AMLA issues guidance on AML/CFT risks ahead of the end of the MiCAR transitional period

On 29 June 2026, the Anti-Money Laundering Authority (AMLA) published an advisory note addressing money laundering and terrorist financing (ML/TF) risks arising from the end of the transitional period under the Markets in Crypto-Assets Regulation (MiCAR).

From 1 July 2026, firms may provide crypto-asset services in the European Union only if they are authorized as MiCAR-compliant crypto-asset service providers (CASPs). AMLA's guidance focuses on the risks associated with the market transition as unauthorized virtual asset service providers (VASPs) exit the market and their customers migrate to authorized CASPs.

According to AMLA, these customer transfers may increase ML/TF and sanctions evasion risks by reducing transparency over customer relationships and crypto-asset flows. To address these risks, unauthorized VASPs are expected to maintain effective AML/CFT controls throughout their wind-down process, including robust governance, customer due diligence, transaction monitoring, and suspicious activity reporting.

For authorized CASPs, AMLA emphasizes the importance of ensuring that onboarding procedures, transaction monitoring systems, staffing, and risk management frameworks are capable of handling increased customer volumes. Firms should assess each incoming customer on an individual, risk-based basis and avoid blanket de-risking solely because customers are transferred from unauthorized providers.

The advisory note also calls on AML/CFT supervisors to enhance oversight of market exits, strengthen cross-border cooperation, and monitor emerging risk patterns. Financial Intelligence Units (FIUs) are encouraged to increase domestic and international information sharing to identify suspicious asset flows and new money laundering typologies during the transition.

What this means for crypto-asset service providers

The end of the MiCAR transitional period is not only a licensing milestone but also a key compliance challenge. Crypto-asset service providers should review their AML/CFT frameworks to ensure they are prepared to manage customer transfers effectively and in line with regulatory expectations.

In particular, firms should:

• ensure onboarding and customer due diligence processes are sufficiently robust to accommodate transferred customers;

• maintain effective transaction monitoring and suspicious activity reporting throughout the transition;

• apply a risk-based approach to each customer rather than relying on blanket de-risking measures; and

• assess whether governance, staffing, and compliance resources are adequate to manage increased operational demands.

  
  

Businesses navigating the post-transition landscape should proactively review their AML/CFT controls to mitigate regulatory and financial crime risks while ensuring continued compliance with MiCAR.