MiCA Regulation and EU Crypto Rules: A Practical Guide for Merchants

If you run a business and simply accept crypto as payment, you almost certainly do not need a MiCA license. The license requirement applies to the provider that processes, holds, or converts crypto for you, not to you for receiving a USDT payment for your software or online store. Most MiCA coverage misses this important distinction because it's written for exchanges, not for the merchant who wants to know, "Does this even apply to me?"

This guide answers that question first, then explains what MiCA actually is, what changed on 1 July 2026, which stablecoins you can still accept in the EU, and how to check in five minutes whether your payment provider is authorized. It points you towards the sources so you can check for yourself.

What is MiCA, in plain terms?

MiCA (Markets in Crypto-Assets) is the EU's single rulebook for crypto assets. It replaces 27 different national rules with one system for licensing all crypto-asset service providers in the bloc.

The main reasons for it are to protect consumers, keep the market in good shape, and support financial stability. For a business, the practical effect is simpler than the legal text suggests: MiCA rules decide who can offer crypto services in the EU, what conditions they must meet, and what happens to the providers you rely on. Adopting Bitcoin doesn't automatically make any shop a regulated financial institution.

Regulation sorts crypto assets into three categories, and each category changes the rules.

The three asset categories under MiCA

E-money tokens (EMTs)

Stablecoins pegged to a single fiat currency, like USDC or EURC. These face the strictest issuer rules: full reserve backing, redemption rights, and authorization as an e-money or credit institution.

Asset-referenced tokens (ARTs)

Tokens referencing a basket of currencies, commodities, or other assets. Rarer in payments, heavier on reserve and governance requirements.

Other crypto assets

Everything else, Bitcoin, Ethereum, and the majority of coins, which fall under general MiCA provisions rather than the stablecoin-specific ones.

How this affects you: the stablecoin you settle in determines your compliance exposure. Inside the EU, a euro or dollar EMT from an authorized issuer, like EURC or USDC, is the clean choice. We explain why below. 

Merchant or CASP? Where accepting payment ends and a regulated service begins

This question decides whether MiCA is your problem or your provider's, and almost no guide answers it directly.

MiCA regulates crypto-asset service providers (CASPs). You become one by providing a crypto service to third parties as a business: custody of clients' crypto, operating an exchange, executing orders, transferring crypto on behalf of others, and similar activities. The full list sits in Article 3 of the regulation.

Accepting crypto as payment for your own goods or services is not on that list. When a customer pays you 200 USDT for a SaaS subscription, and you keep or convert it as your own revenue, you're a merchant receiving payment, not a CASP providing a service.

When a merchant does cross the line

You cross the line when you start doing CASP-type things with other people's crypto. Some examples worth knowing:

• You hold crypto balances for your users (a wallet feature, a marketplace escrow) rather than just taking payment.
• You convert or exchange crypto for customers as a service, not for your own settlement. 
• You transfer crypto on behalf of third parties.

If none of that describes you, you're a merchant, and the license burden sits with the processor and the exchange behind your checkout. If some of it does, take proper legal advice, because you may be inside the CASP perimeter without realizing it.

The practical rule: accepting payment is not a regulated service. Handling other people's crypto usually is.

Who does MiCA actually apply to?

MiCA applies to any firm providing crypto-asset services to clients in the EU, regardless of where the firm itself is based. That last part catches many businesses off guard, and a dedicated section on non-EU companies appears further down.

The regulated crypto-asset services under MiCA include:

• Custody and administration of crypto assets
• Operation of a trading platform
• Exchange of crypto for funds
• Exchange of crypto for other crypto
• Execution of orders
• Placing of crypto assets
• Reception and transmission of orders
• Providing advice 
• Providing portfolio management
• Transfer services for crypto assets

If your provider does any of these for EU clients, it needs CASP authorization. If you merely accept payment, you don't, but you have a strong interest in your provider being properly licensed, because their compliance failure becomes your disruption.

