AMLA's MiCA review response: five crypto gaps it wants closed

On 7 October 2026 AMLA published its response to the European Commission's targeted consultation on the review of the Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114). The document itself is dated 30 September 2026, the day the Commission's consultation closed; the consultation had opened on 20 May 2026. It is a short paper, and it is not a technical standard or a guideline. But it is the first time the EU's AML authority has set out in writing where it believes the crypto perimeter leaves money-laundering and terrorist-financing risk uncovered. For crypto-asset service providers (CASPs), for the credit institutions and payment service providers that bank them, and for issuers of stablecoins, it is a useful map of what AMLA will be looking for once it supervises directly from 2028 and, more immediately, of the themes that will shape its guidelines for the sector.

What AMLA sent, and what weight it carries

The paper is AMLA's answer to a Commission consultation, not an opinion the Commission is bound to seek. Article 140 MiCA names the EBA and ESMA as the authorities the Commission must consult before it reports on the functioning of the regulation; AMLA, established by Regulation (EU) 2024/1620, is not on that list. Its input therefore competes with the EBA and ESMA responses filed in the final week of the consultation, and with every other stakeholder submission. AMLA frames its contribution narrowly: it looks at MiCA only from an AML/CFT angle and identifies areas where, in its words, targeted amendments or clarifications could address ML/TF risks more effectively and support consistent supervision across the Union.

Nothing in the response changes an obligation today. The Commission's review report, and any legislative proposal that follows, are matters for 2027 at the earliest. What the response does is tell obliged entities how the authority that will write the AML/CFT guidelines for the crypto sector reads the current gaps.

The five areas

AMLA's response is organised around five topics.

Staking, lending and borrowing of crypto-assets. These activities are outside the list of crypto-asset services in MiCA. AMLA suggests the Commission consider bringing them within the regulatory framework, on the ground that they carry specific ML/TF risks. The EBA's own response notes that crypto lending and borrowing, including with stablecoins, is growing and is intermediated in at least 16 Member States, often through DeFi channels, so AMLA is not alone here.
DeFi arrangements. MiCA excludes crypto-asset services provided in a fully decentralised manner without any intermediary. AMLA invites the Commission to consider a clear legal definition and common criteria for determining when a person or entity performs, provides or exercises effective control over services offered through such an arrangement. The purpose is to let supervisors identify consistently the arrangements that are not genuinely decentralised and therefore fall within MiCA and the AML/CFT framework. AMLA adds a second idea: where someone holds significant influence over key functionalities or a concentration of governance power without itself providing a crypto-asset service, CASPs that facilitate access to the arrangement could be required to apply appropriate risk-mitigation measures.
Unauthorised stablecoins. Despite the authorisation requirements for issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs) in Titles III and IV of MiCA, stablecoin activity in EEA markets continues to involve tokens issued by entities that are not authorised. AMLA encourages a consistent EU-wide approach that removes legal uncertainty about how such tokens, and the CASPs that handle them, are treated. It also flags third-country multi-issuance stablecoin arrangements as warranting attention from an AML/CFT perspective.
ART issuers that are not obliged entities. Issuers of EMTs must be credit institutions or electronic money institutions and are therefore obliged entities in their own right. Issuers of ARTs are not, unless they also provide a crypto-asset service. AMLA points to a coverage gap where an ART issuer deals directly with customers without another obliged entity applying customer due diligence, and asks the Commission to review whether certain token issuers should fall within the AML/CFT rules. For context, the EBA's response records that as at 1 September 2026 39 EMTs had been issued under MiCA and no ART had yet been authorised under Title III, so this is a forward-looking point rather than a live market problem.
Passporting of CASPs and cross-border supervision. AMLA sees scope for clearer information requirements when a CASP passports services into other Member States, to support effective supervision by host authorities. This mirrors a long-standing concern in the payments and e-money sector, where the central contact point regime exists for exactly this reason.

