MiCA 2: The EU's Next Crypto Regulation Is Already in the Works

MiCA (Markets in Crypto-Assets Regulation) isn't even fully enforced yet — the deadline for full CASP compliance is July 1, 2026 — but EU policymakers are already laying the groundwork for MiCA 2. At Paris Blockchain Week (April 14–16, 2026), the European Commission signalled that a second iteration of the regulation is under preparation, targeting the significant gaps that MiCA 1 deliberately left open.

This isn't surprising to anyone who followed the MiCA 1 legislative process closely. The gaps were known; they were left intentional to avoid regulatory paralysis. But "we'll address it later" has arrived sooner than most expected.

What MiCA 1 Covers (and What It Doesn't)

MiCA 1, which entered into force in December 2024 with a transitional period running to July 1, 2026, covers:

• Centralised exchanges (CASPs) — Crypto-Asset Service Providers must obtain authorization from an EU national regulator
• Stablecoin issuers — Asset-referenced tokens (ARTs) and e-money tokens (EMTs) under strict reserve and transparency requirements
• Crypto service providers — custody, transfer, advisory, portfolio management of crypto-assets

What MiCA 1 explicitly does not cover:

• DeFi protocols — excluded because there is no identifiable central entity to license or hold accountable
• NFTs — partially excluded; only NFTs that function as financial instruments fall under MiCA's reach
• AI-driven and algorithmic trading — operating at the intersection of MiCA and the EU AI Act, unresolved
• Crypto lending and staking protocols — outside basic custody services, these remain in a grey zone
• Cross-chain bridges — not addressed despite being a significant systemic risk vector

These omissions were the political price of getting MiCA 1 passed. Regulating DeFi in particular proved too contentious in 2022–2023, when the legislation was negotiated. The Commission chose to start with what was tractable — centralised intermediaries — and promised a review.

What MiCA 2 Is Expected to Address

Based on the Paris Blockchain Week signals and information from leaked Commission consultation documents, MiCA 2 is expected to tackle several of these open questions.

DeFi regulation is the hardest challenge, and arguably the most important. Without a central operator, traditional licensing doesn't apply. The most discussed approach in Commission circles is the concept of "significant DeFi protocols" — protocols above a defined TVL (total value locked) threshold would be subject to transparency requirements, risk disclosures, and potentially governance accountability standards. Protocols below the threshold would remain unregulated. This mirrors the EU AI Act's risk-tiered approach.

High-value NFT collections that function as financial instruments — fractionalized ownership, yield-bearing structures, collections marketed as investments — are expected to be brought firmly within scope. The current partial exclusion has created legal uncertainty that MiCA 2 is likely to resolve.

Crypto staking and lending currently occupy an ambiguous zone. Platforms that offer yield on deposited assets are providing services that look, in practice, like financial intermediation — but MiCA 1 doesn't clearly classify them. MiCA 2 is expected to introduce explicit CASP sub-categories for staking service providers and crypto lending platforms.

AI-driven and algorithmic trading sits at the intersection of MiCA and the EU AI Act. Both regulatory frameworks are evolving simultaneously, and MiCA 2 is expected to harmonize the requirements rather than leave them in conflict. Automated trading systems operating on crypto markets at scale would likely need to meet both sets of requirements.

Cross-chain bridges have emerged as a systemic risk vector — multiple high-profile bridge exploits have cost users hundreds of millions of dollars. MiCA 2 may introduce minimum security standards and potential liability frameworks for bridge operators, particularly those handling large volumes.

Timeline: When Will MiCA 2 Come?

EU legislative processes are lengthy by design. The path from consultation to enforcement typically follows this pattern:

This timeline assumes the Commission moves quickly and negotiations don't stall on DeFi scope — which is far from guaranteed. MiCA 1 took roughly four years from proposal to enforcement. MiCA 2 could be faster given institutional knowledge, but the scope is arguably more complex.

What This Means for Exchange Users Now

The honest answer: very little changes immediately. MiCA 2 is a medium-term signal, not a near-term operational change. Here's how to think about it:

• MiCA 1 compliance (July 1, 2026) is your immediate priority. If you use a centralised exchange that has not yet obtained or applied for MiCA CASP authorization, that is a concrete near-term risk — not MiCA 2.
• Exchanges with strong MiCA 1 compliance are better positioned for MiCA 2. Regulatory infrastructure built for MiCA 1 — compliance teams, AML systems, custody frameworks — reduces the cost of adapting to MiCA 2. The exchanges that cut corners on MiCA 1 will face the same problem again, compounded.
• DeFi users should watch regulatory signals closely. If you rely significantly on DeFi protocols, MiCA 2 is directly relevant. The 2028–2029 timeline gives protocols 2–3 years to prepare — and those that engage constructively with regulators early will be better positioned than those that don't.
• No panic required. MiCA 2 is in preparation, not in force. The EU regulatory process is long, transparent, and consultative. The signals being sent now are designed to allow the industry to adapt — not to create sudden disruption.

Which Exchanges Are Positioned for the MiCA 2 Era?

The exchanges that have moved decisively on MiCA 1 CASP authorization are demonstrating the regulatory seriousness that will matter under MiCA 2 as well. As of April 2026, the leading MiCA 1 compliant platforms are:

• Coinbase — CSSF Luxembourg ✅ (EU-wide passport)
• OKX — MFSA Malta ✅ (MiCA CASP since December 2024)
• Bitvavo — AFM Netherlands ✅
• Bybit — FMA Austria ✅ (29 EEA countries)
• Bitpanda — BaFin Germany / FMA Austria ✅
• Kraken — Fully EU-licensed ✅

These platforms have invested in the compliance infrastructure — legal teams, technical controls, reporting frameworks — that will serve as the foundation for adapting to whatever MiCA 2 introduces. The compliance advantage compounds over time.

You can check the current MiCA authorization status of all major exchanges in our MiCA Compliance Tracker, which is updated as new authorizations are granted or applications advance.

Frequently Asked Questions

What is MiCA 2?
MiCA 2 is the anticipated second iteration of the EU's crypto regulation framework. While MiCA 1 covers centralised exchanges and stablecoin issuers, MiCA 2 is expected to extend to DeFi, NFTs, staking, lending, AI-driven trading, and cross-chain bridges. The Commission signalled its preparation at Paris Blockchain Week in April 2026.

When will MiCA 2 come into force?
If formal consultation begins in 2026, the realistic enforcement window is 2028–2029. EU legislative processes typically take 2–3 years from proposal to enforcement.

Does MiCA 2 affect DeFi?
DeFi is expected to be a primary focus of MiCA 2, though the approach is still being designed. The most discussed mechanism is a TVL-based threshold for "significant DeFi protocols," which would impose transparency and risk disclosure requirements without requiring traditional licensing of a non-existent central operator.

Should I change my exchange because of MiCA 2?
No immediate action is needed based on MiCA 2 alone. The priority remains MiCA 1 compliance (July 1, 2026). Choose exchanges already holding or actively pursuing CASP authorization — they are also better positioned for MiCA 2.