Crypto firms serving European Union clients under national rules lost their last possible grace period on July 1, 2026.
Eight days earlier, the European Securities and Markets Authority, or ESMA, told any crypto firm still lacking an authorization under the Markets in Crypto-Assets Regulation, known as MiCA, to stop taking on EU clients and to help existing ones exit by selling or moving their coins.
For iGaming platforms that take crypto, the change landed one step before the deposit, on the exchanges and custodial wallets where players buy and hold coins.
On the receiving end sits the crypto-first casino, a gambling site built to take coins, where several Web3 features share one account.
Measured against 2026’s rules, those features lasted where they sat on top of a conventional gambling account, and ran into the law where they turned part of that account into something a player could trade.
Neither MiCA, whose text never uses the word gambling, nor the GENIUS Act, the US stablecoin law signed in 2025, licenses a casino anywhere. Both govern the coin and the firms that issue and handle it.
MiCA split the dollar stablecoin market along the EU border
MiCA treats a dollar stablecoin as an e-money token, and Article 48 lets one be offered to the public in the EU only when its issuer holds a banking or e-money license.
Circle secured an e-money license from France’s banking supervisor in 2024 and said it was the first global stablecoin issuer to comply. Tether’s USDT failed to qualify, The Block Research noted in a July 2026 explainer.
Early in 2025, a statement from ESMA told trading platforms to stop making unauthorized e-money tokens available for trading, allowing only sales until the end of the first quarter. Binance and Coinbase were among the exchanges that removed or restricted USDT for EU users because of MiCA, the explainer said.
The explainer’s mid-2026 figures show the scale: about $184 billion of USDT in circulation, close to 60% of all stablecoins, against roughly $73 billion of USDC.
Neither issuer breaks its circulation down by use, so gambling’s share of either coin is known only from outside estimates, such as those of TRM Labs, an analytics firm that works from addresses it has tagged as gambling platforms.
Washington missed its own stablecoin deadline
The United States started later and is still writing. The GENIUS Act, signed in mid-2025, gave regulators a year to produce implementing rules.
The Office of the Comptroller of the Currency proposed its version early in 2026, covering who may issue a payment stablecoin and how its reserves and redemptions must work. The deadline passed that summer without final rules, and PYMNTS later reported that the agency was aiming for November.
The Act takes effect on January 18, 2027, or 120 days after regulators issue final rules if that comes sooner. No agency had finalized one by September 20, 120 days before that date, so the backstop now governs, and the Federal Reserve was still issuing proposals four days later. The OCC’s target now bears on when its rules are ready, not when the law applies.
Tether, the company behind most of the world’s stablecoin supply, didn’t wait for the rulebook to settle. Early in 2026 it announced the launch of USAT, a separate dollar token issued by Anchorage Digital Bank and built for the new federal framework, while saying USDT would keep operating globally as it worked toward compliance.
A wallet signature carries no date of birth
Sign-In with Ethereum, published as ERC-4361 and marked final, swaps a password for a signed message. The site generates a message carrying a one-time nonce, the user’s wallet signs it and the site checks the signature.
Its authors pitched it as a self-custodied alternative to logging in through large identity providers, noting that many services already signed Ethereum users in that way.
What the signature proves is narrow. It shows that whoever signed controls the private key behind an address, and it says nothing about that person’s age or location. The standard lists verifiable credentials, the kind of tool that could carry such facts, only as possible future work.
Nor can a signature tell one person from ten, since ethereum.org’s documentation notes that creating an account costs nothing.
A crypto-first casino is a natural place to try that kind of login, since its deposits already arrive from a player’s wallet. Deposits at Shuffle’s bitcoin casino arrive as cryptocurrency or as a token the company issues itself, and the Curacao-licensed operator publishes a verification tool for the in-house games it calls provably fair.
Wherever local law forbids the service or would require it to be licensed or registered, the operator’s terms withhold it, and the places they name include the UK, the United States and seven EU member states.
A gambling operator has to establish age and location, and a crypto-first operator’s rules assume more still. The same terms allow each player a single account and oblige players to report any other account tied to them through a shared household, device, IP address or payment credential.
Rules like those only work when the operator knows who stands behind each login, so a wallet signature could front the account but never replace the identity behind it. It would still retire one weak point: a site taking only signed logins would hold no passwords to leak.
Self-custody ends at the deposit address
Self-custody runs through the Web3 pitch, the login standard included, and an earlier Digital Edge explainer on crypto custody describes it as controlling private keys through a personal wallet, with the risk that lost keys can mean coins lost for good.
The terms cited above leave that risk with the player up to the cashier, making the security of a player’s own wallets and private keys the player’s job alone.
