LogoRegulatory Alerts

European Union: fintech & payments regulation

Regulated

EU fintech regulated under MiCA and PSD2; EBA/ESMA/CBK oversight

Lead regulator:
European Banking Authority (EBA)
Key law:
Markets in Crypto-Assets Regulation (MiCA)
Last updated:
2026-07-12

The European Union maintains a comprehensive regulatory framework for fintech and payments, primarily governed by the Markets in Crypto-Assets Regulation (MiCA) and the Payment Services Directive 2 (PSD2). The EBA and ESMA serve as the key supervisory authorities, with the EBA providing guidance on the interplay between PSD2 and MiCA for crypto-asset service providers handling electronic money tokens.

Recent regulatory developments include the end of the No-action Letter transition period for Crypto-Asset Service Providers on 2 March 2026, requiring full compliance with MiCA authorisation standards. The EBA has also issued consolidated ICT and security risk management guidelines to enhance user relationship management under PSD2, while ESMA continues to refine technical standards for crypto-asset service provider authorisations and notifications.

The regulatory environment emphasizes data reporting harmonization, with the EBA mandating that national competent authorities submit SEPA payment data exclusively via the EUCLID infrastructure. Additionally, the ECB has updated remuneration policies for excess reserves to ensure consistent application of the deposit facility rate, reflecting broader monetary policy alignment within the Single Supervisory Mechanism.

Who regulates

  • European Banking Authority (EBA)

    Primary supervisor for payment services and crypto-asset service providers; issues guidelines on ICT risk and PSD2/MiCA interplay.

    [1][2][3][4]

  • European Securities and Markets Authority (ESMA)

    Supervises crypto-asset service provider authorisations, EMIR CCPs, and investment firm passporting.

    [5][6][7][8]

  • European Central Bank (ECB)

    Monetary policy and supervisory oversight for credit institutions; sets remuneration rules for excess reserves.

    [9]

Core laws & rules

  • Markets in Crypto-Assets Regulation (MiCA) (2023/2026)

    Establishes the primary regulatory framework for crypto-assets, including authorisation requirements for Crypto-Asset Service Providers (CASPs) and specific provisions for electronic money tokens.

    [2][4][6][7]

  • Payment Services Directive 2 (PSD2) (2015)

    Regulates payment services and providers, requiring enhanced ICT security and user relationship management processes for payment service providers.

    [3][4]

Licensing & registration

  • Crypto-Asset Service Provider (CASP)

    Authorization required for entities providing crypto-asset services, with a transition period ending on 2 March 2026. ESMA has issued technical standards for authorisation and notifications, emphasizing data minimisation for management bodies. Timeline: Transition period ended 2 March 2026

    [2][6][7]

  • Payment Service Provider (PSP)

    Authorization required under PSD2. National competent authorities must report SEPA data to the EBA via EUCLID, with an annual deadline of 9 October. Timeline: Ongoing

    [1][3]

Restrictions & warnings

  • Crypto-asset service providers transacting electronic money tokens must navigate the interplay between PSD2 and MiCA to avoid disproportionate dual authorization burdens, as clarified by EBA guidance.

    [4]

  • Central Counterparties (CCPs) must adhere to strict authorisation and extension conditions under EMIR 3, with ESMA defining accelerated procedures and exemptions.

    [5]

Direction of travel

  • Regulatory focus is shifting towards harmonized data reporting via EUCLID and enhanced ICT security standards for payment services. The end of the MiCA transition period marks a significant step towards full enforcement of crypto-asset regulations.

    [1][2][3]

Sources

  1. Decision on reporting of data from NCAs to EBA and EC under SEPA Regulation · 2026-01-01
  2. Opinion on the end of the No-action Letter transition period · 2026-01-01
  3. Consolidated version of EBA amending Guidelines on ICT and security risk management · 2026-01-01
  4. Opinion on the interplay between PSD2 and MiCA in relation to crypto-asset service providers that transact electronic money tokens · 2025-01-01
  5. Final Report on EMIR 3 RTS on authorisation and extensions of activity · 2025-10-09
  6. ESMA Opinion on MiCA Regulatory Technical Standards for Crypto-Asset Service Provider Authorisations and Notifications · 2024-10-16
  7. Final Report on Draft Technical Standards for Markets in Crypto Assets Regulation First Package · 2024-03-25
  8. Final Report on review of technical standards on passporting under Article 34 of MiFID II · 2023-07-11
  9. Decision (EU) 2026/812 amending Decision (EU) 2019/1743 on the remuneration of holdings of excess reserves and of certain deposits · 2026-03-26

Email alerts for European Union updates

New circulars, rules and guidance — a digest in your inbox, same day.

This guide is compiled automatically from 9 primary-source documents published by European Union's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.