Croatia’s financial regulator HANFA has ordered Varaždin-based FIMA Plus to immediately stop providing unauthorized crypto services and return digital assets worth $483,756 that the company, led by director Milan Horvat, held on behalf of 123 clients — the first major enforcement action since the full application of the MiCA regulation took effect in Croatia on July 1.
While part of the domestic scene spent the first month under full MiCA application counting the winners and losers among the four licensed platforms, HANFA was quietly pulling its revolver from the holster. The first shot wasn’t fired into the air — it hit the target dead center. Varaždin’s FIMA Plus has thus earned a place in history as the first company banned by the Croatian regulator under the new regime, with a ruling that reads like the closing credits of an entire era of domestic crypto: it operated without approval, held other people’s assets on its own accounts, and claimed all along that it was in a transitional period.
## What exactly did FIMA Plus do?
According to the supervisory findings, from July 1, 2025 to January 23, 2026, FIMA Plus executed buy and sell orders for crypto assets on behalf of clients and provided custody and management services for their assets — all without the required authorization. The company was registered neither in HANFA’s register of authorized crypto asset service providers nor in the earlier register of virtual asset service providers.
The mechanics of the operation were painfully simple. Clients deposited money directly into FIMA Plus’s bank account. The company then transferred the funds to the Kraken exchange and purchased crypto assets through its own user account, following client orders. When selling, it did the same in reverse: selling through its own account and paying out the proceeds to clients. Client assets were held in omnibus accounts opened in the company’s name on Kraken and Binance.
In other words, everyone’s bitcoin, ethereum and bitcoin cash sat in accounts over which only the company had operational control. On February 5, HANFA recorded positions in 18 different crypto assets — including bitcoin, ethereum, bitcoin cash and USD Coin — on the company’s Kraken account. Over the reviewed period, it identified 48 deposits, withdrawals and buy or sell transactions for a total of 16 individuals and legal entities, worth €1.28 million.
Then comes the figure that best captures the scale of the story: as of May 24, 2026, FIMA Plus held crypto assets for 123 clients, valued at $483,756. Nearly the entire amount was stored on Binance, with only a symbolic sum on Kraken. Traders who thought their assets were “somewhere out there on the exchange” were in fact depending on whether one company in Varaždin would honor the deal.
## The “transitional period” defense — VAR reviewed the footage
The most interesting part of the story isn’t the numbers, but the legal defense FIMA Plus offered in its objection. The company did not dispute providing the services. It claimed — wait for it — that it believed it was in the transitional period for aligning with the new regulatory framework until July 1, 2026.
That’s roughly equivalent to a player explaining to the referee after a red card that he thought the offside rule had been abolished. HANFA dismissed the argument faster than one can say “MiCA”: the transitional regime was available exclusively to entities registered in the relevant register, and FIMA Plus wasn’t in it for a single day. From a regulatory standpoint, the company spent its entire time playing on an unregistered pitch, with a ball that wasn’t its own.
## Fimacrypto: a tale of a fake Slovenian identity
The story even has its “Catch Me If You Can” moment. HANFA established that FIMA Plus used the Fimacrypto website to connect Croatian clients with a company outside the European Union for crypto portfolio management services, for which it received a fee. The regulator deemed this prohibited intermediation, noting that in such circumstances the foreign company’s services cannot be considered provided solely on the client’s own initiative.
If anyone thought the circus ended there — it didn’t. FIMA Plus must also remove from the Fimacrypto website the false information claiming that the services were provided by Slovenian company Fima Crypto from Ljubljana. Frank Abagnale Jr. cycled through the identities of a pilot, a doctor and a lawyer; Varaždin’s FIMA Plus settled for a single Slovenian alter ego. The difference is that Abagnale was eventually stopped by the FBI, while here the agent’s role was played by HANFA, ruling in hand.
## What HANFA demands and what comes next
The ruling orders the company to immediately stop providing unauthorized services, notify clients within eight days that it is ceasing operations, and request instructions for returning their assets and money. HANFA must receive a report on the measures taken within 30 days, and proof of asset return within 60 days.
Notably, HANFA did not impose a monetary fine — these are administrative measures aimed at the immediate cessation of unlicensed operations and client protection. No appeal is permitted against the ruling, but FIMA Plus may initiate an administrative dispute before the Administrative Court in Zagreb within 30 days. In other words, the courthouse doors remain open, but the business of trading other people’s bitcoin is over.
## The sheriff’s first shot
The entire FIMA Plus episode is best summed up in a single sentence: the Wild West of domestic crypto has just found its Wyatt Earp. For years, the Croatian scene operated on saloon logic — first come, first served; whoever has an exchange account is a banker. MiCA changed that on July 1, and this ruling is the first proof that the new rules have teeth.
A reminder: since July 1, crypto services in Croatia and across the EU may only be provided by authorized CASPs. HANFA’s register currently lists four companies — Bitblock, Digital Assets, Electrocoin and White Tech — while a fifth, IN Kapital, has received approval and awaits completion of its registration in the court register. During the transitional period, 17 virtual asset service providers were registered with HANFA, and five of them obtained licenses in time.
HANFA, meanwhile, keeps repeating a message that has gained entirely new weight after this decision: users should check whether a platform is listed in official registers before every transaction, because clients of unlicensed companies do not enjoy the protections provided by MiCA — including asset protection. ESMA’s register is the only authoritative source for the whole EU.
For FIMA Plus’s 123 clients, that message is no longer abstract. Their assets, worth nearly half a million dollars, sat in the accounts of a company that lacked authorization for a single transaction. The good news: HANFA ordered the return. The bad news for the rest of the grey zone: the sheriff has shown he can shoot. The coming months will reveal who’s next in the crosshairs — and whether any of the 17 former VASPs that missed the licensing train will try to bypass the system the way FIMA Plus did. One thing is certain: no one will be able to claim they didn’t know the rules.
*This article is for informational purposes and does not constitute financial advice. Crypto assets are a high-risk investment class — before any transaction, verify that the platform is registered with HANFA and ESMA.*