A consultation response, not a rule taking effect
The Authority for Anti-Money Laundering and Countering the Financing of Terrorism, known as AMLA, has set out priorities for the European Commission's review of the Markets in Crypto-Assets Regulation, or MiCA. Its official announcement was published on 7 October. The accompanying response document is dated 30 September 2026.
The distinction between publication and legal effect matters. AMLA is recommending how the framework could address money-laundering and terrorist-financing risks. The announcement does not amend MiCA, grant a licence, change a customer's eligibility or announce a new list of prohibited tokens.
The Commission's consultation is part of its assessment of the regulation's operation. Any subsequent proposal would have to follow the applicable legislative process. Retail users should therefore read the response as an indication of policy priorities, rather than a notice that their account conditions changed that day.
Staking and lending raise questions beyond custody
AMLA argues that staking, lending and borrowing are not regulated as standalone activities under MiCA. It also recognises that custody requirements can already apply to aspects of staking services. Describing the whole field as completely outside regulation would miss that distinction.
The authority asks the Commission to consider dedicated requirements reflecting the activities' particular risks. Its response discusses pooled assets, yield arrangements, temporary transfers of control and periods when customers cannot freely access their assets. It also considers providers that connect clients to decentralised services.
For users, the issue is the difference between a provider holding an asset and the additional activity performed with it. AMLA's recommendation would have the review examine those additional risks. It does not announce a new prohibition on staking or lending, and the document should not be read as a prediction of the final legislative outcome.
DeFi labels would face a closer look at control
Another part of the response concerns services described as decentralised. AMLA wants a clearer legal definition and common criteria for identifying whether a person or organisation effectively controls an arrangement.
The response points to governance power and the ability to pause or alter smart contracts as relevant examples. Its concern is that supervisors may otherwise reach different conclusions about similar arrangements. It also raises the role of regulated providers that facilitate customer access.
This is a question about actual influence and responsibility. A decentralised label alone does not answer it. Equally, the response does not declare every DeFi protocol a regulated intermediary or establish that every holder of a governance token operates a financial service.
Stablecoins and token issuers form separate issues
AMLA calls for consistent treatment of stablecoins whose issuers lack the relevant MiCA authorisation. It refers to existing requirements and asks for legal uncertainty around services involving such tokens to be addressed. This is not a fresh declaration that every stablecoin is unauthorised or that possession of a named token has become unlawful.
Separately, it asks the Commission to examine certain issuers of asset-referenced tokens. The question is whether issuance and redemption can take place without appropriate customer checks and transaction monitoring where no other covered intermediary performs those functions.
The distinction is important: one recommendation concerns treatment of non-authorised stablecoins; the other concerns how token-issuer structures interact with anti-money-laundering obligations. Combining them into a single claim of an immediate stablecoin ban would misrepresent the response.
Cross-border access depends on supervisory information
The final main area concerns crypto service providers operating across member states. AMLA wants authorities to receive clearer information about how those businesses serve customers in another jurisdiction, including whether they maintain an establishment or provide services across borders.
That information helps supervisors understand their responsibilities and a provider's operational presence. The recommendation does not cancel existing cross-border permissions. It identifies a reporting issue for the Commission to consider when reviewing the framework.
For retail readers, the immediate takeaway is limited but useful: the review could affect future provider requirements, while the response itself leaves current rules unchanged. A provider's legal entity, permission and product conditions remain the relevant starting points for checking access. Later legislative or supervisory decisions will need to be assessed on their own terms.
