EBA warns crypto firms are sidestepping EU MiCA rules

The European Banking Authority (EBA) has released a report revealing attempts by some in the crypto industry to sidestep new regulations, including MiCA and the EU’s enhanced AML/CFT framework. Fully enacted in late 2024, MiCA set a harmonized regime for crypto asset providers across the 27-member bloc for the first time.

No company was explicitly cited in the EBA statement. Still, it warned that attempts to circumvent these regulations could persist and carry substantial risks for the functioning of the EU’s financial system.

EBA addresses several risks, including “forum shopping.” This refers to firms attempting to obtain regulatory approval in one country that they perceive as having less stringent approval mechanisms, so they can subsequently operate legally in other parts of the EU. This is also known as “passporting.” 

According to the EBA report, before the adoption of MiCA, one unnamed entity submitted applications for registration and licensing in several states within a short timeframe. It further continued to withdraw from jurisdictions where authorities continuously probed or its application was challenged, before proceeding to operate in countries where it went unchallenged.

EBA noted, “In practice, entities with weak AML/CFT controls have already entered and are operating in the EU market by selecting jurisdictions with lighter supervisory practices or previously lower market entry requirements.”

MiCA transition period may allow unlicensed firms to continue operations

While MiCA came fully into effect last year, it included a transition window that runs until July 1, 2026, giving firms some time to either get a license or be deemed non-compliant. According to the  regulator, “emerging evidence suggests that there may be a risk that entities which were previously licensed in a Member State and have not met the authorisation conditions under MiCA but are appealing their case may continue to operate in the EU in the interim time.”

Dr. Hendrik Müller-Lankow, a lawyer at the German crypto law firm Kronsteyn, states that, based on his experience, supervisory arbitrage and supervisory shopping are in fact occurring throughout the EU.

He adds that this is a phenomenon regulators must accept if they want to establish a single market while still maintaining some level of supervisory authority. “It is well known that people—and thus also authorities—in different Member States have different mentalities when applying laws,” he added.

Müller-Lankow believes the EU could tackle the issue by centralizing both its legislation and supervisory authorities. He noted much of this is already underway, and EU authorities are actively working to expand their powers.

Lankow also highlighted that some crypto firms may be establishing themselves in the EU without transparent governance or clear beneficial ownership, making it difficult to determine accountability.

Opaque structures in crypto firms heighten risk of illicit activity

According to the EBA report, a virtual asset service provider, or VASP, that applied for an operating license in several EU jurisdictions was found by one crypto authority to “be jointly run by more than 20 distinct entities that were largely established outside the EU and outside regulatory oversight.” 

The EBA warns that such opaque structures may enable the misuse of front or shell companies. The  independent EU agency  added that entities that lack real economic activity can serve as drivers to channel illicit funds under the guise of legitimate transactions.”

The EBA’s report highlights the continued difficulty faced by the EU in enforcing a common crypto regulatory framework. Although MiCA aims to provide the market with clarity and stability, areas of uncertainty and opaque corporate structures may persist. 

Regulators are facing increased pressure to intensify the regulation of crypto assets and enhance cooperation between member states, aiming to prevent digital tokens from being used for nefarious purposes, protect investors, and maintain the integrity of the EU financial system. With the transition phase extending into mid-2026, however, the next few months will be crucial in shaping MiCA’s potential to deliver on its promise of a fully harmonized and secure crypto market.

If you're reading this, you’re already ahead. Stay there with our newsletter.