The MiCA timeline and the 1 July 2026 deadline

MiCA rolled out in phases, and one date now matters more than the rest.

30 June 2024 – rules for stablecoins (EMTs and ARTs) became applicable. From this point on, issuing a stablecoin in the EU without authorization was a breach.

30 December 2024 – the full CASP framework took effect, and the grandfathering clock started.

1 January 2026 – DAC8 tax-reporting obligations began (more on this below).

1 July 2026 – the hard deadline. The transitional "grandfathering" period ended.

What grandfathering was, and why it's over

Grandfathering was a special rule that let firms legally operating before 30th December 2024 continue under their old national licenses while their MiCA application was being processed. According to Article 143(3), the cover was valid "until 1 July 2026 or until they are granted or refused authorization," depending on which came first.

Each member state sets its own deadlines. France, Malta, Luxembourg, Estonia and Spain used the full 18 months. Germany and Ireland reduced it to 12 months. The Netherlands and Finland were out earlier still. But according to ESMA, 1 July 2026 was the final deadline, and no member state could extend beyond it.

What changed on 1 July 2026

As of that date, any firm providing crypto-asset services in the EU without full MiCA authorization breaches EU law and must stop serving EU clients. There's no transitional cover left anywhere in the bloc. For you as a merchant, this is the moment your provider either has a CASP license or shouldn't be operating in the EU, which is exactly why the provider check further down is worth five minutes of your time.

Worth noting the framework itself is still moving: the European Commission opened a targeted consultation on reviewing MiCA in May 2026, with the window extended to 30 September 2026, so some details may shift.

What a CASP license actually requires

You won't apply for this, but understanding what it means can help you spot a legitimate provider and why the phrase "We're global, no restrictions" should raise a warning flag.

Capital, substance, and authorization

Minimum capital

Between €50,000 and €150,000 depending on the services offered – €50,000 (Class 1), €125,000 (Class 2, which includes Class 1 services), and €150,000 (Class 3, which includes Class 2), rising with the scope of services offered 

Real EU presence

A registered office in an EU member state, and at least one director resident in the EU. A letterbox address doesn't qualify.

Authorization from an NCA

The firm applies to the national authority of the country where it is based and submits documentation on governance, AML controls, custody of client funds, and operations. 

Passporting

If a CASP is approved in one member state, it can operate across the whole European Economic Area (EEA) with that one license. This means that one license can cover the whole EEA.

The application isn't trivial. Authorisation is a substantial process – completeness review followed by full assessment – and takes months in practice. A provider claiming to serve EU clients should be able to name its NCA and its authorization number without hesitation.

Which stablecoins can you still accept in the EU?

Here's the fear that sends merchants searching, and the answer is more reassuring than the headlines suggest.

The rules for stablecoins themselves (EMTs and ARTs) have applied since 30 June 2024 – that's when offering a non-authorised stablecoin to the EU public became a breach. The 1 July 2026 date is separate: it's the end of the transitional period for service providers (CASPs). So the stablecoin restrictions didn't begin in July 2026; what changed then was that providers lost their transitional cover. By mid-2026, roughly two dozen issuers had cleared MiCA authorisation for their stablecoins (counts vary by tracker and date). USDC and EURC, from MiCA-authorised Circle, are the prominent compliant options, and EURC holds a large share of the euro-stablecoin market – estimates range widely depending on the denominator used.

USDT is the one everyone asks about. Tether has not pursued MiCA authorization, so USDT counts as a non-authorized EMT. Major EU exchanges delisted it through 2024 and 2025: Coinbase in December 2024, Crypto.com in January 2025, Binance and Kraken in March 2025.

