Crypto Casino MiCA Compliance 2026: CASP Rules, Travel Rule, AML
What MiCA, the Transfer of Funds Regulation and the 2027 AML Regulation mean for a casino that takes crypto from EU players: CASP partners, custody, stablecoins, travel rule data, penalties and the deadlines still ahead.
Since 30 December 2024 the Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) has applied in full across the EU, and on 1 July 2026 the last national grandfathering window under Article 143 closed. The stablecoin titles had already been live since 30 June 2024, and the recast Transfer of Funds Regulation (EU) 2023/1113 has attached originator and beneficiary data to every crypto transfer handled by an EU provider since the same 30 December 2024 date. For a casino that takes Bitcoin, Ethereum or USDT from players in the EU, that means the crypto side of the business now runs on the same authorisation logic as a payment institution, whether the casino holds a CASP licence itself or rents one from a partner. The gambling licence didn't change. Everything around the wallet did.
Key facts
- 30 June 2024: MiCA Titles III and IV took effect, so any euro- or dollar-pegged stablecoin offered in the EU needs an authorised issuer (EMT) or an approved white paper (ART).
- 30 December 2024: the rest of MiCA and the recast Transfer of Funds Regulation started to apply; crypto-asset service providers (CASPs) need authorisation, and the travel rule covers crypto transfers with no minimum amount.
- 1 July 2026: the end of the maximum 18-month transitional period under Article 143(3); France used the full window, Germany stopped at 30 December 2025 and the Netherlands at 30 June 2025.
- EUR 50,000 to 150,000: minimum own funds for a CASP by service class under Annex IV, or one quarter of the previous year's fixed overheads if that's higher.
- 10 July 2027: the new Anti-Money Laundering Regulation (EU) 2024/1624 starts to apply to obliged entities, including gambling operators and CASPs, with anonymous crypto accounts banned outright.
What MiCA regulates, and what it leaves to national law
MiCA covers three things: public offers of crypto-assets, issuers of stablecoins, and anyone providing crypto-asset services to clients in the EU. The service list in Article 3 is where a casino intersects with it: custody and administration of crypto-assets on behalf of clients, exchange of crypto-assets for funds or other crypto-assets, transfer services on behalf of clients, and operating a trading platform. Do any of those for EU clients as a business and you're a CASP that needs authorisation under Article 59, or you're a bank or e-money institution that notified its home regulator under Article 60.
What MiCA doesn't do is regulate gambling. There's no EU gambling directive, the Services Directive excludes games of chance, and the Court of Justice has repeatedly upheld the right of each member state to run its own licensing regime. So a crypto casino in 2026 lives under two separate rulebooks: a national gambling licence (MGA, ADM, DGOJ, KSA, GGL, or an offshore licence if the operator stays outside the regulated markets) and a MiCA authorisation for whoever touches the crypto. Having one has never exempted anyone from the other.
The practical line runs through the wallet. A casino that shows a deposit address, holds player balances in crypto and pays out in crypto is providing custody and transfer services. A casino that lets a licensed partner accept the coins, convert them to euros at the moment of deposit and hold the fiat is buying a service from a CASP and stays on the gambling side of the line. Most mid-market operators tracked by iGamingHub moved to the second model for EU traffic during 2025 and 2026, because the first one costs a licence.
What it means for a casino that accepts crypto
CASP partner status. The partner must be on ESMA's interim register of authorised CASPs, or be an EU credit or e-money institution that notified under Article 60. A national VASP registration from 2023 stopped being enough on the transitional deadline in that country. Ask for the authorisation number, the home competent authority and the list of services actually authorised; a provider authorised for exchange only can't hold your players' crypto in custody. The passport under Article 65 lets one authorisation cover all 27 member states, which is why the well-known on-ramps picked a single home regulator (Luxembourg, Ireland, the Netherlands, Malta, Austria) during 2025 rather than registering everywhere.
Custody. If the casino or its partner holds crypto for players, Article 75 applies: a written custody agreement, client assets segregated from the provider's own, a register of positions, and liability for loss of crypto-assets caused by an ICT incident or a hack unless the provider can show the event was outside its control. That liability is why custody carries the higher own-funds requirement and why several white-label suppliers now quote crypto as "fiat-settled via partner" rather than on-chain balances.
Stablecoins. Since 30 June 2024 an e-money token needs an EU-authorised issuer, and ESMA asked CASPs to stop offering non-compliant tokens by the end of March 2025. Circle obtained an e-money institution licence in France in July 2024, so USDC and EURC are usable; Tether didn't seek authorisation and USDT was delisted from the EU-facing exchanges in the first quarter of 2025. A casino that accepted USDT as its main deposit rail in 2024 now converts it off-exchange through a non-EU partner or doesn't take it from EU players at all.
