Sell-only by January: ESMA just made the stablecoin list a product decision

On October 8, the European Securities and Markets Authority published a five-page opinion addressed to national supervisors. Its central line is paragraph 12: “CASPs should not provide crypto-asset services in relation to ARTs or EMTs that are not compliant with the applicable requirements under MiCA.” In plain terms, a licensed crypto firm in the EU shouldn't trade, hold, transfer or advise on a stablecoin whose issuer doesn't meet the MiCA rules for stablecoin issuers.

Six days later, the European Banking Authority classified USDC as the first significant e-money token in the EU, out of 45 e-money tokens notified under MiCA. From November 12, the EBA directly supervises its own funds, reserve of assets, liquidity, and recovery and redemption plans.

Read together, the two documents say the same thing from opposite ends. In Europe, the stablecoins a product touches are no longer a liquidity call or a partnership call. They're a compliance decision, and the regulator expects to see that decision inside the product. I build products in this space and I'm not a lawyer, so what follows sticks to what the texts say, paragraph by paragraph, and what I'd change in a product because of it.

1. The risk sits in the token, so your controls can't fix it

ESMA's reasoning is in paragraph 13. Offering a service in a non-compliant stablecoin exposes clients to risks that “do not arise from the provision of the service itself,” but from “the absence of the issuer-level safeguards required by MiCA.” Those risks “cannot be adequately identified, managed or mitigated through the measures available to the CASP,” and that gives rise to a presumption that offering any MiCA service in such a token breaches the Article 66(1) duty to act in clients' best interests.

That's an unusual shape for a compliance problem. Most of them in crypto products get solved with something the product owns: a better screen, a tighter limit, a new monitoring rule. Here ESMA says the missing piece belongs to the issuer, so nothing the exchange or wallet builds can stand in for it. The only control that works is not offering the token.

2. The acknowledgment screen doesn't count

Paragraph 19 is short: “reliance on warnings, disclosures or client acknowledgements would not sufficiently address the concerns identified in this Opinion.” ESMA explains why. MiCA's protections “operate collectively,” and expecting clients to judge what it means when those protections are missing is “highly unlikely to enable them to accurately evaluate the risks involved.”

James Ross's analysis at denouement called this, for firms that kept non-compliant stablecoins available behind a risk warning or an acknowledgement screen, “the most important paragraph in the document” (read it here). From the product side I'd agree. The checkbox-and-continue modal is the cheapest compliance pattern there is, which is why it's everywhere. For this case, ESMA has said it doesn't work.

3. Every surface counts, alone or combined

Paragraph 21 asks supervisors to look at whether a firm's services, “individually or in combination,” let EU clients acquire, trade, exchange, increase exposure to, or otherwise access or maintain a non-compliant token. It then lists every service: trading platforms, exchange, execution, order transmission, placing, advice, transfer, custody and portfolio management. Paragraph 22 adds that firms “should not maintain, introduce or facilitate access” to these tokens for EU clients, and should have “technical, contractual and organisational controls,” “including controls preventing EU clients from acquiring or increasing positions.”

For a product team, that means taking a token out of the order book isn't enough if it's still the default in a convert widget, a recurring buy, a portfolio product, a deposit list or the settlement leg of another pair. The first job is an inventory of every place each token appears, for each EU-facing entity. The opinion names no token, as denouement points out, so each firm has to make its own call on which ones are compliant, including any exemptions or transitional arrangements (footnote 1 of the opinion).

4. Wind-down is a product, and it has a deadline

ESMA leaves a narrow exit. Under paragraphs 23 and 24, supervisors may allow “strictly limited residual services” for an orderly wind-down. They're limited to “the liquidation, conversion, withdrawal, transfer or safekeeping of existing holdings,” with no new acquisitions, promotion, trading or active distribution, and they should be “time-limited, clearly communicated to clients and subject to close supervisory scrutiny.”

Paragraph 27 sets the clock. Where supervisors find legacy exposures, firms should fix them “as soon as possible and no later than three (3) months following the date of publication,” and anything that continues is “strictly limited to sell-only, conversion, transfer or withdrawal functionalities.” Three months from October 8 is January 8, 2027. Denouement also flagged that safekeeping appears in paragraph 24's list but not in paragraph 27's, and suggested firms confirm the position with their supervisor.

In product terms, a token's availability stops being a yes-or-no flag. It needs states: eligible, wind-down (sell, convert, withdraw or transfer out, nothing that adds), and removed. Each change of state needs a client message with dates, because ESMA asks for wind-down to be clearly communicated. Some edge cases, like whether an incoming deposit of a wind-down token counts as “increasing positions,” are questions I'd put to the supervisor rather than answer in a design doc.

