Regulatory Developments in EU Crypto Asset Services: MiCA, PSD2 Overlap, and EBA Guidelines
MiCA established a harmonised EU framework for crypto asset services – but left uncertainty where activities involving electronic money tokens (EMTs) overlap with the Revised Payment Services Directive (PSD2). To address this, the EBA issued a No Action Letter in the form of an Opinion in June 2025, setting out (i) which type of EMT transactions are not to be regarded as payment services under PSD2, and therefore do not to require an additional authorisation under the same directive, and (ii) for those EMT transactions that would trigger a licensing requirement, which PSD2 provisions are recommended to be de-prioritised for the purpose of supervision and enforcement and from what date. In the latter instance, the EBA advised national regulators not to prioritise enforcement and recommended a grace period until 2 March 2026.
On 12 February 2026, the EBA issued an additional Opinion clarifying how national regulators should supervise crypto asset service providers (CASPs) who fall within scope of PSD2, once the grace period ends. Going forward, the EBA emphasises that CASPs must ensure EMT activities comply with PSD2 requirements either via proper authorisation, partnership with an authorised provider, or by ceasing non compliant activities.
What happens after 2 March 2026?
The EBA’s latest Opinion sets out three scenarios.
1. CASPs authorised under PSD2
Where a CASP manages to obtain a PSD2 licence (or operates through a properly structured partnership with an authorised payment service provider), it may provide EMT-related payment services without issues. The regulatory position is clear.
In Malta, several CASPs have submitted applications under the Financial Institutions Act and are expected to obtain a PSD2 licence before 2 March 2026.
2. CASPs that have not yet received PSD2 authorisation
If a CASP has submitted a PSD2 application but does not receive approval before 2 March 2026, national regulators may allow the temporary continuation of EMT services provided certain conditions are met.
These include:
- a complete and credible application;
- transparent engagement with the regulator;
- no serious supervisory concerns; and
- a realistic prospect of authorisation in the near term.
However, while awaiting the outcome of its authorisation process, the CASP must:
- cease all marketing activities related to EMTs that qualify as a payment service; and
- refrain from providing EMT-related payment services to any new clients.
3. CASPs that have not applied
If a CASP has not applied for PSD2 authorisation (and is not operating through an authorised partner), the EBA advises national authorities to require the firm to cease EMT-related payment services as of 2 March 2026.
What about virtual asset service providers (VASPs) who are not yet MiCA authorised?
The EBA’s latest Opinion suggests that VASPs can continue providing EMT-related payment services until: (a) 1 July 2026 (i.e. the end of the MiCA grandfathering period); or (b) their MiCA authorisation is granted or refused. In practice, affected VASPs should apply for MiCA and PSD2 authorisation at the same time.
A clear supervisory message
The EBA reinforces a key point: MiCA authorisation does not automatically replace PSD2 requirements where EMT activities qualify as payment services.
CASPs should assess their business models, identify any PSD2 requirements, and take steps to remain compliant. The Opinion also stresses the need for coordinated supervision by national regulators across the EU, including the MFSA, ahead of PSD3 and the new Payment Services Regulation.
