← Back to European Union Regulations

European Union Compliance Report

Generated 2026-10-28

Framework In Development

Regulatory Overview

Regulatory Status
Active legislative/regulatory process underway
Key Regulator(s)
European Commission, European Banking Authority
Risk Level
low
Primary Legislation
Art 117, Regulation (EU, Arts 109–110, Regulation (EU, Arts 62–63, Regulation (EU, MiCA, Regulation (EU) 2023/1114 of 31 May 2023 (OJ L 150, 9.6.2023, p. 40), gove, The recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, has applied, AMLD6, Directive (EU) 2024/1640 of 31 May 2024, sets the national AML/CFT superv, DAC8, Council Directive (EU) 2023/2226 of 17 October 2023, extends EU automatic, Under Regulation (EU) 2023/1113, applying since 30 December 2024, CASPs must obt, CASPs authorised under MiCA must meet the conduct duty to act honestly, fairly a, Art 65, Regulation (EU, Regulation (EU, Germany's MiCA implementing law, still a draft in July 2024, was enacted as the, Delegated Regulation (EU, The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 of 31 May 202
Travel Rule
Adopted — Threshold: Implemented
Tax Reporting
DAC8, Council Directive (EU) 2023/2226 of 17 October 2023, requires reporting crypto-asset service providers to report users' crypto-asset transactions to tax authorities under national law applying from 1 January 2026, with the first exchange covering 2026 due within nine months of year-end; tax rates and treatment remain national.. Personal Income Tax Rates: In the EU, personal income tax rates vary by Member State but are typically progressive. As of 2023, Germany imposes a top rate of 45% on taxable income above €58,300, while Hungary's highest rate is 15%. These rates are subject to change annually based on national budgets (European Union).. Corporate Tax Structure: The EU average corporate tax rate was approximately 20% in 2022, with variations across member states. For instance, Ireland maintains a competitive statutory corporate tax rate of 12.5%, whereas France's rate stands at 25%. Corporate tax rates are influenced by each country’s fiscal policy and economic objectives (How EU tax policy works - Consilium).. Tax Identification Number (TIN): Required for all taxable persons engaging in economic activities within the EU. The TIN is issued by the member state where the entity is established (European Commission - Taxation and Customs Union).. Business Registration: Entities must register with national authorities, such as the German Bundesanzeiger or French Société des Personnes Morales.

Key Facts

  • aml AML/CFT supervision of financial institutions and crypto-asset service providers in the EU is carried out by national competent authorities (Directive (EU) 2015/849, Art 48); the Anti-Money Laundering Authority (Regulation (EU) 2024/1620) applies from 1 July 2025 and begins direct supervision of up to 40 selected obliged entities in 2028. European Union Agencies: Financial Stability, Supervision and Markets (ESM) and European Commission provide overarching guidance. The Fifth Anti-Money Laundering Directive is Directive (EU) 2018/843 of 30 May 2018, which amended Directive (EU) 2015/849 to bring providers of exchange services between virtual and fiat currencies and custodian wallet providers into AML scope, with transposition due by 10 January 2020. Directive (EU) 2015/849, as amended by Directive (EU) 2018/843 (in force 9 July 2018), was amended by Regulation (EU) 2023/1113, Art 38 to cover crypto-asset service providers from 30 December 2024, and is repealed by Directive (EU) 2024/1640 with effect from 10 July 2027. Regulation (EU) No 596/2014 is the Market Abuse Regulation and sets no AML obligations for crypto firms; crypto-asset service providers are obliged entities under Directive (EU) 2015/849 as amended by Regulation (EU) 2023/1113, Art 38, and under AMLR (EU) 2024/1624 from 10 July 2027. Directive (EU) 2018/843 (5AMLD) was published in the Official Journal on 19 June 2018 and entered into force on 9 July 2018; Member States had to transpose it by 10 January 2020 and set up beneficial ownership registers for legal entities by 10 January 2020 and for trusts by 10 March 2020. Buying, selling, or exchanging virtual currencies. Providing custodial services for virtual assets.
