Tightening crypto rules in Europe

Stablecoin and DeFi pressure

I see the European Securities and Markets Authority (ESMA) tightening the noose on non-compliant assets. Their October 8, 2025, guidance requires crypto-asset service providers to stop offering services for stablecoins that fail MiCA requirements. Firms must address existing exposures by Jan 8, 2027. This guidance forces platforms to use technical and contractual controls to block EU client access to unauthorized tokens. ESMA clarifies that warnings or client acknowledgements do not replace the need for issuer-level safeguards. Regulators can permit limited, temporary services to help clients exit existing positions, such as liquidation or withdrawal, provided these activities stay under strict oversight.

The EBA and ESMA continue to collaborate on technical standards. They are currently consulting on various Regulatory Technical Standards (RTS), including requirements for issuers of asset-referenced tokens (ARTs). This involves establishing templates and procedures for handling complaints.

The European Banking Authority (EBA) also moves on the DeFi front. During its September 24, 2026, regulatory review, the EBA urged the European Commission to bring crypto-asset lending under the MiCA framework. This includes situations where providers offer access to decentralized finance lending protocols. The EBA suggests the Commission perform a cost-benefit analysis for including intermediary crypto lending in the MiCA regulatory service list. The regulator also proposed that rules for companies providing customer access to DeFi protocols include user suitability testing, leverage limits, and additional information disclosure requirements.

The Polish stalemate

The March 2, 2026, deadline for stablecoin transfers creates a massive vacuum in Poland. After this date, any exchange lacking a payment institution license cannot send USDT, USDC, or other electronic money tokens (EMTs) to a wallet. The EBA issued a supplementary opinion on supervisory priorities on February 12, 2026, to enforce this. Since EMT transfers constitute a payment service under PSD2, a CASP license alone provides insufficient legal coverage for off-platform transfers.

President Karol Nawrocki vetoed the crypto-assets market act twice, once on December 1, 2025, and again on February 12, 2026. These vetoes leave Poland without the legal framework to accept CASP license applications or supervise the market. Local firms face a reality where they cannot obtain the necessary dual licensing to remain competitive with firms in Lithuania or France. I find it ridiculous that a firm can move to Poland to hire staff and pay taxes only to find the state offers no legal way to operate. Because the President deemed the provisions disproportionate, Polish entities currently have no legal basis to submit applications, and this leaves the entire industry standing still while neighboring countries like the Czech Republic and Germany offer functioning procedures for months. You should keep a close eye on how these legislative gaps affect liquidity.

Enforcement and classification

Regulatory pressure extends to product classification and management oversight. BaFin recently scrutinized N26 after a special audit found weaknesses in internal control systems and overall organization. This led investors to seek the removal of the company’s co-CEOs. Meanwhile, ESMA maintains a strict boundary for Non-Fungible Tokens. MiCA excludes NFTs from its scope unless their specific features or uses cause them to re-qualify as crypto-assets.

The consequences for ignoring these rules are severe. Under MiCA Article 111, Member States must ensure effective sanctions for those operating without authorization, including fines up to EUR 5 million or up to 15% of annual revenue. Violators also face a ban on holding management positions for up to 10 years and public disclosure of the violation through naming and shaming on a regulator’s website. Regarding stablecoins, the EBA requires compliance with PSD2 strong customer authentication and fraud reporting obligations. A dual-licensed firm must meet both MiCA and PSD2 capital requirements simultaneously, with no mutual recognition permitted between the two.

How will the market respond when these technical layers become even more complex?

The regulatory environment demands high capital. A firm providing exchange or custody services must hold at least EUR 125,000. Compliance requires strict adherence to these tiered thresholds.