With the Markets in Crypto-Assets Regulation (MiCA), the EU has created uniform rules for crypto service providers. A licence in one member state allows a company to "passport" its services across the bloc (source [1]). In 2025, the large exchanges secured their licences.
Licences for the big exchanges
OKX and Crypto.com received MiCA licences in January 2025, followed by Bybit in May. On 20 June 2025, Coinbase obtained its licence from Luxembourg's financial regulator CSSF and named Luxembourg its new EU headquarters (source [2]). Gemini applied in Malta (source [3]).
Small member states such as Malta and Luxembourg are becoming licensing hubs. Critics warn of a "race to the bottom" in which companies choose the most lenient supervisor (source [3]).
Stablecoins: additional rules from March 2026
Some services involving euro or dollar stablecoins (e-money tokens) also count as payment services under the EU Payment Services Directive PSD2. In June 2025, the European Banking Authority (EBA) recommended that national supervisors require the additional PSD2 authorisation only after a transition period ending on 2 March 2026 (source [4]). Providers that have not applied by then should stop these services (source [5]).
What it means for bitcoin users
- More protection: Licensed providers must meet requirements on capital, governance, disclosure and safeguarding of customer assets.
- Higher hurdles: Small providers may struggle with the costs of compliance.
- Self-custody unaffected: MiCA regulates service providers – people who hold their own bitcoin in their own wallet are not affected.
Sources
