MiCA Enforcement in 2026: NCA Powers, Penalties and What to Watch

Why this page lists no cases

MiCA does not create a single public list of enforcement decisions. Each national competent authority (NCA) publishes its own decisions on its website under Article 114. NCAs also report penalties to ESMA, but the central database ESMA keeps under Article 115(3) is open only to ESMA, EBA and the NCAs. Under Article 115(1), ESMA must publish aggregate penalty data in an annual report. Aggregate data does not identify individual cases.

We will add individual decisions to this page only where an NCA or ESMA has published them, with the date and a link. Until then, this page explains the legal framework and where to look.

Who enforces MiCA against a crypto-asset service provider?

Article 59(1) bars anyone from providing crypto-asset services in the Union unless they are authorised as a crypto-asset service provider (CASP) under Article 63, or are a financial entity allowed to provide those services under Article 60. Enforcing that rule, and the conduct rules that follow it, is the job of the competent authorities each member state designates under Article 93. ESMA publishes the list of designated authorities.

For an authorised CASP, the lead supervisor is the NCA of its home member state. Host-state authorities have a narrower role, described below under Article 102.

The transitional period in Article 143(3) has ended in every member state. The last national periods closed on 1 July 2026. A firm that relied on a national registration now needs MiCA authorisation to provide crypto-asset services. See VASP licence explained and the MiCA implementation status by country.

ESMA does not supervise CASPs. It keeps the register of authorised CASPs under Article 109 and a non-exhaustive register of entities providing services without authorisation under Article 110. It coordinates an on-site inspection or investigation when an NCA asks it to (Article 95(5)).

What powers does an NCA have? (Article 94)

Article 94(1) lists the minimum supervisory and investigative powers every NCA must have. They are exercised in accordance with national law. For CASPs, the main ones are:

• Information and documents. Require any person to provide information and documents relevant to the NCA’s duties (point (a)).
• On-site inspections. Carry out inspections or investigations at sites other than private homes, and enter premises to access documents and data (point (w)). Verifications can be outsourced to auditors or experts (point (x)).
• Suspension and prohibition. Suspend crypto-asset services for up to 30 consecutive working days on reasonable suspicion of an infringement (point (b)). Prohibit services once an infringement is found (point (c)). Suspend services where continuing would harm clients (point (f)).
• Public disclosure. Make public that a CASP fails to meet its obligations (point (e)).
• Unauthorised activity. Order immediate cessation, without prior warning, where there is reason to assume a person provides crypto-asset services without authorisation (point (h)). Where no other means work, require removal of content, restrict access to an online interface, or order a domain name deleted (point (aa)).
• Management. Require removal of a natural person from the management body of a CASP (point (y)).
• Marketing. Suspend or prohibit marketing communications on reasonable suspicion of an infringement (points (p) and (q)).
• Client transfer. Require existing contracts to be transferred to another CASP when authorisation is withdrawn, with the agreement of the clients and the receiving CASP (point (g)).

Article 94(3) adds powers for market abuse cases under Title VI. These include access to any document or data, summoning and questioning any person, entering premises to seize documents where insider dealing or market manipulation is reasonably suspected, obtaining existing telecoms data traffic records where national law allows, freezing or sequestering assets, temporary bans on professional activity, and referring matters for criminal prosecution. Failure to cooperate with an investigation, inspection or request under Article 94(3) is itself an infringement under Article 111(1)(f).

Where national law requires it, the NCA asks a court to decide on the use of these powers (Article 94(4)).

The regulation sets the powers. Deadlines, hearing rights and legal professional privilege come from national law and differ between member states. Three practical points hold in most cases:

• Answer the scope of the request. If the deadline cannot be met, ask in writing for more time before it passes.
• Keep an index of what was produced and when.
• Take advice under the home state’s law on privilege before producing documents.

How do authorities cooperate across borders? (Articles 95 and 102)

Article 95 requires NCAs to cooperate with each other and with EBA and ESMA. They exchange information without undue delay and cooperate in investigation, supervision and enforcement (Article 95(1)). An NCA may refuse a request only on the grounds in Article 95(2), for example where answering would harm its own investigation, or where its courts are already dealing with the same acts by the same persons.

An NCA may ask another NCA for help with an on-site inspection or investigation (Article 95(4)). The NCA that receives the request may carry out the inspection itself, let the requesting authority take part, let it carry out the inspection, or share specific tasks. ESMA coordinates the inspection if one of the authorities asks; EBA does so where asset-referenced or e-money tokens are involved (Article 95(5)). If a request is refused or not acted on within a reasonable time, the requesting NCA can bring the matter to ESMA’s attention (Article 95(6)). An NCA that finds or suspects an infringement must inform the authority responsible for the entity, in sufficient detail (Article 95(9)).

