Your Crypto Platform Loses Its Licence on 1 July 2026: What to Do

Many investors are receiving emails from their cryptocurrency platform announcing that it will stop serving clients resident in Spain, that their accounts are moving to "withdrawal-only mode" or that they must migrate to another entity of the group. This is no coincidence: on 1 July 2026 the Spanish transitional period under the MiCA Regulation ends and, from that date, only authorised crypto-asset service providers may operate. We explain what changes, how to check whether your platform is authorised, the difference between using an unlicensed firm and being scammed, and how to claim your funds.

What Changes on 1 July 2026

Regulation (EU) 2023/1114, known as MiCA (Markets in Crypto-Assets), subjects crypto-asset service providers (CASPs) — trading and exchange platforms, wallet custodians, crypto-to-fiat exchange services — to authorisation and supervision for the first time. A transitional period was put in place so that firms already operating could adapt, and that period ends on 1 July 2026.

From that date, only the following may provide crypto-asset services to clients in Spain:

• CASPs authorised by the CNMV, the Spanish securities regulator.
• CASPs authorised by the competent authority of another EU Member State, operating in Spain under the European "passport".

Platforms that have not obtained authorisation must cease providing services. In practice, this is translating into account closures, restrictions on new deposits, limited withdrawal windows and migrations to other entities of the same group. And it is precisely in these troubled waters that the problems we see at the firm concentrate: withdrawals that never execute, support desks that stop replying and phishing campaigns impersonating the migration emails.

How to Check Whether Your Platform Is Authorised

Do not settle for what the platform's own website says. Verify it against official sources:

• CNMV registers: they list the CASPs authorised in Spain under MiCA.
• ESMA register: it lets you look up providers authorised in any EU Member State, which can operate in Spain under the European passport.
• List of unauthorised entities: the CNMV publishes warnings about firms providing investment or crypto-asset services without authorisation. If your platform appears there, exercise extreme caution.

One important nuance: within the same corporate group, the authorised entity may be a different subsidiary from the one you contracted with. Check the exact legal name in your terms and conditions and which entity actually receives your orders. And distrust any email that, citing "MiCA compliance", asks for keys, seed phrases or a transfer of funds to a "migration" wallet: no legitimate firm requests that.

Using an Unlicensed Platform Is Not the Same as Being Scammed

Two planes are constantly confused and should be kept apart:

• The regulatory plane. The prohibition on operating without authorisation binds the provider, not the client: you commit no offence by having traded on a platform that ends up without a licence. What you take on is a practical risk: a firm without CNMV supervision, without the client-asset safeguards MiCA imposes on authorised providers and, frequently, based outside Spain, with the added difficulty that brings when it comes to claiming.
• The criminal plane. It is triggered where there is an offence: if the platform lured you through deception (fraud, Articles 248 and 249 CP) or if it withholds and keeps funds it is obliged to return to you (misappropriation, Article 253 CP). In that scenario you are a victim, and criminal proceedings offer tools an ordinary claim does not: a judicial investigation, freezing orders and the tracing of the funds.

The practical takeaway: if your platform simply failed to obtain its licence, withdraw your funds in an orderly, documented way before it shuts down. If you are also prevented from withdrawing them, you need to act quickly.

When It Is Fraud: Articles 248 and 249 CP

Article 248 of the Spanish Criminal Code (CP) defines fraud: it is committed by those who, with intent to profit, use deception sufficient to cause error in another person, inducing them to perform an act of disposal to their own or a third party's detriment. The base penalty is six months to three years' imprisonment. Article 249.1.a) CP punishes computer fraud with the same penalty: obtaining a non-consented transfer of any asset by means of computer manipulation or a similar artifice.

In the context of the end of the MiCA transition, the most recurrent patterns are:

• Platforms that never executed real orders: the dashboard showed simulated balances and returns while the funds were diverted from the very first deposit.
• Shutdowns used as cover: an "orderly wind-down for regulatory reasons" is announced, withdrawals are "temporarily" suspended and the firm ends up disappearing with the funds.
• Migration phishing: emails impersonating the platform or the regulator asking users to move funds to a wallet controlled by the fraudsters — a textbook case under Article 249 CP.