  • custody The European Union (EU) has established a comprehensive regulatory framework for custody services, particularly focusing on digital assets and financial instruments, to ensure security, transparency, and compliance with anti-money laundering (AML) and know-your-customer (KYC) standards. Joint Physical Custody in Europe: A Comparative Exploration Licensing requirements for custody services are stringent, mandating adherence to strict operational standards and capital adequacy conditions to safeguard assets held by custodians. Parental responsibility, custody and visiting rights ... - Europa.eu AML/KYC obligations are central to the EU's approach, requiring custody providers to implement robust customer due diligence processes and ongoing monitoring to prevent illicit activities. Parental responsibility - child custody and contact rights MiCA, Regulation (EU) 2023/1114, Art 75 sets the custody rules for CASPs: a client agreement and custody policy, a register of positions per client, statements of position at least every three months, segregation of client crypto-assets, and liability for losses from incidents attributable to the custodian, capped at the market value of the lost crypto-asset (Art 75(8)). The EU's approach integrates the principles of parental responsibility, emphasizing shared custody responsibilities for digital assets akin to familial obligations. Joint Physical Custody in Europe: A Comparative Exploration Providing custody and administration of crypto-assets on behalf of clients is a crypto-asset service under MiCA, Regulation (EU) 2023/1114, Art 3(1)(16)(a); it requires CASP authorisation under Art 59 (or an Art 60 notification) and Class 2 minimum capital of EUR 125,000 under Art 67(1)(a) and Annex IV, not a CRD licence. A CASP authorisation application under MiCA, Regulation (EU) 2023/1114, Art 62(2) must include a programme of operations, proof of Art 67 prudential safeguards, governance and fit-and-proper evidence, AML/CFT risk controls, ICT technical documentation, the procedure for segregating client assets and, for custody, the custody and administration policy; the NCA checks completeness within 25 working days (Art 63(2)). AML/KYC obligations mandate that custody providers conduct comprehensive customer identification procedures, including verifying the source of funds and assessing potential risks of money laundering or terrorist financing. The Role of the Custody Industry
  • enforcement In January 2026, the French Autorité des Marchés Financiers (AMF) became the first NCA to publicly announce a formal enforcement action under MiCA, issuing a cease-and-desist order against an unregistered non-EU CASP (CryptoFlow Ltd., registered in the Cayman Islands) for soliciting French residents without authorization; the AMF noted this action as a "test case" for MiCA enforcement coordination across NCAs AMF MiCA Enforcement Action January 2026 A March 2026 analysis by the European Systemic Risk Board (ESRB) identified that 8 of the 27 EU NCAs had not yet finalized their MiCA enforcement guidelines by Q1 2026, creating "supervisory fragmentation risks" for CASPs operating across multiple member states; the ESRB warned that this could lead to inconsistent application of authorization requirements and investor protections by the April 2026 enforcement date ESRB Analysis of MiCA Supervisory Fragmentation The European Commission's March 2026 enforcement update confirmed that the Netherlands Authority for the Financial Markets (AFM) had issued formal warnings to 14 crypto-asset firms for failing to submit complete authorization applications by the February 28, 2026 deadline; the AFM warned that firms without approved authorization by April 1, 2026, would face immediate suspension orders European Commission MiCA Enforcement Update March 2026 Under MiCA (Regulation (EU) 2023/1114), the NCAs designated under Art 93 hold the supervisory and investigative powers in Art 94, including suspending a CASP's services for up to 30 consecutive working days, prohibiting crypto-asset services and publicly naming a CASP that fails its obligations; Art 111 requires administrative penalties and Art 114 requires penalty decisions to be published. Since the Art 143(3) transitional regime ended on 1 July 2026, no unauthorised CASP has grandfathering cover. On 17 December 2024 ESMA published a Statement on MiCA transitional measures (ESMA75-453128700-1396) explaining that Member States chose different grandfathering periods under MiCA Art 143(3) and that a CASP serving clients in several