European Union
Is crypto legal in the European Union? (2026)
Yes — cryptocurrency is legal in the European Union. The Markets in Crypto-Assets Regulation (MiCA, Regulation 2023/1114) has been fully applicable since 30 December 2024, with national transition windows closing by 1 July 2026. Oversight sits with national competent authorities, coordinated by ESMA and the EBA. Full details — governing law, licensing, tax and enforcement history — follow below (last reviewed 2026-05-03).
Executive summary
The European Union is, as of 2026, the only G20 jurisdiction operating a comprehensive end-to-end crypto regulatory framework. The Markets in Crypto-Assets Regulation, MiCA, has been fully applicable since December 30, 2024 for crypto-asset service providers, and since June 30, 2024 for asset-referenced and electronic-money tokens. Sixteen months into full applicability, MiCA's prescriptive design has produced both the legal certainty European regulators advertised and the structural side-effects critics warned about — most visibly, USD-stablecoin caps that have effectively limited USDC and USDT as means of payment within the EU. Twenty-seven national competent authorities still administer authorisation, with Lithuania, Malta, France, Germany and Ireland emerging as the practical CASP venues. Enforcement is decentralised, talent and capital are polycentric, and the compliance bill is among the heaviest in global crypto. But MiCA is real, knowable and bankable in a way that no US framework has yet been.
Regulatory architecture overview
EU crypto regulation operates on three tiers. At the union level, the European Securities and Markets Authority (ESMA) coordinates harmonisation and writes Level 2 and Level 3 technical standards — over forty Regulatory Technical Standards and Implementing Technical Standards have been published since 2023 covering whitepaper templates, market-abuse rules, complaint handling, ICT risk management, prudential requirements and significance thresholds. The European Banking Authority (EBA) supervises significant asset-referenced tokens and electronic-money tokens under MiCA Title III and IV, with direct authority once a token meets the significance threshold of €5 billion in market cap, 10 million holders, or designation by the Commission. The European Central Bank advises on systemic stability and runs the digital euro project. National competent authorities — BaFin in Germany, AMF and ACPR in France, AFM and DNB in the Netherlands, CONSOB and Bank of Italy in Italy, MFSA in Malta, CSSF in Luxembourg, Bank of Lithuania, Central Bank of Ireland, CNMV in Spain — administer day-to-day authorisation, supervision and enforcement. Authorisation in any single member state passports across all twenty-seven via the EU services directive mechanism. Anti-money-laundering supervision is moving to the new Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt, which began operations in mid-2025.
Crypto-specific framework
MiCA, Regulation (EU) 2023/1114, is the cornerstone. It creates three regulated token categories — asset-referenced tokens (ARTs) backed by a basket of assets, electronic-money tokens (EMTs) pegged to a single fiat currency, and other crypto-assets — and a single CASP authorisation covering ten regulated services: custody, exchange, trading platform, brokerage, advice, portfolio management, transfer, placement, reception and execution. Issuance of ARTs and EMTs requires authorisation as a credit institution, e-money institution, or specifically authorised issuer; reserves must be held one-for-one in segregated, bankruptcy-remote arrangements with significant tokens facing mandatory redemption rights and liquidity buffers. The Title V transparency, market-abuse and disclosure regime is fully applicable to all listed crypto-assets. The Transfer of Funds Regulation, TFR, in force since December 2024, applies the FATF Travel Rule to all crypto transfers regardless of value, with stricter rules for self-hosted wallets including additional verification for transfers above €1,000. DAC8, the eighth amendment to the Directive on Administrative Cooperation, came into force January 2026 and requires CASPs to report customer transactions to tax authorities for cross-border information sharing. The Digital Operational Resilience Act, DORA, has applied to CASPs since January 17, 2025, imposing ICT risk management, third-party oversight and incident-reporting requirements. The non-EUR stablecoin caps under Article 23 — 1 million transactions per day or €200 million daily volume as a means of payment — are the single most consequential operational rule in MiCA.
