Scammers Pose as EU Regulators to Prey on MiCA Deadline Fallout

In brief

French regulator ESMA said its logo and identity are being misused in falsified documents to promote scams, following the passing of the MiCA registration deadline.
More than 1,700 unlicensed firms must wind down EU operations, against 323 that have secured a MiCA license.
Chainalysis puts crypto scam and fraud losses at $17 billion last year, against $6 billion in 2020.

Fraudsters are impersonating European regulators and crypto exchanges to steal from customers caught in the shutdown of unlicensed firms, watchdogs across the bloc have told the Financial Times.

Companies that missed the July 1 deadline to obtain a license under the EU's Markets in Crypto-Assets Regulation are now operating illegally and must tell customers to withdraw or move their holdings. Only 323 firms appear on the register that the European Securities and Markets Authority (ESMA), the EU's markets watchdog, updated at the end of July, while data provider VASPnet estimated last month that more than 1,700 unlicensed companies would have to cease operating.

That has put a large number of people in the position of hurriedly moving funds to an unfamiliar provider, which is precisely the moment criminals want. "This moment is an opportunity for scammers more than usual," Stéphane Pontoizeau, an executive director at France's markets regulator the Autorité des Marchés Financiers (AMF) told the FT.

The AMF has recorded cases of fraudsters posing as its own staff, telling customers of unlicensed firms to transfer assets to a fake website. ESMA said it is aware of "fraudulent practices involving the misuse of ESMA's logo and identity," including falsified documents used to promote scams. Dutch regulator the Autoriteit Financiële Markten said traders should treat any third-party request to move funds with caution and verify it against the provider's official website and app.

The AMF has declined to set an aggressive wind-down date for unlicensed firms operating in France, reasoning that manufactured urgency is what pushes people into scams, and has urged customers to take their time choosing a replacement provider. Pontoizeau said the regulator will refer cases to law enforcement where criminals impersonate it or licensed companies.

How the deadline landed

MiCA replaced a patchwork of national regimes with a single authorization that passports across all 27 member states, and its transition period ended on July 1. Coinbase, Kraken and OKX are among those licensed.

Binance is the largest firm without one. It withdrew its application in Greece in June after reports that the regulator would reject it, and said it would seek approval elsewhere. Spain's securities regulator ruled out any extension days before the cut-off.

Chainalysis puts losses to crypto scams and fraud at $17 billion last year, a projection based on historical trends, against $6 billion five years earlier. Impersonation is among the fastest-growing categories it tracks.