This edition is for crypto-asset service providers (CASPs), investment firms and fund managers in the Baltics and across the EU.

At a glance

• EU AML/CFT: the European Commission adopted Delegated Regulation C(2026) 6179, extending the anti-money laundering and countering the financing of terrorism (AML/CFT) central contact point standards to CASPs. A host Member State may require a contact point where, among other criteria, the value of services provided by a CASP’s local establishments exceeds EUR 3 million per financial year, or where the money laundering and terrorist financing (ML/TF) risk justifies it.
• MiCA review: the European Banking Authority (EBA) identified four priorities: multi-issuer stablecoin schemes with third-country issuers, the scope and classification of crypto-assets, crypto-asset lending, and reporting. 39 electronic money tokens (EMTs) had been issued as of 1 September 2026.
• Latvia: Latvijas Banka licensed SIA IBC INVEST as an investment firm. This was the third license in 2026, making it the 13th licensed investment firm in Latvia. It also registered SIA “Finterra” as an alternative investment fund manager (AIFM), bringing the total to 31 registered and three licensed managers.
• United Kingdom: the Financial Conduct Authority (FCA) published final perimeter guidance and opened its authorization gateway. The regime takes effect on 25 October 2027, and existing firms that apply by 28 February 2027 can continue operating while their application is assessed.
• ESMA: the European Securities and Markets Authority (ESMA) set a new Union Strategic Supervisory Priority (USSP) on digital innovation, covering artificial intelligence (AI) and tokenization, which applies from 2027. ESMA’s 2027 priorities also cover MiCA convergence, Digital Operational Resilience Act (DORA) oversight, the Retail Investment Strategy and T+1 settlement.

European Commission extends central contact point requirements to CASPs

Date: 8 September 2026 | Source: European Commission
Link

The European Commission adopted a Delegated Regulation (C(2026) 6179) that extends the regulatory technical standards on central contact points in Commission Delegated Regulation (EU) 2018/1108 to CASPs. Until now, these standards applied only to electronic money issuers and payment service providers operating in a host Member State through establishments other than branches.

A host Member State may require a CASP headquartered in another Member State to appoint a central contact point where, among other criteria, the cumulative value of the services and activities of its establishments in the host territory is expected to exceed EUR 3 million per financial year, or exceeded that amount in the previous financial year. It may also do so where this is commensurate with the ML/TF risk. The contact point must:

• facilitate the implementation of the CASP’s AML/CFT policies and procedures in the host state
• oversee compliance and inform the head office of breaches
• represent the CASP before the host supervisor and financial intelligence unit (FIU)

The act follows an EBA consultation and cost-benefit analysis. It enters into force twenty days after publication in the Official Journal, subject to scrutiny by the Parliament and the Council.

Why it matters

A MiCA authorization allows cross-border services within the EU, but local AML/CFT requirements still matter. For CASPs operating through establishments other than branches, a host-state contact point can mean additional local compliance responsibilities. CASPs providing only advice on crypto-assets fall outside the definition used in this act.

What we recommend for cross-border CASPs

• CASPs authorized in Lithuania or Latvia that serve other Member States through agents, physical points or local entities that are not branches should calculate the value of services provided in each country and identify where a host-state request is likely.
• Prepare a central contact point job description and reporting line that can be put in place on request.
• Reflect this possibility in the group AML/CFT policy and in the MiCA passport notifications.

EBA identifies four priorities for the MiCA review

Date: 24 September 2026 | Source: EBA
Link

The EBA published its response to the European Commission’s targeted consultation on the review of MiCA, identifying four priorities:

• Multi-issuer stablecoin schemes. The framework for schemes involving third-country issuers should be strengthened because the EBA assesses their risks as significant to very significant. Separately, the reserve requirements for issuers, notably the minimum amount of reserves held as deposits, should be reviewed.
• Scope and classification. The Commission should clarify the scope and classification of crypto-assets because uncertainty about classification creates avoidable costs and delays in launching products.
• Crypto-asset lending. The EBA encourages regulation of crypto-asset lending, including where CASPs facilitate access to decentralized lending protocols, because of the risks to consumers.
• Reporting. The reporting framework for issuers and service providers should be reviewed to improve supervision and risk monitoring.

The EBA notes that 39 EMTs had been issued as of 1 September 2026.

Why it matters

For stablecoin issuers and distributors, the review may change reserve requirements, while clearer classification rules could reduce uncertainty for firms developing products that sit between MiCA and other EU financial rules. Crypto-asset lending may also come within scope, but the EBA recommendations do not themselves create new obligations.

What we recommend for CASPs, crypto lenders and stablecoin issuers

• CASPs offering or intermediating lending, earn or staking-like yield products, or providing access to decentralized finance (DeFi) lending protocols, should document the legal analysis of these activities under current MiCA and national law. They should also prepare for these products to be brought expressly within scope.
• EMT issuers and CASPs distributing stablecoins issued under multi-issuer schemes with non-EU issuers should assess how changes to reserve requirements and stricter requirements for multi-issuer schemes would affect liquidity and redemption arrangements.
• Track the Commission’s MiCA review report and any legislative proposal, and align product classification memos with the EBA and ESMA positions on scope.

Latvia issues its third investment firm license of 2026 to IBC INVEST

Date: 17 September 2026 | Source: Latvijas Banka
Link

The Supervision Committee of Latvijas Banka issued an investment firm license to SIA IBC INVEST. The license covers reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management, and placing of financial instruments without a firm commitment. It also covers two ancillary services: safekeeping of financial instruments and services related to underwriting.

This is the third investment firm license Latvijas Banka has issued in 2026, bringing the number of licensed investment firms in Latvia to 13. Latvijas Banka encouraged applicants to use its licensing guide and pre-licensing consultations.

Why it matters

Latvia’s fintech strategy for 2025–2027 targets a 30% increase in the number of fintech companies in the country, and Latvijas Banka continues to authorize new firms.

What we recommend for investment firms and applicants in Latvia

• Firms considering a Markets in Financial Instruments Directive II (MiFID II) license in Latvia should note the pace of authorizations in 2026 and use the pre-licensing consultation to prepare their application. They should focus on the initial capital for the requested services, safeguarding of client instruments and the conflicts framework for own-account dealing.
• Existing Latvian investment firms should review the competition and confirm that their own permissions cover the services they plan to add.

Latvia registers Finterra as an alternative investment fund manager

Date: 23 September 2026 | Source: Latvijas Banka
Link

The Supervision Committee of Latvijas Banka registered SIA “Finterra” as an AIFM on 22 September 2026. The company may provide alternative investment fund management services and supplementary services as provided in the Law on Alternative Investment Funds and their Managers.

Latvia now has 31 registered and three licensed AIFMs. Latvijas Banka directed applicants to the registration procedure and required documents on its website, where registration applications are submitted electronically.

Why it matters

For sponsors of smaller funds, registration may be an option where the applicable conditions are met. The choice between registration and a full license matters when planning how far the fund will grow and where it will raise capital.

What we recommend for fund managers and sponsors in Latvia

• Sponsors planning sub-threshold fund structures in Latvia should use the registration route where assets under management remain below the Alternative Investment Fund Managers Directive (AIFMD) thresholds. If the strategy anticipates leverage or growth that would take assets under management beyond the thresholds, they should plan for a full license.
• Registered managers should monitor the thresholds and the marketing rules that apply to sub-threshold managers, since registration does not confer a marketing passport.

FCA clarifies the scope of the UK cryptoasset regime

Date: 16 September 2026 | Source: FCA (UK)
Link

The FCA published final perimeter guidance on how the UK cryptoasset regime applies to different business activities: issuing qualifying stablecoins, operating a cryptoasset trading platform, dealing and arranging deals, safeguarding cryptoassets and arranging staking. The guidance clarifies “adding value” activities, staking arrangements and the distinction between asset types.

The FCA confirmed that authorization applications open on 30 September 2026 and that the regime takes effect on 25 October 2027. The Government has laid a final amending statutory instrument with limited exclusions, including for UK qualifying stablecoins and a technical-services exclusion from the arranging activity. The FCA will consult in October 2026 on targeted updates to the guidance. Pre-application meetings and webinars are available to prospective applicants.

Why it matters

The guidance helps firms serving UK customers determine which activities may require FCA authorization. For businesses operating in both the EU and the UK, this affects the scope of their UK application and how they organize compliance across the two regimes.