Delisting is not the same as a ban

This is an important difference, but people often confuse the two. EU users can still hold USDT for themselves, trade on decentralized exchanges, and use it in DeFi. These activities are not included in MiCA Title V. What a MiCA-authorised CASP cannot do is offer USDT to the public in a way that facilitates acquiring it – chiefly listing it for trading. ESMA clarified in March 2025 that custody and transfer of non-compliant stablecoins aren't themselves prohibited; what's restricted are the services that help the public buy them, and the "sell-only" wind-down window closed on 31 March 2025. In practice, that's why USDT trading pairs disappeared from regulated EU exchanges.

So, if a customer pays you in USDT from their own wallet, they're not doing anything illegal, and you receiving it isn't illegal either. The friction appears when you want to convert or cash out through a regulated venue.

The practical fix: auto-convert to an authorized EMT

One practical approach some merchants use is to accept the USDT a customer pays with, then settle into an authorised stablecoin like USDC or EURC. Worth being precise here: exchanging one crypto-asset for another is itself a regulated service under MiCA, so whether a given auto-conversion setup is compliant depends on how it's structured and who provides it – there's no blanket carve-out for settlement conversion. If you're EU-facing, treat this as a question for your provider and, where needed, your compliance advisor, not a default you can assume.

The fiat leg: why CASP alone isn't the whole picture

This is the hidden counterparty most merchants overlook, and it explains a lot of confusing provider structures.

When a processor takes crypto and pays out euros to your bank account, two different regulated activities are happening. The crypto side is a CASP service. The fiat side is more nuanced than it looks: per the EBA, exchanging crypto for fiat isn't itself a PSD2 payment service, but a separate money transfer can be. Where a fiat payment service is involved, it needs a PSD2 authorisation or a partnership with a licensed institution, and the EBA's no-action period on this closed on 2 March 2026. If your provider settles euros to your bank, ask how that leg is licensed.

That's why serious crypto-to-fiat providers either hold both authorizations or partner with a licensed EMI for the fiat leg. When you pay in euros, there's a regulated payment institution somewhere in the chain that you didn't choose and may never see. If you know it's there, you can ask the right questions. For example, who is responsible for the fiat leg, and are they licensed?

If you settle purely in stablecoins and never touch euro rails, this leg may not apply. The moment fiat enters, PSD2 does too. 

Travel Rule: the one MiCA-adjacent rule your checkout can feel

Most of the MiCA perimeter lives in your legal team's inbox. The Travel Rule is an exception because it can affect conversion.

The EU's Transfer of Funds Regulation (TFR) implements the Financial Action Task Force (FATF) Travel Rule for crypto. CASPs must collect and share information about the people involved in a transfer. Unlike in some places, the EU has no lower limit for these transfers, but it requires more thorough checks for transfers involving self-hosted wallets worth more than €1,000.

What this means at checkout

When a customer pays from a self-hosted wallet (MetaMask, a hardware wallet), a compliant provider may need to collect additional information to satisfy TFR obligations, particularly above €1,000. In practice, that can mean an extra verification step for larger self-custody payments. It's the one piece of the compliance perimeter that shows up in conversion data rather than only in a compliance file, so it's worth knowing your provider's approach before it surprises a high-value customer.

DAC8: what your provider now reports about you

Regulation and tax reporting connected in 2026, and this is the part your CFO should know.

DAC8, implementing the Crypto-Asset Reporting Framework (CARF), took effect on 1 January 2026. It requires CASPs to collect detailed data on their users and transactions, with the first automatic cross-border exchanges of that information between EU tax authorities taking place in 2027.

For your business, the takeaway is straightforward: your provider will report information about your account and activity to tax authorities. This isn't optional and isn't a reason for alarm; it's the same direction of travel as bank reporting. But it does mean your crypto payment flows are now visible to tax authorities in a way they weren't before, so your accounting should assume that visibility rather than be surprised by it.

Penalties: what happens if you don't comply?

The consequences fall on the providers, not the merchants that simply accept payment. They explain why using an unlicensed provider is risky for you.

