Crypto users in Cyprus are being urged to check exactly which company holds their assets after the end of the EU’s Markets in Crypto-Assets Regulation, known as MiCA, transition forced unauthorised providers to withdraw and gave fraudsters a convincing new way to target investors.

Since July 1, 2026, companies may provide crypto-asset services in Cyprus only if they are permitted to do so under the MiCA.

The deadline did not mark the introduction of MiCA itself. Rules covering crypto-asset service providers had applied since December 30, 2024, but Cyprus allowed businesses already operating under its previous national framework to continue temporarily.

That arrangement ended on July 1 or earlier if a company’s MiCA application was approved or rejected.

The Cyprus Securities and Exchange Commission (CySEC) instructed providers wishing to remain in the market to submit their applications by February 27, 2026. Those that did not apply were required to prepare plans for winding down their operations.

The change means a company’s earlier presence on Cyprus’ national register is no longer enough. Investors must now confirm that the legal entity providing their account is permitted to operate under MiCA.

That task is not quite as simple as checking whether a familiar brand appears on a list.

CySEC maintains one register for crypto-asset service providers authorised under article 63 and another for regulated financial companies using the article 60 notification route.

Article 63 covers companies applying for authorisation as crypto-asset service providers. Article 60 allows certain businesses already regulated in the financial sector, including investment firms and electronic money institutions, to provide specified crypto services after notifying their competent authority.

The two lists should not be added together without checking for cross-references or duplication. CySEC’s records, for example, connect eToro Europe with the article 60 notification route, even though its name is also visible through the regulator’s wider MiCA pages.

For that reason, the number of names shown on a webpage should not be described as the total number of crypto exchanges licensed in Cyprus. The companies are not all exchanges, do not all use the same regulatory route and are not authorised for identical services.

A provider may be permitted to safeguard crypto assets, execute orders or arrange transfers without being allowed to operate a trading platform. Investors must therefore check both the company and the specific activities listed beside it.

Companies authorised in another EU member state can also serve customers in Cyprus through MiCA’s passporting system. Such businesses will not necessarily appear among the locally authorised companies on CySEC’s article 63 page.

The most reliable starting point is the wider ESMA register, followed by the detailed entry held by the national authority responsible for the company.

One prominent Cyprus-authorised provider is Revolut Digital Assets Europe, which is based in Limassol and holds CySEC licence CASP001/25.

According to its official entry, the company was registered on October 20, 2025, with Revolut recorded as its approved trading name.

Its permitted activities include custody and administration of crypto assets, operating a trading platform, exchanging crypto assets for money or other crypto assets, placing crypto assets and providing transfer services.

However, even a recognised name should be checked carefully. MiCA authorisation belongs to a specific legal entity, not automatically to every subsidiary, website or service carrying the same brand.

A criminal can copy the name, logo and licence number of a legitimate business while replacing its website address or payment instructions. Finding the real company on a register does not prove that the email, telephone call or social media account contacting an investor is genuine.

The regulatory transition has made that deception easier.

Some legitimate providers are contacting customers because their EU services are being restricted, transferred to an authorised entity or closed. Fraudsters can imitate those notices and tell victims that their accounts must be moved urgently to comply with MiCA.

The message may claim that a provider has lost its licence, that a wallet is about to be frozen or that assets must be transferred to a new “regulated” account. The address supplied belongs to the criminal.

Other scammers pose as regulators or recovery specialists and claim that they have located money stolen in an earlier fraud. The victim is then asked to pay a tax, legal charge or administrative fee before the assets can supposedly be released.

CySEC’s July announcement warned that customers dealing with unauthorised providers do not benefit from MiCA safeguards, including protections concerning client assets.

It advised investors to verify their provider through ESMA’s register and act promptly if the company is not authorised, including by identifying an approved provider or considering a self-hosted wallet.

A self-hosted wallet gives its owner direct control of the assets but also places responsibility for protecting the private keys and recovery phrase entirely on that person.

CySEC has separately warned regulated businesses about the risks created when customers and assets are moved from unauthorised companies to a smaller group of approved providers.

In a regulatory circular, it said abrupt exits could weaken anti-money laundering controls, reduce transparency over financial flows and create opportunities to conceal criminal money or evade sanctions.

Authorised companies receiving new customers must conduct appropriate checks and ensure their staffing, onboarding procedures and transaction-monitoring systems can cope with any increase in activity.

Customers should not automatically be rejected because they previously used an unauthorised provider. Instead, CySEC said companies should examine each case individually and apply stronger checks where higher risks are identified.

The Cyprus changes form part of a much larger European shake-up.

Data provider VASPnet estimated that more than 1,700 unlicensed crypto companies could face closure, relocation or the transfer of their EU operations after the transitional arrangements ended.

An analysis of ESMA’s register identified 323 authorised providers at the end of July, while separate industry estimates suggested that up to 10 million users could be affected by the restructuring.

These are not official EU counts of companies already closed or customers already moved. The number of authorised providers also changes as national authorities grant further approvals and ESMA updates its register.

Another dataset produced a different picture. TRM Labs identified 1,343 operating crypto providers in the European Economic Area on July 1, of which 281 held MiCA authorisation and 1,062 did not.

The difference reflects the way the figures were compiled. Some estimates begin with old national registration lists, which may include inactive or very small entities, while others attempt to count companies still providing services.

The reliable conclusion is not that precisely 1,700 platforms closed overnight, but that a substantial number of providers reached July without MiCA authorisation and had to restrict or wind down their EU business.

ESMA instructed those companies to stop accepting new EU customers, opening accounts and marketing their services. They could continue only with activities needed to sell or transfer assets, close positions and complete an orderly withdrawal.

The movement created an opening for impersonation fraud across Europe.

ESMA confirmed that criminals had misused its name, identity and logo, including in falsified documents. Regulators in France, the Netherlands and Austria have also warned about scams targeting people looking for authorised providers or trying to move their assets.

France’s financial markets regulator received cases involving criminals posing as officials or crypto companies. The Dutch regulator warned that the migration process itself could become an opportunity to deceive retail investors.

The scale of the fraud problem extends beyond MiCA. Chainalysis estimated that worldwide losses from crypto scams and fraud reached $17 billion in 2025, up from $6 billion five years earlier, with impersonation among the fastest-growing methods.

MiCA provides common requirements covering governance, capital, complaints, disclosures, conflicts of interest and the safeguarding of client assets. It does not, however, turn crypto into a low-risk investment.

Prices can still move sharply, projects may fail and investors can lose everything they commit. Crypto assets are generally not protected by the deposit guarantee arrangements covering money held in a bank.

For Cyprus users, the immediate question is therefore not simply whether a brand claims to be MiCA compliant. It is which legal company provides the service, under which regulatory route, for which activities and through which approved website.

Unexpected requests to transfer assets, pay recovery charges, disclose a private key or install screen-sharing software should be treated with suspicion. Links sent through unsolicited emails, messages or social media should also be avoided.

MiCA was designed to remove weak providers and give European customers clearer protections. In Cyprus, it has also made the difference between a trading name and the legal company behind it more important than ever.

For scammers, meanwhile, the regulatory clean-up has supplied something unusually useful. A real deadline, a genuine market disruption and a believable reason to demand money quickly.