What we recommend for EU CASPs operating in the UK

• EU CASPs serving UK customers should use the guidance to map each of their services against the UK regulated activities. They should then decide whether to seek UK authorization, restructure the UK offering or withdraw before 25 October 2027.
• Groups with both MiCA and UK authorization plans should align governance, safeguarding and conflicts arrangements so that a single control framework satisfies both regimes. They should also book pre-application meetings early.

ESMA makes digital innovation a supervisory priority for 2027

Date: 23 September 2026 | Source: ESMA
Link

ESMA announced a new USSP on digital innovation, effective from 2027. The priority will focus on how supervised entities use AI and tokenization, with flexibility to cover other emerging technologies. It runs alongside the existing USSP on cyber and operational resilience launched in 2025. ESMA is also concluding the priority on environmental, social and governance (ESG) disclosures, launched in 2023.

ESMA will work with national competent authorities to ensure supervisors have the expertise and capacity to oversee the use of new technologies. Supervised entities, including investment firms, fund managers, trading venues and CASPs, should expect more supervisory attention to the governance, risk management and client-facing use of AI and tokenized instruments.

Why it matters

The priority helps direct national supervisory resources, so firms using AI or tokenization can expect these activities to receive more attention from 2027. This makes the governance and risk controls around their use relevant to supervisory reviews.

What we recommend for firms using AI and tokenization

• List the AI tools used in client onboarding, suitability and appropriateness assessments, trading, surveillance and customer communication. Document the governance, testing and human oversight arrangements for each.
• Firms issuing or servicing tokenized financial instruments should review how they classify the instruments under MiFID II and MiCA, and how custody, settlement and investor disclosure are handled. Lietuvos bankas and Latvijas Banka are expected to align their 2027 supervisory work programs with the USSP.

ESMA outlines its 2027 supervisory priorities

Date: 28 September 2026 | Source: ESMA
Link

ESMA published its 2027 priorities, describing 2027 as the year in which many Savings and Investments Union initiatives move into the delivery phase. ESMA will:

• strengthen supervisory convergence with national competent authorities on CASPs under MiCA
• advance the oversight of critical information and communication technology (ICT) third-party service providers under DORA, together with the other European Supervisory Authorities (ESAs)
• support the implementation of the Retail Investment Strategy and continue its simplification work, including on the retail investor journey

Other priorities include implementing the European Single Access Point, transitioning to T+1 settlement, reviewing the impact of the clearing reforms under the European Market Infrastructure Regulation (EMIR) 3 and deploying AI-based supervisory tools.

Why it matters

For CASPs, closer convergence on MiCA aims to make supervision more consistent across Member States. For investment firms and fund managers, work on the Retail Investment Strategy and T+1 settlement is relevant to how they serve retail investors and organize post-trade operations.

What we recommend for CASPs, investment firms and fund managers

• CASPs authorized in the Baltic states should expect peer reviews, common supervisory actions and Q&A-driven convergence on MiCA topics such as reverse solicitation, custody segregation and conflicts of interest. They should keep their policies aligned with ESMA guidance as it is issued.
• Investment firms and fund managers should plan for Retail Investment Strategy changes to inducements, value-for-money and disclosure rules, and for T+1 operational changes.

FCA opens UK cryptoasset authorization gateway

Date: 30 September 2026 | Source: FCA (UK)
Link

The FCA opened the authorization gateway for cryptoasset firms. Firms that want to carry on regulated cryptoasset activities in the UK from 25 October 2027 can now apply. The FCA stresses that authorization is not automatic: applicants must demonstrate compliance with standards on consumer protection, safeguarding of assets, market integrity and financial resilience.

Existing firms that apply by 28 February 2027 benefit from transitional arrangements. They can continue providing cryptoasset services, including taking on new customers, while their application is assessed, even if a decision is not reached before the regime takes effect. Pre-application meetings and webinars are available.

Why it matters

For existing cryptoasset firms intending to remain in the UK market, applying by 28 February 2027 is important for business continuity: it allows services and new business to continue while the application is assessed. This transitional protection does not guarantee authorization.

What we recommend for CASPs serving UK customers

• CASPs with UK customers that intend to remain in the UK market should aim to apply well before 28 February 2027 to secure transitional protection. They should prepare a UK-specific regulatory business plan, safeguarding arrangements and evidence of financial resilience.
• Firms that will not apply should plan an orderly withdrawal from UK customers before 25 October 2027 and update terms, marketing and geo-restrictions accordingly.

Our view

The UK application deadline is the only deadline in this edition that firms can act on now: applications filed by 28 February 2027 preserve transitional protection. The EU changes come later. The central contact point rules still need publication, the Commission is assessing responses to its MiCA review consultation, which closed on 30 September, and ESMA’s new priority applies from 2027. We expect the ESMA priorities and the central contact point rules to become part of day-to-day supervision in the Baltics in 2027, while any MiCA amendments would follow a separate legislative process.

In Latvia, interest from crypto-asset businesses keeps growing, and we are receiving inquiries about MiCA licensing in Latvia. Latvijas Banka continues to issue MiCA licenses, and we will cover the latest authorizations in next month’s edition.

How ECOVIS ProventusLaw can help crypto and investment businesses

ECOVIS ProventusLaw advises crypto-asset businesses, investment firms and fund managers on EU licensing, regulatory compliance and cross-border operations.

Our services related to the developments covered in this edition include:

• Gap assessments, compliance reviews and remediation – reviewing existing authorizations and operations against current requirements and supervisory priorities, and addressing identified gaps.
• MiCA authorization and CASP regulatory compliance – licensing strategy, regulatory perimeter assessments, EU passporting and ongoing compliance.
• Token classification and MiCA white papers – legal analysis of token offerings, stablecoins, tokenized assets and related regulatory requirements.
• MiFID II investment firm licensing – authorization applications, scope of permitted activities, governance and regulatory documentation.
• Investment fund management and AIFM licensing – fund structures, manager registration and licensing, and regulatory requirements.
• AML/CFT compliance – host-state requirements including central contact points, risk assessments, internal policies, controls and compliance arrangements for financial institutions and crypto businesses.
• Regulatory compliance and risk management – preparation for supervision, governance, DORA and ICT risk management, regulatory reporting and internal controls.

If your plans involve a license application, a question about the regulatory perimeter or a new regulatory proposal, we can help you assess the work required before the regulator asks.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw is one of the most experienced financial regulatory law firms in the Baltics, with a long track record of advising financial institutions and early participants in the cryptocurrency market.

Our teams operate across Lithuania, Latvia and Estonia, providing clients with a single point of contact for regulatory and compliance matters throughout the Baltic region. Through the ECOVIS International network, present in more than 90 countries, we also support businesses operating across multiple jurisdictions.

As an early legal advisor to crypto businesses in the Baltics, ECOVIS ProventusLaw has developed extensive experience across all stages of crypto and financial services operations. We have advised on more than 40 end-to-end licensing projects, from initial business structuring and regulatory applications to ongoing supervision and compliance.

Our highly qualified and experienced regulatory and compliance teams within the Banking and Finance and FinTech departments work together to provide coordinated legal and operational support, including licensing, AML/CFT, sanctions, internal controls and regulatory risk management.

The post RegRally Insights: Crypto & Investments Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

This September edition of RegRally is for crypto-asset service providers (CASPs), investment firms, fund managers and crowdfunding platforms operating in the Baltics and across the EU.

This month at a glance

• Lithuania licensing: Evernord Asset Management was licensed as a management company of alternative collective investment undertakings, covering informed-investor funds, UCITS, real-estate funds and portfolio management. Nasdaq Vilnius rule amendments took effect on 1 September, with the Auction Volume Discovery (AVD) order rolling out across the Baltic markets in stages from 21 September.
• Lithuania supervision: Aria Securities received a Category C brokerage license structured without holding client funds or financial instruments. FinoMark’s crowdfunding license was supplemented with a strictly non-matching bulletin board, and the 2026 inspection plan was adjusted for two payment sector firms.
• United States: the SEC proposed Regulation Crypto Assets, with two registration exemptions (USD 5 million once over four years, and USD 75 million per 12-month period), a conditional safe harbor from the “investment contract” definition, and preemption of state registration requirements. Comments close on 20 October 2026.
• Prudential: the EBA is consulting on three draft technical standards on the EUR 30 billion reclassification threshold, related reporting from EUR 5 billion, and, for the first time, the factors competent authorities must consider when deciding whether to grant a waiver. Registration for the 30 September hearing closes on 25 September; comments close on 25 November 2026.
• Derivatives and markets: the ESAs proposed removing initial margin exchange for counterparties below the EUR 8 billion threshold on both new and existing uncleared OTC contracts, and weekly commodity derivatives position reporting went live on 3 September under XML schema v2.0.

