If you're running a crypto asset service provider in the EU, the compliance calendar through 2028 is the most consequential since the sector began. MiCA authorization is now the baseline for staying in the EU market -- but it's only the first layer. Behind it sits a complete overhaul of anti-money laundering rules, a new supranational supervisor, and a Travel Rule that's already in force but widely under-implemented.

This article lays out the full regulatory timeline from 2024 through 2028, explains what each milestone means in operational terms, and identifies the infrastructure decisions you should be making now -- not when the deadline arrives.

What is the complete regulatory timeline from 2024 to 2028?

Five major regulatory instruments converge between 2024 and 2028. Here they are in chronological order, with the dates that matter for compliance planning.

Key risk

These five instruments are not independent. They stack. A CASP that obtained MiCA authorization by July 2026 has less than 12 months before the AMLR rewrites its CDD obligations, and about 18 months before it could face direct AMLA supervision. Building compliance infrastructure for today's minimums means rebuilding it within a year.

What changed when the MiCA transition ended in July 2026?

The MiCA transitional period (Article 143(3) of Regulation 2023/1114) allowed CASPs operating under national law to continue providing services while applying for authorization. That window closed on 1 July 2026, at most. After that date, four things changed simultaneously.

End of grandfathering

CASPs that were operating under national registration regimes must now hold a full MiCA authorization to keep providing crypto-asset services in the EU. Operating without one is not a post-deadline growth strategy: ESMA's 23 June 2026 public statement expects unauthorised CASPs to wind down EU activities in an orderly manner, stop onboarding new EU clients, cease marketing and solicitation, and limit services to actions necessary to sell or transfer crypto-assets, reallocate assets, or close positions.

Do not confuse this with EBA/OP/2026/01. That opinion addressed the separate PSD2/MiCA no-action-letter transition for CASPs transacting e-money tokens (EMTs) that qualify as payment services. That transition ended on 2026-03-02; it was not a general MiCA grandfathering extension.

NCA authorization rounds

National Competent Authorities are still processing applications, ownership changes, and post-authorization notifications. But the operational posture changed after 1 July 2026: a pending application is not a passport. If authorization has not been granted, the plan should be client protection and orderly exit, not continued expansion under the old national regime.

Cross-border passporting

MiCA-authorized CASPs have the right to passport services across all EU/EEA Member States -- the single market for crypto that the industry has been waiting for. This is a significant competitive advantage for authorized firms. A CASP authorized in Lithuania can serve clients in Germany, France, and Spain without separate national licenses. For more on the authorization requirements, see our EBA Guidelines breakdown.

Reverse solicitation restrictions tighten

ESMA published final guidelines on reverse solicitation on 26 February 2025. The guidelines state that they apply 60 calendar days after publication on ESMA's website in all official EU languages. The definition of "solicitation" is extremely broad: websites, social media, SEO, influencer marketing, sponsorships, and even push notifications directed at EU clients all qualify. The reverse solicitation exemption -- where services are provided at the client's own exclusive initiative -- is narrow and strictly enforced. Third-country firms that relied on this loophole will find it largely closed.

Strategic note

Passporting is the carrot; the end of grandfathering and reverse solicitation crackdown is the stick. Together, they restructure the market: authorized EU CASPs gain scale, while unlicensed competitors lose access. After July 2026, the question is no longer whether the transition will close -- it has -- but whether your compliance infrastructure can absorb the next layer.

What is AMLR and what does it replace?

The Anti-Money Laundering Regulation (Regulation EU 2024/1624) is the most consequential piece of the puzzle for day-to-day operations. Unlike AMLD4 and AMLD5, which were directives requiring national transposition (and resulting in 27 different implementations), the AMLR is a regulation -- directly applicable in all Member States from 10 July 2027, with no national interpretation layer.

For CASPs, this means the compliance rules in Estonia, Cyprus, Germany, and Lithuania will be identical. No more regulatory arbitrage through jurisdictional differences in AML implementation.

New customer due diligence requirements

The AMLR brings CASPs fully into the obliged entity framework. Key CDD changes include:

Enhanced screening obligations

CASPs become subject to the same enhanced due diligence triggers as banks: politically exposed persons (PEPs), high-risk third countries, complex ownership structures, and unusual transaction patterns. The screening must be ongoing, not just at onboarding. For a detailed comparison of screening versus monitoring obligations, see our analysis of sanctions screening vs. transaction monitoring.

