AMLA’s response to the MiCA review: AML/CFT recommendations relevant to crypto-asset service providers
Summary
On 7 October 2026, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) published its response to the European Commission’s targeted consultation on the review of the Markets in Crypto-Assets Regulation (MiCA). The response is dated 30 September 2026, the day the consultation closed.
The response focuses on five areas: staking, lending and borrowing; DeFi arrangements; unauthorised stablecoins; issuers of asset-referenced tokens (ARTs) that are not obliged entities; and the passporting regime for crypto-asset service providers (CASPs). It also comments on third-country multi-issuance stablecoins, crypto-asset account identifiers, and the assessment of good repute.
As a consultation response, it does not change any current obligation. The Commission’s report under Article 140(1) of MiCA is due by 30 June 2027.
The review
The Commission’s consultation opened on 20 May 2026 and closed on 30 September 2026. It informs the report the Commission must prepare under Articles 140 and 142 of MiCA. Article 140(1) requires the Commission, having consulted the EBA and ESMA, to present a report by 30 June 2027,
“accompanied, where appropriate, by a legislative proposal”. AMLA responded to the targeted consultation, and its response refers to the EBA’s own response.
What AMLA recommends
Staking, lending and borrowing
AMLA notes that MiCA does not regulate these as standalone activities. AMLA says staking may fall indirectly within MiCA through the authorisation requirement for custody and administration services, but that this “only addresses the custody element”. In its view, this does not capture the specific risks of asset pooling, yield generation, temporary control transfers and limited client access to assets during staking periods. AMLA says similar concerns arise where CASPs facilitate access to DeFi lending, borrowing or staking arrangements on behalf of their clients. It sees a risk that the current framework could create a “structural incentive for CASPs to route transactions through unregulated lending wrappers”. It also refers to exposure to high-risk jurisdictions or jurisdictions with deficient AML/CFT frameworks, and to risks from customer anonymity and no or limited monitoring of activity, which it says the EBA and ESMA have recognised.
AMLA recommends that the Commission consider whether dedicated requirements for staking, lending and borrowing would be appropriate, rather than relying solely on the ancillary coverage of the custody provisions in Article 75. It says such requirements could be incorporated into the existing CASP framework, where appropriate. It also suggests considering additional management requirements for CASPs acting as gatekeepers when they give customers access to DeFi services, a point it attributes to the EBA.
DeFi arrangements
AMLA says that where an arrangement claims to be decentralised, as set out in Recital 22 of MiCA, there may still be “significant reliance” on the persons or entities concerned to self-assess whether it falls outside MiCA. It gives two examples of how effective control may arise: a concentration of governance tokens, or the ability to pause or modify smart contracts. It recommends that the legal framework define the term “DeFi arrangement” and set common criteria for determining whether a person or entity exercises effective control. Where a person or entity has “significant influence over key functionalities” or holds “a significant concentration of governance power” without providing a crypto-asset service itself, it suggests considering a requirement for CASPs that facilitate access to the arrangement to apply appropriate risk-mitigation measures.
Unauthorised stablecoins
AMLA notes that, under Articles 16(1) and 48(1) of MiCA, CASP services involving ARTs or e-money tokens (EMTs) that do not comply with MiCA also constitute an offer to the public or admission to trading. It refers to the Commission’s clarification in a Q&A and to statements by the EBA and ESMA, which it supports. It cites the FATF’s 2026 targeted report on stablecoins and unhosted wallets. According to AMLA, the report “identifies stablecoins as a common component of money laundering, terrorist-financing and proliferation-financing activity”, particularly where transactions involve unhosted wallets or no AML/CFT-obliged intermediary. It recommends clarifying the treatment of non-authorised ARTs and EMTs and applying it consistently across the EEA, “including where such tokens continue to circulate or are intermediated by CASPs”. It also recommends that the Commission consider “legislative measures to remove legal uncertainty” about the application of MiCA applies to services involving these tokens.
ART issuers
AMLA notes that an ART issuer that is a credit institution is an obliged entity, but that “the AMLR does not mention ART issuers as obliged entities”. The AMLR is the EU Anti-Money Laundering Regulation. AMLA says other issuers are classified as obliged entities only if they decide to provide services in relation to their ARTs, that is, obtain a CASP licence. In AMLA’s words, “Pure-play ART issuers without engagement of another obliged entity placing the token are therefore not directly subject to AML/CFT requirements”, so customer due diligence is not performed when a token is issued or redeemed. It points to Article 16(1) of MiCA, under which the issuer may itself offer an ART to the public, and to holders’ permanent right of redemption against the issuer under Article 39.
