AMLA Identifies Five Gaps in the EU’s Crypto-Asset Regulatory Framework

The European Union’s Anti-Money Laundering Authority (AMLA) has identified five areas where amendments or clarifications to the Markets in Crypto-Assets Regulation (MiCA) could strengthen protections against money laundering and terrorist financing. The recommendations cover staking and crypto-asset lending, decentralised finance, unauthorised stablecoins, certain token issuers and cross-border supervision of crypto-asset service providers.

AMLA published its response to the European Commission’s targeted consultation on the MiCA review on October 7, 2026. The response assesses the existing framework from an anti-money laundering and counter-terrorist financing perspective and proposes targeted changes to address potential regulatory gaps. The recommendations do not themselves amend MiCA or introduce new legal obligations.

One area of concern is the treatment of crypto-asset staking, lending and borrowing. These activities are not comprehensively regulated as standalone services under the current MiCA framework. Where an authorised crypto-asset service provider offers staking alongside custody services, the custody component may fall within existing requirements, but those requirements do not necessarily address all the risks associated with pooled assets, yield generation, temporary transfers of control or restrictions on customers’ access to their holdings.

AMLA considers that these business models can create vulnerabilities where transactions take place through arrangements that lack adequate customer identification and transaction monitoring. It has asked the Commission to consider whether dedicated requirements should apply to staking, lending and borrowing, taking account of their specific money laundering and terrorist financing risks.

Decentralised finance (DeFi) is a second area requiring clarification. AMLA notes that determining whether a DeFi arrangement falls within the regulatory framework can be difficult, particularly where responsibility is distributed among developers, governance-token holders and other participants.

The authority argues that the label “decentralised” should not, by itself, determine whether an arrangement falls outside regulatory oversight. The ability to control key functions, including concentrated governance rights or the power to pause or modify smart contracts, may indicate that identifiable parties exercise effective control.

AMLA has therefore called for a clearer legal definition of decentralised arrangements and common criteria to help supervisors determine who provides or controls a service. It has also suggested considering risk-mitigation requirements for entities that facilitate access to DeFi arrangements where those entities exercise relevant influence but do not themselves provide a regulated service. The proposal does not mean that every developer or holder of governance tokens would automatically become a regulated service provider.

The third area concerns stablecoins that are not authorised for use under the applicable EU framework. AMLA has called for a consistent approach across Member States to reduce legal uncertainty over the treatment of services involving such tokens.

The issue has also been addressed separately by the European Securities and Markets Authority (ESMA), which issued an opinion setting out supervisory expectations for authorised crypto-asset service providers dealing with unauthorised stablecoins. ESMA expects providers to cease the relevant services for EU clients and to address remaining exposures within a defined transition period, with limited continuation permitted for supervised activities necessary to unwind positions or safeguard existing assets.

AMLA’s consultation response and ESMA’s supervisory opinion serve different purposes. AMLA is proposing changes or clarifications to the regulatory framework, while ESMA’s opinion sets out expectations for how existing requirements should be applied. The two should not be interpreted as a single new legislative measure.

A fourth concern relates to certain issuers of asset-referenced tokens. AMLA observes that an entity holding authorisation to issue such tokens is not necessarily covered by the anti-money laundering framework solely because it acts as an issuer. An entity may fall within the relevant AML/CFT obligations if it separately provides regulated crypto-asset services, but this does not resolve every situation involving direct issuance or redemption.

The authority is concerned that customers may be able to obtain or redeem tokens directly with an issuer without an intermediary applying equivalent customer due diligence and transaction-monitoring measures. It has asked the Commission to examine the respective responsibilities of issuers, distributors, custodians, banks and crypto-asset service providers throughout a token’s lifecycle.

AMLA suggests considering whether certain issuers should be brought directly within the AML/CFT framework or be subject to equivalent requirements. The recommendation is targeted at potential gaps in coverage rather than a proposal to impose identical obligations on every token issuer regardless of its activities or existing regulatory status.

The fifth area concerns cross-border supervision. Under MiCA, authorised crypto-asset service providers can operate across the European Union through passporting arrangements. AMLA considers that supervisory authorities do not always receive sufficient information to distinguish between providers operating through an establishment in another Member State and those providing services across borders without establishing a local presence.

This distinction can affect the supervisory powers available to host-country authorities and their ability to assess a provider’s activities and risks. AMLA has called for clearer information requirements, including information about the basis on which services are provided and, where relevant, the infrastructure used in the host jurisdiction.

The authority has also raised concerns about stablecoin arrangements in which identical and interchangeable tokens are issued in different jurisdictions. In such structures, tracing a token’s history and understanding the origin of funds may be difficult when the asset is ultimately redeemed. AMLA has suggested considering stronger transparency, cooperation and information-sharing arrangements if such structures are permitted.

Another issue concerns the relationship between crypto-account identifiers and wallet addresses. AMLA has asked for clarification on whether the identifiers required under the EU’s new anti-money laundering framework will enable authorities to identify the relevant wallet addresses. The ability to connect account information with blockchain addresses can be important when investigating transactions and tracing the movement of assets.

The recommendations form part of the European Commission’s broader review of MiCA, which has applied to most crypto-asset service provider requirements since December 30, 2024, while the rules for asset-referenced tokens and e-money tokens began applying earlier, on June 30, 2024.

The European Banking Authority has separately called for changes to address risks associated with multi-issuer stablecoin arrangements, clarify the classification of crypto-assets and consider regulating crypto-asset lending, including activities connected with decentralised finance. These recommendations reflect related concerns about the scope and consistent application of the EU’s crypto-asset rules.

AMLA’s response is intended to inform the Commission’s review. Any amendments to MiCA or associated anti-money laundering legislation would require a separate legislative process. Until changes are adopted and become applicable, the recommendations should be distinguished from obligations already in force.

The proposed reforms focus on ensuring that financial crime safeguards follow the activities through which crypto-assets are issued, held, transferred, lent and redeemed, while providing supervisors with clearer information about the entities responsible and the cross-border services they provide.

By fLEXI tEAM