The European Union’s crypto regulatory framework is entering a decisive enforcement phase. As the MiCA moves from authorisation into supervision, CASPs operating EMT activities face increasing scrutiny where crypto services intersect with traditional payments regulation under the PSD2.
Recent guidance issued by the EBA confirms what many firms had anticipated: MiCA authorisation does not automatically replace PSD2 licensing obligations. With the supervisory grace period ending on 2 March 2026, CASPs across the European Union must now ensure that EMT-related payment activities meet both regulatory regimes.
For firms operating in Malta and other EU financial centres positioning themselves as MiCA hubs, the coming months represent a critical compliance milestone.
Why EMTs Trigger PSD2 Requirements
MiCA introduced a harmonised framework governing crypto asset issuance and service provision across Member States. However, EMTs crypto assets designed to maintain stable value by referencing a single official currency can function similarly to electronic money and payment instruments.
Where EMT activities meet the legal definition of payment services, PSD2 requirements apply alongside MiCA obligations.
Recognising industry uncertainty, the EBA issued a No Action Letter in June 2025 clarifying two important points. Certain EMT transactions fall outside PSD2 scope and therefore do not require additional authorisation. Others clearly qualify as payment services and trigger licensing requirements under payments law.
To allow firms time to adapt, national regulators were advised to deprioritise enforcement temporarily. That supervisory flexibility expires on 2 March 2026.
The EBA’s February 2026 Opinion: A Clear Supervisory Message
On 12 February 2026, the EBA published further guidance setting out how national competent authorities should supervise CASPs once the grace period ends. The Opinion removes remaining ambiguity.
CASPs engaging in EMT activities that qualify as payment services must either obtain PSD2 authorisation, operate through a licensed payment service provider, or cease non-compliant services.
The transition period has therefore shifted from interpretation to enforcement readiness.
What Happens After 2 March 2026
The EBA outlines three supervisory outcomes depending on a firm’s regulatory position.
CASPs that secure PSD2 authorisation may continue EMT-related payment activities without interruption. Authorisation may be obtained directly or through structured partnerships with authorised payment institutions. For these firms, regulatory certainty strengthens operational continuity and market credibility.
In Malta, several CASPs have already submitted applications under the Financial Institutions Act and are expected to obtain licences ahead of the deadline. Early applicants may benefit from stronger institutional trust as counterparties increasingly favour regulated operators.
Firms that have submitted PSD2 applications but have not yet received approval fall into a transitional supervisory category. Regulators may allow temporary continuation where applications are credible, supervisory engagement remains transparent and there are no significant regulatory concerns.
However, this flexibility is limited. Firms awaiting approval are expected to suspend marketing of EMT payment services and refrain from onboarding new clients. Supervisory tolerance is therefore designed to prevent commercial expansion while authorisation remains pending.
CASPs that have not applied for PSD2 authorisation and are not operating through authorised partners face the strictest outcome. National authorities are advised to require cessation of EMT-related payment services from 2 March 2026.
What About Virtual Asset Service Providers (“VASPs”) Still Awaiting MiCA Authorisation?
VASPs operating under transitional arrangements also face regulatory deadlines.
According to the EBA, VASPs may continue EMT-related payment activities until the earlier of two dates: the end of the MiCA grandfathering period on 1 July 2026 or the approval or refusal of their MiCA application.
In practice, firms impacted by both frameworks are increasingly expected to pursue MiCA and PSD2 authorisation simultaneously. Sequential licensing strategies risk operational disruption as supervisory coordination increases across Member States.
Regulatory Integration Ahead of Third Payment Services Directive (“PSD3”)
The EBA’s broader message reflects a structural shift in EU financial supervision. Crypto regulation is not replacing traditional financial services law but integrating with it.
Where EMTs function as payment instruments, PSD2 safeguarding requirements, governance expectations and operational resilience standards remain applicable. National regulators, including the Malta Financial Services Authority, are expected to apply coordinated supervision as the EU prepares for PSD3 and the forthcoming Payment Services Regulation.
Regulatory convergence between crypto markets and traditional finance is becoming the defining characteristic of the European digital asset ecosystem.
What CASPs Should Do Now
CASPs should reassess business models, customer transaction flows and operational structures to identify where EMT activities constitute payment services. Governance arrangements, safeguarding mechanisms and risk controls must align with PSD2 expectations as well as MiCA obligations.
Licensing strategy, supervisory engagement and operational readiness are rapidly becoming competitive differentiators within the EU market. Firms that delay preparation risk service disruption, enforcement action or reputational damage as supervisory tolerance ends.
How Promethean Supports MiCA and PSD2 Compliance
Promethean supports CASPs and VASPs navigating MiCA and PSD2 alignment through licensing strategy advisory, regulatory gap analysis and supervisory engagement preparation. By assisting firms with authorisation planning, governance structuring and operational readiness programmes, Promethean helps translate complex regulatory requirements into practical implementation strategies.
As the March 2026 deadline approaches and supervisory scrutiny increases across the EU, proactive preparation remains the most effective safeguard against operational disruption and licensing delays.
