Regulatory Horizon Scanner

What it is

MiCAR is the EU’s harmonised rulebook for crypto-assets, directly applicable across the EU and EEA.

Before MiCAR, EU crypto regulation was limited and fragmented. AMLD5 brought certain crypto-to-fiat exchange providers and custodian wallet providers within AML/CFT obligations, but implementation sat with individual Member States. This created different registration standards, supervisory approaches and compliance expectations across the EU.

MiCAR is the EU’s harmonised response to that fragmentation. As a regulation, it applies directly and creates a single framework for crypto-asset issuers and CASPs across authorisation, governance, conduct, prudential safeguards, white papers, market abuse and ongoing compliance. It also introduces passporting, allowing authorised firms to operate across the single market under one authorisation.

MiCAR is only the starting point. Firms must also track Level 2 and Level 3 measures, including RTS, ITS, guidelines, Q&As and supervisory notices — and understand how MiCAR interacts with banking, payments, MiFID II, DORA, AMLR, TFR, GDPR, DAC8 and other regimes.

What it is

The EU’s Travel Rule framework for transfers of funds and certain crypto-assets, introduced through the recast Transfer of Funds Regulation, Regulation (EU) 2023/1113.

The TFR requires payment service providers, intermediary payment service providers and CASPs to collect, verify where required, transmit and screen information on the originator and beneficiary. For crypto-asset transfers, the EU approach applies broadly and is not limited to transfers above a minimum threshold.

For CASPs, TFR is not just a data-sharing requirement. It affects onboarding, wallet screening, counterparty CASP due diligence, transaction monitoring, sanctions controls, Travel Rule vendor selection, exception handling, escalation workflows, record keeping and evidence of implementation.

What it is

The first federal framework for permitted payment stablecoin issuers in the United States, replacing a fragmented state-led approach with a national regime for payment stablecoin issuance.

The GENIUS Act establishes authorisation pathways for payment stablecoin issuers, with the relevant supervisor depending on the type of issuer and the scale of operations. It sets requirements around 1:1 reserves, redemption rights, governance, compliance, BSA/AML programmes and token-level freeze capability.

Compared with MiCAR, one notable feature is the pathway for foreign payment stablecoin issuers to register or operate in the United States, subject to applicable requirements and supervisory expectations. The framework is expected to reshape how banks, non-bank issuers, foreign issuers and stablecoin infrastructure providers approach U.S. market access.

What it is

For years, UK crypto regulation was fragmented across the Money Laundering Regulations, financial promotions, Travel Rule implementation, and wider developments in private and property law. Cryptoasset businesses were generally brought into the FCA’s remit through AML registration and financial promotion rules, rather than a bespoke full-scope regime.

That is changing. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring a broad range of cryptoasset activities into the FCA’s regulatory perimeter for the first time. The regime moves beyond AML and financial promotions into authorisation, prudential requirements, conduct, stablecoin issuance, admissions and disclosures, market abuse, operational resilience and wider FCA Handbook standards.

From 25 October 2027, firms carrying on regulated cryptoasset activities will need the relevant FCA permissions. Firms planning to operate in the UK will need to prepare early, including assessing perimeter, permissions, governance, capital, controls, disclosures, safeguarding, operational resilience and Consumer Duty expectations. The FCA says the new regime is expected to come into force on 25 October 2027, with applications for authorisation open from 30 September 2026 to 28 February 2027.

What it is

AMLA is the EU’s new central authority for anti-money laundering and countering the financing of terrorism, established under Regulation (EU) 2024/1620 and headquartered in Frankfurt.

It is designed to make AML/CFT supervision more consistent across the EU by coordinating national supervisors, supporting cooperation between Financial Intelligence Units and directly supervising selected high-risk, cross-border obliged entities.

For firms, AMLA marks a shift from fragmented national supervision toward a more coordinated EU-level approach. The impact will be felt most by groups operating across multiple Member States, high-risk financial institutions and obliged entities with complex cross-border activity. Even firms not directly supervised by AMLA are likely to feel the effect through more consistent expectations, stronger supervisory convergence and increased focus on evidence, governance and control effectiveness.