Bank of Lithuania licenses Evernord Asset Management and approves Nasdaq Vilnius rule changes

Date: 26 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

In its Financial Market Supervision Committee decisions of 26 August, the Bank of Lithuania took two decisions relevant to investment activity.

It licensed Evernord Asset Management UAB as a management company of alternative collective investment undertakings. The license permits the company to manage collective investment undertakings intended for informed investors (including those intended for professional investors), to manage undertakings for collective investment in transferable securities (UCITS), to manage real-estate collective investment undertakings, and to manage portfolios of financial instruments belonging to other persons.

It also approved Baltic membership rules amendments at the request of AB Nasdaq Vilnius. Part of the amendments implement the European Commission regulation establishing requirements for the publication of market data on reasonable commercial terms. A new order type, the Auction Volume Discovery (AVD) order, is being introduced on the Nasdaq Nordic markets for use in opening and closing auctions, with the aim of increasing auction liquidity without adversely affecting price formation. It will be rolled out across all three Baltic markets in stages from 21 September. The rule amendments entered into force on 1 September 2026.

Why it matters for crypto and investment businesses

The Evernord license covers four activities under a single authorization: informed-investor funds, UCITS, real-estate funds and individual portfolio management. For anyone scoping a Lithuanian application, it is a current reference point for how widely a management company authorization can be drawn, and a reminder that individual portfolio management has to be applied for expressly.

For trading members, the AVD order and the market-data requirements come with fixed dates. The rulebook changes applied from 1 September and the AVD rollout begins on 21 September.

Recommended actions

Businesses should:

• use the scope granted to Evernord as a benchmark when scoping their own license application (managers planning Lithuanian AIFM or UCITS activity), and apply expressly for individual portfolio-management permission where the business model requires it
• update rulebook compliance, order-handling and best-execution documentation for the AVD order type (trading members on Nasdaq Vilnius)
• review market-data licensing and redistribution arrangements against the reasonable-commercial-terms requirements

Bank of Lithuania licenses Aria Securities and expands FinoMark’s crowdfunding permissions

Date: 20 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Financial Market Supervision Committee decisions bulletin of 20 August contained four decisions.

A Category C financial brokerage (investment) firm license went to UAB Aria Securities, permitting the reception and transmission of orders, management of financial instrument portfolios, provision of investment advice, and placing of financial instruments without a firm commitment basis. Ancillary services were also authorized: advising undertakings on capital structure and business strategy, advice and services on reorganizations and acquisitions, investment research and financial analysis, and other general recommendations relating to transactions in financial instruments. The firm will not hold client funds or client financial instruments.

The crowdfunding license of UAB “FinoMark” was supplemented with the right to operate a bulletin board on which registered and properly identified platform clients may advertise an intention to transfer or acquire claims relating to loans originally offered on the platform. The board will operate only as a technical facility. It will not automatically match buying and selling interests, execute client orders or conclude claim-transfer agreements.

The 2026 inspection plan was adjusted. The planned on-site inspection of electronic money institution UAB B4B PAYMENTS EUROPE will be replaced by off-site (remote) supervision. The inspection window for payment institution RIA Lithuania UAB moves from August–October 2026 to November 2026–January 2027. Senior appointments were approved at UAB SME Bank (head of the internal audit service) and Urbo bankas (board member).

Why it matters for crypto and investment businesses

Aria Securities will not hold client funds or client financial instruments, which materially narrows its safeguarding and prudential profile. Applicants often treat client asset holding as a given when it is a decision they control at the design stage.

The FinoMark decision shows how a bulletin board can be built to sit inside a crowdfunding license. The board stays passive: no automatic matching of buying and selling interests, no execution of client orders, no conclusion of claim-transfer agreements. That is the boundary that keeps such a facility outside the trading-venue perimeter under the Crowdfunding Regulation (ECSPR). Automated matching would raise a trading venue and MiFID authorization question.

Recommended actions

Businesses should:

• treat client asset holding as a design decision rather than a default (investment-firm applicants), and scope ancillary services explicitly in the application
• keep any bulletin board strictly non-matching and non-executing and document that design (crowdfunding platforms adding secondary-liquidity features), since automated matching of buy and sell interest risks triggering trading venue and MiFID authorization requirements
• re-check their slot and re-phase inspection-readiness work (PIs and EMIs named in the published inspection plan), since off-site supervision still produces data requests and remote reviews

SEC proposes Regulation Crypto Assets with two registration exemptions and a conditional safe harbor

Date: 18 August 2026 | Source: SEC (U.S. Securities and Exchange Commission)
Link

What happened?

The SEC proposed new rules titled “Regulation Crypto Assets”, intended to create a clear and fit-for-purpose framework for certain investment contracts involving crypto assets. The proposal builds on the Commission’s March 2026 interpretation of how the federal securities laws apply to crypto assets and transactions involving them.

Two exemptions from the registration requirements of the Securities Act of 1933 are proposed. The first is a one-time exemption permitting offerings of up to USD 5 million over a four-year period. The second permits offerings of up to USD 75 million in each 12-month period. Issuers under both would make principles-based narrative disclosures available to investors, and issuers relying on the second would also provide financial statements and be subject to ongoing reporting requirements.

The proposal also includes a conditional safe harbor from the “investment contract” element of the “security” definitions in the Securities Act of 1933 and the Securities Exchange Act of 1934, available once an issuer has completed or permanently ceased the essential managerial efforts it represented or promised it would undertake. Securities issued under a Regulation Crypto Assets exemption would be exempt from state securities law registration and qualification requirements, as would certain secondary market transactions.

The proposing release (Release Nos. 33-11434 and 34-106150, File No. S7-2026-27) was published in the Federal Register on 21 August 2026. The public comment period closes on 20 October 2026.

Why it matters for crypto and investment businesses

The two frameworks do different jobs, which is why they have to be mapped rather than compared. MiCA authorizes service providers and regulates offers to the public through white papers, disclosure and marketing rules. The SEC proposal is an offering regime built on a different premise: the security is the investment contract surrounding the asset, and the proposed safe harbor turns on whether the issuer has completed or permanently ceased the managerial efforts it promised. An asset that falls outside MiCA’s white-paper obligations can still form part of an investment contract in the US, and an offering structured under a proposed US exemption still needs its EU treatment worked out separately.

For smaller issuers, the caps set the shape of what a US-facing raise can look like: USD 5 million once, or USD 75 million a year with financial statements and ongoing reporting attached.

Recommended actions

Crypto-asset firms with US touchpoints should:

• test planned or completed token offerings against the two proposed exemptions and the conditions of the safe harbor, including the point at which essential managerial efforts are treated as complete
• map the interaction with MiCA for any asset offered in both markets, covering classification, white-paper and disclosure content, and marketing rules
• submit comments under File No. S7-2026-27 by 20 October 2026 if the proposed conditions would affect a planned offering
• review group structures to ensure US-facing activity is ring-fenced or appropriately authorized

EBA consults on the EUR 30 billion threshold at which investment firms become credit institutions

Date: 25 August 2026 | Source: EBA (European Banking Authority)
Link

What happened?

The EBA launched a consultation on three draft regulatory technical standards (RTS) on the reclassification of investment firms as credit institutions. Under the Capital Requirements Directive (CRD), an investment firm whose total assets exceed EUR 30 billion must obtain a credit institution authorization rather than operate under a MiFID investment firm authorization.

The first two RTS revise the methodology for calculating total assets against that threshold, at solo and group level, and the related reporting requirements. They reflect the 2024 amendments to the CRD, which clarified the scope of entities to be included in the calculation. Reporting applies from a lower level than reclassification: under Article 55(5) of the Investment Firms Regulation (IFR), it covers investment firms whose total assets exceed EUR 5 billion.

