Blog · Stablecoins · 13 October 2026

Non-MiCA stablecoins: how to block new exposure but allow an exit

ESMA's 8 October opinion turns stablecoin eligibility into a control problem: stop new exposure, permit a supervised exit, and prove it. What that means for operations.

On 8 October 2026 the European Securities and Markets Authority (ESMA) published an opinion saying that crypto-asset service providers (CASPs) authorised under the Markets in Crypto-Assets Regulation (MiCA) should cease providing services related to stablecoins that do not comply with MiCA to clients in the European Union. The opinion covers asset-referenced tokens (ARTs) and e-money tokens (EMTs), and it is addressed to national competent authorities (NCAs), the supervisors who will apply it firm by firm.

For anyone who moves money through stablecoins, the interesting part is not the headline. It is the shape of the obligation: stop anything that adds exposure, keep open the narrow paths that let clients get out, and be able to show a supervisor which is which.

What ESMA's opinion actually covers

The scope is deliberately wide. According to ESMA's announcement, it applies to the full range of MiCA services: operating trading platforms, exchange, order execution, placing, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management, whether provided alone or in combination.

ESMA also asks NCAs to make sure firms have "appropriate technical, contractual, and organisational controls" to prevent these tokens being available in the EU, including controls that stop clients acquiring or increasing exposure, as set out in the same release.

There is a time limit for what is already on the books. Where NCAs find pre-existing exposures, they should require remediation as soon as possible and no later than three months after publication, and any continuing service must be limited to liquidation, conversion, withdrawal, transfer or safekeeping, time-limited, risk-based and closely supervised, per ESMA. Crypto.news calculates that the outer limit falls on 8 January 2027, and notes that the opinion addresses licensed firms serving EU clients rather than banning the holding of a token in a private wallet.

Which tokens are caught depends on each token's MiCA status, not on its peg or its ticker. Crypto.news points out that ESMA did not publish a list of affected tokens, so a firm has to establish each token's legal classification and its issuer's standing itself.

Why removing a trading pair is not enough

The practical lesson is that "do we support this token?" is no longer a single yes or no. It splits by action. The same balance can be allowed to leave but not allowed to grow. Crypto.news describes a customer who finds the sell button works while a new purchase does not, or who can withdraw to an external wallet while a fresh deposit is refused, and says neither outcome is necessarily an error.

That has knock-on effects that sit with operations, not just compliance:

Deposits versus existing balances. Inbound transfers of an affected token may need to be refused or routed to a conversion-only path, while existing balances stay withdrawable.
Every route into exposure. Order entry, conversions into the token, portfolio rebalancing, collateral top-ups and internal transfers between entities are all ways of increasing exposure. Closing one and leaving another open defeats the control.
Collateral and settlement. Where a token is used as margin, settlement asset or a bridge between venues, someone has to decide how it is replaced and on what timetable. Crypto.news notes that a firm closing transfers immediately could force customers into an internal conversion, while one accepting indefinite deposits could undermine the restriction, and that both choices need a documented rationale.
Dormant and hard-to-reach clients. Clients who cannot complete updated identity checks, or never read a notice, still hold balances. The firm has to decide in advance whether those are kept in custody, converted under contract, or handled through a later claims process.

The United States is heading the same way

The US framework puts a similar duty on the venue rather than the token. Under the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), beginning on 18 July 2028 it will be unlawful for a digital asset service provider to offer or sell a payment stablecoin to a person in the United States unless a permitted issuer issued it, as described in Treasury's notice of proposed rulemaking (NPRM). The same Treasury proposal says the Act's effective date is expected to be 18 January 2027, and comments on it close on 19 October 2026.

The proposal is also explicit about the kind of evidence it has in mind. One of its questions asks whether controls such as customer due diligence, geographic access restrictions, device or network-location checks, contractual representations and transaction monitoring should support a reasonable belief that a buyer is outside the United States, per the NPRM text. Separately, an interim final rule effective 30 September 2026 set out how states certify that their regimes are substantially similar to the federal framework, which issuers with no more than $10 billion of outstanding stablecoins need in order to stay under state regulation.

The common thread across both jurisdictions: a stablecoin's eligibility depends on who issued it, where the client is, and what the action does to exposure. It can change on a date set by a regulator. That is rule data, and it needs owners.

What it means for payment operations and treasury

Even an institution that is not a CASP is affected if it holds stablecoins, pays suppliers in them or relies on a provider that does. Some questions worth answering now:

Do you have a token register? For each stablecoin you touch: issuer, regulatory status per jurisdiction, the source of that status, and the date it was last checked.
Are your rules direction-aware? Can your systems tell "this payment increases our holding of token X" from "this payment reduces it", and treat them differently?
Can an exception expire on its own? ESMA's exit window is time-limited. A wind-down permission that someone must remember to switch off is a control that will fail.
Can you show your working? If a supervisor asks why a transfer was allowed in December, can you produce the rule in force that day, who approved it and what evidence it relied on?
What do your providers do? If you hold stablecoins through a custodian or exchange, ask for their plan, their deadlines and how they will treat balances they cannot convert.

None of this is legal advice. Each institution must check its own obligations under MiCA, the GENIUS Act and local law with its advisers and supervisors.

Where IXFXN fits

IXFXN is a control plane for money movement: rules, approvals, permits, a ledger and an audit trail. A rule sets which assets, providers, recipients and jurisdictions a payment may use, and up to what amount; a payment outside it is stopped with a stated reason, and larger amounts need more approvers. Rules are versioned, and every decision is recorded against the version in force that day, which is the evidence a supervisor asks for when an eligibility list changes on a regulator's date. IXFXN's AI can draft such a rule or explain why a payment was held, but it never sends money; the payment engine needs a permit for one exact payment, which works once and expires within 60 seconds.

To be clear about where it stands: USD Coin (USDC), bank transfers and tokenized deposits run against a built-in simulation only, and recipient and wallet screening is simulated too. Custodial crypto through CoinPayments and non-custodial crypto through DepiPay are planned, not built.

Sources

IXFXN's weekly briefing on payments, treasury and AI. Not legal or investment advice. Get new posts in a feed reader (RSS).