EU regulation · Curated timeline
EU Crypto & Fintech Regulatory Timeline
An evergreen timeline of EU crypto & fintech regulation — MiCA, DORA, PSD3/PSR, the AML package and DAC8/CARF — with dates, what changes and what to do.
As of: 20 September 2026 · Sources: EUR-Lex & EU regulators · statuses are date-derived; curated content refreshed when milestones are confirmed
The EU regulatory stack for crypto, payments and fintech operators, on one page — grouped by regime, in date order, with what each milestone changes and our read on what to do. Dates are compiled from EUR-Lex and the EU regulators; items still in negotiation are marked expected and may move. Statuses on this page are date-derived, so what is “in force” versus “upcoming” updates automatically. For the focused, country-by-country MiCA grandfathering countdown, see the MiCA deadline hub.
Next deadline — 10 July 2027 (293 days away): AMLR + AMLD6 apply. The single AML rulebook (Reg (EU) 2024/1624) and the 6th AML Directive (Dir (EU) 2024/1640) apply; AMLA (Reg (EU) 2024/1620) supervises selected obliged entities.
MiCA — markets in crypto-assets (Reg (EU) 2023/1114)
The core crypto regime: stablecoin issuance and crypto-asset services across the EU/EEA.
| Date | Milestone — what changes | Status |
|---|---|---|
| 30 Jun 2024 | EMT & ART rules apply — Titles III–IV start; issuing e-money tokens and asset-referenced tokens becomes a licensed, supervised activity. | In force |
| 30 Dec 2024 | CASP regime + rest of MiCA apply — crypto-asset service providers need authorisation; the full regulation is live. | In force |
| 1 Jul 2026 | Transitional (“grandfathering”) period ends — EU backstop; national windows ran 0–18 months and several closed earlier. | Ended |
| 20 May – 31 Aug 2026 | MiCA review — Commission consultation → report — a targeted consultation on the functioning of MiCA opened 20 May 2026 (responses by 31 Aug 2026); the Commission’s report to the Parliament and Council is due by 30 Jun 2027 and may lead to targeted amendments. | Report due 30 Jun 2027 |
| Ongoing | Level 2 / Level 3 (RTS, ITS, guidelines) — ESMA and EBA technical standards keep filling in the detail. | Ongoing |
Our read: If you touch crypto-asset services, the window is essentially shut — authorise, passport in, or stop serving EU clients. Map your exposure with the MiCA Exposure Checker, see who is authorised in the CASP Licence Tracker, and size capital with the Capital Calculator.
DORA — digital operational resilience (Reg (EU) 2022/2554)
ICT and operational-resilience rules for financial entities — including CASPs, EMIs and payment institutions.
| Date | Milestone — what changes | Status |
|---|---|---|
| 17 Jan 2025 | DORA applies — ICT risk management, incident reporting, resilience testing and ICT third-party risk become mandatory. | In force |
| Ongoing | Register of information & TLPT — annual register-of-information submissions; threat-led penetration testing for significant entities. | Ongoing |
Our read: Financial entities must already run the five DORA pillars. Confirm whether you are in scope (and how) with the DORA Checker.
Payments — PSD2 → PSD3 / PSR
The current PSD2 / EMD2 regime, and the PSD3 + Payment Services Regulation (PSR) that will replace it and merge the PI and EMI licences.
| Date | Milestone — what changes | Status |
|---|---|---|
| In force | PSD2 / EMD2 — today’s regime: payment institutions (PI) and e-money institutions (EMI) are licensed separately. | In force |
| 27 Nov 2025 | PSD3 + PSR — provisional political agreement — co-legislators agreed the texts; legal-linguistic review underway, Official Journal publication expected in H2 2026. | Agreed |
| Expected ~2027–2028 | PSD3 + PSR apply — PI/EMI regimes merge — tighter safeguarding, open-banking and fraud changes (incl. payee-name/IBAN verification). The rules generally apply ~21 months after Official Journal publication (OJ expected H2 2026), so roughly 2027–2028. Dates not final. | Expected · in negotiation |
Our read: Build to where payments rules are going — a single merged authorisation, stricter safeguarding and stronger fraud controls. If you are unsure whether you need a payments, e-money or crypto licence, run the CASP-or-EMI checker.
