Crypto & Fintech Companies

• Markets in Crypto-Assets Regulation (MiCA) (EU) 2023/1114 – The “Markets in Crypto-Assets” regulation (MiCA) is a comprehensive framework from the European Union to standardize the rules for crypto-assets across its member states. Its main goals are to protect consumers and investors, ensure financial stability, and foster innovation by providing a clear legal basis for crypto assets that were not covered by existing financial laws. MiCA regulates both the issuance of crypto-assets, such as stablecoins, and the services provided by crypto-asset service providers (CASPs), like exchanges and custodians, by requiring authorization and setting operational standards.

• Transfer of Funds Regulation (TFR) (EU) 2023/1113 (crypto-asset transfers / “travel rule”) – The EU’s Transfer of Funds Regulation (TFR), Regulation (EU) 2023/1113, implements the “travel rule” for crypto-asset transfers, requiring Crypto-Asset Service Providers (CASPs) to share sender and receiver information with each other to prevent money laundering and terrorist financing. This rule, which came into effect on December 30, 2024, extends the obligations from traditional finance to the crypto sector, meaning the data must “travel” with the assets, regardless of the transfer amount. The goal is to improve traceability and market integrity for crypto transfers within the EU and with parties established outside the EU.

• Payment Service Act (PSD2 (EU) 2015/2366) and forthcoming PSD3/PSR package – PSD2 (Directive (EU) 2015/2366) – Тhe current EU regulation for payment services, aimed at improving security and fostering competition through “open banking”. The upcoming PSD3/PSR package will replace and update PSD2, consolidating most payment rules into a Payment Services Regulation (PSR) and addressing remaining issues with a new Payment Services Directive 3 (PSD3). PSD3/PSR aims to further level the playing field between banks and non-banks, strengthen consumer protection, and adapt rules for new payment technologies.

• AML legislative package (incl. AML Regulation and AMLA Regulation—entering into force in stages) – The EU Anti-Money Laundering (AML) legislative package is a comprehensive reform of the Union’s anti-money-laundering and counter-terrorist-financing (AML/CFT) framework, adopted in 2024 and entering into force in stages between 2025 and 2027. Its goal is to create a single, harmonised AML rulebook across all Member States and to strengthen supervision through a new EU-level authority.

• MiFID II / MiFIR (2014/65/EU; (EU) 600/2014) where instruments qualify as financial instruments – Under MiFID II/MiFIR, a financial instrument is a tradable asset or contractual agreement to receive or deliver an asset, covering a broad range of products including equities (shares, ETFs), non-equity instruments (bonds, structured products, emission allowances), and derivatives. MiFID II/MiFIR expands the scope of regulation beyond equities to include these other instruments to increase transparency, protect investors, and strengthen market integrity.

• E-Money Directive 2009/110/EC – The EU’s E-Money Directive 2009/110/EC provides a legal framework for the business and supervision of electronic money institutions to create a single market for e-money services. It defines e-money and establishes rules for how institutions can issue and manage it, ensuring consumer protection through requirements like safeguarding customer funds and granting an “e-money passport” for cross-border operations. This directive promotes competition and innovation while also harmonizing regulations across EU member states

• DORA (EU) 2022/2554 (ICT risk in finance) – The Digital Operational Resilience Act (DORA) — Regulation (EU) 2022/2554 — is a cornerstone of the European Union’s effort to strengthen the cybersecurity and resilience of the financial sector. It was adopted in December 2022, entered into force in January 2023, and becomes fully applicable from 17 January 2025.

DORA establishes a single, comprehensive EU framework to ensure that all financial entities — including banks, investment firms, insurers, payment institutions, FinTech’s, and crypto-asset service providers — are able to withstand, respond to, and recover from ICT-related incidents (Information and Communication Technology risks).

• Measures Against Money Laundering Act (PAML)

• Payment Services and Payment Systems Act (transposes PSD2)

• Markets in Financial Instruments Act (MiFIA)

• Credit Institutions Act (where relevant)

• Corporate Income Tax Act; VAT Act (crypto/tax questions)