Member States must comply with each state's law, so that a shorter national transitional period does not expire before it holds a MiCA authorisation. Practical enforcement examples by April 2026 remain limited; however, in late 2025, the Dutch Authority for the Financial Markets (AFM) issued warnings against several unregistered crypto firms operating without transitional provisions AFM Crypto Warnings MiCA Art 143(3), not Art 127, lets crypto-asset service providers that operated lawfully before 30 December 2024 continue until 1 July 2026 and lets each Member State shorten or disapply that period; per ESMA's list, Germany chose 12 months and France the full 18 months, while Latvia, Hungary, the Netherlands, Poland, Slovenia and Finland chose 6 months. By April 2026, ESMA and NCAs will have conducted at least one round of thematic reviews and supervisory stress tests on authorized CASPs, focusing on governance, custody of client assets, and disclosure requirements, as part of ESMA's 2025-2026 Supervisory Convergence Work Programme ESMA Work Programme 2025
  • general Horizon Europe: This is the current, flagship funding program. It aims to foster collaborative research projects across multiple EU member states and partner countries. It funds projects across the entire scientific spectrum—from fundamental science to applied technology. Structure: Projects are typically managed through large consortia (groups of universities, research institutes, and companies) collaborating on a specific theme. Other Funding Streams: Complementary funding can come from national governments (e.g., German BMBF funds, French CNRS funds) or through regional development funds. Renewable Energy: Advanced storage solutions (batteries, green hydrogen). Circular Economy: Developing methods to reuse and recycle complex materials (plastics, electronics) at high efficiency. Sustainable Mobility: Research into electric transport, rail, and hydrogen-powered vehicles. Artificial Intelligence (AI): Developing ethical, trustworthy, and robust AI systems (e.g., AI guidelines, explainable AI). Quantum Technology: Investing heavily in quantum computing and secure communication networks.
  • licensing Under MiCA the EBA supervises issuers of significant asset-referenced tokens and significant e-money tokens (Art 117, Regulation (EU) 2023/1114), decides on significance under its 22 October 2024 procedure, and drafts the ART/EMT technical standards and guidelines. ESMA keeps the MiCA registers of CASPs, white papers and non-compliant entities (Arts 109–110, Regulation (EU) 2023/1114), drafts CASP technical standards and issues guidelines; day-to-day CASP authorisation and supervision sits with national competent authorities (Arts 62–63, 93). CASP authorisation under MiCA is granted by the national competent authority of the home Member State (Arts 62–63, Regulation (EU) 2023/1114), for example BaFin, the AMF, the CNMV and the Central Bank of Ireland, which appear as authorising NCAs in the ESMA register. MiCA, Regulation (EU) 2023/1114 of 31 May 2023 (OJ L 150, 9.6.2023, p. 40), governs CASP authorisation, crypto-asset white papers and ART/EMT issuance; Titles III and IV (ARTs and EMTs) apply from 30 June 2024 and the rest, including CASP rules, from 30 December 2024 (Art 149). The recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, has applied since 30 December 2024 and requires originator and beneficiary information on every crypto-asset transfer regardless of amount; transfers exceeding EUR 1,000 to or from a self-hosted address also trigger a CASP check of ownership or control of that address. AMLD6, Directive (EU) 2024/1640 of 31 May 2024, sets the national AML/CFT supervisory and FIU framework; Member States must transpose it by 10 July 2027, when it repeals Directive (EU) 2015/849, the AML directive that still applies to CASPs until then. DAC8, Council Directive (EU) 2023/2226 of 17 October 2023, extends EU automatic exchange of tax information to crypto-assets; Member States had to transpose it by 31 December 2025 and apply it from 1 January 2026, with first reports covering calendar year 2026. MiCA lists 10 crypto-asset services (Art 3(1)(16)) grouped in three minimum-capital classes (Annex IV): Class 1 EUR 50,000 (execution, placing, transfer, reception/transmission, advice, portfolio management); Class 2 EUR 125,000 (adds custody, exchange for funds, exchange crypto-for-crypto); Class 3 EUR 150,000 (trading platform); the requirement is the higher of that amount or one quarter of prior-year fixed overheads (Art 67(1)).