At the deposit, the responsibility changes hands, and so does the rulebook. MiCA requires an authorized custodian to keep clients’ crypto legally segregated from its own estate, out of reach of its creditors, and makes it liable for losses from incidents attributable to it.
ESMA’s June statement reminded clients of unauthorized firms that those safeguards don’t cover them. Unless a casino holds that authorization, the protection around a balance there comes from its own terms and whatever its gambling regulator requires.
Nothing in the game moves the price of the asset underneath, so a bitcoin balance can lose value without a single losing bet.
A dollar stablecoin removes most of that price risk for anyone counting in dollars, but it leaves the player relying on the issuer’s promise to redeem as well as the operator’s promise to pay.
Loyalty points stay outside MiCA only while they cannot move
MiCA leaves the familiar kind of loyalty scheme alone. Recital 17 says digital assets that only the issuer accepts and that can’t be transferred to anyone else fall outside the regulation, and it names loyalty points redeemable only with the issuer as its example. Points that never leave a player account appear to sit on that side of the line.
Move the same reward onto a public blockchain, where holders can pass it on, and it generally counts as a crypto-asset.
Article 4 then requires anyone offering it to the public in the EU to publish a white paper, unless an exemption applies, such as a token handed out free or one usable only within a limited network of merchants.
The free route carries a condition that matters to account-based platforms: a token doesn’t count as free when recipients must hand over personal data to receive it.
Those rules turn an on-chain loyalty program into a legal decision as much as a design one. In the United States the same question runs through securities law, where a gambling company’s NFT program has already been tested in court.
DraftKings paid $10 million to close its NFT chapter
MiCA’s Article 2(3) sets unique, non-fungible crypto-assets aside, and an SEC interpretation in force since March 2026 says digital collectibles are not themselves securities, though it adds that such an asset can still be sold under an investment contract, which is one.
Neither rule existed when DraftKings entered the NFT business in 2021, later running Reignmakers, a fantasy sports game powered by NFTs, according to CoinDesk.
A buyer sued in Massachusetts federal court in 2023, arguing the NFTs were unregistered securities and the marketplace an unregistered exchange.
The judge declined to dismiss the case in mid-2024, and weeks later DraftKings told customers it was discontinuing Reignmakers and the marketplace, citing recent legal developments. It settled the class action for $10 million, which the court approved the following year.
The 2026 retreat came from the Web3 side. Magic Eden, an NFT trading platform, closed its Ethereum-compatible and Bitcoin markets on March 9 and shifted resources to an on-chain casino of its own, after chief executive Jack Lu said 80% of the company’s costs sat in products producing 20% of its revenue, Cointelegraph reported.
A closed feature can stay live on-chain
Shutting a Web3 product down doesn’t retire what it put on a blockchain. When DraftKings closed its marketplace, collectors could still access and transfer their NFTs, because the tokens sat on the Polygon network rather than in the company’s database.
Magic Eden met a harder version of the same problem in late September 2026, months after its Ethereum-compatible marketplace closed.
Approvals that users had granted to a payment contract the old marketplace used, for listings made during 2024, left NFTs worth more than $5.7 million exposed to an exploit, The Block reported. A whitehat rescue pulled 23,155 NFTs to safety, though 660 wrapped ether stayed out of reach.
Any platform weighing an on-chain feature needs a shutdown plan that covers the approvals and tokens that will outlive the product.
None of these rules reached the two features that never hold a balance
Side by side, the features sort by how close they come to a player’s money. None of the rules covered here addresses the signed login or the checkable draw, the two features that never hold funds.
A provably fair draw lets a player confirm that a result matches a seed the operator committed to before the bet. It proves the round wasn’t altered after the fact and does nothing to the game’s built-in house edge.
| Feature | What it does | Regulatory status or caveat, September 2026 |
| Sign-In with Ethereum (ERC-4361) | Logs a wallet in by signing a one-time message | A final technical standard, not a law; age and identity checks still sit behind it |
| Provably fair draws | Lets a player check a result against a seed hash published before the bet | No rule covered here addresses it; it proves integrity, not better odds |
| Stablecoin deposits (MiCA 2023/1114, GENIUS Act) | Moves dollar value on-chain into an operator account | EU e-money token rules since June 30, 2024, with USDT restricted for EU users on major exchanges; US rules still proposed, and the Act takes effect January 18, 2027 |
| Transferable reward tokens | Pays rewards in a token that can leave the platform | EU public offers need a MiCA white paper unless an exemption applies; US treatment turns on securities law |
| NFT marketplaces (DraftKings, 2021 to 2024) | Sold collectibles that buyers could resell | Securities class action survived dismissal in 2024; marketplace closed that July; $10 million settlement approved in 2025 |
A reader weighing a gambling platform’s Web3 label can put each advertised feature into one of those rows and ask of it: if this feature fails, whose money is exposed?