The third RTS is new. For the first time, the EBA is consulting on the factors competent authorities must consider when deciding whether to grant a waiver from the requirement to hold a credit institution authorization. Where a waiver is granted, the firm continues to operate under its investment firm authorization.

The legal bases are Articles 8a(6)(b) and 8a(7) CRD and Article 55(5) IFR. The feedback deadline is 25 November 2026. A virtual public hearing takes place on 30 September 2026 at 10:00 CEST, with registration required by 25 September 2026 at 16:00 CEST.

Why it matters for crypto and investment businesses

Crossing the threshold moves a firm out of the IFR/IFD regime and into the full CRR and CRD prudential framework, with a fresh authorization to obtain. For a firm within reach of EUR 30 billion, the calculation methodology determines when the threshold is crossed, and the proposed waiver factors may determine whether the firm can stay under its investment firm authorization. Both are worth reading before they are finalized.

The EUR 5 billion reporting level catches a much wider group. Firms above it will be reporting against the threshold long before they come close to it.

Recommended actions

Large investment firms approaching the total-assets threshold should:

• model total assets under the proposed methodology at both solo and group level and identify the point at which EUR 30 billion would be crossed
• assess the proposed waiver factors against the firm’s structure and business model, since a waiver preserves the investment firm authorization
• check the proposed reporting templates and instructions where total assets exceed EUR 5 billion
• register for the 30 September hearing by 25 September and prepare consultation comments ahead of the 25 November deadline

European Supervisory Authorities propose to simplify initial margin requirements under EMIR

Date: 3 August 2026 | Source: EBA / EIOPA / ESMA (Joint Committee of the ESAs)
Link

What happened?

The EBA, EIOPA and ESMA published a final report on draft regulatory technical standards proposing to simplify the bilateral margin requirements in Commission Delegated Regulation (EU) 2016/2251 under the European Market Infrastructure Regulation (EMIR).

The proposal concerns initial margin only, and targets counterparties below the EUR 8 billion threshold for exchanging initial margin. Under the current framework, those counterparties are exempt from exchanging initial margin on new uncleared over-the-counter (OTC) derivative contracts but continue to exchange it on existing ones. The amendments would remove the requirement for new and existing contracts alike, completing the phase-out for this group and moving the EU closer to the treatment applied in other jurisdictions. The ESAs present the change as a response to requests from market participants and part of their simplification and burden reduction work.

The final report has been submitted to the European Commission for endorsement. The RTS will then be subject to scrutiny by the European Parliament and the Council before publication in the Official Journal.

Why it matters for crypto and investment businesses

The proposed change would reduce the initial margin burden for affected counterparties. A counterparty below EUR 8 billion that is still posting and collecting initial margin on legacy uncleared trades would be able to stop, releasing collateral and retiring the associated custody and segregation arrangements.

The timing sits with the Commission and the co-legislators, so nothing changes yet. The consultation stage has passed and comments are closed, which makes this a planning item rather than a lobbying one.

Recommended actions

Derivatives counterparties should:

• confirm whether the firm sits below the EUR 8 billion initial margin threshold, and identify any legacy uncleared OTC contracts on which initial margin is still exchanged
• estimate the collateral and custody arrangements that would be released, and plan the operational steps and counterparty communications needed to unwind them
• track the endorsement timeline through the Commission, Parliament and Council, since the relief applies only once the amending RTS are published in the Official Journal

ESMA confirms 3 September go-live of weekly commodity derivatives position reporting

Date: 14 August 2026 | Source: ESMA (European Securities and Markets Authority)
Link

What happened?

ESMA confirmed that the new weekly commodity derivatives position reporting framework went live on 3 September 2026. From that date, market participants submit weekly position reports under the updated requirements, technical specifications and validation rules introduced by XML schema version 2.0.

The go-live follows ESMA’s original reporting instructions and a subsequent decision to postpone the rollout, which gave firms additional time for technical and operational preparation. Updated reporting instructions and the XML schema are published on ESMA’s website.

Commodity derivatives position reporting sits within the MiFID II position limits and position management regime, and the shift to a weekly cycle increases the frequency and consistency of the data available to supervisors across trading venues.

Why it matters for crypto and investment businesses

The date has already passed. Any firm holding commodity derivative positions should be submitting weekly against schema v2.0, and a validation failure now surfaces every week instead of at a longer interval.

The earlier postponement led some firms to pause their implementation work. Where that work was not restarted in time, the gap will show in rejected or incomplete submissions from the first reporting week onwards.

Recommended actions

Firms holding commodity derivatives positions should:

• confirm that weekly submissions are running against XML schema v2.0 with the updated validation rules implemented, and resolve any rejected or incomplete submissions since 3 September
• review position-limit monitoring and ancillary-activity assessments against the more frequent data

What crypto and investment businesses should focus on now

License scope is a design choice. The Evernord authorization shows how widely a Lithuanian management company license can be drawn, and Aria Securities shows what falls away when a firm decides not to hold client assets. The FinoMark bulletin board marks where a crowdfunding license stops and a MiFID trading venue question starts.

On the SEC proposal, the work worth doing now is mapping a token’s treatment under both regimes side by side. Comments under File No. S7-2026-27 close on 20 October 2026, so there is still time to respond on the points that would affect a planned offering.

Three dates are live in the EU. Weekly commodity derivatives position reporting went live on 3 September, so any gap in submissions is already accruing. Registration for the EBA public hearing closes on 25 September, ahead of the hearing on 30 September and the consultation deadline of 25 November. The Nasdaq Vilnius rule amendments took effect on 1 September and the AVD rollout starts on 21 September.

The EMIR initial margin relief runs on a slower track. It has gone to the Commission for endorsement and applies only once the amending RTS reach the Official Journal.

How ECOVIS ProventusLaw can help crypto and investment businesses

ECOVIS ProventusLaw advises crypto-asset and investment businesses across the Baltics on fintech and financial institution licensing in the EU, including:

• MiCA authorization strategy and regulatory perimeter mapping
• scoping AIFM, UCITS and investment firm license applications, including ancillary services and client-asset choices
• crowdfunding licensing and the design of secondary-liquidity features under ECSPR
• structuring cross-border activity across the EU and US regimes
• white papers, token offerings and disclosure documents
• AML/CTF, Travel Rule and sanctions controls for crypto businesses
• DORA and ICT risk readiness
• dialogue with financial supervisors, from pre-licensing consultations to inspections

If a license application, a perimeter question or a new regulatory proposal touches your plans, we can help you scope it before the regulator asks.

The post RegRally Insights: Crypto & Investments Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

At the same time, FATF is highlighting growing risks linked to stablecoins, unhosted wallets, offshore VASPs and decentralised finance, while European supervisors are increasing scrutiny of ICT and AI-related risks.

This month’s RegRally focuses on the developments most relevant to CASPs, crypto businesses, investment firms, issuers and financial institutions operating with digital assets.

Latvia issues its 10th MiCA licence to Nodu Digital

Date: 9 July 2026 | Source: Latvijas Banka
Link

Latvijas Banka issued Nodu Digital SIA both a MiCA licence for crypto-asset services and a payment institution licence. The CASP authorisation covers the exchange of crypto-assets for funds and the provision of crypto-asset transfer services on behalf of clients.

Nodu Digital became the 10th company authorised under MiCA by Latvijas Banka. Once authorised in one EU Member State, a CASP can provide its authorised services across the EU through the cross-border notification mechanism.

Why it matters

The decision illustrates the growing importance of combining crypto-asset and payment regulatory analysis for businesses operating crypto payment models. For businesses whose model involves both fiat payment services and crypto-asset services, the regulatory perimeter may require parallel authorisation strategies.

Recommended actions

• Determine whether the proposed business model requires both CASP and PI authorisation.
• Map the regulatory perimeter before preparing the licensing application.
• Use Latvijas Banka’s pre-licensing consultations to resolve classification and authorisation questions early.
• Consider whether the business model can benefit from EU-wide cross-border provision following MiCA authorisation.

ESMA launches EU-wide supervisory action on CASP custody and operational resilience

Date: 8 July 2026 | Source: ESMA
Link

ESMA launched a Common Supervisory Action (CSA) with national competent authorities focusing on the digital operational resilience of CASPs providing custody services.

The supervisory exercise will examine how CASPs manage risks associated with distributed ledger technology, including:

• governance arrangements;
• private key and storage management;
• transaction controls;
• incident detection and response;
• smart contract risks; and
• dependencies on third-party providers.

