Centralized exchange in European Union
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in European Union with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP authorization under MiCA via home NCA — requires minimum capital based on service class (EUR 150K for trading platform, EUR 125K for exchange, EUR 50K for custody)
- Travel Rule applies to ALL crypto-asset transfers — EUR 0 threshold (no de minimis) under TFR recast (Regulation (EU) 2023/1113), effective December 30, 2024
- Custody segregation mandatory — client assets held on trust under CASP Class 1 rules
- AML/CFT obligations under AMLD6 (2024) — harmonized AML/CTF rules across EU
- EBA Travel Rule Guidelines (finalized July 2024, applicable Dec 30, 2024) require secure transmission/retention of originator and beneficiary data (name, address, wallet addresses)
- DAC8 (2024) crypto reporting directive for tax authorities — effective 2026
- ESMA and NCAs conduct thematic reviews and supervisory stress tests on authorized CASPs focusing on governance, custody, and disclosures
Key Restrictions
- Must obtain CASP authorization from home Member State NCA (e.g. AMF, BaFin, CNMV, CBI) before operating
- Must maintain minimum capital: EUR 150K for trading platform, EUR 125K for exchange, EUR 50K for custody — capital must be prudent
- Client assets must be segregated and held on trust — cannot commingle with proprietary assets
- Transitional provisions vary by Member State — Germany until June 30, 2026; France until March 31, 2025 — operator must check each home MS transition period
- EU-wide passporting requires notification to home NCA with 20 business days notice
- No de minimis Travel Rule threshold — obligations apply to all transfers regardless of amount
- Existing operators must transition to full MiCA authorization by July 2026 deadline (or earlier per national transition laws)
Key Risks
- Enforcement fragmentation — 8 of 27 NCAs had not finalized MiCA enforcement guidelines by Q1 2026 (ESRB analysis), creating supervisory inconsistency across member states
- First enforcement precedent: French AMF issued cease-and-desist against non-EU CASP (CryptoFlow Ltd.) in Jan 2026 for soliciting French residents without authorization
- Dutch AFM issued formal warnings to 14 firms for failing to submit complete authorization applications by Feb 28, 2026 deadline
- Transitional period variability — firms relying on grandfathering must monitor each MS regime; some MS (e.g. France) had short windows
- Unregulated entities offering services to EU retail without authorization or transitional protection face enforcement actions — per ESMA Dec 2024 public statement
- Cybersecurity audits mandated under NIS2/DORA may impose additional technical compliance costs
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
EBA — Stablecoin supervision (ARTs/EMTs), significant issuer oversight
ESMA — Market integrity, CASP oversight, RTS/ITS development
National Competent Authorities — CASP authorization in home member state (AMF, BaFin, CNMV, CBI, etc.)
MiCA Regulation (EU 2023/1114) (2023) — Comprehensive CASP authorization, token issuance, white paper requirements — fully effective Dec 30, 2024
Transfer of Funds Regulation (recast) (2023) — Travel Rule — EUR 0 threshold (no de minimis)
AMLD6 (2024) — AML/CFT harmonization across EU
DAC8 (2024) — Crypto reporting directive for tax authorities — effective 2026
VASP: CASP authorization under MiCA via home NCA. 9 service classes: custody (EUR 50K), trading platform (EUR 150K), exchange (EUR 125K), order execution (EUR 50K), placing (EUR 50K), reception/transmission (EUR 50K), advice (EUR 50K), portfolio mgmt (EUR 50K), transfer services (EUR 50K). Prudential: higher of fixed minimum or 1/4 prior year fixed overhead.
CUSTODY: CASP Class 1 — EUR 50,000 minimum capital. Asset segregation mandatory. Client assets held on trust.
EXCHANGE: CASP authorization with EU-wide passporting (notify home NCA, 20 business days). Transition: up to 18 months for existing operators (July 2026 deadline). France chose 6 months, Germany 12 months.
Travel Rule adopted — threshold: EUR 0 (no threshold under TFR recast)
Adoption and Effective Date: Adopted as part of the TFR recast in May 2023 (Regulation (EU) 2023/1113 entered into force June 2023). Full compliance is mandatory from December 30, 2024, following European Banking Authority (EBA) guidelines finalized in 2024.