The penalties for breaking MiCA rules are designed to be severe. Administrative fines under MiCA Article 111 for CASP breaches – including operating without authorization – start at a floor that member states must provide of at least €5 million or 5% of annual turnover for legal persons, whichever is higher, with higher ceilings for specific infringement types. Authorities can also suspend services, and the framework allows for sanctions against management, applied case by case. A provider serving EU clients without authorization after 1 July 2026 falls under this regime.

You are indirectly affected, but it is real. If your processor gets shut down or sanctioned, your settlement stops, your funds may be frozen mid-flow, and you're left trying to find a replacement. It's better to check who is allowed to use the software before you add it to your system, not after.

Non-EU businesses selling into the EU

"We're based in Dubai, so MiCA doesn't apply to us." This is the most expensive misconception in the whole topic.

MiCA applies based on where your clients are, not where you are. If you provide crypto-asset services to clients in the EU, you're in scope regardless of your headquarters. For a merchant merely accepting payment, this is less of an issue, but for anything resembling a CASP service aimed at EU customers, it's decisive.

Reverse solicitation is a narrow exception, not a strategy

There's one exception: reverse solicitation, where an EU client contacts a non-EU company on their own, with no marketing or solicitation from the company. ESMA interprets this exception very narrowly. Any marketing aimed at EU users, a localised website, EU-language ads, EU-targeted promotions, breaks it.

Treating reverse solicitation as a business model is a mistake. In practice, a non-EU business serious about the EU market either geofences EU users out or works through a licensed EU provider. The false confidence of "they can't touch us" is exactly what gets firms into trouble.

How MiCA compares to other jurisdictions

MiCA is the most comprehensive framework, and it's become the template others borrow from.

The pattern is convergence. The UK and US have since built their own stablecoin frameworks, and major markets are converging toward licensed issuers and reserve requirements. For a business operating across regions, the practical implication is that "compliant in the EU" is increasingly close to "compliant-ready elsewhere," and the provider checks below travel reasonably well across borders.

Checklist: how to verify your provider in five minutes

This is the part that turns abstract regulation into a five-minute action, and it's the single most useful thing you can do after reading this.

• Ask for the exact legal entity name and authorization number. A licensed provider gives you both without friction. Hesitation is a red flag.
• Check the ESMA register. ESMA maintains a public Interim MiCA Register of authorised CASPs, stablecoin white papers, and – importantly – a list of non-compliant entities flagged by regulators. Confirm your provider is on the authorised list and not on the non-compliant one. 
• Check the NCA register. Cross-reference with the national competent authority that supposedly issued the license.
• Watch for "no restrictions, fully global" claims. Genuine MiCA authorization comes with a defined perimeter. A provider selling borderlessness as a feature may be operating outside one.
• Ask who handles the fiat leg. If they settle euros to your bank, confirm there's a licensed PI or EMI in the chain.
• Confirm the settlement stablecoin. For EU exposure, settling in an authorized EMT like USDC or EURC is cleaner than holding a delisted one.
• Ask about Travel Rule handling for self-hosted wallet payments, so it doesn't surprise a large customer at checkout.

Run this before you integrate. Which crypto payment provider is best for a business accepting payments in the EU comes down less to fees than to whether the provider can pass this list.

To sum up

MiCA didn't turn every business accepting crypto into a regulated entity. It regulated the providers, set a hard deadline of 1 July 2026, and left ordinary merchants with one real job: use a properly authorized provider and settle in a compliant stablecoin.

The USDT fear is overblown in one direction and real in another. Your customer can still pay you with it, and you can still accept it. What regulated EU venues stopped doing is offering it for public trading – custody and transfer aren't themselves prohibited. If you're EU-facing and considering auto-conversion into USDC or EURC at settlement, check with your provider how that's structured, since exchanging one crypto-asset for another is a regulated service rather than an automatic exception. 

If you do just one thing after reading this, run the five-minute provider check. In a complicated legal topic, checking an authorization number against the ESMA register is the most valuable five minutes you'll spend, and it protects the part of the chain you actually depend on.

 

FAQ