National competent authorities will conduct the exercise on a risk-based sample of authorised CASPs from H2 2026 to H1 2027, with ESMA’s consolidated report expected in H2 2027.

Why it matters

This is a clear indication that MiCA supervision is moving beyond licensing documentation towards testing the operational substance of CASP business models.

Custody arrangements, key management and third-party dependencies are likely to receive particular supervisory attention.

Recommended actions

CASPs providing custody services should:

• review key-management and wallet-storage arrangements;
• verify segregation and transaction-control mechanisms;
• test incident detection and response procedures;
• document smart-contract risk controls;
• map critical third-party dependencies, including custody technology and blockchain infrastructure providers; and
• assess their framework against both MiCA custody requirements and DORA.

ESMA clarifies MiCA rules on crypto advice, lending and token distributions

Date: 10 July 2026 | Source: ESMA
Link

ESMA published a new batch of Q&As providing important clarifications on MiCA.

Three Q&As are particularly relevant to CASPs and crypto businesses.

Crypto-asset advice – Q&A 2882

ESMA clarified that the concept of advice on crypto-assets under MiCA is broader than investment advice under MiFID II. Certain introductory or referral activities recommending a crypto-asset service to a potential investor may therefore constitute advice requiring authorisation. A general reference to a CASP that is equally accessible to all investors does not, by itself, constitute advice.

Crypto-asset lending – Q&A 2883

ESMA confirmed that CASPs may offer crypto-asset lending as an unregulated service, subject to specific conditions. In particular, clients must provide prior, express and specific consent to the use of their assets. Consent embedded only in general terms and conditions is not sufficient.

The service must also include fair, clear and non-misleading risk disclosures and adequate collateral arrangements. MiCA safeguarding requirements do not apply to assets that have been lent.

Primary token offerings – Q&A 2417

ESMA clarified that an issuer transferring crypto-assets directly from an issuance smart contract to purchasers’ wallets in a primary offering does not, by that activity alone, provide custody or transfer services requiring CASP authorisation.

Why it matters

These clarifications affect the regulatory perimeter of referral models, crypto lending products and token issuance structures.

Recommended actions

• Review referral, affiliate and introduction arrangements to determine whether they could constitute crypto-asset advice.
• Redesign crypto lending consent flows so that client consent is standalone, prominent and specific.
• Review risk disclosures and revenue-sharing arrangements for lending products.
• For token issuances, document the precise role of the issuer and determine which activities fall within the CASP perimeter.

ESMA sets deadlines for the EU move to T+1 settlement

Date: 20 July 2026 | Source: ESMA – T+1 settlement preparations
Link

ESMA published a statement on preparations for the EU’s transition to a T+1 settlement cycle, scheduled for 11 October 2027.

Two key deadlines apply:

• 7 December 2026 – requirements relating to the exchange of allocations and confirmations, including timing requirements and the default use of international communication standards;
• 11 October 2027 – requirements aimed at optimising the settlement layer, including earlier submission of settlement instructions and broader use of CSD functionalities.

ESMA stresses that preparation must cover the entire trading and settlement chain, including clients, brokers, custodians, CSDs, CCPs, trading venues, vendors and outsourcing providers.

Why it matters for crypto and investment businesses

The transition is particularly relevant for investment firms and businesses with exposure to tokenised or traditional securities, where post-trade processes may involve multiple regulated and outsourced providers.

Recommended actions

• Map the complete post-trade chain and identify dependencies.
• Confirm vendor and custodian readiness for the December 2026 deadline.
• Review Standard Settlement Instructions and reference-data quality.
• Identify operational changes required before the 2027 transition.

European Supervisory Authorities highlight AI-driven ICT risks for financial entities

Date: 31 July 2026 | Source: ESMA – ESA statement on ICT risks from frontier AI
Link

The European Supervisory Authorities published a joint statement on ICT risks arising from frontier AI models.

The statement is particularly relevant to CASPs given the increasing supervisory focus on digital operational resilience. AI-enabled cyber tools can accelerate vulnerability discovery and exploitation, target shared infrastructure and exploit single points of failure.

The ESAs recommend strengthening ICT risk management through three areas:

• Prevention – comprehensive IT asset inventories, secure-by-design architecture, proactive patching and supply-chain controls.
• Detection – continuous vulnerability scanning, behavioural monitoring and more frequent testing.
• Management – resilience testing against AI-enhanced attack scenarios, dependency mapping and clear management-body accountability.

Why it matters

For CASPs, AI-related cyber risks may directly affect private keys, custody infrastructure, smart contracts and critical third-party services.

Recommended actions

CASPs should:

• include AI/ML components in ICT asset inventories;
• update vulnerability-management and monitoring processes;
• test resilience against AI-enhanced attack scenarios;
• map dependencies on critical ICT providers; and
• ensure management bodies receive appropriate information on AI-related cyber risks.

FATF identifies growing risks around stablecoins, unhosted wallets and offshore VASPs

Date: 16 July 2026 | Source: FATF – Seventh Targeted Update on Virtual Assets and VASPs
Link

The FATF’s Seventh Targeted Update on Recommendation 15 reports continued global progress in implementing requirements for virtual assets and VASPs.

According to the report, 83% of surveyed jurisdictions have now passed Travel Rule legislation, compared with 73% in 2025.

However, significant gaps remain in supervision and enforcement.

For the crypto sector, FATF highlights several emerging risks, including:

• industrialised virtual-asset-enabled fraud;
• misuse of stablecoins, which now feature in most identified on-chain illicit activity;
• P2P transactions involving unhosted wallets;
• offshore VASPs operating outside effective oversight; and
• risks associated with DeFi.

Why it matters

The report provides a useful benchmark for the risk-based AML/CTF and sanctions controls expected from CASPs.

Recommended actions

CASPs should:

• reassess stablecoin-related risks in their ML/TF risk assessments;
• review exposure to unhosted-wallet and P2P transactions;
• assess offshore VASP counterparties;
• test the quality and completeness of Travel Rule information; and
• update transaction-monitoring scenarios to reflect current crypto-specific typologies.

FATF calls for a functional approach to DeFi regulation

Date: 21 July 2026 | Source: FATF
Link

FATF published its Targeted Report on Regulatory Challenges from Decentralised Finance (DeFi), updating its earlier guidance.

The report promotes a functional, risk-based approach: regulators should look beyond the label “decentralised” and determine whether identifiable natural or legal persons exercise sufficient control or influence over a DeFi arrangement.

Relevant indicators include governance token concentration, administrative privileges, control over protocol upgrades, and significant economic benefits.

The FATF also highlights risks arising from interactions with DeFi protocols, including chain-hopping, cross-chain bridges, decentralised exchanges, mixers and governance manipulation.

Why it matters

Calling a protocol “decentralised” does not necessarily remove it from the regulatory perimeter. CASPs and financial institutions interacting with DeFi arrangements need to understand who actually controls or influences the protocol and what risks arise from the interaction.

Recommended actions

CASPs integrating DeFi protocols should:

• conduct and document a control analysis for each relevant protocol;
• assess governance-token concentration and administrator privileges;
• identify protocol-level and counterparty risks;
• reflect DeFi exposure in the business-wide risk assessment; and
• verify that appropriate due diligence and control measures can be applied before interacting with a protocol.

EU sanctions package introduces new crypto-specific restrictions

Date: 23 July 2026 | Source: European Commission – 21st sanctions package against Russia
Link

The EU’s 21st package of sanctions against Russia introduces several measures directly relevant to the crypto-asset sector.

The package creates a new mechanism that allows third-country legal entities that provide crypto-asset services used to circumvent EU sanctions to be designated. Systematic failure to prevent sanctions circumvention may trigger designation.

The package also introduces transaction bans involving additional third-country crypto platforms and crypto-linked firms, with more than 20 crypto-asset service financial institutions added.

In addition, restrictions on the ownership, control or board membership of companies providing crypto-asset services by Russian and Belarusian nationals have been extended.

Why it matters

Crypto businesses need to consider sanctions risk not only when screening direct customers but also when assessing counterparty platforms, liquidity providers, ownership structures and management.

Recommended actions

CASPs should:

• rescreen counterparties and crypto platforms against updated sanctions lists;
• review liquidity-provider relationships;
• refresh ownership and management nationality checks;
• assess third-country crypto counterparties for sanctions-evasion risk; and
• update sanctions representations and contractual clauses where necessary.