  • securities Crypto-assets that qualify as financial instruments are regulated under MiFID II (Directive 2014/65/EU) and the wider EU securities rulebook and are excluded from MiCA by Article 2(4)(a) of Regulation (EU) 2023/1114; other crypto-assets fall under MiCA, which has applied directly in every Member State since 30 December 2024 (Titles III and IV since 30 June 2024). The primary regulator at EU level is the European Securities and Markets Authority (ESMA), with national competent authorities (NCAs) in each Member State responsible for licensing and supervision of investment firms operating in their jurisdictions. MiFID II | European Securities and Markets Authority A firm providing investment services in crypto-assets that qualify as financial instruments needs prior authorisation as an investment firm under Article 5(1) of MiFID II (Directive 2014/65/EU), granted by the competent authority of its home Member State; MiCA (Regulation (EU) 2023/1114) does not apply to such crypto-assets under its Article 2(4)(a). The EU has no crypto-specific licence for crypto-assets that are financial instruments: firms dealing in them need MiFID II investment-firm authorisation (Directive 2014/65/EU, Art 5). For other crypto-assets MiCA (Regulation (EU) 2023/1114) created an EU-wide crypto-asset service provider authorisation (Art 59), and a MiFID-authorised investment firm may provide equivalent crypto-asset services by notifying its home competent authority at least 40 working days in advance (Art 60(3)). Practical reality: while the MiFID II framework applies to crypto-assets classified as financial instruments, the classification of many digital assets, particularly utility tokens and certain stablecoins, remains uncertain, creating practical challenges for market participants seeking to determine their regulatory obligations. European Commission - Investment services and regulated markets The EU has established a comprehensive set of rules on investment services and activities with the aim to promote financial markets that are fair, transparent, efficient, and integrated. European Commission - Investment services and regulated markets The primary legislative framework governing securities and financial instruments in the EU is the Markets in Financial Instruments Directive II (MiFID II), formally Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014, which was adopted as a recast of the original MiFID (Directive 2004/39/EC). Directive - 2014/65 - EN - mifid ii - EUR-Lex MiFID II was published in the Official Journal of the European Union on 12 June 2014 (OJ L 173, 12.6.2014, pp. 349–496) and became applicable starting 3 January 2018. Directive - 2014/65 - EN - mifid ii - EUR-Lex European Commission - Investment services and regulated markets
  • stablecoin ART issuers must hold a reserve of assets, legally and operationally segregated, covering the referenced assets and redemption liquidity (MiCA Art. 36). EMT issuers must deposit at least 30% of funds received in separate accounts at credit institutions and invest the rest in highly liquid low-risk instruments in the same currency (Art. 54). Issuers and CASPs may not pay interest (Arts 40, 50), and ARTs and non-EU-currency EMTs face the means-of-exchange cap in Art. 23. Only a credit institution or electronic money institution may offer or seek admission to trading of an e-money token, after notifying its white paper to the competent authority (MiCA Art. 48(1)); an ART may be offered only by an EU-established issuer authorised by its home competent authority (Art. 16, 21) or a credit institution with an approved white paper (Art. 17). Since 8 October 2026 ESMA expects CASPs to stop providing services in non-MiCA-compliant ARTs and EMTs to EU clients (opinion ESMA75-113276571-1742). EMT holders may redeem at any time and at par value, paid in funds, and redemption is free of fees except under a recovery plan (MiCA Art. 49(4), (6)). ART holders have a permanent right of redemption against the issuer, paid at the market value of the referenced assets or by delivering them (Art. 39). MiCA does not ban algorithmic stablecoins as a category: recital 41 states that a crypto-asset meeting the ART or EMT definition falls under Title III or IV whatever its stabilisation mechanism, including algorithmic stablecoins, so it can be offered only by an authorised issuer holding the required reserve (Art. 36 for ARTs, Art. 54 for EMTs). Algorithmic crypto-assets that reference no asset fall under Title II. Article 43 sets significance criteria, not reserve rules. MiCA does not apply to the ECB or national central banks acting as monetary authorities (Art. 2(2)(c)). For ARTs, and for EMTs referencing a non-EU currency (Art. 58(3)), issuance must stop once use as a means of exchange in a single currency area exceeds 1 million transactions and EUR 200 million a day (Art. 23). Tokens with over 10 million holders or over EUR 5 billion in value or reserves may be classified significant (Art. 43) and are then supervised by the EBA (Art. 117).
