MiCA Now Fully Enforced: US Crypto Rules Follow EU Model

The European Union's Markets in Crypto-Assets Regulation is now fully enforced as of July 1, 2026. The grace period that allowed firms to operate under old national rules expired with no extensions. Companies serving EU clients must hold full authorization or wind down, said Maria Golenkov, a partner at DLA LLC who heads digital assets governance.

MiCA requires a license for crypto services such as custody and advisory. Exchange services also require authorization. Client assets must be segregated, independently audited and monitored in real time. Capital and transparency requirements apply. Companies must explain risks to clients in plain language, not legalese, Golenkov said.

The U.S. is roughly a year behind the EU on crypto regulation, Golenkov said. The SEC and CFTC published joint guidance in March 2026 clarifying which crypto assets are securities and which are not, and how stablecoins fit in. That followed a September 2025 joint statement that registered exchanges could facilitate trading of certain spot crypto products. The enforceable rules are still coming. Golenkov expects them to look a lot like MiCA.

Golenkov pointed to a pattern: the U.S. operated in enforcement mode for years, suing Coinbase over staking and Binance over deposits, without a clear framework. The guidance from 2025 and 2026 marked a shift, she said. The binding rulemaking is not here yet.

She cited two cases that illustrate what happens without those controls. Galois Capital lost 50% of its assets on FTX, which was not even a qualified custodian. Binance faced SEC and CFTC enforcement in 2023 for improper asset segregation and inadequate risk disclosures, even though it managed billions. "This wasn't incompetence," Golenkov said. "This was what happened when the rules were unclear, so companies gambled on legality."

A Fidelity survey of institutional investors found 58% are already allocating to digital assets. Custody security and regulatory clarity remain their biggest concerns, Golenkov noted. She said advisors need to prove they have controls in place, not just a checklist.

Felix Xu, co-founder of ZX Squared Capital, said operational risk in digital assets is part of the investment risk. In traditional markets, investors rely on a mature network of custodians, administrators, prime brokers and auditors. In crypto, those protections are less consistent. The manager's internal control environment carries more weight, Xu said.

Xu said before discussing returns, advisors should understand who controls the assets, who can move them, how transactions are approved and how positions are independently reconciled. No single person should be able to initiate, approve and settle a transaction. Wallet permissions should be limited by role, transaction size, counterparty and approved address. Custody, trading, valuation and reconciliation should be sufficiently independent from one another.

"The firms that run into problems are the ones with too much fragmented data and no disciplined process for classifying it," Xu said. By the time an audit or regulatory request comes in, the team may be trying to reconstruct activity from wallet histories, spreadsheets and employee knowledge. That is where small inconsistencies become expensive.

The better approach, Xu said, is to build reporting into the transaction process itself. Every material transaction should have a clear business purpose, an approver, a valuation source, and a documented accounting treatment at the time it occurs. Accurate reporting is usually the result of good operational design, not a year-end cleanup.

Golenkov said the firms winning right now started early. The ones that waited until enforcement hit spent the next two years writing settlement checks and rebuilding trust. She estimated that teams often underestimate implementation time by a factor of two or three. "They plan for nine months; it takes eighteen," she said. "The rules are rarely the hard part. Retrofitting controls into systems built without them is."