Article 102 covers host states. Where a host NCA has clear and demonstrable grounds to suspect irregularities, it notifies the home NCA and ESMA. If the irregularities persist despite the home NCA’s measures and amount to an infringement, the host NCA may, after informing the home NCA and ESMA, take measures to protect clients. Those measures include preventing the CASP from conducting further activities in the host state (Article 102(2)). A home NCA that disagrees can refer the matter to ESMA (Article 102(3)). Public precautionary measures are entered in ESMA’s register (Article 109(6)).

A passport therefore does not remove host-state exposure. A CASP serving clients in several member states should expect information to move between the authorities involved.

When must an NCA withdraw an authorisation? (Article 64)

Article 64(1) lists the cases in which the NCA shall withdraw a CASP’s authorisation. The CASP:

• (a) has not used its authorisation within 12 months of the date of authorisation;
• (b) has expressly renounced it;
• (c) has not provided crypto-asset services for nine consecutive months;
• (d) obtained it by irregular means, such as false statements in the application;
• (e) no longer meets the conditions of authorisation and has not taken the remedial action the NCA requested within the timeframe set;
• (f) lacks effective systems, procedures and arrangements to detect and prevent money laundering and terrorist financing under Directive (EU) 2015/849;
• (g) has seriously infringed MiCA, including the rules protecting clients and holders of crypto-assets, or market integrity.

Article 64(2) adds two discretionary grounds: infringement of national law transposing Directive (EU) 2015/849, and loss of a payment institution or e-money institution authorisation that the CASP has not remedied within 40 calendar days.

The procedure points in the regulation:

• Withdrawal can be limited to a particular crypto-asset service (Article 64(4)).
• Before withdrawing, the NCA must consult the authority of another member state where the CASP is linked to a CASP authorised there through a parent, subsidiary or common control (Article 64(5)). It may consult the AML supervisor (Article 64(6)).
• EBA, ESMA and host NCAs may ask the home NCA to check whether the CASP still meets the conditions of authorisation (Article 64(7)).
• The NCA notifies ESMA and the single points of contact of host member states. ESMA publishes the withdrawal in the register (Article 64(3)), where it stays for five years (Article 109(7)).
• CASPs must keep procedures for transferring clients’ crypto-assets and funds to another CASP if authorisation is withdrawn (Article 64(8)).

For market abuse, Article 111(5)(d) separately lets NCAs withdraw or suspend a CASP’s authorisation.

Decisions must be reasoned and open to appeal before a court (Article 113(1)). Hearing rights, procedure and appeal deadlines follow national law.

Point (e) has a built-in warning: the NCA must first request remedial action and set a timeframe. A CASP that receives such a request should treat it as the point to act.

What penalties must national law provide? (Articles 111 and 112)

Article 111(1) lists the infringements for which NCAs must be able to impose administrative penalties and other measures. For CASPs, point (d) covers Articles 59, 60, 64 and 65 to 83. Point (e) covers market abuse under Articles 88 to 92. Point (f) covers failure to cooperate with an investigation, inspection or request under Article 94(3).

The fine figures in Article 111 are minimum levels for the maximum fine. National law must allow fines at least this high and may set higher levels (Article 111(6)).

Infringement	Legal persons: maximum fine of at least	Natural persons: maximum fine of at least
CASP rules, Article 111(1)(d)	EUR 5,000,000 (Article 111(3)(a)); 5% of total annual turnover (Article 111(3)(c))	EUR 700,000 (Article 111(2)(d))
Points (a) to (d), where profits gained or losses avoided can be determined	Twice that amount, even above the figures above (Article 111(2)(c))	Twice that amount (Article 111(2)(c))
Public disclosure of inside information, Article 88	EUR 2,500,000 or 2% of total annual turnover (Article 111(5)(j))	EUR 1,000,000 (Article 111(5)(i))
Insider dealing, unlawful disclosure, market manipulation and prevention duties, Articles 89 to 92	EUR 15,000,000 or 15% of total annual turnover (Article 111(5)(j))	EUR 5,000,000 (Article 111(5)(i))
Market abuse, where profits gained or losses avoided can be determined	Three times that amount (Article 111(5)(h))	Three times that amount (Article 111(5)(h))

Where the legal person belongs to a group that prepares consolidated accounts, turnover means the consolidated turnover of the ultimate parent undertaking (Article 111(3), second subparagraph).

Fines are one tool among several. For CASP-rule infringements, NCAs must also be able to:

• issue a public statement naming the person responsible and the nature of the infringement (Article 111(2)(a));
• order the person to stop the conduct and not repeat it (Article 111(2)(b));
• impose a temporary ban on any member of the management body, or other responsible person, from exercising management functions in a CASP (Article 111(4)).

For market abuse, Article 111(5) adds disgorgement of profits, withdrawal or suspension of authorisation, temporary management bans, a ban of at least 10 years for repeated infringements of Articles 89 to 92, and a temporary ban on dealing on own account.

