MEXC Is on ESMA's “Blacklist”. What It Means and What Happens to Your Assets

I won't spoil your Sunday with hedging, so straight to it: MEXC appears in ESMA's register of “non-compliant entities” — platforms that a national supervisor has reported as providing crypto-asset services in the EU in breach of MiCA.

The entry is specific and verifiable. Here it is, verbatim from ESMA's official CSV file:

AFM has also issued a public warning to consumers — that MEXC actively targeted Dutch clients (campaigns, a Dutch profile on X, sponsorship of a local blockchain conference), without it being clear which legal entity, and from which country, actually provides the service.

Where to check: ESMA's Interim MiCA Register → the Non-compliant entities file (NCASP.csv). The register is updated weekly; at the time of writing, the last update is 31 July 2026.

A small technical note if you've saved old links: ESMA announced that the interim CSV files would be integrated into its IT systems “around mid-2026.” As of August 2026 this hasn't happened yet, and the CSVs remain the official source. Check the main MiCA page rather than a bookmarked direct link.

What this list actually is

Its official name under Article 110 MiCA is the Register of non-compliant entities providing crypto-asset services. In practice it's a “blacklist,” but it is not a list of “banned CASPs.”

It includes persons and websites that a competent authority has reported as breaching:

• Art. 59 MiCA — providing crypto services in the EU without the required MiCA license or Art. 60 right, or misleadingly presenting themselves as a CASP;
• Art. 61 MiCA — third-country firms actively soliciting EU clients while improperly relying on the reverse solicitation exemption (“the client approached us”).

The MEXC case is squarely under Art. 59.

What the list does not mean

Being listed does not necessarily mean the firm:

• held a MiCA license;
• had its license revoked;
• received an identical formal ban on activity in every EU country;
• is a fraudster.

Many of the entries are simply unlicensed platforms, cloned websites, or third-country firms illegally targeting EU clients. In the CSV itself, quite a few entries have no LEI and not even a clear legal entity — they list mainly a trade name, domains, the reporting supervisor and a date. For MEXC, for example, the LEI field is empty.

If you go through the file, you'll see that the vast majority of entries are Italian — CONSOB systematically submits dozens of domains a month, most of them obvious scam sites with auto-generated names. MEXC sits on an entirely different level in this list, and that's exactly why the case is interesting.

The difference from a revoked license

Revoked licenses are reflected in the separate register under Article 109 MiCA — Crypto-asset service providers — which states the authorization date and any revocation. Information on a revoked license stays published for five years.

Listing under Article 110 is itself a public disclosure, not a separate sanction or an automatic EU-wide blocking order. Behind it, however, there is usually an established breach, warning, or measure by a national supervisor. The competent authority may separately order cessation of activity, blocking of a website, a public warning, or a sanction.

The register is also explicitly non-exhaustive — incomplete. A platform's absence from it in no way proves that it is lawful.

Context: the transition period is over

This is what's different compared with the situation a year ago. The grandfathering clause under Art. 143(3) MiCA allowed firms operating under national law before 30 December 2024 to continue until 1 July 2026, or until a MiCA authorization was granted or refused.

That period has now expired. So the argument “they're in the process of getting licensed” no longer works — a platform without a CASP authorization, listed in the Article 109 register, has no legal basis to serve EU/EEA clients.

How I would treat it in a compliance check

As an official negative regulatory list. If a firm or its domain appears in it, I would not accept it as an admissible counterparty until the following are established:

• the exact measure;
• the decision of the reporting authority;
• any subsequent change.

The positive check must be separate — in ESMA's official MiCA CASP register, by legal entity, LEI, domain, authorized services and countries of activity. Presence in one register is not verified through absence from the other.

Part two: if I have assets there, what happens when I move them?

The question people actually care about: what if they first pass through my own private address?

Short answer: a private address does not break the asset history.

Any licensed exchange will likely treat such a deposit as elevated risk, but the assets don't automatically become “dirty,” seizable or inadmissible just because they were held at an entity from the list.

What the licensed exchange sees

The path: Non-compliant entity → your self-hosted wallet → licensed exchange

The receiving exchange immediately sees a deposit from a self-hosted address. But blockchain analytics can trace that the previous source is an address or cluster linked to the non-compliant platform. One hop erases nothing.

The possible reactions

There is no single automatic outcome. An exchange may:

• credit the deposit with no further questions;
• hold the deposit for manual review;
• request Source of Funds / Source of Wealth;
• restrict withdrawals until the review is complete;
• return or refuse the transfer;
• terminate the relationship;
• where there is reasonable suspicion, file a report with the FIU, without being able to notify the client.

The regulation explicitly requires risk-based procedures for executing, suspending, returning or refusing transfers where information is missing — Regulation (EU) 2023/1113, Art. 17–18.

What actually determines the risk

The reason for the listing is decisive:

• If the platform merely provided services in the EU without a MiCA authorization — as is the case for MEXC per AFM's data — that's a regulatory problem, but it doesn't prove a criminal origin of your assets.
• If the platform is linked to fraud, sanctions, theft, mixers or missing identification, the risk is much higher.
• If you acquired the assets before the date of the regulatory decision or before MiCA applied, that's an important fact and should be documented.

How I would approach it in practice

Before moving a substantial amount I would prepare:

• a statement from the account at the old exchange;
• the full trade history;
• the deposit and withdrawal history;
• bank statements for the original acquisition;
• all transaction hashes along the route;
• proof that the private address is yours;
• a short chronology — when the assets were acquired, when the platform was listed, and why they were moved;
• tax returns or accounting records, if relevant.

After that I would request a preliminary compliance review from the receiving exchange, openly stating the name of the platform and the route. Only after a positive answer would I first make a small test transfer, and then the main one.

Trying to “clean” the history through intermediate addresses does exactly the opposite — it turns a documentable situation into one that looks like deliberate concealment.

This text is informational and does not constitute legal or investment advice. Check the primary sources — ESMA's registers are updated weekly.

Sources

• ESMA — Markets in Crypto-Assets Regulation (MiCA), Interim MiCA Register
• ESMA — Non-compliant entities (NCASP.csv)
• ESMA — Article 110 MiCA, Register of non-compliant entities
• AFM — public warning about MEXC (September 2025)
• Regulation (EU) 2023/1114 (MiCA)