What it is

The EU AML framework has historically been built around AML directives, which Member States had to transpose into national law. That approach created fragmentation across the EU, with differences in national implementation, supervisory expectations and compliance standards.

The AMLR changes that. Regulation (EU) 2024/1624 creates a directly applicable EU Single Rulebook for AML/CFT, replacing parts of the fragmented directive-based approach with harmonised rules across all 27 Member States.

The AMLR sets common standards for obliged entities, including customer due diligence, beneficial ownership transparency, internal controls, group-wide policies, outsourcing, high-risk relationships and ongoing monitoring. For firms operating across multiple EU markets, it is a major step toward more consistent AML/CFT expectations and supervision.

What it is

Hong Kong’s Stablecoins Ordinance establishes a dedicated licensing regime for fiat-referenced stablecoin issuers.

The regime applies to persons issuing fiat-referenced stablecoins in Hong Kong, issuing Hong Kong dollar-referenced stablecoins outside Hong Kong, or actively marketing relevant stablecoins to the Hong Kong public. Licensed issuers are subject to requirements around reserve backing, redemption, governance, risk management, AML/CFT and ongoing supervision.

The framework positions Hong Kong as one of the first major Asian financial centres with a bespoke stablecoin issuer regime. It is relevant for issuers, banks, payment firms, Web3 businesses and infrastructure providers assessing stablecoin issuance, distribution or market access in Hong Kong.

What it is

The UK MLRs form the core of the UK’s AML/CFT framework, setting requirements for firms in the regulated sector to assess financial crime risk, conduct customer due diligence, monitor activity, maintain controls and report suspicious activity.

For cryptoasset businesses, the MLRs have historically been the main route into FCA supervision, requiring cryptoasset exchange providers and custodian wallet providers to register for AML purposes. The 2026 amendments update that framework, including more proportionate risk-based requirements, enhanced due diligence for certain cryptoasset arrangements, trust registration changes and FCA breach notification obligations.

The MLRs remain a key part of the UK crypto compliance stack, even as the broader UK cryptoasset regime moves toward full authorisation in October 2027. Firms need to understand how AML registration, MLR obligations, Travel Rule implementation and the new cryptoasset perimeter interact.

What it is

DORA is the EU’s operational resilience framework for the financial sector, introduced as part of the EU Digital Finance Package alongside MiCAR.

It creates harmonised requirements for managing ICT and cyber risk across financial entities, including incident reporting, digital operational resilience testing, ICT risk management and third-party risk management. It also introduces direct EU-level oversight of critical ICT third-party providers.

For firms, DORA is not only a cybersecurity regulation. It affects governance, outsourcing, vendor management, contractual arrangements, incident response, resilience testing, board oversight and evidence of ICT risk controls across the business and technology stack.

What it is

The EU AI Act is the EU’s horizontal regulatory framework for artificial intelligence, establishing risk-based obligations for AI systems placed on the EU market or used in the EU.

It sets requirements across prohibited AI practices, general-purpose AI, high-risk AI systems, transparency obligations, governance, human oversight, data quality, technical documentation, conformity assessment and post-market monitoring.

For firms, the AI Act is not only a technology compliance exercise. It affects product design, governance, vendor oversight, model validation, documentation, customer impact, internal training and how AI-enabled systems are deployed across regulated and non-regulated environments.

What it is

The CLARITY Act is a U.S. federal market structure proposal for digital assets.

It is designed to create a clearer framework for digital asset markets by allocating oversight between the SEC and CFTC, setting guardrails for exchanges, brokers, dealers and intermediaries, and introducing consumer and investor protection requirements.

If enacted, the CLARITY Act would be a major step toward a federal digital asset market structure regime in the United States. It is intended to reduce regulatory uncertainty, support responsible innovation, address illicit finance and national security risks, and provide clearer rules for developers, issuers, platforms and market participants.