How the amount is set

Article 112(1) lists the circumstances an NCA takes into account: the gravity and duration of the infringement; intent or negligence; the degree of responsibility; financial strength; profits gained or losses avoided; losses caused to third parties; the level of cooperation; previous infringements; measures taken to prevent repetition; and the impact on holders and clients, in particular retail holders. Under Article 112(2), NCAs coordinate in cross-border cases to avoid duplication.

Cooperation and measures to prevent repetition are listed factors. A CASP under investigation should keep a dated record of both.

Criminal exposure

Member states could choose not to lay down administrative penalties for infringements that their national criminal law already covered, and rely on criminal penalties instead (Article 111(1), second subparagraph). In market abuse cases, NCAs can refer matters for criminal prosecution (Article 94(3)(d)). Where a member state uses criminal penalties, Article 95(1) requires its NCA to be able to liaise with prosecutors and courts and share information with other authorities. Whether a given breach is criminal depends on the member state.

Where are enforcement decisions published?

Four places, each with limits.

NCA websites (Article 114). A decision imposing a penalty or other measure under Article 111 is published without undue delay after the person concerned has been informed. It states at least the type and nature of the infringement and who is responsible. Investigatory measures need not be published. The NCA may defer publication, publish anonymously or, in limited cases, not publish (Article 114(2)). Appeals and their outcomes are also published (Article 114(3)). Publications stay online for at least five years (Article 114(4)).

ESMA’s register (Article 109). For each CASP it records the authorising authority, the services, the host member states, and the dates of authorisation and any withdrawal. NCAs must also notify ESMA of suspensions and prohibitions under Article 94(1), points (b), (c), (f), (l), (m), (n), (o) and (t), and of public precautionary measures under Article 102; ESMA includes them in the register (Article 109(6)). The register does not list fines.

ESMA’s non-compliant entities file (Article 110). A non-exhaustive list of entities that provide crypto-asset services in breach of Article 59 or 61. Each entry gives at least the commercial name or website and the authority that submitted it.

ESMA’s annual report (Article 115(1)). Aggregate data on administrative penalties, and on criminal penalties where a member state uses them. It does not identify cases.

Refusals of authorisation are reported to ESMA (Article 63(13)). The register contents set out in Article 109(5) do not include refusals, so MiCA does not make them public at EU level.

To check a specific firm:

1. Find the firm in the CASP file of ESMA’s interim MiCA register and look for a withdrawal date.
2. Search the non-compliant entities file by name and website.
3. Find the home NCA in ESMA’s list of competent authorities under Article 93, then search its sanctions or enforcement page.
4. Check the warnings page of the NCA in your own member state.

Significant CASPs (Article 85)

A CASP is significant if it has at least 15 million active users in the Union, on average over one calendar year. The average is the daily number of active users across the previous calendar year (Article 85(1)).

The CASP notifies its NCA within two months of reaching that number. If the NCA agrees that the threshold is met, it notifies ESMA (Article 85(2)). The home NCA gives ESMA’s Board of Supervisors annual updates on authorisations, withdrawal processes and the use of certain Article 94 powers in relation to significant CASPs (Article 85(3)). It may update the Board more often, or before taking a decision, and an exchange of views may follow (Article 85(3) and (4)). ESMA may use its powers under Articles 29, 30, 31 and 31b of the ESMA Regulation where appropriate (Article 85(5)).

What Article 85 does not do:

• It gives ESMA no route to designate a CASP as significant at its discretion. The test is the user count.
• It does not move supervision. The home NCA remains the supervisor, with all its powers under Articles 64, 94 and 111.
• It gives ESMA no direct supervisory powers over significant CASPs. Direct EU-level supervision in MiCA applies to issuers of significant asset-referenced tokens and e-money tokens, which EBA supervises under Article 117.

Article 85 is also unrelated to direct AML supervision by the EU Anti-Money Laundering Authority (AMLA), which has its own selection criteria under separate legislation.

What to watch

• ESMA’s interim register. ESMA republishes it at regular intervals. Note the update date on the ESMA page, and check the withdrawal-date field for firms you deal with.
• NCA publications. Decisions under Article 114 appear on the website of the authority that took them. Check both home and host authorities.
• ESMA’s annual report under Article 115. It is the only EU-wide source of penalty totals that MiCA requires.
• National implementing law. Fine levels can exceed the MiCA minimums (Article 111(6)), and some member states use criminal rather than administrative penalties (Article 111(1)).
• ESMA Q&As. They are not legislation, but they show how ESMA reads the text. Check them before relying on a reading of an ambiguous provision.

This page was revised on 24 October 2026. Earlier versions gave estimates of refusals, withdrawals, fines and criminal referrals that we could not trace to a named, dated source; they have been removed. Article references were corrected against the text of Regulation (EU) 2023/1114.

For corrections, links to published decisions, or counsel referrals on MiCA enforcement, email [email protected].