The amount aggravates the penalty: where the fraud exceeds 50,000 euros or affects a large number of people, the penalty is one to six years' imprisonment plus a fine of six to twelve months (Article 250.1.5 CP); and where it exceeds 250,000 euros, four to eight years' imprisonment plus a fine of twelve to twenty-four months (Article 250.2 CP). On platforms with many victims these aggravated forms are common, and the victims' actions tend to be grouped into a single set of proceedings.

If Your Funds Are Withheld: Misappropriation (Article 253 CP)

A different scenario is the platform that operated normally but, come the shutdown, fails to process withdrawal orders. Article 253 CP imposes the penalties of Article 248 (or Article 250, where aggravating circumstances apply) on those who, to another's detriment, appropriate money, securities or any other movable asset received "on deposit, on commission, or in custody", or under any other title that creates an obligation to deliver or return it, or who deny having received it.

Crypto-asset custody fits that scheme: you handed your funds to the platform under a contract that obliges it to return them on demand. If, upon ceasing its activity, the firm disposes of those funds, applies them to its own ends or refuses to return them without justification, we are looking at possible misappropriation.

One caveat we always make: not every failed withdrawal is a crime. Operational incidents, temporary anti-money-laundering blocks or the firm's insolvency require a case-by-case analysis of whether there is a genuine intent to appropriate. That is why the first technical step is to document the refusal and reconstruct where the funds went through forensic blockchain tracing.

Steps to Claim Your Funds

If your platform is not authorised and will not return your funds, this is the order of action we recommend:

1. Document your position now. Screenshots of your balance and portfolio, statements, proof of deposits (bank transfers and TXIDs), the contractual terms and all communications. If the website disappears, that evidence can no longer be obtained.
2. Place a withdrawal order in writing through the official channels and keep the acknowledgement. A formal withdrawal order that is rejected or ignored is the key piece of evidence of the retention.
3. Send a formal demand for return (by burofax or another verifiable means) setting a deadline. It evidences the refusal and defuses the "technical incident" excuse.
4. Report the facts to the CNMV if the entity is operating without authorisation. The CNMV will not return your money, but its public warning documents the irregularity and strengthens your claim.
5. File a criminal complaint or private prosecution, for fraud or misappropriation as the case may be, seeking interim measures (freezing of accounts and wallets, prohibition on disposal) and investigative steps: requests to the receiving exchanges and tracing of the blockchain movements.
6. Consider the civil route in parallel: a contractual claim and, if the firm enters insolvency proceedings in another State, the lodging of your claim in those proceedings. Each route has its own deadlines, and it is unwise to let them run out while waiting.

One further caution: do not accept, without legal advice, "conversions" of your balance into the platform's own tokens or haircut agreements offered as a condition for withdrawing. They can seriously weaken your later claim. For a deeper look at the recovery avenues, you can read our guide to recovering money from a cryptocurrency scam.

Do Not Forget the Tax Authority

Losing access to the platform does not release you from your tax obligations. The Spanish tax agency (AEAT) published criteria on the taxation of crypto-assets in April 2026, and transactions carried out up to the shutdown must still be reported. Keep the full traceability of your investment (origin of the funds, dates and acquisition cost): besides ensuring correct taxation, that documentation may prove relevant if you later need to evidence a capital loss for funds that turn out to be definitively unrecoverable. On the specific risks in this area, see our page on tax offences and cryptocurrency.

How We Handle These Cases

In our crypto-assets criminal defence practice we assist both victims of platforms that withhold funds and investors who need to manage an orderly exit from unauthorised firms. We combine criminal action — fraud or misappropriation — with forensic tracing and freezing orders, and we work to locate the funds before they are dispersed. The sooner action is taken, the better the chances of following their trail.