What AMLA wants changed in MiCA, and the inventory a CASP can build now

On 7 October 2026, the EU Anti-Money Laundering Authority published its response to the European Commission's targeted consultation on the review of MiCA. The paper is dated 30 September, the day the consultation closed, and reads MiCA through an AML/CFT lens. It asks the Commission to revisit five areas: staking, lending and borrowing; DeFi arrangements; unauthorised stablecoins; asset-referenced token issuers that sit outside the AML rulebook; and the CASP passport.

Nothing in the paper changes a CASP's obligations today. The Commission's report under Article 140 MiCA is due by 30 June 2027 and may come with a legislative proposal. Several other dates are fixed regardless of the review: AMLA must begin its first selection of directly supervised entities by 1 July 2027, and the AMLR applies from 10 July 2027.

So why should an MLRO read it now? Because it is a map of where the EU's AML authority believes MiCA leaves money laundering risk uncovered, and two of its themes line up with the responses the EBA (24 September) and ESMA (30 September) filed in the same week. When three EU authorities point at the same gap, supervisory attention usually arrives before the legislation does.

1. Staking, lending and borrowing

MiCA's list of crypto-asset services (Article 3(1)(16)) has ten entries, and lending, borrowing and staking are not among them. Staking reaches MiCA indirectly, through the custody and administration service under Article 75, which covers only the custody element. AMLA points to the risks that custody leaves out: asset pooling, yield generation, temporary transfers of control and periods when clients cannot access their assets. It asks the Commission to consider dedicated requirements, possibly within the existing CASP framework, and additional management requirements for CASPs that act as gateways to DeFi lending and staking.

What to record now: for each staking or lending product, which authorisation it relies on, where client assets go once they leave custody, and who the counterparty or protocol is.

2. DeFi arrangements

MiCA addresses decentralisation only in Recital 22, which excludes services provided in a fully decentralised manner without an intermediary. AMLA's concern is evidential: claims of decentralisation often rest on self-assessment, so supervisors struggle to see who actually controls an arrangement. It names two places where control can sit, a concentration of governance tokens and the ability to pause or modify smart contracts, and asks for a legal definition of a DeFi arrangement with common criteria for effective control. It also suggests that CASPs giving access to arrangements where someone holds significant influence could be required to apply risk-mitigation measures.

ESMA goes further from a market angle, warning against "decentralisation washing" and proposing a new regulated service for CASPs that give clients access to DeFi.

What to record now: every protocol clients can reach through your interface, and for each one, who can pause or upgrade the contracts and how concentrated governance is.

3. Unauthorised stablecoins

The current position comes from January 2025: the Commission's answer in ESMA Q&A 2404 and ESMA's statement required trading platforms to stop listing non-compliant ARTs and EMTs, while leaving custody and transfer possible. AMLA backs the EBA and ESMA line and asks the Commission to ensure consistent treatment across the EEA, explicitly including tokens that continue to circulate or are intermediated by CASPs. It supports the request with the FATF's March 2026 report on stablecoins and unhosted wallets.

ESMA's ask is the most specific of the three: an express rule that a CASP may provide no licensable MiCA service at all for non-compliant ARTs or EMTs. If that lands, custody and transfer would no longer be safe ground.

What to record now: every token you hold or move for clients that may qualify as an ART or EMT without an authorised issuer, tested against the Q&A 2404 criteria.

4. ART issuers outside the AMLR

The AMLR lists obliged entities, and ART issuers are not among them unless they are credit institutions or also hold a CASP licence. AMLA's point is that a pure-play ART issuer can issue and redeem directly (holders have a permanent redemption right under Article 39 MiCA) without anyone applying CDD at either end. It proposes a staged review: first map the roles of CASPs, custodians and banks across issuance, distribution and redemption, then consider bringing such issuers into the AMLR or applying equivalent requirements.

What this means for CASPs: where you distribute an ART with the issuer's written consent, you may be the only obliged entity between issuer and holder. Your CDD is then the only CDD in the chain, and supervisors may start to treat it that way.

5. The passport notification

To passport under Article 65 MiCA, a CASP notifies its home authority of four things: the target Member States, the services, the start date and any non-MiCA activities. None of them says whether the CASP will serve a host state through an establishment or under the freedom to provide services, or whether it will use agents, distributors or infrastructure there. National authorities have told AMLA that they often cannot work out what a CASP actually does on their territory.

That distinction drives several AML rules. Under AMLD6, host supervisors are responsible for activity carried out through agents, distributors or other infrastructure in their territory (Article 38), and Member States may require a central contact point (Article 41). It also feeds AMLA's own direct supervision test: the six-Member-State count includes host states served under the freedom to provide services only where minimum activity thresholds, still to be fixed in RTS under Article 12(7) of the AMLA Regulation, are met. AMLA asks the Commission to add these information requirements to Level 1.

What to record now: for each host state, whether you operate through an establishment or under the freedom to provide services, and any agents, distributors or infrastructure located there.

Two further signals

AMLA also asks whether the crypto-asset account registers that Member States must build under Article 16 AMLD6 will capture wallet addresses. The register must include a unique account identifier and opening and closing dates, but it is unclear whether that identifier will map to the addresses blockchain analytics depends on. For a CASP, that is an open question about its own account data model.

Finally, AMLA supports the EBA in aligning MiCA's good repute assessment with other sectoral law, so that ML/TF information can be taken into account more fully when authorising issuers and assessing qualifying holdings.

The inventory, in one place

None of AMLA's asks requires a policy change today. What a CASP can do is assemble the facts each proposal would test, so that whatever the Commission proposes lands on records that already exist.

Record	Fields	Why it pays off before any amendment
Staking and lending products	Authorisation relied on, asset destination after custody, counterparty or protocol	Answers the first supervisory question on any yield product
DeFi access points	Protocols reachable, pause and upgrade rights, governance concentration	Supports EDD on DeFi-related flows today
Stablecoin exposure	Tokens held or moved, issuer, MiCA status, freeze capability	Needed for current Q&A 2404 compliance and for any stricter rule
ART distribution	ARTs offered with issuer consent, other obliged entities in the chain	Shows where your CDD is the only CDD
Host Member States	Establishment or FPS, agents, distributors, infrastructure	Feeds AMLD6 host supervision and the AMLA eligibility count
Account identifiers	What you would report as the account identifier and how it maps to addresses	Prepares for AMLD6 Article 16 registers

The host Member State record deserves priority. It matters under the current directive's central contact point rules, under AMLD6 on its own transposition timetable, and under AMLA's selection exercise, which runs on data as of 31 December 2026.

Where Avus fits

Regulatory status changes faster than monitoring logic usually does. In Avus, alert rules are written in natural language and grouped by customer type, so a change in how a token, product or market is treated becomes a rule change a compliance officer can read and sign off directly. Each case keeps the evidence and reasoning behind its decision, which means that when the rules move, a firm can still show why every past decision was right under the rules that applied at the time.

Sources

This article is for information only and does not constitute legal advice.