EU scam surge follows MiCA compliance deadline, officials warn

ESMA's MiCA registry listed 338 registered crypto-asset service providers as of July 31, up from roughly 194 in May. That is a 74% increase in three months. Still, that represents a small fraction of the more than 3,000 crypto companies previously operating under national licenses. Data provider VASPnet estimates that more than 1,700 firms will eventually stop serving EU clients.

The imbalance pushes a large share of investors toward a small number of licensed platforms. Every account migration – verifying identity, transferring assets, updating credentials – creates a moment where users are vulnerable. Binance was the most notable firm to wind down EU services without a MiCA license. Its former EU clients now have to move assets to an authorized platform, re-verify their identities and follow instructions that look similar to what a phishing email might contain.

National regulators are publishing warnings about unauthorized crypto businesses. Belgium's Financial Services and Markets Authority (FSMA) reminded investors that cryptocurrency holdings are generally not covered by compensation schemes.

Chainalysis estimated that crypto-related scams generated roughly $17 billion in illegal revenue in 2025. AI-powered social engineering has made phishing campaigns more effective through fake websites, counterfeit customer-support agents and authentic-looking emails.

Impersonation scams existed before MiCA. The transition gave fraudsters a wider window. Regulatory changes that force users to move between platforms create short windows of confusion that criminals exploit. The lesson extends beyond Europe: any major regulatory shift that relocates clients – new licensing rules, exchange closures – will produce the same pattern.

ESMA's advice is the simplest defense. Verify instructions by going to the regulator's website directly, rather than clicking links in an email or message.