MiCAR Transitional Period Ends: What AMLA's AML/CFT Guidance Means for CASPs
As of 1 July 2026, the EU's crypto-asset market entered a new regulatory phase. The transitional window created by Article 143(3) of Regulation (EU) 2023/1114 (MiCAR) has closed, and only fully authorised Crypto-Asset Service Providers (CASPs) may now legally offer crypto-asset services across the European Union. Ahead of that deadline, the Anti-Money Laundering Authority (AMLA) issued targeted guidance on the money laundering and terrorist financing (ML/TF) risks that the end of the transitional period generates, and what it expects from firms, supervisors, and Financial Intelligence Units (FIUs) in response. For accounting firms, compliance officers, and CFOs using or evaluating crypto accounting software, understanding these expectations is now a prerequisite for staying ahead of supervisory scrutiny.
What the Transitional Period Actually Meant
MiCAR became effective across the EU on 30 December 2024. To avoid an overnight cliff-edge for thousands of crypto-asset businesses operating under pre-existing national frameworks, Article 143(3) granted member states the option to allow Virtual Asset Service Providers (VASPs) already registered or licensed under domestic rules to continue operating while they pursued full MiCAR authorisation. That window ran for eighteen months, until 1 July 2026.
Who was covered and who is now excluded
Any VASP that relied on that national grandfathering provision and failed to obtain a MiCAR licence before the deadline is now legally prohibited from providing crypto-asset services in the EU. The market has therefore shrunk, at least structurally, to a set of fully authorised CASPs. The customer bases, assets under custody, and transaction flows of the exiting firms do not disappear, they migrate, and that migration is precisely where AMLA sees the greatest near-term ML/TF risk.
AMLA's Core Risk Assessment
AMLA's guidance identifies two distinct risk populations: VASPs winding down because they did not secure authorisation, and authorised CASPs absorbing the customers those firms leave behind. The risks affecting each group are different in character, and AMLA addresses them separately.
Exiting VASPs: the wind-down risk
When a firm is closing a regulated activity under time pressure, the natural human tendency is to focus on operational continuity and commercial wind-down rather than compliance hygiene. AMLA explicitly warns against this. Accelerated wind-downs risk straining AML/CFT controls, reducing visibility over customer activity, and creating gaps in transaction monitoring precisely when illicit actors may attempt to move funds or conceal the origin of assets.
AMLA's expectation for exiting firms is unambiguous: effective AML/CFT governance must be maintained until all regulated activities have actually ceased. That means keeping customer due diligence (CDD) records current, sustaining transaction monitoring, and filing suspicious activity reports (SARs) for as long as the firm holds customer relationships or processes transactions. Compliance obligations do not taper as the business winds down; they run in parallel until the final day.
For accounting teams supporting these firms, the practical implication is that a full and auditable record of CDD documentation, transaction logs, and SAR filings must be preserved and accessible. Regulators have long memories, and supervisory reviews of wind-down practices can begin well after a firm has ceased operations.
Authorised CASPs: the onboarding surge risk
For CASPs that have secured MiCAR authorisation, the transitional period's end brings opportunity but also compliance strain. The simultaneous withdrawal of multiple competitors concentrates customer flow into a smaller number of licensed firms. Onboarding volumes rise sharply. Transaction activity increases. Exposure across customer risk categories widens, potentially very quickly.
AMLA is clear that this surge does not justify relaxing controls. The authority stresses the need for scalable AML/CFT frameworks, adequate staffing, and system capacity that can absorb higher volumes without degrading the quality of monitoring or due diligence. Compliance teams that were sized for a stable customer base may find themselves materially under-resourced within weeks of the deadline passing.
The specific area AMLA highlights is transaction monitoring infrastructure. Systems calibrated to a firm's historical transaction profile may generate false negatives when volumes and customer risk profiles change rapidly. Firms should review their monitoring parameters and alert thresholds as a matter of urgency.
The de-risking prohibition
One of the most operationally significant points in AMLA's guidance concerns how authorised CASPs treat customers arriving from unauthorised providers. AMLA explicitly prohibits blanket de-risking of these customers. A firm cannot simply refuse to onboard or immediately exit all customers migrating from an unauthorised VASP on the grounds that they previously used an unlicensed provider. Instead, individual risk assessments are required, and CDD measures must be proportionate to the risk actually identified for each customer. This is consistent with the broader risk-based approach embedded throughout the EU's AML framework, but it carries a direct operational cost: compliance teams need workflows capable of assessing individual risk profiles at scale, not categorical exclusion policies.
Supervisory and FIU Expectations
AMLA's guidance extends beyond firm-level obligations to address the supervisory architecture itself. Simultaneous market exits, large customer migrations, and evolving business models create what AMLA describes as supervisory blind spots, particularly where regulatory standards and supervisory capacity differ across member states.
