EBA No-Action Letter on MiCA and PSD2: Who Needs a License
Quick answer. In the EBA's view, yes: transferring e-money tokens for clients, and custody allowing third-party transfers, are payment services needing a PSD2 license or a licensed partner since March 2, 2026. Exchanging crypto-assets is not.
Video transcript
In the EBA's view, a CASP moving e-money tokens for clients provides a payment service. Since March 2, 2026, that needs a PSD2 license or licensed partner.
MiCA deems these tokens electronic money, so they are funds under PSD2. Client transfers and custody allowing third-party transfers are payment services. A custodial EMT wallet is a payment account. Exchanging crypto-assets is not.
Three details catch product teams. Purpose does not matter. Own-wallet transfers count, and so can custody pay-outs.
By the EBA's February 2026 follow-up, more than 100 CASPs had approached authorities or applied for payment licenses.
Licensed or partnered firms continue. Pending applicants may continue if four conditions hold, without marketing or new clients. Everyone else should stop and offboard those clients.
Once licensed, strong customer authentication and fraud reporting apply. Capital requirements stack, to 250,000 euros in the EBA's custody example. SEPA, safeguarding and open banking are deprioritized.
The EBA says EMT custody and transfers must be as secure as other payment services. Our reading: SCA follows the service map, custody pay-outs included.
The Payment Services Regulation should settle this. The Council has adopted its position and Parliament's second reading is pending. Until the PSR applies, the letter stands.
Guardian maps your activities to the licenses that reach them, with your counsel, and pentests your authentication and withdrawal flows. Read the full article or talk to Guardian.
MiCA deems e-money tokens (EMTs) to be electronic money (Article 48(2)). That makes them "funds" under PSD2.
So some CASP services are also payment services, and MiCA does not say which. The EBA's No Action letter of June 10, 2025 answered that for national authorities.
Its transition period ended on March 2, 2026. The law meant to settle the question, the Payment Services Regulation (PSR), is not in force yet.
This article explains the technical and security side of EBA/Op/2025/08 and EBA/OP/2026/01. It is not legal advice; confirm how it applies to you with counsel.
What the Letter Is
EBA/Op/2025/08 is a formal EBA Opinion, issued as a No Action letter under Article 9c of the EBA Regulation. The Commission asked for it on December 6, 2024.
It does not change the law. It advises national competent authorities (NCAs) which EMT services to treat as payment services, and which PSD2 rules to prioritize.
The EBA aimed to keep the services needing a second license to a minimum. It added that this was not because a MiCA license alone covers the risks.
The advice runs until the PSR applies and PSD3's transposition deadline passes, unless the EBA reassesses it sooner.
Which Services Count
| Service | EBA view |
|---|---|
| Transferring EMTs on behalf of clients | Payment service |
| Custody and administration of EMTs | Payment service, if it allows third-party transfers |
| Custodial wallet sending and receiving EMTs | Payment account |
| Exchanging crypto-assets for funds | Not a payment service |
| Exchanging crypto-assets for other crypto-assets | Not a payment service |
| Intermediating purchases of crypto-assets with EMTs | No PSD2 license needed |
| Transferring ARTs or other crypto-assets | Not funds; likely outside PSD2 |
Exchange falls outside because MiCA defines it as dealing "by using proprietary capital". The CASP is buyer or seller, not an intermediary.
Three points catch product teams:
- Purpose does not matter. The EBA rejected a request to exclude trading or investment transfers.
- Own-wallet transfers count. First-party EMT transfers "would still qualify as payment transactions" (paragraph 71).
- Custody pay-outs count. They can be payment transactions even if the wallet is not a payment account (EBA/OP/2026/01).
The March 2, 2026 Deadline
The letter gave CASPs until March 2, 2026 to hold a PSD2 license or partner with a licensed payment service provider (PSP).
After that date, NCAs should stop firms with neither from providing these services (paragraph 18).
The letter's executive summary says "until 1 March 2026". Paragraph 18 and the February 2026 opinion both say March 2.
On February 12, 2026, the EBA followed up with EBA/OP/2026/01. More than 100 CASPs had approached NCAs or applied for payment licenses.
It set out three scenarios:
| On March 2, 2026 | EBA advice to NCAs |
|---|---|
| Licensed as a payment or e-money institution, or partnered | Continue within that authorization |
| Applied, not yet authorized | May continue if four conditions hold |
| Not applied, or a condition fails | Cease these services and offboard clients |
The four conditions for pending applicants:
- The application is complete under PSD2 Article 5.
- The applicant answers NCA queries fully and quickly.
- No material supervisory measures or breaches under MiCA, AML or other EU law.
- The NCA expects approval "within a very short time frame".
Pending applicants allowed to continue should stop marketing these services and take no new clients for them.
For CASPs in a MiCA national transitional regime running to July 1, 2026, that time frame should not run past that date. It has now passed.
Which PSD2 Rules Apply
Once licensed, a CASP does not face all of PSD2 at once.
| PSD2 area | EBA advice to NCAs |
|---|---|
| Strong customer authentication (Articles 97, 98) | Apply; grace period ended March 2, 2026 |
| Fraud reporting (Article 96(6)) | Apply from March 2, 2026, selected data only |
| Initial capital and own funds | Apply cumulatively with MiCA |
| Charges information | Deprioritized where gas fees are unknown upfront |
| Maximum execution time | Deprioritized where unknown; give an estimate |
| Unique identifier (Article 88) | Deprioritized |
| SEPA Regulation | Deprioritized in full |
| Safeguarding (Article 10) | Deprioritized; MiCA Article 70 safekeeping applies |
| Open banking | Deprioritized |
Even with uncertain gas fees, users should see the applicable charges before they authorize a transfer.