Recent enforcement actions
Enforcement under MiCA has accelerated through 2025 and into 2026. BaFin issued nine enforcement notices to unauthorised CASPs operating in Germany during 2025 and ordered Bybit to wind down German operations until authorisation in February 2025. The AMF blacklist now contains over 250 unregistered platforms; the AMF coordinated with French prosecutors on three criminal referrals. CONSOB suspended the Italian operations of two unregistered exchanges in mid-2025. The Central Bank of Ireland refused authorisation to four major applicants and granted CASP authorisations to Gemini Europe (April 2025) and Kraken Ireland (December 2025); Coinbase Europe secured its MiCA authorisation via Luxembourg (June 2025). The MFSA in Malta, historically lenient, tightened materially under EU peer review and revoked one CASP authorisation in October 2025 for inadequate AML controls. Bank of Lithuania, the volume leader in CASP authorisations with 24 issued by end-2025, faced direct ESMA peer review in March 2026 raising concerns about substance requirements. USDT has been delisted from MiCA-compliant venues including Binance EU, Crypto.com EEA, OKX EU and Coinbase Europe across 2024 and 2025 because Tether has not pursued EMT authorisation; USDC remains compliant via Circle's French e-money institution authorisation. The EBA has opened proceedings against three credit institutions for ART/EMT supervisory non-compliance, with results expected late 2026.
Tax treatment
Crypto taxation in the EU is determined at the member-state level — there is no harmonised EU crypto tax regime, only the DAC8 reporting harmonisation. Treatment varies dramatically. Germany applies a one-year holding-period exemption: crypto held more than twelve months is tax-free on disposal for individuals; shorter holdings face progressive income tax up to 45%. France applies a flat 30% prélèvement forfaitaire unique on disposals exceeding €305 per year. Italy applies a 26% capital-gains rate above a €2,000 threshold; this rises to 33% in 2026 under the 2025 Italian budget. Spain applies tiered savings-income rates of 19-28% on crypto gains. Portugal, historically the EU crypto tax haven with no tax on individual disposals, introduced a 28% rate on holdings under one year from January 2023; longer holdings remain tax-free. Belgium and the Netherlands apply varying capital-gains and wealth-tax constructs. Malta and Cyprus offer favourable individual regimes with extensive professional-trader exemptions. Staking rewards are generally taxed as miscellaneous income at receipt across most member states. Mining is treated as business income. Crypto-to-crypto swaps are taxable disposals in nearly all member states. DAC8 reporting since January 2026 means the home-country tax authority of any EU resident now receives detailed transaction data from any EU-authorised CASP — operational opacity has effectively ended.
Banking and on-ramp infrastructure
Banking access in the EU is bifurcated by member state and license posture. Tier-one universal banks — Deutsche Bank, BNP Paribas, Santander, ING, UniCredit — remain cautious; Deutsche has begun crypto custody under the German Krypto-Verwahrgeschäft license, but treasury services for unauthorised CASPs are still difficult. The standard fintech path runs through Lithuanian and Maltese e-money institutions: Bankera, ConnectPay, Verifo, Bank Frick (Liechtenstein but EEA-passportable). SEBA Europe and Sygnum Europe operate as crypto-native banks under Luxembourg and German licenses. Specialist payment institutions — IBAN.com, Stripe (re-entered Europe with crypto support 2024), Banking Circle, ClearJunction — service the broader operator ecosystem. SEPA Instant access is the practical baseline for any EU-authorised CASP. Stablecoin on-ramps are dominated by Circle's EURC and USDC under French e-money authorisation; Société Générale-Forge issues EURCV; Banking Circle has launched EUR1. Card programs operate through Visa Europe and Mastercard Europe with Coinbase Card, Crypto.com Card and Gemini Card. Identity verification is harmonised by the eIDAS 2.0 framework, with the European Digital Identity Wallet rolling out across member states through 2026 and 2027 for KYC reuse.