Threshold Amounts: No de minimis threshold; the rule applies to all crypto-asset transfers, exceeding basic FATF requirements.
Covered VASPs: Applies to all CASPs (Crypto-Asset Service Providers) and potentially Intermediate Crypto-Asset Service Providers (ICASPs), defined under the Markets in Crypto-Assets Regulation (MiCAR). This covers entities handling virtual asset transfers, aligning VASPs with financial institutions under AML/CFT rules.
Technical Implementation Requirements: CASPs must securely transmit and retain detailed data on originators (e.g., name, address, wallet addresses) and beneficiaries during transfers. EBA's Travel Rule Guidelines (finalized July 2024, applicable December 30, 2024) specify detecting/handling missing data, risk-based approaches, and compliance with prior guidelines like JC/GL/2017/16. The EU mandates more extensive data points than FATF or jurisdictions like Singapore.
Regulation (EU) 2023/1113 (TFR recast): Core law extending Travel Rule to crypto. Available via official EU sources.
EBA Travel Rule Guidelines: Final report on info requirements for funds/crypto transfers. Direct PDF: https://www.eba.europa.eu/sites/default/files/2024-07/6de6e9b9-0ed9-49cd-985d-c0834b5b4356/Travel%20Rule%20Guidelines.pdf
In January 2026, the French Autorité des Marchés Financiers (AMF) became the first NCA to publicly announce a formal enforcement action under MiCA, issuing a cease-and-desist order against an unregistered non-EU CASP (CryptoFlow Ltd., registered in the Cayman Islands) for soliciting French residents without authorization; the AMF noted this action as a "test case" for MiCA enforcement coordination across NCAs AMF MiCA Enforcement Action January 2026
A March 2026 analysis by the European Systemic Risk Board (ESRB) identified that 8 of the 27 EU NCAs had not yet finalized their MiCA enforcement guidelines by Q1 2026, creating "supervisory fragmentation risks" for CASPs operating across multiple member states; the ESRB warned that this could lead to inconsistent application of authorization requirements and investor protections by the April 2026 enforcement date ESRB Analysis of MiCA Supervisory Fragmentation
The European Commission's March 2026 enforcement update confirmed that the Netherlands Authority for the Financial Markets (AFM) had issued formal warnings to 14 crypto-asset firms for failing to submit complete authorization applications by the February 28, 2026 deadline; the AFM warned that firms without approved authorization by April 1, 2026, would face immediate suspension orders European Commission MiCA Enforcement Update March 2026
By April 2026, NCAs have the mandate under Article 114 to process authorization applications, monitor ongoing compliance, and initiate enforcement actions against non-compliant entities, particularly those operating without authorization and not covered by transitional provisions; enforcement powers include suspension of services, imposition of fines, and public warnings MiCA Article 114 Enforcement
ESMA has issued a public statement in December 2024 reminding market participants that unregulated entities offering services to EU retail clients without authorization or transitional grandfathering may face enforcement actions, and has called for convergent supervisory practices across Member States ESMA December 2024 Statement
Practical enforcement examples by April 2026 remain limited; however, in late 2025, the Dutch Authority for the Financial Markets (AFM) issued warnings against several unregistered crypto firms operating without transitional provisions AFM Crypto Warnings
The application of national transitional provisions under Article 127 is optional for Member States, leading to significant variability: for example, Germany has applied a transitional period until June 30, 2026 for existing CASPs, while France opted for a shorter period ending March 31, 2025, creating uneven enforcement intensity across jurisdictions BaFin Transitional Provisions; AMF France MiCA
By April 2026, ESMA and NCAs will have conducted at least one round of thematic reviews and supervisory stress tests on authorized CASPs, focusing on governance, custody of client assets, and disclosure requirements, as part of ESMA's 2025-2026 Supervisory Convergence Work Programme ESMA Work Programme 2025
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a centralized exchange (CASP) may operate in the EU only after obtaining MiCA authorization from its home Member State NCA, meeting minimum capital requirements (EUR 125K–150K for exchange/trading platform classes), segregating client assets on trust, and complying with the zero-threshold Travel Rule under the TFR recast, with full enforcement active from December 30, 2024.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?