It recommends that the Commission review the interaction between MiCA and the AML/CFT framework, to determine whether the existing regulatory perimeter sufficiently captures the AML/CFT risks of ART issuance and redemption. AMLA says the review should take into account the roles of the entities involved in issuance, distribution, and redemption, including CASPs, custodians, and credit institutions, and whether customer due diligence and transaction monitoring are applied at each stage. Following that review, AMLA says, the Commission should consider whether to amend the AMLR to include ART issuers that are not otherwise covered as obliged entities and that issue or redeem ARTs directly, without the involvement of another obliged entity applying appropriate AML/CFT measures. Alternatively, AMLA says, the Commission should consider whether equivalent AML/CFT requirements should apply to such issuers.
Passporting
AMLA says feedback from competent authorities suggests that the nature of cross-border activity cannot always be reliably ascertained. It says this because CASPs notifying activities in another Member State are not required to specify whether services are provided through an establishment or under the freedom to provide services. It links this to the central contact point regime in the AML/CFT framework. It recommends that the Commission consider adding information requirements to MiCA itself, so that authorities can distinguish establishment-based from freedom-to-provide-services business models and, for services provided under the freedom to provide services, identify whether they rely on infrastructure in the host Member State.
Additional observations
AMLA says third-country multi-issuance stablecoin arrangements warrant consideration from an AML/CFT perspective, citing limited visibility of a token’s transaction history and the origin of funds at redemption. If such arrangements are permitted, it says consideration could be given to measures on transparency, cooperation, and information exchange across jurisdictions, in line with ESRB recommendations. AMLA notes that the new framework addresses some AML/CFT concerns in this area, including Article 16 of the AML Directive (AMLD) on the attribution and identification of crypto-asset accounts. It considers that this may mitigate the wider issue of attributing wallet activity. It says clarification is needed on whether the required unique identifier for a crypto-asset account will enable identification of the relevant wallet addresses.
It also supports the EBA’s observation that MiCA’s Level 1 mandates are not fully aligned with other sectoral rules, for example on authorisations and the assessment of qualifying holdings. AMLA says this may limit the information available when assessing good repute, including from an ML/TF perspective. It says the Commission should consider aligning the relevant provisions and mandates.
Position for CASPs
Any amendment to MiCA or the AMLR would require EU legislation. Under Article 140(1), the Commission’s report, due by 30 June 2027, is to be accompanied, where appropriate, be accompanied by a legislative proposal. AMLA’s description of services involving non-compliant ARTs and EMTs follows the Commission’s Q&A and the EBA and ESMA statements, and AMLA supports the EBA and ESMA position. It also asks the Commission to consider legislative measures to remove legal uncertainty on this point.
In our view, two points, if adopted, would give CASPs a larger gatekeeping role. The first is the DeFi suggestion described above, under which CASPs that facilitate access to an arrangement would apply appropriate risk-mitigation measures. The second is the point AMLA attributes to the EBA on additional management requirements for CASPs acting as gatekeepers when giving customers access to DeFi services. On staking, lending, and borrowing, AMLA asks the Commission to consider whether dedicated requirements would be appropriate.
Points for compliance teams
In our view, compliance teams may wish to consider:
For staking and lending products, recording how each product addresses the ML/TF risks AMLA describes, including exposure to high-risk jurisdictions, customer anonymity and limited monitoring, as well as asset pooling, yield generation, temporary control transfers and limited client access.
For DeFi access, recording which arrangements the firm gives customers access to and what controls apply to each.
For stablecoin services, checking services involving ARTs or EMTs that do not comply with MiCA against Articles 16(1) and 48(1) of MiCA, as set out in the Commission’s Q&A and the EBA and ESMA statements.
For ARTs from issuers that are not obliged entities, recording whether the firm is the only obliged entity in the issuance, distribution or redemption chain, and what customer due diligence and transaction monitoring it applies.
For passported services, recording for each host Member State whether the firm operates through an establishment or under the freedom to provide services, and whether it uses infrastructure in that state.
Timeline
20 May 2026: Commission consultation opened.
30 September 2026: consultation closed; AMLA response dated.
7 October 2026: AMLA response published.
By 30 June 2027: Commission report due under Article 140(1) of MiCA, accompanied, where appropriate, by a legislative proposal.
Sources
James Ross, Head of Advisory, denouement. This note is for information and is not legal advice.
Comments