What it is

Australia’s Digital Assets Framework introduces a dedicated regulatory regime for digital asset platforms and tokenised custody platforms by amending the Corporations Act 2001 and the ASIC Act 2001.

The framework brings Digital Asset Platforms (DAPs) and Tokenised Custody Platforms (TCPs) within Australia’s financial services regime, requiring firms to obtain an Australian Financial Services Licence (AFSL), comply with conduct and consumer protection obligations, and meet new standards for custody, safeguarding, disclosures and governance. The reforms are intended to provide greater regulatory certainty while strengthening consumer protection and market integrity.

The regime marks Australia’s shift from relying primarily on existing financial services law to introducing a bespoke framework for digital asset businesses, with ASIC leading implementation through guidance, licensing and supervisory expectations.

What it is

eIDAS 2.0 updates the EU framework for electronic identification and trust services and introduces the European Digital Identity Wallet as its central feature.

Each Member State must make at least one EUDI Wallet available to citizens, residents and businesses. Wallets may be issued directly by the state, provided by a mandated entity or recognised where developed by an approved private-sector provider. Users will be able to identify themselves and securely store, present and share digital credentials across borders, including identity documents, professional qualifications, driving licences and other verified attributes.

For regulated firms, eIDAS 2.0 will affect digital onboarding, strong customer authentication, identity verification and credential-based customer journeys. Banks and other specified private-sector service providers will need to prepare to accept EUDI Wallets where strong user authentication is required, while ensuring that their systems, workflows and data practices support secure and privacy-preserving verification.

What it is

DAC8 extends the EU’s tax transparency framework to crypto-assets and implements the OECD Crypto-Asset Reporting Framework within EU law.

It requires Reporting Crypto-Asset Service Providers to collect tax residence and identification information, including Tax Identification Numbers, and report relevant transactions involving EU-resident users. National tax authorities will then exchange that information automatically with the Member State in which the user is tax resident.

The regime covers a broad range of crypto-assets and transactions, including exchanges between crypto-assets and fiat currency, exchanges between crypto-assets, transfers and certain retail payment transactions. Its scope can also extend to non-EU providers serving EU-resident users, requiring them to register in a Member State unless an exemption applies.

What it is

The EU DLT Pilot Regime is a controlled regulatory framework under Regulation (EU) 2022/858 for testing the trading and settlement of financial instruments using distributed ledger technology.

It allows authorised market infrastructures to operate DLT multilateral trading facilities, DLT settlement systems, or combined DLT trading and settlement systems. Operators may receive limited exemptions from parts of MiFID II, MiFIR and CSDR where necessary for their DLT model, subject to safeguards for investor protection, market integrity and financial stability.

The regime applies to tokenised financial instruments such as shares, bonds and fund units, rather than crypto-assets governed by MiCAR. It provides a route for regulated institutions and market infrastructure providers to test tokenised capital-markets models, although limited uptake and restrictive thresholds have prompted proposals to broaden and make the framework more permanent.

What it is

PSD3 and the PSR modernise the EU payment services framework, replacing much of PSD2 with a revised directive and a directly applicable regulation.

PSD3 will govern the authorisation and supervision of payment institutions and electronic money institutions, while the PSR will establish harmonised conduct requirements for payment services across the EU. The package is intended to reduce payment fraud, improve consumer protection, increase fee transparency, strengthen open banking and create a more consistent framework for banks, payment institutions, fintechs and other payment service providers.

The framework also responds to new payment models and the interaction between payments and digital assets. Firms will need to assess changes to authorisation, safeguarding, fraud prevention, strong customer authentication, account access, customer communications and liability arrangements. The final compromise also addresses the treatment of certain payment transactions involving e-money tokens, creating an important link between the payment services framework and MiCAR.

What it is

FiDA is the EU’s proposed open finance framework, extending customer-controlled data sharing beyond payment accounts to a wider range of financial products and services.