Cross-border coordination between competent authorities
AMLA calls for stronger cooperation and information sharing between national competent authorities (NCAs), with a particular focus on overseeing wind-down activities and the transfer of customer relationships. The concern is that a VASP exiting in one jurisdiction might transfer customers to a CASP supervised in another, and that the receiving supervisor has limited visibility into the risk profile of the incoming customer cohort. Enhanced communication between NCAs is intended to close that gap.
FIU collaboration on emerging ML/TF risks
Financial Intelligence Units are similarly expected to step up both domestic and cross-border collaboration. The logic is straightforward: ML/TF risks that emerge during a period of market transition may not be visible to any single FIU in isolation. Patterns of suspicious activity may span multiple jurisdictions and involve customers moving between exiting VASPs and authorised CASPs in different member states. Coordinated intelligence sharing is the mechanism AMLA believes can maintain visibility over those patterns.
Accounting and Compliance Implications for Firms
For accounting practices, auditors, and CFOs advising or managing EU-regulated crypto-asset businesses, AMLA's guidance has several concrete implications that go beyond pure AML compliance.
Record-keeping and audit trail requirements
The guidance reinforces the importance of complete and retrievable records. Whether a firm is winding down or onboarding a surge of new customers, the underlying documentation requirements under MiCAR and the EU's AML Directive remain in force. CDD files, transaction records, monitoring alerts, and SAR filings must be maintained for the prescribed retention periods. Firms using digital asset accounting software or crypto bookkeeping software should confirm that their systems capture and archive the data points required for both regulatory reporting and potential supervisory review.
Compliance cost as a financial planning item
The expectation of scalable AML/CFT frameworks and adequate staffing is not abstract regulatory language. It translates into a budgetary obligation. CASPs expecting to absorb significant customer volumes from exiting VASPs should model the compliance cost of that onboarding surge now, including additional KYC analyst capacity, enhanced transaction monitoring tooling, and potentially legal costs associated with individual risk assessments at scale. CFOs who treat compliance as a fixed overhead rather than a variable cost linked to customer volume may find themselves caught short.
Client advisory for accounting firms
Accounting firms with CASP clients need to ensure those clients understand that AMLA's guidance creates enforceable expectations, even where it is framed as risk management advice rather than hard regulation. Supervisors in EU member states will be using this guidance as a reference point when assessing whether CASPs have taken adequate steps to manage transition-period risks. Firms that cannot demonstrate scalable onboarding processes, up-to-date monitoring calibration, and individual risk assessments for migrating customers face a credible enforcement risk. Robust crypto accounting software that integrates with compliance workflows will be an asset in demonstrating that systemic controls were in place.
What Comes Next Under MiCAR
AMLA and the MFSA are both clear that the end of the transitional period is not the end of MiCAR's implementation journey. It marks the beginning of a phase of regulatory maturity and ongoing refinement. The European Commission has opened consultation processes that will shape how MiCAR evolves, and discussions on the proposed Markets in Financial Services Package are expected to address further upgrades to the framework. Firms should expect continued regulatory activity, including AMLA's own supervisory work as it takes on its direct oversight role for the largest cross-border CASPs in the years ahead.
For context on how EU member states and industry groups are already engaging with potential changes to MiCAR, see France's MiCA revision proposals from the AMF, ACPR, and Treasury. And for the latest picture of which firms are formally authorised under the framework, ESMA's latest additions to the MiCA register provide an up-to-date reference point.
Frequently Asked Questions
Did all EU VASPs have to stop operating on 1 July 2026?
Only those relying on the Article 143(3) transitional provision. VASPs that secured full MiCAR authorisation before that date may continue operating as CASPs. Those that did not obtain authorisation are no longer permitted to provide crypto-asset services in the EU.
What does AMLA specifically require from exiting VASPs?
Exiting firms must maintain effective AML/CFT governance, keep CDD records current, continue transaction monitoring, and file suspicious activity reports for as long as they hold active customer relationships or process transactions. Compliance obligations do not reduce simply because a wind-down is underway.
Can authorised CASPs refuse to onboard customers from unauthorised VASPs?
Not categorically. AMLA explicitly prohibits blanket de-risking of customers migrating from unauthorised providers. CASPs must conduct individual risk assessments and apply CDD measures proportionate to each customer's actual risk profile.
How does AMLA's guidance interact with a firm's existing AML/CFT programme?
It sets a higher bar for scalability. A programme that was adequately calibrated for a stable customer base may no longer be sufficient if the firm is absorbing a large inflow of migrating customers. Firms should review monitoring thresholds, staffing levels, and onboarding workflows against the risks AMLA has identified.
What is AMLA's own supervisory role going forward?
AMLA is set to take on direct supervisory responsibility for the largest cross-border CASPs as it becomes fully operational. Its guidance on transitional risks signals the supervisory culture it intends to bring: risk-based, forward-looking, and focused on systemic vulnerabilities rather than box-ticking compliance.