Privacy coins and anonymous instruments

The AMLR prohibits CASPs from maintaining accounts or facilitating transactions involving crypto-assets designed to be untraceable. This effectively bans EU-regulated CASPs from listing or supporting privacy coins. Whether specific tokens fall under this prohibition will depend on AMLA's guidance and individual NCA interpretations -- but the direction is clear.

The EUR 10,000 reporting threshold

Consistent with the cash payment limit for traditional finance, the AMLR introduces a EUR 10,000 threshold that triggers enhanced scrutiny for crypto transactions. This aligns crypto oversight with the broader financial system's reporting framework.

Directly applicable = no excuses

Because the AMLR is a regulation (not a directive), there is no national transposition period. On 10 July 2027, the rules apply uniformly. CASPs cannot wait for "national guidance" or "implementing measures" -- the regulation is the implementing measure.

What is AMLA and how will it supervise CASPs?

The EU Anti-Money Laundering Authority (Regulation EU 2024/1620) is headquartered in Frankfurt and has been operational since mid-2025. Its direct supervisory power begins in 2028, but the selection machinery is already moving in 2026-2027.

What AMLA does

AMLA serves three functions:

  1. Direct supervision of the highest-risk cross-border obliged entities (up to 40, starting 2028)
  2. Indirect supervision -- coordinating and overseeing how national supervisors (CySEC, BaFin, AMF, etc.) enforce AML rules
  3. Standard-setting -- issuing guidelines, regulatory technical standards (RTS), and opinions that shape how the AMLR is applied in practice

2026 reporting package

AMLA's 2026 work is no longer just staffing and setup. On 12 May 2026, AMLA published a reporting package for identifying provisionally eligible obliged entities for direct supervision. In July 2026, AMLA finalised draft ITS under Article 15(3) AMLAR; the standards now move to Commission adoption before Official Journal publication. The 10 June webinar materials, published on 16 June 2026, are practical guidance for obliged entities that may be asked to report.

Selection criteria for direct supervision

The first selection process takes place in 2027. Entities are selected based on:

CASPs are explicitly in scope. A large exchange operating across multiple EU jurisdictions with high transaction volumes is a prime candidate.

What changes under direct supervision

If your CASP is selected, you no longer answer primarily to your national supervisor. AMLA becomes your lead AML/CFT regulator. This means:

Even if you're not selected

AMLA's indirect supervision function means it will review how your NCA supervises you. If AMLA finds that CySEC, BaFin, or any other NCA is being too lenient, it can issue opinions and recommendations requiring stricter enforcement. The standard rises for everyone, not just the 40 directly supervised entities.

How do these regulations stack together?

The real challenge isn't any single regulation -- it's the compounding effect. Here's what a CASP's compliance obligations look like at each stage:

Obligation 10 Jul 2026 H2 2026 Jul 2027 Jan 2028
MiCA authorization Required / wind-down Required Required Required
Travel Rule (TFR) In effect In effect In effect In effect
AMLR CDD obligations AMLD4/5 AMLD4/5 AMLR applies AMLR applies
Privacy coin ban Not yet Not yet Prohibited Prohibited
Self-hosted wallet CDD TFR only TFR only AMLR + TFR AMLR + TFR
AMLA direct supervision Eligibility reporting Provisional list Selection Active
EU sanctions screening EBA GL/2024/15 EBA GL/2024/15 EBA + AMLR EBA + AMLR + AMLA

Notice the pattern: each layer adds requirements on top of the previous ones. Nothing gets replaced -- everything accumulates. A CASP that built compliance only to clear July 2026 will need to harden for July 2027, and potentially again for January 2028.

What should CASPs do now to prepare?

The compliance teams that will navigate 2026-2028 successfully are the ones making infrastructure decisions today that anticipate the full stack, not just the next deadline. Three principles should guide your planning.

1. Build scalable compliance infrastructure

Your sanctions screening, CDD workflows, and transaction monitoring systems need to handle increasing scope. Today's requirement is EU Consolidated List screening (EBA GL/2024/15). By 2027, it's full AMLR CDD with self-hosted wallet verification, enhanced PEP screening, and automated privacy coin detection. By 2028, it may need to satisfy AMLA's standardized reporting formats.

Choose tools and vendors that can grow with you. A sanctions screening tool that gives you a binary check without audit trails today will not survive a CySEC inspection tomorrow. For a detailed analysis of what free tools actually provide versus what regulators require, see our Chainalysis Oracle analysis.

2. Don't optimize for current minimums

A setup built only to clear MiCA authorization in July 2026 will not be the cheapest compliant setup for the AMLR in July 2027. If you build a bare-minimum CDD system now and a separate AMLR-compliant system next year, you pay twice -- in money, engineering time, and regulatory risk during the transition.

