ESMA Moves to Close the Custody Loophole for Stablecoins

October 19, 2026 · 8 min read · Inglorious Editorial

If your European settlement stack has a non-compliant dollar-pegged token sitting anywhere inside it, that stack has an expiry date. It is roughly three months away, and it may be shorter depending on which national regulator supervises the firm holding your balance.

On 8 October 2026 the European Securities and Markets Authority (ESMA) published Opinion ESMA75-113276571-1742, on the provision of crypto asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens. The short version: a MiCA-authorised crypto-asset service provider should not provide any crypto-asset service involving a stablecoin that does not meet MiCA requirements. Not trading. Not transfers. Not custody.

The last two matter most, and almost nobody outside crypto has worked out why yet.

The Legal Hook Is Conduct, Not Licensing

ESMA did not write a new rule. It could not. The opinion is issued under Article 29(1)(a) of the ESMA Regulation (Regulation (EC) No 1095/2010), a supervisory convergence power. It is addressed to national competent authorities (NCAs), not to firms, and it carries no fine of its own.

That is not the comfort it sounds like. The instrument ESMA reached for is Article 66(1) of MiCA, the duty on CASPs to act honestly, fairly and professionally in the best interests of clients and prospective clients. ESMA's position is that providing any MiCA service in a non-compliant ART or EMT should give rise to a presumption of incompatibility with that duty, because the firm would be knowingly facilitating client exposure to risks created by the absence of Title III and Title IV safeguards.

Paragraph 12 is blunt: "ESMA considers that CASPs should not provide crypto-asset services in relation to ARTs or EMTs that are not compliant with the applicable requirements under MiCA."

ESMA also pre-empts the obvious defence. The conclusion, it says, does not depend on whether a given service itself amounts to an offer to the public or an admission to trading within the meaning of Articles 16(1) or 48(1). So the argument that custody is passive, that transfers are just plumbing, that you are not marketing anything, is dead on arrival. Conduct rules do not care about your taxonomy.

Every Service, Including The Boring Ones

Paragraph 21 lists the scope and it is the whole licence: operating a trading platform, exchange services, execution of orders, reception and transmission of orders, placing of crypto-assets, advice, transfer services, custody, and portfolio management.

Paragraph 22 goes further. CASPs should not maintain, introduce or facilitate access to non-compliant ARTs or EMTs for EU clients through their services, and should put in place technical, contractual and organisational controls stopping EU clients from acquiring or increasing positions.

This is a real escalation. ESMA's earlier position, in its statement of 17 January 2025, restricted trading and services that amounted to public offers but left plain custody and transfers alone. CryptoSlate and Cointelegraph both read the October opinion as extending supervisory expectations to custody and transfers, permitting them only temporarily so that clients can get out.

Which means the quiet workaround a number of firms adopted before the opinion, delist the pair, keep the wallet, keep the deposits, keep the flow, is no longer viable. CryptoSlate's analysis is that removing trading pairs alone may not satisfy ESMA where the authorised provider carries on servicing the token. Anything left has to fit inside a narrowly permitted, supervised wind-down.

And before anyone drafts a risk warning: paragraph 19 says investor protection and market integrity can be achieved "only by refraining from the provision of services". Disclosures, warnings and signed client acknowledgements are expressly rejected as substitutes. You cannot consent your way out of this one.

The Three Months Are An Outer Limit, Not An Entitlement

Paragraph 27 tells NCAs that where they find remaining legacy exposures, they should require remediation as soon as possible and no later than three months after publication. The opinion fixes no calendar date. CoinDesk, Cointelegraph and CryptoSlate all do the arithmetic and land on 8 January 2027. Treat that date as journalism, not as text.

Two things make it worse than it reads.

First, Cointelegraph reports that national regulators can set earlier deadlines. The three months run from publication, not from the day your provider gets round to telling you. Second, CryptoSlate notes that national supervisors decide whether to allow exit services at all. There is no guaranteed glide path.

What survives, under paragraph 24, is tightly drawn: liquidation, conversion, withdrawal, transfer or safekeeping of existing holdings. It must not facilitate new acquisitions, promotion, trading, active distribution or continued market availability. It must be time-limited, clearly communicated to clients, and subject to close supervisory scrutiny. Paragraph 27 repeats the point, sell-only, conversion, transfer or withdrawal, risk-based and closely supervised.

ESMA has also said, at paragraph 28, that it will monitor timely application in cooperation with NCAs, and at paragraph 25 it asks NCAs to go and check whether any CASP they authorise is currently providing these services. That is a sweep instruction. Expect your provider's compliance team to act faster than the headline deadline, because their supervisor is about to ask.

Which Tokens, And Who Has Already Moved

ESMA names no token and no issuer. Everything below comes from reporting and from exchanges' own customer guidance.

CoinDesk identifies Tether's USDT as the largest stablecoin by market capitalisation and the standout example not authorised under MiCA, and says PayPal USD (PYUSD), the third largest, is also not authorised.
Cointelegraph reports that Coinbase identified USDT and PYUSD as non-compliant and told European Economic Area customers to withdraw affected balances by 30 October, with remaining balances automatically converted into USDC or another supported asset or currency.
CryptoSlate reports that Kraken's guidance, updated 13 April, lists USDT among stablecoins delisted for EEA trading while still permitting deposits and withdrawals, though it discourages deposits.

Note the gap between those two approaches. One is a hard exit with forced conversion. The other is the delist-but-keep-the-rails model that the October opinion now puts under pressure. If your counterparty is running the second model, it is going to change, and the change will not arrive with ninety days of notice to you.

None of this is a worldwide ban on holding the token. CryptoSlate makes that point explicitly. The question is narrower and more awkward: which exit services your EU-regulated provider and its supervisor will still allow, and for how long.

The Damage Lands Outside Crypto

Here is the part the sources do not cover, and it is our read rather than anything ESMA or the reporting says. A large amount of high-risk settlement in Europe moves through dollar-pegged tokens held at regulated venues. iGaming operators use it for affiliate payouts and B2B settlement. PSPs use it to move value between entities faster than correspondent banking allows. Brokers hold client and treasury balances in it. Very few of those businesses are CASPs. Almost all of them depend on one.

If the opinion bites as written, that rail stops being available through MiCA-authorised firms for EU clients. The exposure is second-order, which is exactly why it gets missed. You are not the regulated entity. You will still get the email.

So do this, in order:

Map every balance, float and settlement leg denominated in a stablecoin, and record which legal entity holds it and which MiCA licence that entity relies on.
Ask each provider, in writing, for its wind-down position and its actual cut-off date. Do not accept 8 January 2027 as an answer. Ask what its NCA has told it.
Check whether your tokens and issuers appear in ESMA's interim MiCA register, which lists authorised CASPs, ART and EMT issuers, white papers and non-compliant entities, and was last updated on 16 October 2026.
Build and test a second settlement route that does not depend on a non-compliant token, before you need it.
Re-read your client and merchant contracts for any obligation to settle or redeem in a specific token, and amend the ones that bind you to something your provider will soon refuse to touch.

The firms that get hurt here will not be the ones that read the opinion. They will be the ones who assumed custody was neutral, that a risk warning buys time, and that a three-month window belongs to them rather than to their supervisor. Open the register, phone your CASP this week, and find out what your real deadline is before someone converts your balance for you.