On 1 July 2026, the EU's transition to a fully harmonised crypto-asset framework reached a key milestone with the end of MiCAR's transitional period. Under Article 143(3) of Regulation (EU) 2023/1114 (MiCAR), crypto-asset service providers operating under national regulatory regimes before 30 December 2024 were permitted to continue providing services while seeking MiCAR authorisation. With the grace period now over, only MiCAR-authorised Crypto-Asset Service Providers (CASPs) may legally provide crypto-asset services across the EU.
Ahead of this deadline, both ESMA and AMLA issued guidance on the implications of the transition. In particular, AMLA highlighted the money laundering and terrorist financing (ML/TF) risks arising from the withdrawal of unauthorised VASPs, large-scale customer migrations, and the concentration of activity among a smaller number of authorised CASPs. To mitigate these risks, AMLA called for a coordinated, forward-looking, and risk-based response from crypto-asset firms, AML/CFT supervisors, and Financial Intelligence Units (FIUs) to ensure the continued integrity of the EU financial system.
Managing AML/CFT Risks During the Transitional Period
AMLA recognises that the transitional period gives rise to different risk considerations among exiting VASPs and newly authorised CASPs.
Unauthorised VASPs Winding Down - For VASPs that did not obtain MiCAR authorisation, AMLA warns that accelerated wind-downs may strain AML/CFT controls and reduce visibility over customer activity and asset movements, increasing the risk of illicit funds being concealed or transferred. To address these risks, exiting firms are expected to maintain effective AML/CFT governance, keep customer due diligence records up to date, continue monitoring transactions, and report suspicious activity until all regulated activities have ceased.
Authorised CASPs Absorbing the Migration - For authorised CASPs, the key challenge lies in absorbing customers migrating from unauthorised providers. Increased onboarding volumes, transaction activity, and overall business exposure may place strain on compliance teams and transaction monitoring systems, potentially weakening controls as risk levels rise. AMLA therefore stresses the need for scalable AML/CFT frameworks, adequate staffing, sufficient system capacity, and robust onboarding procedures. Importantly, customers migrating from unauthorised VASPs should not be subject to blanket de-risking. Instead, CASPs should apply a risk-based approach, carrying out individual risk assessments and proportionate customer due diligence measures.
AMLA also highlights the role of AML/CFT supervisors and Financial Intelligence Units (FIUs) during the period of market transition. Simultaneous market exits, customer migrations, and evolving business models can create supervisory blind spots, particularly where standards differ across Member States. To address these risks, AMLA encourages stronger cooperation and information sharing between competent authorities, with a focus on overseeing wind-down activities and customer transfers. FIUs are similarly encouraged to enhance domestic and cross-border collaboration to monitor emerging ML/TF risks and maintain visibility over potentially suspicious activity.
Beyond 1 July: MiCAR’s Next Chapter
The end of the transitional period should not be viewed as the conclusion of MiCAR's implementation journey, but as the beginning of a new phase of regulatory maturity and ongoing refinement for the European crypto-asset market. The European Commission has opened a consultation to review MiCAR, and discussions on the proposed Markets in Financial Services Package look to upgrade the EU’s DLT pilot regime.
