EU Crypto AML Rules in 2026: MiCA and the Travel Rule

MiCA has applied in full since December 30, 2024, following the earlier June 30, 2024 start for its asset-referenced-token and e-money-token titles. It establishes EU-wide rules for in-scope crypto-asset issuers and service providers, including authorization, governance, custody, conflicts, complaints, prudential safeguards, and market abuse. MiCA is not itself the complete AML rulebook.²³

The recast Transfer of Funds Regulation—Regulation (EU) 2023/1113, often called the travel-rule regulation or TFR—also applies from December 30, 2024. It requires information about originators and beneficiaries to accompany covered crypto-asset transfers and amended Directive (EU) 2015/849 so the broader MiCA CASP category entered the AML/CFT framework.⁸⁹

The EBA's crypto-specific ML/TF risk-factor and travel-rule guidelines have applied from the same date. National competent authorities and financial intelligence units continue to perform core authorization, AML supervision, and suspicious-activity functions. The EU Anti-Money Laundering Authority (AMLA) is building a more centralized supervisory system, with direct supervision of selected high-risk cross-border financial entities scheduled to begin in 2028.¹²¹⁰¹⁶

A new directly applicable AML Regulation, Regulation (EU) 2024/1624, is already in force as legislation but generally applies from July 10, 2027. Directive (EU) 2024/1640 will replace Directive (EU) 2015/849 from that date as Member States complete transposition. The result is a current 2026 layer plus a known 2027 changeover—not one timeless checklist.¹⁴¹⁵

Other regimes may apply at the same time: sanctions and restrictive measures, payment services, e-money, securities, data protection, tax reporting, consumer law, cyber resilience, and national criminal law. A MiCA licence is not a declaration that every product or transaction complies with all of them.

MiCA defines a CASP through the professional provision of named crypto-asset services to clients. The list includes custody and administration, operating a trading platform, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, receiving and transmitting orders, advice, portfolio management, and transfer services. Authorization is granted for specified services, not for an unlimited category called crypto business.²⁴

The TFR amended the AML directive to align the obliged-entity category with MiCA services, subject to wording and exclusions in the applicable instrument. A bank, investment firm, e-money institution, or other regulated financial entity can also provide permitted crypto services through MiCA's notification route rather than the ordinary CASP authorization route, but its exact permissions still matter.⁸⁴

Software publication, self-custody, protocol development, token issuance, mining or validation, decentralized interfaces, and professional client services raise different scope questions. A label such as DeFi, non-custodial, DAO, or offshore does not decide the legal analysis. Control, intermediation, service facts, solicitation, establishment, clients, asset classification, and exemptions all matter.

EU AML/CFT rules use a risk-based approach. A CASP must understand its business, customers, products, transaction types, delivery channels, counterparties, and geographies; apply controls proportionate to those risks; and document why the controls are effective. The EBA's crypto amendments provide sector-specific risk factors rather than declaring every crypto customer or self-hosted transfer high risk.¹²¹³

Blockchain analytics can help identify exposure patterns, typologies, and address risk, but it does not replace customer identification, beneficial-owner analysis, source-of-funds work, sanctions screening, context, or human review. A chain score can be wrong, incomplete, vendor-specific, or unable to identify the person controlling an address.¹²

For a covered transfer, the originator's CASP must ensure required originator and beneficiary information is submitted before, simultaneously with, or concurrently with the crypto transfer. The beneficiary's CASP must have procedures to detect missing or incomplete information. Personal travel-rule data can travel through a secure provider messaging channel; it does not need to be written publicly into the blockchain transaction.⁸¹⁰

The required data depends on the transaction and legal provisions, but it is designed to make the originator and beneficiary traceable. Providers need data-quality checks, secure transmission, matching to the on-chain transfer, sanctions and AML screening, handling of technical failure, and rules for retention and personal-data protection.⁸¹⁰

The crypto travel rule is not generally switched off below €1,000. The €1,000 figure is especially relevant to the additional requirement for a CASP to verify ownership or control when its customer sends to or receives from that customer's self-hosted address. Treating €999 as a no-information threshold misreads the structure of the regulation.⁸

A self-hosted address is one for which no crypto-asset service provider controls the transfer. The TFR expressly contemplates transfers to and from those addresses whenever a CASP is involved. ESMA's April 2026 transition statement even identifies transfer to a self-hosted wallet as one possible way to offboard a client from an unauthorized provider.⁸⁶

For transfers above €1,000 made between a CASP customer and a self-hosted address that the customer says is their own, the CASP must verify ownership or control. EBA guidance lists possible methods including an attended or unattended display, a small predefined transfer, or signing a message with the key corresponding to the address. The provider must choose reliable and secure evidence, not blindly apply one method to every chain or wallet.⁸¹¹

When the external address belongs to another person, the CASP generally obtains the required counterparty information from its own customer and assesses risk. Risk factors can include transaction pattern, geography, exposure, use of privacy-enhancing features, and the quality of available information, but self-hosting alone is not proof of money laundering.¹⁰¹²

MiCA's ordinary rule is that a person may not provide crypto-asset services in the EU unless it is an authorized CASP or an eligible regulated financial entity providing permitted services through Article 60. An authorized CASP has a registered office in a Member State, effective management in the EU, and an authorization specifying its services.⁴

Existing national providers could use Member State grandfathering only until the relevant national end date, authorization or refusal, and never later than July 1, 2026. ESMA's April 2026 statement says that after the EU-wide expiry, an entity providing MiCA services to EU clients without a licence is in breach and must cease. It also warns that a non-EU group company cannot rely on an affiliated EU company's licence.⁶⁵

Consumers and counterparties should check ESMA's register and the national authority, then match the named legal entity and authorized services to their contract. A familiar brand, application localization, or statement that an application is MiCA-ready is not authorization evidence.⁷⁶

The AMLR will replace much of the directive-based private-sector rule set with directly applicable EU requirements from July 10, 2027. Its purpose is greater consistency across Member States. Firms should map its requirements early but avoid describing a future-applying provision as the controlling 2026 rule.¹⁴

AMLD6 addresses the national mechanisms surrounding that single rulebook, including supervisors, financial intelligence units, registers, cooperation, and sanctions. It repeals Directive (EU) 2015/849 from July 10, 2027, subject to the directive's phased transposition details.¹⁵

AMLA is developing regulatory standards, common methods, FIU coordination, and supervisory convergence. It plans to select directly supervised entities in 2027 and begin direct supervision in 2028 for a limited group meeting cross-border and high-risk criteria. Most CASPs will still interact directly with national authorities, even as AMLA shapes the common framework.¹⁶