Fraudsters are impersonating European regulators and cryptocurrency exchanges to target customers of firms forced to shut down under the EU's new MiCA framework, watchdogs across the bloc have told the Financial Times.

The European Securities and Markets Authority (ESMA) confirmed it is aware of "fraudulent practices involving the misuse of ESMA's logo and identity," including falsified documents used to promote scams. The warning follows the expiration of the transition period for the EU's Markets in Crypto-Assets Regulation (MiCA) on July 1, which replaced a patchwork of national regimes with a single authorization that passports across all 27 member states. MiCA is the first comprehensive crypto rulebook adopted by a major economy, covering exchange services, custody, and token issuance—meaning firms that previously operated under lighter national regimes now face uniform capital, governance, and consumer protection standards.

Only 323 firms appear on the register ESMA updated at the end of July. Data provider VASPnet estimated last month that more than 1,700 unlicensed companies must now cease operating. Companies that missed the deadline are operating illegally and must instruct customers to withdraw or transfer their holdings.

That situation has left a large number of people urgently moving funds to unfamiliar providers—precisely the scenario criminals exploit. "This moment is an opportunity for scammers more than usual," Stéphane Pontoizeau, an executive director at France's Autorité des Marchés Financiers (AMF), told the FT.

The AMF has documented cases in which fraudsters posed as its own staff, directing customers of unlicensed firms to transfer assets to fraudulent websites. The Dutch regulator, the Autoriteit Financiële Markten, advised traders to treat any third-party request to move funds with caution and to verify such instructions against the provider's official website and application.

Rather than impose an aggressive wind-down deadline for unlicensed firms operating in France, the AMF has deliberately taken a measured approach. The reasoning: manufactured urgency is exactly what drives people into scams. Pontoizeau said the regulator will refer cases to law enforcement when criminals impersonate the AMF or licensed companies, and urged customers to take their time selecting a replacement provider.

How the MiCA deadline landed

MiCA's transition period ended on July 1, establishing a unified authorization framework across the EU. Coinbase, Kraken, and OKX are among the firms that have secured licenses. Binance, the largest exchange without one, withdrew its application in Greece in June after reports that Greek regulators intended to reject it, stating it would pursue approval in other jurisdictions. Spain's securities regulator ruled out any extension days before the cut-off. The outcome means EU residents whose providers exited the market now have a narrower set of MiCA-licensed alternatives—concentrating customer flows among firms like Coinbase and Kraken while other major exchanges work through national approvals.

Chainalysis estimates losses from crypto scams and fraud reached $17 billion last year—a projection based on historical trends—compared with $6 billion five years earlier. Impersonation ranks among the fastest-growing fraud categories the firm tracks.