5. Conversion becomes the exit, and the way to keep the client

In a wind-down, conversion is one of the few things still allowed. That makes the convert flow the most important screen for a client holding a token that's being wound down. It's how they keep their money with you, in an asset you can still serve.

Notabene showed the business-payment version of this in October: The Better Money Company paid a Notabene invoice in RLUSD, and Notabene received USDC, with the conversion handled inside the payment rather than as a separate trade (their write-up). Notabene Flow verifies who is paying whom before the money moves. The general point carries over: the payer and the payee don't have to hold the same stablecoin if conversion is part of the rail. In Europe, which stablecoin the payee ends up with now has a regulatory floor under it.

One cost wrinkle to watch. According to Elliptic's regulatory digest, on October 16 the French National Assembly narrowly voted for a 2027 budget amendment that would make swaps of crypto like bitcoin or ether into MiCA-authorized stablecoins subject to capital gains tax. It isn't law yet, and Elliptic notes critics warn it could push investors toward unapproved tokens. That's crypto-to-stablecoin, not stablecoin-to-stablecoin, but it shows how tax and supervision can pull in different directions.

6. “Significant” is a supervision status, not a warning label

The EBA's decision on USDC splits supervision. From November 12, the EBA covers own funds, reserve of assets, liquidity, and recovery and redemption plans, while France's ACPR keeps governance, qualifying holdings, fit and proper, outsourcing and conflicts of interest. The EBA also signed a memorandum of understanding with the New York State Department of Financial Services.

Those are the issuer-level safeguards paragraph 13 of the ESMA opinion is talking about, with a named supervisor attached. Under MiCA, e-money token holders have a direct claim on the issuer for redemption at any time at par, without a fee, as Chainalysis summarized in 2024. That redemption right is the thing a platform can't recreate with a disclosure. I'd show it on the asset page: issuer, home supervisor, redemption terms, not just a ticker.

7. The partner map just got smaller

At TRM Labs' Q3 policy roundtable, a speaker said about 281 crypto-asset service providers held MiCA authorization at the end of the grandfathering period, compared with roughly 1,300 identified across Europe during it. Any product that relies on partners for on-ramps, liquidity or custody in Europe should recheck that list against the register.

Notabene made a related point in its notes from Merge Madrid: “Europe has MiCA and the US has the GENIUS Act. But clarity is not the same as readiness.” An address, they wrote, doesn't tell you “which legal entity, in which jurisdiction, is accountable,” and “a global exchange might run ten licensed entities.” Put that next to the ESMA opinion and eligibility becomes a two-part check: is this token compliant, and is this counterparty entity authorized for what we're doing with it?

What's still moving

The European Commission's MiCA review consultation closed on September 30, and the Commission will publish a report with proposals by June 30, 2027, per TRM. In its response to that consultation, ESMA proposed amending MiCA to expressly prohibit CASPs from providing services in non-compliant stablecoins (Abreu Advogados summary). For now the opinion is supervisory guidance addressed to national authorities, and how each one applies it is the open question. ESMA says it will monitor that in paragraph 28.

What I'd do before January 8

1. Build the token inventory by surface (order book, convert, recurring buys, portfolios, deposits, withdrawals, settlement legs) and by EU-facing entity.
2. Record each stablecoin's MiCA status with its source and who signed off, and include any exemption or transitional arrangement relied on.
3. Replace the listing flag with states: eligible, wind-down, removed. Make the wind-down state block anything that adds to a position.
4. Stop using acknowledgment screens as the control for these tokens.
5. Make convert the main action in the wind-down state, and test it end to end, including what the client receives.
6. Write the client notice with dates before the change ships, not after.
7. Take the open questions to the supervisor: deposits, safekeeping, and how long wind-down can run.
8. Show issuer, home supervisor and redemption terms on each stablecoin's page.
9. Recheck partners and counterparties against MiCA authorization.

The short version: in Europe a stablecoin listing is now a control, not a menu item. ESMA has told supervisors that disclosures don't cure a non-compliant token, every service counts, and what's left after January 8 should be sell, convert, transfer or withdraw. The teams that treat token eligibility as product infrastructure, with states, messaging and conversion built in, will find this easier than the ones still treating it as a listing decision.

Related on the site: Freeze it, but don’t file on it: what BSA teams miss in the GENIUS Act rules. This essay is a plain-language reading of public documents, not legal advice.