Instead, build for the AMLR standard before it is required. The regulation text is already published (EUR-Lex: Regulation 2024/1624). The requirements are known. Implementing them during the remaining runway reduces disruption when the regulation applies.

3. Choose tools that compose

The 2026-2028 regulatory stack requires sanctions screening, transaction monitoring, CDD/KYC workflows, audit trail systems, and regulatory reporting -- each with its own data requirements and legal basis. You need tools that integrate cleanly with each other and with your existing tech stack.

The right architecture looks like a pipeline: screening feeds into risk scoring, risk scoring feeds into monitoring, monitoring feeds into audit trail generation, and audit trails feed into regulatory reports. Each component should be replaceable without rewiring the others. For a comparison of how screening and risk scoring fit together operationally, see our screening vs. risk scoring analysis.

The remaining AMLR runway

As of 10 July 2026, the MiCA transition has ended and the AMLR applies on 10 July 2027. You have one year to harden CDD, wallet-control verification, sanctions screening evidence, and reporting paths before the next layer applies.

Frequently asked questions

When did the MiCA transitional period end for CASPs?

The maximum MiCA transitional period ended on 1 July 2026, per Article 143(3) of Regulation (EU) 2023/1114. After this date, CASPs must hold a MiCA authorization to operate in the EU. ESMA expects unauthorised CASPs to wind down EU activities, stop onboarding new EU clients, cease marketing and solicitation, and limit services to what is necessary for an orderly exit. Some Member States chose shorter transitional periods -- ESMA maintains a list -- so check your national regulator's specific deadline.

What is the AMLR and when does it apply to crypto?

The Anti-Money Laundering Regulation (Regulation EU 2024/1624) is a directly applicable EU regulation that replaces the AMLD4/5 directive framework. It applies from 10 July 2027. For CASPs, it introduces uniform CDD requirements, enhanced due diligence for self-hosted wallet transfers above EUR 1,000, a ban on anonymous crypto accounts, and restrictions on privacy-preserving crypto-assets.

Will AMLA directly supervise crypto companies?

Yes. Starting in January 2028, AMLA will directly supervise up to 40 high-risk obliged entities, which can include CASPs. AMLA's 2026 reporting package supports the identification of provisionally eligible entities, and the first selection process takes place in 2027 based on criteria including cross-border activity in at least six EU Member States and a high residual risk profile. Even CASPs not selected for direct supervision will be affected, because AMLA will oversee how national supervisors apply AML rules.

What is the Travel Rule for crypto in the EU?

The EU Travel Rule (Regulation 2023/1113, also called TFR) requires CASPs to collect and transmit originator and beneficiary information with every crypto-asset transfer -- analogous to SWIFT messages in traditional banking. It has applied since 30 December 2024. EBA Guidelines GL/2024/11 specify implementation details, including acceptable methods for verifying self-hosted wallet ownership.

How should a small CASP prepare for the 2026-2028 regulatory wave?

Start by confirming your post-transition MiCA position: authorized CASPs should keep Travel Rule compliance fully operational and build toward AMLR requirements in July 2027; unauthorised CASPs should prioritize wind-down, client protection, and regulator communication. The most efficient approach is to choose compliance infrastructure that scales -- sanctions screening, transaction monitoring, CDD evidence, and audit trail systems that can grow with the regulatory requirements rather than needing replacement at each milestone.

Bottom line

The period between July 2026 and January 2028 represents the densest concentration of crypto regulatory change in EU history. MiCA authorization is now the baseline; the AMLR's directly applicable AML framework and AMLA's direct supervision powers arrive next -- each building on the last, none replacing the others.

CASPs that treat MiCA as the finish line will be caught off guard when the AMLR applies on 10 July 2027. CASPs that treat compliance as a series of minimum-viable checkboxes will rebuild their infrastructure at every deadline. The winning strategy is to build once for the 2028 standard and use the intervening milestones as validation checkpoints.

The regulatory texts are published. The MiCA transition has closed. The remaining variable is how quickly you use the next year.

Does your screening infrastructure scale to AMLR?

Take our 2-minute compliance self-check. Ten questions based on EBA GL/2024/15 and AMLR requirements -- see where you stand before 10 July 2027.

Read the regulatory guides →

Sources

Related articles

Regulations MiCA Compliance Checklist for Small CASPs in 2026 Read → Regulations MiCA CASP License Requirements: Capital, Governance, and Application Process Read →