Fenced in: ESMA tells licensed crypto firms to cut off non-MiCA stablecoins
The European Securities and Markets Authority (ESMA) has published an opinion directing national regulators to require authorised crypto-asset service providers (CASPs) to stop servicing stablecoins that do not comply with the Markets in Crypto-Assets Regulation (MiCA). The opinion, dated 8 October 2026, covers asset-referenced tokens (ARTs) and e-money tokens (EMTs), and gives firms until about 8 January 2027 to clear legacy exposure. It names no specific token, but the commercial effect has already reached customers.
Fenced in
ESMA addresses the opinion to national competent authorities (NCAs), asking them to ensure that MiCA-authorised CASPs do not maintain, introduce or facilitate client access to non-compliant ARTs and EMTs. The expectation applies to every MiCA service, whether offered alone or in combination, including trading, exchange, order execution, advice, transfers, custody and portfolio management. ESMA said, as reported by Cointelegraph, that CASPs:
should cease providing services related to non-MiCA-compliant stablecoins to clients in the European Union
ESMA, as quoted by Cointelegraph
Warnings, disclosures and client acknowledgements will not meet the expectation. ESMA wants technical, contractual and organisational controls that stop clients acquiring new exposure or increasing existing positions. LeapRate summarised the practical consequence in plain terms: a firm cannot keep a non-compliant token by moving it from one service line to another.
Custody is no longer a side door
ESMA's January 2025 statement had left room for firms to continue custody and transfers of non-compliant stablecoins. According to CryptoPotato, the new opinion brings both into scope. Where an NCA finds legacy exposure, it should require remediation as soon as possible and no later than three months after publication. Until then, permitted activity is limited to liquidating, converting, withdrawing, transferring or safekeeping the assets, and ESMA expects that activity to be time-limited, risk-based and closely supervised. New purchases, promotion and active distribution fall outside the window.
Customers will feel it first
Cointelegraph reports that Coinbase has identified Tether's USDT and PayPal's PYUSD as non-compliant in a help-centre notice, telling customers in the European Economic Area to withdraw affected balances by 30 October, with remaining balances converted automatically into USDC or another supported asset. The same report notes that ESMA itself did not name any token. The licensing picture adds context: CryptoPotato, citing CASP Tracker, reports that by 21 July fewer than 300 of more than 3,000 firms serving EU crypto clients held a licence.
Opinion, not yet law
An ESMA opinion states a supervisory expectation and does not create new law, and enforcement sits with each NCA. The practical weight is still considerable, because a licensed firm that ignores a regulator's expectation invites scrutiny of its authorisation. Unchained reports that the European Commission is preparing a revision of MiCA to address foreign stablecoin issuers, expected in 2027, so the position for offshore issuers may move again. Readers who followed our earlier coverage of how MiCA's stablecoin rules could affect major offshore issuers will recognise the direction of travel.
What now?
Crypto businesses that serve EU clients, or hold a MiCA authorisation, should act promptly to:
identify every ART and EMT listed, held or supported on the platform, and confirm whether each is issued in compliance with MiCA;
map each MiCA service line (trading, exchange, custody, transfers, advice and portfolio management) to those tokens, since ESMA treats the services alone or combined;
implement technical, contractual and organisational controls that block new acquisitions and increases in exposure, rather than relying on disclosures or client acknowledgements;
prepare a client communication and wind-down plan for legacy balances, with the three-month period running to about 8 January 2027, and confirm any earlier deadline set by the relevant NCA; and
brief the board and compliance function, and document the basis for any residual safekeeping that continues after the deadline.
The EU has chosen to enforce its stablecoin perimeter through the licensed intermediaries that EU clients use, rather than against issuers outside its borders. That approach differs from the issuer-focused authorisation model in the United States and from the settings still being developed in the United Kingdom, Cayman Islands and Australia, though each regime ultimately asks who may offer a payment stablecoin to local users. Whether platform-level controls can hold the line for tokens that users can self-custody and move on-chain remains to be seen.
By Michael Bacina
