Crypto scammers impersonate regulators as unlicensed EU firms shut down

Fraudsters are impersonating European regulators and crypto exchanges to steal from customers caught in the shutdown of unlicensed firms, watchdogs across the bloc have told the Financial Times.

Companies that missed the July 1 deadline to obtain a license under the EU's Markets in Crypto-Assets Regulation are now operating illegally and must tell customers to withdraw or move their holdings. Only 323 firms appear on the register that the European Securities and Markets Authority (ESMA), the EU's markets watchdog, updated at the end of July, while data provider VASPnet estimated last month that more than 1,700 unlicensed companies would have to cease operating.

That has put a large number of people in the position of hurriedly moving funds to an unfamiliar provider, which is precisely the moment criminals want. "This moment is an opportunity for scammers more than usual," Stéphane Pontoizeau, an executive director at France's markets regulator the Autorité des Marchés Financiers (AMF) told the FT.

The AMF has recorded cases of fraudsters posing as its own staff, telling customers of unlicensed firms to transfer assets to a fake website. ESMA said it is aware of "fraudulent practices involving the misuse of ESMA's logo and identity," including falsified documents used to promote scams. Dutch regulator the Autoriteit Financiële Markten said traders should treat any third-party request to move funds with caution and verify it against the provider's official website and app.

The AMF has declined to set an aggressive wind-down date for unlicensed firms operating in France, reasoning that manufactured urgency is what pushes people into scams, and has urged customers to take their time choosing a replacement provider. Pontoizeau said the regulator will refer cases to law enforcement where criminals impersonate it or licensed companies.

How the deadline landed

MiCA replaced a patchwork of national regimes with a single authorization that passports across all 27 member states, and its transition period ended on July 1. Coinbase, Kraken and OKX are among those licensed.

Binance is the largest firm without one. It withdrew its application in Greece in June after reports that the regulator would reject it, and said it would seek approval elsewhere. Spain's securities regulator ruled out any extension days before the cut-off.