Crypto compliance for the EU rulebook

MiCA is the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), the EU's single rulebook for crypto-asset markets. It has applied in full since 30 December 2024. Firms providing crypto-asset services to EU clients must be authorised as Crypto-Asset Service Providers (CASPs) in one member state, after which they can passport their services across all 27. The authorisation bar is high: governance, capital adequacy, operational resilience, segregation and safeguarding of client assets, complaints handling, and record-keeping are all tested, and the obligations continue for as long as the licence does. Stablecoin issuers face separate, stricter titles covering e-money tokens and asset-referenced tokens.

Readiness is everything up to the licence: a gap assessment, remediation, and the evidence pack behind an application. Ongoing compliance is everything after it: the recurring cycle of reviews, evidence, notifications and supervisory responses that proves you still meet the conditions you were authorised against. The distinction matters commercially because firms routinely budget for the first and not the second, then find that their first supervisory contact tests arrangements nobody has looked at since the application was filed. Authorisation is the entry ticket. Supervision is the job.

It is an independent review of the anti-money-laundering controls you actually operate, tested against the obligations that apply to you. We look at customer due diligence and onboarding, ongoing monitoring, transaction monitoring rules, sanctions and PEP screening, blockchain analytics screening of wallet exposure, Travel Rule handling, suspicious transaction reporting, record-keeping, training, and the compliance officer function. The output is a written report with findings ranked by severity and a remediation plan you can work through.

DAC8 is the eighth amendment to the EU Directive on administrative cooperation in tax (Directive (EU) 2023/2226). It transposes the OECD Crypto-Asset Reporting Framework into EU law and applies from 1 January 2026. Crypto-asset service providers with EU-resident users must identify those users, collect tax self-certifications including tax residence and taxpayer identification numbers, aggregate their reportable transactions per user and per asset at fair market value, and report the lot to a tax authority annually. That authority then exchanges the data automatically with every member state where a user is tax resident. There is no minimum threshold: any reportable activity above zero is reported.