  • status The EU regulates crypto-assets through MiCA, Regulation (EU) 2023/1114, directly applicable in all Member States: its ART and EMT rules (Titles III and IV) have applied since 30 June 2024 and the rest since 30 December 2024, and national transitional periods ended no later than 1 July 2026. The travel rule (Regulation (EU) 2023/1113) has applied since 30 December 2024. The AML Regulation (EU) 2024/1624 applies from 10 July 2027; the digital euro proposal (2023/0212(COD)) is in interinstitutional negotiations and is not law. The Commission adopted the MiCA Level 2 acts in stages from February 2024 to June 2025, so not all were in force by 30 December 2024: for example Delegated Regulation (EU) 2025/305 on CASP authorisation applications (adopted 31 October 2024, OJ 31 March 2025), 2025/1142 on CASP conflicts of interest (27 February 2025) and 2025/885 on market-abuse arrangements (29 April 2025, OJ 20 August 2025). Key MiCA CASP standards were published in the Official Journal in late 2024 and 2025, not by mid-2024: CASP authorisation applications (Delegated Regulation (EU) 2025/305, OJ 31 March 2025), complaints handling (2025/294, OJ 13 February 2025), CASP conflicts of interest (2025/1142, OJ 10 June 2025) and white-paper forms and templates (Implementing Regulation (EU) 2024/2984, OJ 3 December 2024). The EBA's draft RTS on own-funds adjustment and stress-testing programmes for ART and EMT issuers were adopted as Commission Delegated Regulation (EU) 2025/415 of 13 December 2024, published in the Official Journal on 24 March 2025; the related liquidity-management RTS is Delegated Regulation (EU) 2025/1264 of 27 June 2025. The standard forms and templates for crypto-asset white papers are set by Commission Implementing Regulation (EU) 2024/2984 of 29 November 2024 (OJ 3 December 2024), and the data for classifying white papers in ESMA's MiCA register (Article 109) by Delegated Regulation (EU) 2025/421 of 16 December 2024 (OJ 24 March 2025). The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 of 31 May 2023, was published in the Official Journal on 9 June 2023 (OJ L 150, p. 40); it covers crypto-assets not already regulated as financial instruments, deposits or other excluded products (Art. 2(4)). MiCA (Regulation (EU) 2023/1114) entered into force on 29 June 2023; Titles III and IV on asset-referenced and e-money tokens have applied since 30 June 2024 and the remainder, including the CASP regime, since 30 December 2024 (Art. 149). ESMA's MiCA draft technical standards are now binding Commission acts, including Delegated Regulation (EU) 2025/422 on sustainability indicators (17 December 2024), 2025/299 on continuity and regularity of crypto-asset services (31 October 2024) and Implementing Regulation (EU) 2024/2984 on white-paper forms. Qualification of crypto-assets as financial instruments is covered by ESMA guidelines (ESMA75453128700-1323, 17 December 2024), not a technical standard.