Latvia issues investment firm licence following pre-licensing cooperation

Date: 23 July 2026 | Source: Latvijas Banka – C Capital Markets licence
Link

Latvijas Banka issued an investment firm licence to SIA C Capital Markets, a subsidiary of AS Citadele banka, for the placing of financial instruments on a non-firm-commitment basis and related ancillary services.

The licence was issued less than one month after the official application was submitted, following pre-licensing cooperation with the regulator.

Latvia now has 12 licensed investment firms.

Why it matters for crypto businesses

Although the licence concerns an investment firm rather than a CASP, the case provides a useful indication of the potential efficiency of well-prepared licensing processes in Latvia.

For businesses considering MiCA, investment firm or combined regulatory structures, early regulatory dialogue can help resolve issues before the formal application is submitted.

Recommended actions

Applicants considering Latvian authorisation should:

• use the pre-licensing consultation process;
• establish the regulatory perimeter before filing;
• prepare a complete and internally consistent application package; and
• resolve governance, ownership, business-model and operational questions before formal submission.

MiCA transitional period has ended: unlicensed CASPs must wind down

Date: 2 July 2026 | Source: Lietuvos bankas – End of MiCA transitional period
Link

The EU-wide MiCA transitional period ended on 1 July 2026.

Unlicensed CASPs that are no longer entitled to rely on transitional arrangements must wind down their EU-facing activities in an orderly manner. During the wind-down process, firms must address client communications, positions and assets while maintaining applicable AML/CTF and Travel Rule controls.

Third-country CASPs cannot simply continue providing services to EU clients without an appropriate regulatory basis, and custody cannot be delegated to unlicensed providers.

Lietuvos bankas has also established a dedicated Investment and Crypto-Asset Firms Supervision Division, signalling a more specialised supervisory approach.

Why it matters

The end of the transitional period marks an important shift: operating in the EU crypto market now requires businesses to have a clear legal basis under MiCA or to cease the relevant activities.

Recommended actions

CASPs and crypto businesses should:

• confirm that all EU-facing crypto-asset services are provided through appropriately authorised entities;
• review whether any activities remain dependent on transitional arrangements;
• ensure orderly wind-down procedures are operational where authorisation has not been obtained;
• maintain AML/CTF and sanctions controls throughout any wind-down; and
• review outsourcing and custody arrangements to ensure that critical services are not being provided by unlicensed entities.

What crypto businesses should focus on now

The regulatory focus is shifting from “Are you licensed?” to “How are you operating?”

For CASPs and other businesses active in the crypto-asset market, the developments covered in this edition point to several immediate priorities:

• MiCA: confirm that all EU-facing activities have the appropriate regulatory basis.
• Custody: prepare for supervisory scrutiny of key management, wallet segregation, incident response and third-party dependencies.
• AML/CTF: strengthen controls around stablecoins, unhosted wallets, offshore VASPs and DeFi.
• Sanctions: review crypto counterparties, ownership structures, liquidity providers and sanctions-evasion risks.
• DORA: test ICT resilience against increasingly sophisticated and AI-assisted attacks.
• Business models: reassess referral, advisory, lending and other activities against the latest ESMA interpretations.
• DeFi: do not rely on the “decentralised” label; assess actual control and influence over the protocol.
• Licensing strategy: where authorisation is still required, use regulatory pre-licensing dialogue to resolve the perimeter and prepare a coherent application.

The direction of travel is clear: crypto regulation is becoming increasingly operational, risk-based and supervisory in practice.

Need assistance?

Our legal and regulatory specialists assist crypto-asset businesses with:

• MiCA licensing and regulatory perimeter analysis
• CASP authorisation and cross-border EU expansion
• AML/CTF and Travel Rule compliance
• Sanctions and crypto-asset sanctions screening
• DORA and ICT risk management
• Crypto custody and client-asset arrangements
• DeFi regulatory analysis
• Crypto lending and business-model structuring
• Token issuance and white-paper requirements
• Internal policies, procedures and compliance documentation

If you have questions about the regulatory developments covered in this edition or would like to assess your crypto-asset business model against the current EU regulatory framework, our team will be happy to assist you.

The post RegRally Insights: Crypto & Investments Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

As your legal advisors we will be happy to assist you regarding all the questions related to proposed changes in regulation, including legal advice as well as revision and preparation of your internal documents.

The post MICA to RegRally: The Crypto Guide, June 2026 appeared first on ECOVIS ProventusLaw.

ECOVIS ProventusLaw advised Trek Technologies SIA throughout the MiCA regulatory licensing process.

The authorisation allows the company to provide regulated crypto-asset services within the European Union, including the custody and administration of crypto-assets, the exchange of crypto-assets for funds and other crypto-assets, the execution of client orders, and the transfer of crypto-assets.

MiCA licensing framework in practice

The authorisation is part of the broader implementation of the EU Markets in Crypto-Assets Regulation (MiCA), which entered into force in 2024 and introduced a harmonised regulatory framework for crypto-asset service providers across the European Union.

MiCA establishes mandatory authorisation requirements for CASPs and enables authorised entities to operate across the European Economic Area under a cross-border notification regime, once licensed in a single EU jurisdiction.

Regulatory focus: beyond formal authorisation

While MiCA creates a harmonised legal structure, supervisory practice shows that licensing assessments increasingly extend beyond formal compliance checks.

Competent authorities typically expect applicants to demonstrate:

• robust governance and organisational structure
• effective internal control and risk management frameworks
• AML and compliance systems aligned with EU requirements
• operational resilience and outsourcing governance
• sustainable and well-documented business models

As a result, CASP authorisation has become a comprehensive regulatory assessment of an organisation’s operational and compliance maturity.

Baltic region and EU crypto-asset regulation

The Baltic States continue to play an active role in shaping the EU’s fintech and digital asset regulatory environment.

With the implementation of MiCA, the region remains an important jurisdiction for licensing and regulatory structuring of crypto-asset service providers seeking access to the EU single market.

ECOVIS ProventusLaw Fintech Practice

ECOVIS ProventusLaw advises fintech and digital asset clients on:

• MiCA CASP licensing and regulatory strategy
• cross-border regulatory structuring and expansion
• AML, governance, and compliance frameworks
• supervisory engagement and regulatory risk management

The firm has supported a significant number of licensing projects across the Baltic region, assisting clients throughout the full lifecycle of regulatory authorisations.

The authorisation of Trek Technologies SIA under MiCA reflects the continued transition of EU crypto-asset regulation from legislative framework to practical supervisory implementation.

As MiCA becomes fully operational, regulatory expectations increasingly focus on governance quality, operational resilience, and long-term compliance sustainability, in addition to formal licensing requirements.

The post Trek Technologies (Backpack) Receives MiCA CASP Authorisation from Latvijas Banka appeared first on ECOVIS ProventusLaw.

Welcome to the May 2026 edition of MiCA to RegRally: The Crypto Guide. This month’s developments confirm that the crypto regulatory landscape is entering a decisive implementation phase across both the EU and the UK. Supervisors are moving from framework-building to active enforcement, licensing expansion, and practical interpretation of how digital assets fit within existing financial services rules.

Across Europe, MiCA license authorisations continue to accelerate, while ESMA has made clear that the 1 July 2026 transitional deadline is a hard stop for unauthorised providers. At the same time, the European Commission is issuing important clarifications on passporting, token issuance, exchange classifications, and disclosure obligations—providing greater certainty for banks, EMIs, CASPs, and token issuers navigating the new regime.

In parallel, the UK FCA is signalling a pragmatic innovation-focused approach by opening a clear pathway for fund tokenisation under existing rules. For market participants, the message is clear: 2026 is the year to move from strategy to execution, ensuring licensing, governance, product structuring, and cross-border models are fully aligned with the rapidly maturing digital asset regulatory environment.

The post MICA to RegRally: The Crypto Guide, May 2026 appeared first on ECOVIS ProventusLaw.

Across jurisdictions, regulators are moving beyond formal compliance frameworks and increasingly concentrating on substance: how firms are governed in practice, how competence is assessed and maintained, and how regulatory obligations are embedded into day-to-day operations.

