Scammers impersonating financial regulators and licensed exchanges are targeting crypto holders who are still moving assets five weeks after the EU’s licensing deadline under the Markets in Crypto-Assets Regulation (MiCA).
This is according to several regulators, including France’s Autorité des Marchés Financiers (AMF), the Dutch Authority for the Financial Markets (AFM), and the European Securities and Markets Authority (ESMA), which described the pattern to the Financial Times.
Fraudsters contact customers of firms that failed to win authorization, present themselves as staff of a regulator or an exchange, then direct the customer to a website or account the criminals control. Regulators say they never cold-contact consumers with instructions to send funds to a particular account.
The transitional period under the Markets in Crypto-Assets Regulation (MiCA) closed on July 1. ESMA’s register listed 322 authorized crypto-asset service providers across 26 member states at its August 4 update, and every provider outside it lost the right to serve EU clients.
Regulators Told Users to Move
ESMA’s public statement of June 23 ordered unauthorized providers to “immediately stop onboarding new EU clients” and to limit services to “actions necessary to sell or transfer crypto-assets, reallocate assets, or close positions.” Custody may continue only for the period strictly necessary to complete an orderly exit.
That same statement told clients to check the register and, where their provider is unauthorized, to transfer holdings “to an authorized CASP, where one is identified, or to a self-hosted wallet.”
Regulators said that the overlap is what the fraudsters are exploiting, with large numbers of users being legitimately told to move funds in the same window.
Authorizations clustered ahead of the cut-off. Seventy-six firms entered the register in June, more than in any other month since the regime opened, with 31 added in July. OKX European CEO Erald Ghoos had predicted that 80% of crypto companies would not survive MiCA and would be pushed out of the bloc.
Impersonation Fraud Is Scaling
Chainalysis put the growth of impersonation scams at 1,400% year over year in 2025, with the average payment rising from $782 to $2,764. The firm valued total crypto scam and fraud losses for the year at near $17 billion.
CryptoPotato reported £2.1 million in Bitcoin taken from a cold wallet after a caller posed as a senior UK police officer and sent the victim to a site that captured the seed phrase, and the FBI has warned of a fake token carrying an “FBI message” subject line on Tron built to harvest wallet access.
ESMA said that national competent authorities are directly engaged with the firms concerned and may now take coordinated action against unauthorized providers, as the transitional period has ended.