Anti-money laundering — the AML package
The new single EU AML rulebook and the central authority, AMLA, in Frankfurt.
| Date | Milestone — what changes | Status |
|---|---|---|
| 1 Jul 2025 | AMLA operational (Frankfurt) — the EU Anti-Money Laundering Authority stood up, ahead of direct and indirect supervision. | In force |
| 10 Jul 2027 | AMLR + AMLD6 apply — the single AML rulebook (Reg (EU) 2024/1624) and the 6th AML Directive (Dir (EU) 2024/1640) apply; AMLA (Reg (EU) 2024/1620) supervises selected obliged entities. | Upcoming · next |
Our read: Harmonised CDD, UBO and enhanced-due-diligence rules land in 2027 — start aligning your AML programme now. Screen counterparty country risk with the Sanctions & Jurisdiction Risk Checker.
Tax transparency — DAC8 / CARF
Crypto-asset tax reporting: the EU’s DAC8, aligned with the OECD Crypto-Asset Reporting Framework (CARF).
| Date | Milestone — what changes | Status |
|---|---|---|
| 1 Jan 2026 | Reporting period begins — reporting crypto-asset service providers (RCASPs) must collect reportable user and transaction data from 2026 (DAC8, Dir (EU) 2023/2226). | In force |
| by 30 Sep 2027 | First reporting & inter-authority exchange (2026 data) — DAC8 reports on 2026 data are exchanged between EU tax authorities by 30 September 2027 (within 9 months of year-end). Some member states set earlier national RCASP filing deadlines (~Jan–Jul 2027). | Upcoming |
Our read: RCASPs need data-collection and reporting pipelines in place for 2026 — the first reports are due in early 2027. Treat this as an operational build, not just a tax footnote.
Digital identity — eIDAS 2.0 (Reg (EU) 2024/1183)
The framework for the EU Digital Identity (EUDI) Wallet — relevant to onboarding and KYC.
| Date | Milestone — what changes | Status |
|---|---|---|
| 20 May 2024 | eIDAS 2.0 in force — legal framework for the EU Digital Identity Wallet established. | In force |
| 24 Dec 2026 | EU Digital Identity Wallets — Member States must make at least one EUDI Wallet available to citizens and residents by 24 Dec 2026; an emerging option for onboarding / identity verification. | Upcoming |
Our read: Watch the EUDI Wallet for onboarding and KYC — not yet mandatory, but worth designing for.
Related tools & guides
- Focused countdown: the MiCA deadline & grandfathering hub — per-country windows against 1 July 2026.
- Live trackers: CASP Licence Tracker · EMI & PI Tracker · Stablecoin Tracker · Sanctions & Jurisdiction Risk Checker.
- Decision tools: MiCA Exposure Checker · CASP or EMI? · DORA Checker · Capital Calculator.
- Background reading: our regulatory guides.
Need this turned into a plan? We map these deadlines to your licence, capital and compliance roadmap — so you know exactly what to do, and by when. Book a 30-minute call.
Methodology & sources
- Curated, evergreen content — not a live feed. We refresh it when a major milestone is confirmed (for example, when PSD3/PSR or the AML package are published in the Official Journal).
- Primary sources: EUR-Lex (the Official Journal texts) and the relevant EU authorities — the European Commission, ESMA, EBA and AMLA.
- Fixed dates (MiCA, DORA, the Travel Rule, DAC8) are taken from the adopted texts; expected dates (PSD3/PSR, AMLR/AMLD6 application) reflect the latest published status and may move.
- Primary texts: EUR-Lex (eur-lex.europa.eu ↗); regulators: ESMA, EBA, the European Commission and AMLA.
Indicative guidance only — general information, not legal, tax or financial advice, and not a substitute for the official texts. Dates are compiled from EUR-Lex and the EU regulators; items in negotiation (notably PSD3/PSR and parts of the AML package) are marked “expected” and may change. Verify against the official sources before relying on any date.