What is MiCA? The EU crypto rules explained for people who just want to use an exchange

If you've opened a crypto exchange app in the EU over the last year or so, you've probably seen a banner about MiCA. Maybe your exchange asked you to accept new terms, moved your account to a company in Malta or Ireland, or stopped letting you trade USDT. All of that comes from the same law.

This guide explains what MiCA is in plain language, what it actually changed for people who buy and sell crypto, and what it doesn't do, which matters just as much.

MiCA in one paragraph

MiCA stands for Markets in Crypto-Assets. It's an EU regulation, officially Regulation (EU) 2023/1114, and it creates a single rulebook for crypto across the whole EU. Before MiCA, every country had its own approach. Some had registration schemes for crypto firms, some had almost nothing. Now there's one licence, granted by a national supervisor, that lets a company offer crypto services in every EU country.

The timeline

MiCA didn't switch on overnight. The main dates are:

During the transition period, companies that were already registered under old national rules could keep operating while they applied. Some countries cut that period short; none could extend it beyond 1 July 2026. So if you're reading this now, any exchange legally serving EU customers should have a MiCA licence, or be in the process of leaving the EU market.

Who MiCA applies to

MiCA covers three groups:

• Crypto-asset service providers (CASPs). This is the term the law uses for exchanges, brokers, custodial wallets and similar businesses. If you use a centralised exchange, you're dealing with a CASP.
• Issuers of stablecoins. MiCA splits them into e-money tokens, which track one official currency like the euro or the dollar, and asset-referenced tokens, which track a basket of things.
• Anyone publicly offering other crypto-assets, who has to publish a document called a white paper describing the token and its risks.

It doesn't cover everything. Crypto-assets that count as financial instruments, like tokenised shares or derivatives, fall under existing securities law instead. Truly unique NFTs are mostly outside MiCA. So are fully decentralised services with no company behind them, which is one of the grey areas people will be arguing about for a while.

The ten services that need a licence

When a company gets a MiCA licence, it's authorised for specific services, not for "crypto" in general. The law lists ten:

1. Custody and administration of crypto-assets for clients (holding your coins)
2. Operating a trading platform
3. Exchanging crypto for money (euros, dollars)
4. Exchanging crypto for other crypto
5. Executing orders on behalf of clients
6. Placing crypto-assets (helping issuers sell a token)
7. Receiving and transmitting orders
8. Giving advice on crypto-assets
9. Managing crypto portfolios
10. Transferring crypto on behalf of clients

A large exchange will usually hold most of these. When we list an exchange on CryptoRewards, the services from its register entry are shown in the box at the bottom of the page.

What actually changed for you as a user

Most of MiCA is about how companies are run, but a few changes are very visible.

You now deal with a specific EU company

Global exchanges have set up EU companies and moved EU customers to them. OKX's EU business runs through OKX Europe Limited in Malta, Bybit's through Bybit EU GmbH in Austria, Kraken's through Payward Europe Solutions Limited in Ireland. That company is the one that holds your account, and its terms are the ones that apply, including the terms of any bonus. It's also why EU users sometimes see different products and promotions from the rest of the world.

Your coins have to be kept separate

A licensed provider has to keep clients' crypto separate from its own, and it can't use your assets for its own purposes. If the company goes bust, client assets aren't supposed to be part of its estate. This was the biggest lesson from the FTX collapse, and MiCA writes it into law.

Some stablecoins disappeared

Stablecoins offered to the public in the EU now need an issuer authorised as a bank or an e-money institution. Tether, the company behind USDT, didn't go down that route, so many exchanges restricted USDT trading for EEA users and pushed people towards MiCA-compliant coins like USDC or euro stablecoins. That's why you'll see bonuses in the EU that ask you to convert USDT into USDC.

Marketing has to be fair

MiCA requires crypto firms to give clients information, including advertising, that is fair, clear and not misleading. That doesn't mean every bonus banner is perfect, but it does mean the full terms have to exist and say what you'll actually get. We always read those terms before listing a bonus.

Complaints and conflicts of interest

Licensed providers must have a complaints procedure, manage conflicts of interest, and publish their fees. If something goes wrong with your account, you can complain to the company first and then to its national supervisor.

Transfers carry your details

This one is technically a separate law, the EU Transfer of Funds Regulation, but it started on the same day as MiCA's exchange rules. When you send crypto to or from an exchange, the exchange has to record who is sending and who is receiving. That's why you may be asked to confirm whether a withdrawal address is your own wallet or another exchange.

What MiCA doesn't do

This is the part most marketing leaves out.

• There's no deposit guarantee. Your bank account is protected up to €100,000 by a deposit guarantee scheme. Crypto on an exchange isn't. MiCA makes collapses less likely and recovery more orderly, but there is no fund that pays you back.
• It doesn't protect you from price drops. Bitcoin can fall 30% in a week under MiCA just as it could before.
• A licence isn't a recommendation. The supervisor checks that the company meets the rules. It doesn't say the exchange is good, cheap or right for you.
• It doesn't approve bonuses. A licensed exchange can still run a welcome campaign with tough conditions. The licence tells you who you're dealing with, not whether the offer is worth it.
• It doesn't cover everything an exchange sells. Perpetual futures and other derivatives fall under different EU rules, and retail access to them is limited.

How to check whether an exchange has a MiCA licence

It takes about five minutes.

1. Find the EU company's name

   Open the exchange's terms of service on its EU website. The legal entity is usually named in the first paragraph or the legal notice at the bottom, for example "OKX Europe Limited".

2. Look it up in the ESMA register

   ESMA, the EU's securities markets authority, publishes an interim register of authorised crypto-asset service providers on its MiCA page. Search it for the company name or LEI code. You'll see the home country, the supervisor, the date of authorisation and the services covered.

3. Cross-check with the national supervisor

   The supervisor that granted the licence, such as the MFSA in Malta, the FMA in Austria or the Central Bank of Ireland, keeps its own register. It can be more up to date and will show if a licence has been withdrawn.

Be careful with a few look-alikes. "Pre-authorised", "applied for a licence" and "registered as a VASP" are not the same as a MiCA licence. Old VASP registrations were a light anti-money-laundering check, not authorisation.

We do this check for every exchange we list. The result, with the date, is in the "EU entity and MiCA authorisation" box on each exchange page.

Does MiCA change anything about referral codes and sign-up bonuses?

Indirectly, yes. Because your account now sits with an EU company, the bonus terms that apply are that company's terms, not the global site's. That's why a code that advertises "up to 10,000 USDT" on a global page often gives much less in the EU, or works differently. Some EU campaigns also exclude accounts opened with a referral code; Bybit EU's Welcome Gifts are an example.

Our rule of thumb: read the EU terms, not the headline. That's what our exchange pages are for: OKX and Bybit so far.