MiCA Wind-Down Phishing: How to Verify a Withdrawal Notice

Since 1 July 2026, crypto service providers in the European Union can only operate with an authorisation under the MiCA regulation. Firms that missed the deadline have to wind down their EU business and tell customers to withdraw their balances. Roughly 1,700 providers are in that position, while around 323 have received authorisation, according to analyses of the register published in late July. Further authorisations are coming through, so the count keeps moving.

That gap now feeds a wave of fraud. Tens of thousands of European investors are receiving a message that is entirely routine: their provider is closing its EU operation and the balance has to move. For the criminals behind the wave, the request no longer has to be made to sound plausible. It only has to look genuine.

The French markets regulator AMF warned on 5 and 6 August that perpetrators are posing as staff of supervisory authorities or licensed trading venues and telling customers of unauthorised providers to move holdings quickly. Stéphane Pontoizeau, who covers this area at the AMF, said in international reporting that the current moment offers fraudsters a better opportunity than usual. ESMA, the EU-wide securities supervisor, has found its own name and logo being misused in letters of this kind.

The forgeries are well made. The warnings document copied letterheads and file references, rebuilt websites that mirror a genuine provider's layout, transfer instructions pointing to wallets owned by the operators, and phone calls from supposed officials.

What the letters almost never include is a register entry the customer could look up, or an independent way to reach the sender. What they do include is a destination address and a reason to hurry.

A second variant is subtler. Instead of an address, the message carries a link to a platform that claims to be MiCA-licensed. The customer opens an account and verifies their identity with an ID document. The balance they see on the screen is a number on an interface controlled by the operators. Withdrawals later fail over alleged taxes. This version is more dangerous because it copies the ordinary account-opening process.

The Register Check That Settles the Case

One check settles most of these cases, and it takes about two minutes. Look the provider up in an official register, using an address you type yourself rather than a link from the message. Fraudsters can rebuild any logo and fake any confirmation page. They cannot create an entry in a supervisor's database. If a supposedly licensed provider is not listed, the matter is settled, however convincing the letter looks.

The European securities regulator maintains the central directory of all MiCA-authorised service providers. It shows whether a company holds an authorisation and which member state granted it. The entry also lists the services the authorisation covers. A provider can be authorised without the authorisation covering everything it offers. Search for the legal entity name, not the brand. Many venues trade under a brand name while the registration sits under a different company. If the message gives no company name at all, that is itself a finding. Of the roughly 323 authorised companies, only 21 are trading platforms in the narrow sense, meaning venues where retail investors actually buy and sell.

For providers with a German authorisation, BaFin keeps a company database that shows which permission was granted. It needs no registration and is the faster route when the provider is based in Germany.