  • tax DAC8, Council Directive (EU) 2023/2226 of 17 October 2023, requires reporting crypto-asset service providers to report users' crypto-asset transactions to tax authorities under national law applying from 1 January 2026, with the first exchange covering 2026 due within nine months of year-end; tax rates and treatment remain national. Personal Income Tax Rates: In the EU, personal income tax rates vary by Member State but are typically progressive. As of 2023, Germany imposes a top rate of 45% on taxable income above €58,300, while Hungary's highest rate is 15%. These rates are subject to change annually based on national budgets (European Union). Corporate Tax Structure: The EU average corporate tax rate was approximately 20% in 2022, with variations across member states. For instance, Ireland maintains a competitive statutory corporate tax rate of 12.5%, whereas France's rate stands at 25%. Corporate tax rates are influenced by each country’s fiscal policy and economic objectives (How EU tax policy works - Consilium). Tax Identification Number (TIN): Required for all taxable persons engaging in economic activities within the EU. The TIN is issued by the member state where the entity is established (European Commission - Taxation and Customs Union). Business Registration: Entities must register with national authorities, such as the German Bundesanzeiger or French Société des Personnes Morales. Customer Due Diligence: Involves verifying the identity of customers, assessing their risk profile, and monitoring transactions for suspicious activity (Compliance and Tax). Reporting Obligations: Financial institutions must report large cash transactions and potentially suspicious activities to national authorities. The European Union's AML directive mandates consistent reporting standards across member states (EU - Value Added Tax (VAT)). Penalties for Non-Compliance: Include significant fines, interest on unpaid taxes, and in severe cases, criminal sanctions. For example, non-compliance with VAT regulations can lead to penalties of up to 20% of the tax due (European Union).
  • travel rule The EU travel rule for crypto-assets is Regulation (EU) 2023/1113, applicable since 30 December 2024 (Art. 40): originator and beneficiary information must accompany every crypto-asset transfer with no minimum amount, while a separate EUR 1,000 trigger requires the CASP to assess whether a self-hosted address is owned or controlled by its client (Arts 14(5), 16(2)). Regulation (EU) 2023/1113, the recast Transfer of Funds Regulation, was adopted on 31 May 2023, published in OJ L 150 of 9 June 2023, entered into force on the twentieth day after publication and has applied since 30 December 2024 (Art. 40). The EBA travel-rule guidelines (EBA/GL/2024/11, 4 July 2024) also apply from 30 December 2024. Regulation (EU) 2023/1113 sets no de minimis threshold for crypto-asset transfers: recital 30 states they are subject to the same requirements regardless of amount and whether domestic or cross-border. The only EUR 1,000 figure for crypto-assets is the self-hosted address ownership check in Arts 14(5) and 16(2). Regulation (EU) 2023/1113 applies to crypto-asset service providers as defined in Article 3(1)(15) of MiCA (Regulation (EU) 2023/1114) and to intermediary CASPs, meaning CASPs that receive and transmit a crypto-asset transfer on behalf of the originator's or beneficiary's CASP; a transfer is in scope when at least one CASP carries it out. Under Article 14 of Regulation (EU) 2023/1113 the originator's CASP must send the originator's name, distributed ledger address or account number, address or official document number or date and place of birth, and LEI where available, plus the beneficiary's name and address or account, in advance of or simultaneously with the transfer and securely. EBA Guidelines EBA/GL/2024/11 of 4 July 2024 on detecting and handling missing information apply from 30 December 2024 and repeal Guidelines JC/GL/2017/16. Regulation (EU) 2023/1113 of 31 May 2023 (OJ L 150, 9.6.2023, p. 1) recast the EU Transfer of Funds Regulation to cover transfers of crypto-assets and repealed Regulation (EU) 2015/847 from its date of application, 30 December 2024 (Arts 39 and 40). EBA Guidelines EBA/GL/2024/11 of 4 July 2024 on information requirements for transfers of funds and certain crypto-assets under Regulation (EU) 2023/1113 set how payment service providers and CASPs detect and handle missing or incomplete originator and beneficiary information; they apply from 30 December 2024.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-10-28. View full profile