The proposed regulation would establish rights and obligations for financial institutions, insurers, investment firms, pension providers and authorised financial information service providers that hold, access or use customer data. Customers would be able to permit their data to be shared through secure interfaces, enabling new services across lending, savings, investments, insurance and personal financial management.

FiDA moves the EU from open banking toward open finance. It will require firms to consider consent management, data-access permissions, API infrastructure, compensation arrangements, data security and participation in financial data-sharing schemes. It is also likely to affect how financial data is used in AI-enabled products, customer analytics and personalised financial services.

What it is

NIS2 is the EU’s cybersecurity framework for essential and important entities operating across critical sectors.

It expands the scope of the original NIS Directive to 18 sectors, including digital infrastructure, ICT service management, financial market infrastructure, energy, transport, health, manufacturing, public administration and certain digital service providers. It introduces requirements covering cybersecurity risk management, incident reporting, business continuity, supply-chain security and management-body accountability.

For financial entities, NIS2 must be read alongside DORA. DORA generally operates as the sector-specific framework for financial-sector ICT risk, while NIS2 may remain relevant to other activities, group entities, technology providers and infrastructure falling outside DORA’s scope. Firms therefore need to determine which entities and services fall under each regime rather than treating them as interchangeable.

What it is

Brazil’s Central Bank has introduced a comprehensive regulatory framework for virtual asset service providers through BCB Resolutions 519, 520 and 521.

Resolution 519 establishes the authorisation process for companies seeking to provide virtual asset services. Resolution 520 governs the operation of VASPs, including permitted activities, governance, risk management, client asset segregation, AML/CFT controls, monitoring and information-sharing requirements. Resolution 521 brings specified virtual asset transactions within Brazil’s foreign-exchange framework, including certain cross-border payments, fiat-referenced virtual asset transactions and transfers involving self-hosted wallets.

The framework marks Brazil’s move from a principles-based regime to direct prudential and conduct supervision by the Banco Central do Brasil. Existing providers must assess their authorisation path, operating model, capital and governance arrangements, customer asset controls, AML/CFT framework and reporting obligations. Firms using virtual assets for international payments must also consider how their activity is treated under the foreign-exchange rules.

What it is

Singapore regulates digital token activities through a combination of the Payment Services Act and the Financial Services and Markets Act, with the Monetary Authority of Singapore serving as the principal regulator.

The Payment Services Act governs Digital Payment Token services provided in Singapore, including dealing in or facilitating the exchange of DPTs and facilitating their transmission. Licensed providers are subject to requirements covering AML/CFT, safeguarding of customer assets, conduct, technology risk, disclosures and consumer protection. Amendments that took effect in 2024 expanded the regulated scope to include additional activities such as custodial services and certain transfers or exchanges where the provider does not take possession of the assets.

The Financial Services and Markets Act separately regulates Singapore-established Digital Token Service Providers that provide services solely to customers outside Singapore. From June 2025, such providers require an MAS licence, with licensing expected to be granted only in limited circumstances and no transitional arrangement for firms already carrying on the activity. The regime includes AML/CFT, conduct, disclosure, governance and financial requirements.

Singapore has also finalised a framework for single-currency stablecoins issued in Singapore and pegged to the Singapore dollar or a G10 currency. Issuers seeking recognition as MAS-regulated stablecoins must meet requirements relating to reserve assets, capital, redemption at par and disclosures.

What it is

Hong Kong regulates virtual asset trading platforms through a mandatory licensing regime administered by the Securities and Futures Commission under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

The regime applies to centralised virtual asset trading platforms carrying on business in Hong Kong or actively marketing their services to Hong Kong investors. Licensed platforms must meet requirements covering governance, custody, client asset protection, token admission, market surveillance, conflicts of interest, AML/CFT, cybersecurity and investor protection.

Hong Kong is continuing to expand the framework beyond trading platforms. The SFC’s ASPIRe roadmap focuses on access, safeguards, products, infrastructure and regulatory relationships, while further regimes are being developed for virtual asset dealing and custody. The SFC has also introduced measures covering staking, financing, market making, new product offerings and access to global liquidity.