How this sits next to the AMLR

The AMLR already treats crypto as a higher-risk sector in several places, and the response should be read against those provisions rather than as a replacement for them.

CASPs are obliged entities under Article 3(3)(g) AMLR. Article 19 AMLR sets a lower occasional-transaction threshold for them: customer due diligence from EUR 1 000, instead of the EUR 10 000 default.
Article 36 AMLR requires enhanced measures for correspondent relationships with respondent entities outside the Union that provide crypto-asset services; Article 37 AMLR sets specific measures for transactions with self-hosted addresses. The guidelines AMLA must issue under both articles are tracked on our dashboard with the status 'EBA guideline in force, AMLA successor pending': until AMLA's guidelines arrive, the crypto provisions of the EBA Risk Factors Guidelines (EBA/GL/2021/02, amended on 16 January 2024) and the EBA Travel Rule Guidelines apply.
Article 79 AMLR prohibits anonymous crypto-asset accounts and accounts allowing the anonymisation of transactions, which is where the unauthorised-stablecoin and DeFi themes meet the single rulebook.
The recast Transfer of Funds Regulation (Regulation (EU) 2023/1113) is not replaced by the AML package and keeps applying to transfers of crypto-assets.

Two of AMLA's five points, DeFi access and unauthorised stablecoins, are therefore not only MiCA questions. If the Commission does nothing, AMLA can still address them through the risk-factor and crypto guidelines it owes under Articles 20, 36 and 37 AMLR. The other three, staking and lending, ART issuers and passporting information, require changes to MiCA itself and are outside AMLA's own rule-making power.

What it means for obliged entities

For CASPs, the response is a preview of supervisory expectations. AMLA will directly supervise a selection of cross-border credit and financial institutions from 2028, and CASPs operating in several Member States are within the scope of the selection methodology. A CASP that facilitates access to DeFi protocols, lists stablecoins issued by non-authorised entities, or offers staking or lending alongside its authorised services should expect to be asked how it has assessed and mitigated the ML/TF risk of those activities, even where MiCA does not regulate them. The business-wide risk assessment under Article 10 AMLR, and its elaboration in the draft Guidelines on the business-wide risk assessment (status: 'Consultation closed, being finalised'), is the natural place to document that analysis.

For credit institutions and payment service providers that serve crypto firms, the response reinforces the questions that already belong in onboarding and periodic review of CASP customers: which tokens the CASP supports, whether any are unauthorised stablecoins, whether it offers staking or lending, and how it treats self-hosted addresses and DeFi interactions. The EBA's Guidelines on access to financial services and de-risking (status: 'EBA guideline in force, AMLA successor pending') remain the frame: the answer to elevated risk is proportionate enhanced measures, not blanket exits.

For issuers of ARTs and EMTs, the message is to check which AML/CFT obligations attach to their current structure. EMT issuers are obliged entities as credit or e-money institutions. An ART issuer distributing tokens directly to the public without a CASP in between should assume that AMLA regards this as a gap it wants closed, and that national supervisors will ask how CDD is performed in the meantime.

What to do now

Read the full response and map its five topics against your product list: which of staking, lending, DeFi access, non-authorised stablecoins and cross-border passporting apply to you.
Update the crypto section of your business-wide risk assessment so that these activities are assessed explicitly, with the mitigating controls named, even where MiCA does not regulate them.
If you are a bank or PSP with CASP customers, add the five topics to your CASP onboarding questionnaire and periodic review template.
Keep applying the EBA Risk Factors Guidelines (crypto amendment of 2024) and the EBA Travel Rule Guidelines; no AMLA successor has been consulted yet, and no consultation on the Article 36 and 37 guidelines is open.
Watch the Commission's review report and the EBA and ESMA inputs; a legislative proposal on MiCA, if any, would not change the AMLR obligations that apply from 10 July 2027.

The AMLR Monitor dashboard tracks the Guidelines on EDD for correspondent relationships with CASPs and self-hosted addresses, the Risk Factor Guidelines and the other instruments mentioned here, with their current status.