Court-tested precedents
MiCA is too new to have generated significant judicial precedent, but several pre-MiCA national rulings continue to shape interpretation. The German Federal Court of Justice's 2018 ruling that Bitcoin is not 'money' under German criminal law, but is property, remains foundational. The Swedish Supreme Administrative Court's 2015 ruling confirmed crypto trading is exempt from VAT — applied EU-wide via the Court of Justice of the EU's Hedqvist decision (C-264/14). The CJEU's 2019 Funke Medien ruling, while not crypto-specific, reinforced limits on national over-implementation of EU directives. Tornado Cash-related criminal proceedings against Alexey Pertsev concluded in May 2024 with a 64-month conviction in the Netherlands for money laundering; the appeal heard in late 2025 is still pending and is being closely watched for its implications on developer liability. The Bibox France criminal proceedings on unauthorised CASP operation, ongoing in 2026, will produce the first significant post-MiCA criminal precedent. ESMA has begun issuing supervisory convergence opinions that increasingly carry interpretive weight: an October 2025 opinion clarified that staking-as-a-service falls under the custody and administration definition, materially affecting Lido and Rocket Pool's commercial offerings to EU users.
Regulatory roadmap
The 2026-2028 horizon for EU crypto regulation contains four substantial deliverables. The MiCA review under Article 142 is due by June 2027; the European Commission's call for evidence in late 2025 already signalled likely extensions to cover decentralised finance, NFTs, and crypto-asset lending — none of which were brought into Title II of the original regulation. AMLA fully takes over direct supervision of high-risk CASPs from member-state authorities by Q1 2027, beginning with the forty highest-risk operators. The digital euro decision phase concluded in October 2025; the European Central Bank is now in the preparation phase, with member-state legislation in 2026 setting the foundational legal framework, but actual issuance is unlikely before 2028 and requires formal European Parliament approval. ESMA Level 3 guidance continues to flow through 2026, with ongoing supervisory convergence work on tokenised securities under the existing MiFID II regime, distinct from MiCA. The DLT Pilot Regime, in operation since 2023, is up for review and likely extension; only six firms have used it to date but lessons learned will inform tokenisation policy. The proposed Payment Services Directive 3 includes provisions affecting stablecoin payments and is expected to enter trilogue in 2026.
Practical implications for operators
Operating a crypto business in the EU requires choosing a member state, completing a substantive authorisation, and budgeting for ongoing harmonised compliance. Authorisation timelines vary: Bank of Lithuania has averaged 9-11 months, Malta 12-15 months, Ireland 14-18 months, Germany 18-24 months. Initial capital requirements depend on services: €50K for advice/reception/transmission, €125K for custody/operating a trading platform, €150K for principal-on-own-account services, with bespoke add-ons for issuers. Substance requirements — local directors, real-staff presence, on-the-ground compliance — have tightened materially through ESMA peer review pressure on Lithuania and Malta. Realistic ongoing compliance cost for a mid-sized CASP is €2M-€8M annually covering compliance staff, audit, ICT under DORA, and AML/Travel Rule tooling. Once authorised, a single passport opens 449 million consumers across 27 member states. The non-EUR stablecoin caps mean payment-rail products denominated in USDC or USDT are operationally constrained; EUR-denominated stablecoin products are commercially preferred by EU regulators and increasingly by EU corporate customers. The Coinbase, Kraken, Bitstamp, Bitpanda and Circle authorisations under MiCA in 2024-2025 demonstrate the path is achievable for well-capitalised operators; over 200 smaller pre-MiCA national licensees did not survive transition, which has materially consolidated the market.
Notable licensees
- Coinbase Europe (Luxembourg)
- Kraken Ireland
- Bitstamp (Luxembourg)
- Bitpanda (Austria)
- Crypto.com (Malta)
- Circle (France)
- Gemini Europe (Ireland)
Top regulators
- ESMA
- EBA
- ECB
- AMLA
- BaFin (DE)
- AMF (FR)
- AFM (NL)
Watch points
- MiCA Article 142 review draft expected June 2027 — DeFi extensions likely
- AMLA full direct supervision of high-risk CASPs from Q1 2027
- ESMA Level 3 staking-as-a-service guidance interpretive impact on Lido and Rocket Pool
- Stablecoin caps biting in 2026 — USDC and USDT supply trajectory in EU
- Pertsev appeal ruling on developer liability in the Netherlands
TL;DR
World's only fully comprehensive crypto framework — heavy-handed, prescriptive, but real, knowable and bankable.
Get DeFi Intel research in your inbox
Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.