewer MiCA licences. Bitpanda, for example, previously held 10 national registrations and licences and now holds three MiCA licences.
Once a country’s transitional period ended, an old national registration no longer allowed a firm to provide crypto-asset services covered by MiCA. Where a group moved its EU business to another company, that company’s licence is the one your counterparty due diligence should confirm.
Which firms kept operating?
Of the 276 firms whose current status we could verify:
- 141 were still operating without a MiCA licence of their own. This includes firms that changed their activities and firms whose groups continued serving EU customers through another entity.
- 110 were no longer operating. This includes firms that closed, were dissolved or entered liquidation.
- 25 had paused operations while waiting for MiCA authorisation.
What do legacy VASPs do now?
As of 29 September 2026, seven of the 11 German legacy VASPs we reviewed continued in securities activities, which may not require a MiCA licence. In Greece, one firm reported a shift towards B2B technology, and in Croatia, one firm swapped its crypto ATMs for an online store.
Other firms moved their operations abroad, including a second Croatian firm that went to the UAE to work on real-world assets, an Estonian firm that now operates from Saint Kitts and Nevis and a Bulgarian firm that moved to Switzerland after a Swiss company acquired it.
What to look for in an older counterparty profile
Where a counterparty profile still shows a national VASP registration from before MiCA, such as an Estonian registration from 2023, counterparty due diligence should:
1. Establish which legal entity provides the service today
The firm may now operate through another company in its group, or from outside the EU.
2. Confirm that entity’s MiCA licence
If another group company now serves you, its licence is the one that counts, and if it serves customers across EU borders, our guide to MiCA passporting explains how to find its home regulator and confirm its passporting rights.
3. Confirm it still offers the service you use
A firm that has changed its activities may no longer provide crypto transfers or custody at all.
4. Record the serving entity, the service and the licence that covers it in your counterparty profile
Review it again when the group’s structure changes.
How VASPnet tracks changes to counterparties
A VASPnet counterparty profile brings together an entity’s regulatory status, home regulator and the markets it may serve. Users can also subscribe to a VASP group and receive notifications when an entity is added or removed, so they know when to revisit their counterparty due diligence.
How we counted
The operational review records firms’ status as of 29 September 2026 in 23 EEA countries and does not include the Czech Republic, Hungary, Iceland, Latvia, Malta, Romania or Slovenia. The breakdown covers the 276 firms where we found clear evidence of their current activity, such as a live service, a licence or a closure. For the other legacy registrations in these countries we found no reliable evidence either way, so they aren’t counted as operating or as closed.
The comparison of national registrations and MiCA licences uses register counts from two different periods, and the Czech Republic’s historical registration data is partial, so the figures don’t show what proportion of legacy firms obtained a MiCA authorisation.
Our paper, Three months post MiCA deadline, has the wider country comparison, passporting figures and examples of how legacy providers changed their businesses.
[1] The 3,659 is higher than the 3,389 in VASPnet’s May 2025 report because it counts all registrations recorded before 31 December 2024, while the 2025 report counted legal entities that were still regulated on 12 May 2025.