Capital stacks. In the EBA's example, a firm offering custody (a class 2 CASP) and payment services needs EUR 125,000 under MiCA plus EUR 125,000 under PSD2.
That is EUR 250,000 in total.
The security side
The EBA's reasoning: EMT custody and transfers "need to be as secure as all other payment services subject to PSD2" (paragraph 44).
SCA applies when a customer accesses a custodial EMT wallet, and before an EMT transfer is initiated.
Fraud reports split EMT transactions by remote and non-remote initiation, with and without SCA. They add fraud losses per liability bearer.
Our reading: the service map above decides where SCA must sit. Every flow that moves EMTs for a client needs it, including custody pay-outs.
For factors, dynamic linking and test cases, see PSD2 Strong Customer Authentication for Crypto EMT Wallets.
Own License or Partner
MiCA Article 70(4) gives a CASP two routes to payment services: its own authorization, or a partnership with an authorized PSP.
- Own license: NCAs should reuse MiCA application information instead of requesting it again.
- Scope: the license should match the activities the applicant declares.
- Partner: for example, acting as an agent of an authorized PSP.
- Partner check: NCAs should assess whether the partner itself needs MiCA authorization (Article 59).
The EBA recommended no particular order for firms applying under both laws.
Our reading: with a partner, agree in writing who runs SCA, who files fraud data and who keeps the records behind both.
What the PSR Changes
The EBA asked lawmakers to settle the overlap in the PSD3 and PSR reform. That reform is close but not yet law.
- November 26, 2025: final political trilogue.
- October 29, 2026: Council adopted its first-reading position on the PSR.
- December 14, 2026: indicative plenary date for Parliament's second reading.
The PSR would mostly apply 21 months after entry into force. Until then, the No Action letter's advice stands.
What the agreed text says
The Council's PSR position, which reflects the deal with Parliament, treats EMTs as electronic money and as "funds" (recital 28). It also:
- Says CASP transfer services for EMTs "could qualify" as executing payment transactions (recital 28).
- Excludes EMT exchanges where the CASP deals in its own name, or matches buyers and sellers swapping EMTs for crypto-assets (Article 2(3)(j)).
- Keeps CASP transfers in scope where EMTs pay for goods or services (recital 29).
- Excludes EMT payments with no intermediary, such as between two self-hosted addresses (Article 2(3)(b)).
- Does not extend that exclusion to custodial wallet and self-hosted address transfers (recital 30).
Still open: Parliament's second-reading vote, publication in the Official Journal and the application date. For MiCA itself, see What Is MiCA?
How Guardian Helps
Guardian's Regulatory & Compliance readiness assessment maps your activities to the licenses that reach them, confirmed with your counsel.
It also writes the technical sections of an authorization file from the system as built.
Guardian's pentests for fintechs attack the flows that authenticate users, authorize actions and approve withdrawals, function by function.
Frequently Asked Questions
Does the EBA No Action letter still apply?
Yes. Only its transition period ended, on March 2, 2026. The advice runs until the PSR applies and PSD3's transposition deadline passes, unless the EBA reassesses it. Parliament has not yet held its second-reading vote on the PSR.
Is exchanging crypto for e-money tokens a payment service?
Not in the EBA's view. Exchanging crypto-assets for funds or other crypto-assets is not a payment service, and intermediating purchases of crypto-assets with EMTs needs no PSD2 license. The agreed PSR text also excludes these exchanges (Article 2(3)(j)).
What happened to CASPs without a payment license on March 2, 2026?
The EBA advised authorities to let pending applicants that meet four conditions continue, without marketing or new clients. CASPs that had not applied, or failed a condition, should stop the EMT payment services and offboard those clients.
Does the letter cover bitcoin or asset-referenced tokens?
No. The EBA says transfers of asset-referenced tokens and other crypto-assets are not transfers of funds, so they do not seem to be payment services under PSD2. The letter covers e-money tokens only.
Sources
- EBA: Opinion on the interplay between PSD2 and MiCA in relation to CASPs that transact EMTs, EBA/Op/2025/08 (June 10, 2025)
- EBA: Opinion on the supervisory priorities at the end of the transition period under the No Action letter, EBA/OP/2026/01 (February 12, 2026)
- EBA: The EBA advises national authorities on actions to take at the end of the transition period under its No Action letter (February 12, 2026)
- Council of the EU: Position of the Council at first reading on the Payment Services Regulation, 8543/1/26 REV 1 (November 4, 2026)
- Council of the EU: Draft statement of the Council's reasons on PSD3, 8535/26 ADD 1 (October 21, 2026)
- European Parliament Legislative Observatory: Payment services regulation, procedure 2023/0210(COD) (accessed November 6, 2026)
- Guardian: PSD2 Strong Customer Authentication for Crypto EMT Wallets
- Guardian: Fintech Security, Pentests and Managed Security
Secure the EMT flows PSD2 now reaches
Guardian tests the login, custody and transfer flows the EBA treats as payment services, and maps the evidence to each provision.