Crypto-asset regulation in the European Union: MiCA, the travel rule and the new AML framework

Overview for education, not legal advice. Rules change — check the official sources. Last reviewed 20 October 2026.

Why the EU created a single framework

Before MiCA, the EU had no common rulebook for crypto-assets that were not already financial instruments. The main EU-wide obligation came from anti-money laundering law, which required certain crypto businesses to register. Beyond that, member states took different paths: some, such as France and Germany, created national regimes, while others had almost none. A firm wanting to serve customers across the EU faced a patchwork of requirements.

The Markets in Crypto-Assets Regulation (MiCA) replaced this patchwork with one regime that applies directly in all member states. Firms authorised in one country can provide services across the EU, a principle known as passporting.

MiCA in brief

What counts as a crypto-asset

MiCA defines a crypto-asset as a digital representation of a value or a right that can be transferred and stored electronically using distributed ledger technology or similar technology. It does not cover crypto-assets that qualify as financial instruments — those remain under existing securities law — nor deposits, and it generally excludes crypto-assets that are unique and not fungible with others. Digital currencies issued by central banks are also outside its scope.

Three categories

• E-money tokens (EMTs) aim to keep a stable value by referring to one official currency. Only credit institutions and electronic money institutions may issue them, holders have a right to redeem them at par value, and issuers may not pay interest on them.
• Asset-referenced tokens (ARTs) aim to keep a stable value by referring to another value or right, or a combination, such as a basket of currencies or commodities. Issuers need authorisation and must hold a reserve of assets.
• Other crypto-assets — everything else within scope. The main obligation for offering them to the public is a published white paper.

Stablecoins that are large or widely used can be classified as "significant", in which case the European Banking Authority takes over key supervisory tasks.

White papers

Anyone offering a crypto-asset to the public in the EU, or seeking its admission to trading, generally has to publish a crypto-asset white paper describing the issuer, the project, the rights attached and the main risks. For most crypto-assets the white paper is notified to the national authority rather than approved by it, and it must state clearly that it has not been approved.

Crypto-asset service providers

Firms that provide services such as custody, operating a trading platform, exchanging crypto-assets for funds or other crypto-assets, executing or transmitting orders, placing, advice, portfolio management or transfer services for clients must be authorised as crypto-asset service providers (CASPs). MiCA sets requirements on governance, minimum capital, safeguarding of clients' assets, complaints handling and conflicts of interest. ESMA keeps a central register of authorised CASPs and published white papers.

Market abuse

MiCA prohibits insider dealing, unlawful disclosure of inside information and market manipulation involving crypto-assets admitted to trading, and requires platforms to have systems to detect them.

Timeline

MiCA entered into force in June 2023. Its rules on asset-referenced and e-money tokens have applied since 30 June 2024, and the rest since 30 December 2024. Firms already operating under national law could continue during a transitional period that member states could shorten, and which ended no later than 1 July 2026.

The travel rule: the Transfer of Funds Regulation

Regulation (EU) 2023/1113 extended the EU's rules on information accompanying transfers of funds to transfers of crypto-assets. Since 30 December 2024, CASPs must send information about the originator and the beneficiary with each crypto-asset transfer, and the receiving CASP must check it. Unlike for traditional transfers, there is no minimum amount below which the rule does not apply.

For transfers to or from a self-hosted address — one controlled by the user's own software or device rather than by a provider — the CASP must collect the information and, for amounts above EUR 1,000, take measures to assess whether the address is owned or controlled by its own customer. The European Banking Authority has issued guidelines on how these obligations should be applied.

The DLT Pilot Regime

Regulation (EU) 2022/858, applicable since 23 March 2023, is not about crypto-assets in the MiCA sense. It lets market infrastructures test the trading and settlement of tokenised financial instruments — shares, bonds and fund units issued on a ledger — under temporary exemptions from some existing rules. It created three types of authorised infrastructure: DLT multilateral trading facilities, DLT settlement systems and DLT trading and settlement systems. The regime limits which instruments and what volumes can be included, and ESMA reports on how it is working.

Anti-money laundering: AMLR and AMLA

Crypto exchange and custody businesses became subject to EU anti-money laundering rules through the fifth Anti-Money Laundering Directive. In 2024 the EU adopted a new package: the Anti-Money Laundering Regulation (EU) 2024/1624 (AMLR), which creates a single rulebook and lists CASPs among the entities that must apply customer due diligence; a new directive on national supervisory systems; and Regulation (EU) 2024/1620, which established the Anti-Money Laundering Authority (AMLA) in Frankfurt. AMLR is due to apply from 10 July 2027. AMLA coordinates national supervisors and is expected to supervise directly a limited number of high-risk cross-border firms, which may include CASPs.

Related EU rules

Several other laws touch crypto-asset businesses. The Digital Operational Resilience Act (Regulation (EU) 2022/2554) sets requirements for managing technology risks and applies to authorised CASPs. Council Directive (EU) 2023/2226, known as DAC8, requires CASPs to report information about their users' transactions to tax authorities, with reporting starting from 1 January 2026.

Overview for education, not legal advice. Rules change — check the official sources. Last reviewed 20 October 2026. Nothing here is an offer or a recommendation to use any crypto-asset service.