In Lithuania and the wider Baltic region, MiCA implementation continues to gain momentum, with an expanding licensing pipeline and clear supervisory expectations for crypto-asset service providers. At the same time, ESMA and EBA are shaping more harmonised and intrusive approaches to governance and suitability assessments, reinforcing the principle of continuous compliance for senior management roles.

Retail investment, crowdfunding structures, and staff competence requirements are also under renewed scrutiny, reflecting a broader EU-wide effort to simplify investor experience while strengthening consumer protection and operational resilience.

Lithuania expands MiCA licensing activity

The Bank of Lithuania has granted a MiCA CASP licence to UAB Micar assets, authorising crypto-asset services including custody, exchange, and order execution for retail and professional clients.

This is the fourth MiCA licence issued in Lithuania, following Robinhood Europe, Coingate (UAB “Decentralized”), and Nuvei Liquidity UAB. One shareholder is the licensed investment firm UAB FMĮ “Myriad Capital”.

According to ESMA data, Lithuania ranks second in the Nordics and Baltics by number of MiCA CASP licences (behind Finland with five, and ahead of Latvia and Sweden).

The steady issuance of MiCA licences by the Bank of Lithuania signals an active and growing crypto-asset regulatory environment in Lithuania.

Entities providing or intending to provide crypto-asset services in the EU should ensure they have obtained the appropriate MiCA authorisation, as operating without a licence exposes them to enforcement risk.

Existing virtual asset service providers operating under transitional arrangements should closely monitor their authorisation timelines.

ESMA/EBA draft rules tighten suitability checks for senior roles

ESMA and EBA have published draft Guidelines to harmonise the way EU financial institutions assess the suitability of members of management bodies and key function holders.

The scope covers credit institutions, investment firms, and certain third-country branches, as well as their supervisors. It applies to both executive and supervisory board members, as well as to key roles such as CFOs and heads of internal control functions.

The aim is to ensure more consistent EU-wide standards for governance, competence, and integrity assessments at the senior management level.

At their core, the Guidelines reflect a continued regulatory shift towards strengthened governance expectations, building on lessons from past financial crises and more recent supervisory developments. Entities themselves bear the primary responsibility for ensuring that members of the management body and key function holders are suitable at all times, while competent authorities retain a parallel role in assessment and intervention.

The Guidelines place significant emphasis on ongoing monitoring and reassessment, rather than treating suitability as a one-off exercise at the point of appointment. Any material change in circumstances should trigger a reassessment by the entity, reinforcing the expectation of continuous compliance.

From a supervisory standpoint, the Guidelines confirm a more intrusive and structured approach by competent authorities, including the ability to prevent appointments or require the removal of individuals who do not meet suitability criteria.

ESMA Retail Investor Journey – Key Takeaways (2025)

ESMA identifies measures to improve retail investing accessibility, focusing on:

• Simplified disclosures – reducing length, complexity, and non-digital formats
  • Streamlined suitability/appropriateness tests – lowering compliance burden, especially for simple and digital products
  • Sustainability preferences under MiFID II – making requirements less complex and more workable

Stakeholders highlight major barriers: excessive information, burdensome assessments, and overly complex ESG preference integration, alongside non-regulatory issues (low trust, fees, financial literacy, taxation).

The findings will inform ESMA’s future technical advice on MiFID II delegated acts and updates to guidelines under the Retail Investment Strategy.

Financial market participants should closely monitor the forthcoming changes to MiFID II delegated acts and ESMA guidelines, as simplification of disclosure, suitability, and sustainability preference requirements may require updates to internal processes, client-facing documentation, and digital distribution channels. Institutions with mobile-first or digitally distributed products should pay particular attention, as ESMA’s consumer testing work is likely to produce more prescriptive guidance on digital investor journeys.

ESMA Q&A – Nominee Structures in Crowdfunding

ESMA clarified the regulatory treatment of nominee (fiduciary) structures under the European Crowdfunding Service Providers Regulation (ECSPR).

Nominee structures are permitted but only under strict conditions. They must be fully disclosed to the competent authority (in Lithuania – the Bank of Lithuania) and cannot undermine the core principle that investment decisions remain with the individual investor.

Key requirements:

• Investors must retain full discretion over investment decisions in specific projects.
• Structures cannot aggregate or intermediate investments in a way that dilutes investor choice.
• Where nominee arrangements involve custody of financial instruments, MiFID/CRD authorisation may be required due to regulated custody activities.

Enhanced disclosure obligations apply, including clear information on:

• the structure and purpose of the nominee arrangement;
• ownership and voting rights allocation;
• costs and insolvency risks;
• impact on investor rights.

These details must also be reflected in the Key Investment Information Sheet (KIIS).

Overall, ESMA confirms a substance-over-form approach: nominee structures are allowed only where they preserve direct investor decision-making and comply with transparency and, where relevant, licensing requirements.

Crowdfunding Authorisation in Latvia: FUNDAUS SIA

Latvijas Banka authorised FUNDAUS SIA to operate a crowdfunding platform under Regulation (EU) 2020/1503. The company may facilitate lending-based crowdfunding and provide ancillary services, including credit scoring and support for pricing/interest rates. The authorisation reflects the EU framework for regulated online platforms connecting investors with funding seekers.

This development should be viewed in a broader context of Latvia’s increasingly active licensing environment, with multiple electronic money and payment institutions already operating in the jurisdiction. It reflects a clear strategic direction by the Latvijas Banka to position Latvia as an attractive hub for financial services and fintech businesses within the EU.

The Latvian regulator actively promotes the use of pre-licensing consultations, which serve as an important tool for aligning expectations between applicants and the supervisor at an early stage.

Engagement at the pre-licensing phase allows firms to obtain initial feedback on their business model, governance arrangements, and compliance framework, thereby significantly increasing the likelihood of a successful application. This approach also enables Latvijas Banka to filter and shape incoming applications, resulting in higher-quality submissions and more efficient review processes.

Staff Competence Requirements under MiCA (Estonia)

The Estonian Financial Supervision Authority (Finantsinspektsioon) has endorsed ESMA Guidelines on knowledge and competence requirements under MiCA, clarifying expectations for crypto-asset service providers’ client-facing staff.

The rules apply to staff providing information or advice on crypto-assets, with a clear distinction between the two: advisory roles are subject to higher competence standards.

The Guidelines will apply from 28 July 2026. Firms should use the transition period to update internal policies, training, and documentation to ensure compliance.

From a practical perspective, firms are expected to ensure that staff possess appropriate qualifications, experience, and understanding of crypto-asset risks, tailored to their role. This includes not only initial assessment but also ongoing compliance.

The clarification signals a clear supervisory expectation that competence frameworks should be formalised and embedded into internal governance, rather than addressed on an ad hoc basis.

MiCA Transition Deadline (Estonia)

The Estonian Financial Supervision Authority (Finantsinspektsioon) has confirmed that crypto-asset service providers must obtain MiCA authorisation by 1 July 2026 or cease operations.

This marks the end of the transitional regime based on prior FIU registration. From the deadline onward, only MiCA-authorised providers (in Estonia or another EU Member State) may lawfully offer crypto-asset services in Estonia.

The regulator has sent a strong signal that late applicants face significant execution risk. It has been indicated that firms submitting licence applications close to the deadline are unlikely to receive a decision in time and may be required to include wind-down plans as part of their application. This reflects a strict supervisory approach, prioritising orderly market transition over accommodating delayed compliance efforts.

In addition, firms that choose or are required to cease operations must ensure an orderly exit, with a particular focus on client protection. This includes safeguarding client assets, ensuring secure handling or transfer to another licensed provider, and avoiding unjustified financial harm to customers.

The post MICA to RegRally: The Crypto Guide, April 2026 appeared first on ECOVIS ProventusLaw.

ESMA Statement, reminder on obligations under CFD product intervention measures

ESMA reminded firms that perpetual futures/contracts offering leveraged exposure to crypto-assets (e.g., Bitcoin) are likely to fall within the scope of existing national CFD product intervention measures.

Where the CFD definition is met, firms must comply with:

1. leverage limits;

2. mandatory risk warnings;

3. margin close-out and negative balance protection;

4. prohibition of monetary and non-monetary benefits.

Additionally:

1. A narrow target market and aligned distribution strategy are required, given product complexity.

2. Appropriateness assessments must be carried out for non-advised services.

3. Conflicts of interest must be identified, prevented or managed.

Companies offering perpetual futures or similar leveraged derivatives should:

1. Assess whether the product falls within the CFD definition and applicable national intervention measures.

2. Ensure full compliance with CFD requirements (leverage limits, risk warnings, margin close-out, negative balance protection, benefits prohibition);

3. Define a narrow target market and review distribution strategy;

4. Implement appropriateness assessments for non-advised clients;

5. Review and update conflicts of interest policies.

ESMA Q&As, MiCA and Others

ESMA published new and updated Q&As.

Markets in Crypto-Assets Regulation (MiCA)

1. Clarification on Withdrawal Requirements under Article 75 of MiCA for CASPs (2320)

2. Calculation of fixed overheads (2349)

3. Interests earned from client funds deposited at credit institutions (2486)

4. Payouts in fiat currency by CASPs in the context of exchange services (2550)

5. Overlap between offers of crypto-assets and placing (2551)

6. Application of Title II requirements to CASPs operating a trading platform for crypto-assets (2552)

Detailed information:

1. Withdrawal requirements (Art. 75) – CASPs providing custody and administration services must ensure procedures are in place to return the same type of crypto-asset held at the time of the client’s request; the words „return crypto-assets held“ mean the identical type of asset must be returned, not an equivalent; CASPs cannot require clients to withdraw in fiat currency or other crypto-assets, though they may offer this as an option only upon obtaining explicit client consent at the time of withdrawal; where a conversion option is offered, the CASP must be separately authorised for the additional crypto-asset service involved (e.g. exchange of crypto-assets for funds, exchange for other crypto-assets, execution of orders, or reception and transmission of orders); CASPs should not take on custody of assets they foreseeably cannot return; technical limitations must not make withdrawal difficult for most clients; all fees, technical requirements and conversion options must be agreed upfront in the Article 75(1) MiCA agreement;

2. Fixed overheads calculation (Art. 67) – the prudential safeguard must be calculated from the total of all overhead expenses, both fixed and variable, using figures from the applicable accounting framework; only the items listed exhaustively in Art. 67(3)(a)–(d) may be subtracted – unlike under IFR (Regulation 2019/2033), Art. 67 MiCA does not allow NCAs or CASPs any discretion to subtract additional items; the requirement is consumer protection-oriented and all overhead costs must be covered;

3. Client funds interest – CASPs may not earn interest on client funds deposited at credit institutions; Art. 70(1) – (3) MiCA requires CASPs to deposit client funds in risk-free savings accounts solely for the benefit of clients; any interest generated as a result of complying with Art. 70(3) must be transferred entirely to the client since it derives from client funds;

4. Fiat-only payouts – a business model where clients can only collect their balance in fiat currency without the possibility of having the purchased crypto-asset transferred to them is not permitted under MiCA; where a client purchases a crypto-asset, the CASP incurs an obligation to transfer that specific asset; a service where an entity offers clients to “buy” a crypto-asset that is never delivered and can only be redeemed in fiat is not to be allowed as a crypto-asset exchange service; offering fiat collection as an optional alternative remains permissible provided crypto-asset transfer is also available;

5. Overlap between offers of crypto-assets and placing – persons offering crypto-assets to the public on behalf of an issuer under written consent (e.g. under Art. 16(1) MiCA second subparagraph) act on behalf of the issuer and do not require a CASP licence for that activity alone, provided it is not exercised in the context of providing crypto-asset services on a professional basis; however, where such person engages in placing of crypto-assets or any other MiCA crypto-asset service on a professional basis, a CASP licence is required for the relevant services; such persons must in all cases comply with MiCA’s offer and marketing provisions (e.g. Arts. 27, 29 and 40 for ARTs);

6. Application of Title II requirements to trading platforms – Art. 5(2) MiCA, which requires CASPs operating a trading platform to comply with Art. 5(1) where they initiate admission to trading and no white paper has been published, does not apply to crypto-assets without an identifiable issuer, as no white paper is required for such assets under MiCA (recital 22); however, CASPs are not relieved from their general authorisation obligations, must conduct suitability assessments of all admitted crypto-assets and determine whether an identifiable issuer exists; CASPs must also provide clients with hyperlinks to white papers where a white paper is required under MiCA. Other Q&As published: AAR threshold calculation, AAR representativeness obligation, AAR stress testing (EMIR/CCPs); use of fiduciary (nominee) structures in equity crowdfunding; interaction of IFRS 18 & APM Guidelines (effective 1 January 2027).ESMA published new and updated Q&As.

EBA Opinion on the end of the No-Action Letter transition period, interplay between PSD2 and MiCA (EBA/Op/2025/08)

The EBA published an Opinion advising NCAs on how to proceed once the 9-month PSD2/MiCA transition period expires on 2 March 2026. Three scenarios apply:

1. ASP has obtained PSD2 authorisation or partnered with an authorised PSP, and may continue EMT services;

2. CASP has submitted an application but has not yet received authorisation. NCA may allow continued EMT services only if:

• • application duly submitted with all required documents;
  • The applicant responds to NCA queries exhaustively and expeditiously.
  • NCA has verified no material supervisory measures or MiCA/AML infringements;
  • NCA has no reason to expect non-compliance, and approval is expected within a very short timeframe. In this scenario, the CASP must cease marketing EMT payment services and must not onboard new clients.

3. CASP has not submitted an application or fails to meet scenario 2 conditions, NCA must require the CASP to cease EMT payment services and offboard relevant clients as of 2 March 2026.

CASPs transacting EMTs that qualify as payment services should urgently verify which scenario applies to them.

CASPs in scenario 2 must ensure full cooperation with their NCA and immediately cease marketing and new client onboarding for EMT payment services.

CASPs that have not submitted a PSD2 application must discontinue EMT payment services as of 2 March 2026.

The post MICA to RegRally: The Crypto Guide, March 2026 appeared first on ECOVIS ProventusLaw.

Latvia issues two MiCA licences and promotes crypto-asset supervision framework

Latvia issued two MiCA (Markets in Crypto-Assets Regulation) licences in 2025, demonstrating progress in establishing a clear and predictable regulatory framework for crypto-asset service providers.

Latvia has positioned itself as an attractive jurisdiction for crypto-asset service providers within the EU, offering early regulatory consultations that reduce uncertainty, structured and transparent licensing pathways, and alignment with EU regulatory frameworks including MiCA.

Five crypto-asset service providers receive MiCA authorisation across Europe

European regulators authorised five crypto-asset service providers under the MiCA framework in January 2026:

Germany

ISF Institut Deutsch-Schweizer Finanzdienstleistungen GmbH (authorised 28 January 2026)

• Regulator: Federal Financial Supervisory Authority (BaFin)
• Authorised services: reception and transmission of orders for crypto-assets on behalf of clients

Ireland

Interactive Brokers Ireland Limited (authorised 22 January 2026)

• Regulator: Central Bank of Ireland (CBI)
• Authorised services: reception and transmission of orders for crypto-assets on behalf of clients

Malta

Damex Digital LTD (authorised 29 January 2026, registered 30 January 2026)

• Regulator: Malta Financial Services Authority (MFSA)
• Authorised services: providing custody and administration of crypto-assets on behalf of clients; exchange of crypto-assets for funds; exchange of crypto-assets for other crypto-assets; execution of orders for crypto-assets on behalf of clients; providing transfer services for crypto-assets on behalf of clients

Slovakia

Firefish Europe s.r.o. (authorised 2 January 2026, registered 5 January 2026)

• Regulator: National Bank of Slovakia (NBS)
• Authorised services: providing custody and administration of crypto-assets on behalf of clients; exchange of crypto-assets for funds; exchange of crypto-assets for other crypto-assets; providing transfer services for crypto-assets on behalf of clients

Okazio s.r.o. (authorised 15 January 2026, registered 16 January 2026)

• Regulator: National Bank of Slovakia (NBS)
• Authorised services: providing custody and administration of crypto-assets on behalf of clients; execution of orders for crypto-assets on behalf of clients; providing advice on crypto-assets; providing portfolio management on crypto-assets; providing transfer services for crypto-assets on behalf of clients

The post MICA to RegRally: The Crypto Guide, February 2026 appeared first on ECOVIS ProventusLaw.

The post MICA to RegRally: The Crypto Guide, January 2026 appeared first on ECOVIS ProventusLaw.