Travel rule data. The recast TFR has no EUR 1,000 de minimis for crypto. Every transfer handled by a CASP carries the originator's name, distributed-ledger address or account number, and either an address, an ID document number, a customer number or a date and place of birth, plus the beneficiary's name and address. The EUR 1,000 figure people remember is the self-hosted wallet threshold in Article 14(5): above it, the CASP has to take steps to confirm the customer actually controls that wallet, typically by a signed message or a micro-transaction. For a casino that means the exchange account and the casino account must belong to the same verified person, and a withdrawal to an unverified MetaMask address over EUR 1,000 needs ownership proof first. The KYC record becomes the source of truth for both rulebooks.
On the platform side, 25 of the 44 platforms in the iGamingHub catalog flag crypto support. SOFTSWISS lists 300 payment methods and 25 licences and certifications, MGA, Curacao and Kahnawake among them. EveryMatrix (180 methods, MGA, Curacao and Denmark among its licences) and BetConstruct (500 methods, MGA and UKGC) both run crypto through a payment partner layer rather than native custody, which is the configuration that keeps the operator outside CASP scope. Hub88 covers the Curacao and Anjouan end of the market where native crypto balances are still common. If you're still choosing, the crypto casino launch guide walks through the partner questions before you sign.
Wallet providers are consolidating
The number of crypto payment providers that serve casinos didn't grow after MiCA; it shrank. Getting a CASP authorisation took the well-capitalised exchanges six to twelve months of preparation in 2024 and 2025. Coinbase (Luxembourg), Kraken (Ireland), OKX and Crypto.com (Malta), Bybit (Austria) and MoonPay (Netherlands) all announced MiCA authorisations during 2025. Smaller gambling-focused crypto PSPs faced the same own-funds, DORA and governance requirements with a fraction of the revenue, and several of them either moved the EU business under an authorised partner or stopped onboarding EU merchants. The exact count on ESMA's register in September 2026 is pending confirmation, but the direction is clear: fewer, larger, better-supervised intermediaries.
For an operator the consequence is pricing and dependency. The crypto rail now looks like high-risk acquiring: a small number of authorised partners, 1-3% processing, reserves, and merchant onboarding that asks for the gambling licence, the AML policy and the UBO chart. The merchant of record question also moves onto the crypto side, because whoever converts the coins to euros is the party the player's bank and the FIU see.
AML: the 2027 Regulation replaces the directives
MiCA didn't rewrite AML rules; it made CASPs obliged entities under the existing Fourth and Fifth AML Directives from 30 December 2024. The bigger change is still ahead. The Anti-Money Laundering Regulation (EU) 2024/1624 is directly applicable law, no national transposition, and it starts to apply on 10 July 2027. Gambling service providers stay obliged entities, CASPs are listed explicitly, and Article 79 bans anonymous crypto accounts and accounts using anonymity-enhancing coins. It also feeds the new Anti-Money Laundering Authority (AMLA) in Frankfurt, created by Regulation (EU) 2024/1620, which started work in July 2025 and takes over direct supervision of the riskiest cross-border entities, CASPs included, from 2028.
For a crypto casino the effect is that AML obligations on the gambling licence and on the CASP partner converge on one set of rules in July 2027. Transaction monitoring has to cover on-chain data (source of funds, mixer exposure, sanctions screening of counterparty addresses) as well as the usual deposit-to-wager ratios, and regulators want the model behind the alerts documented. The explainable AI in compliance explainer covers what "explain the decision" means in practice for automated risk scoring.
The non-EU angle: Curacao and Anjouan casinos with EU players
MiCA applies to crypto-asset services provided in the Union. A casino licensed in Curacao or Anjouan that holds crypto balances for EU residents is, on the text of Article 59, providing custody and transfer services without authorisation, and the reverse solicitation exemption in Article 61 is narrow: ESMA's guidelines make clear that a website in English with EU-facing bonuses is solicitation. In practice enforcement has so far come indirectly. National gambling regulators (the Dutch KSA, Germany's GGL, Italy's ADM) run blocklists and payment-blocking orders, and EU-authorised CASPs treat unregistered casino addresses as high-risk counterparties, so player deposits from a Kraken or Bitpanda account to an offshore casino get flagged, delayed or refused under the travel rule.
That's the real mechanism: the offshore casino isn't fined by ESMA, but its EU players lose their on-ramp. Operators that count on Curacao plus a crypto wallet as an EU strategy should read the offshore licensing comparison with that in mind, and treat provably fair mechanics as a product feature, not a substitute for a licensed deposit path.
Key numbers
| Rule | Date | Threshold or amount | Penalty or consequence |
|---|---|---|---|
| MiCA Titles III-IV (ARTs, EMTs) | 30 June 2024 | Authorised issuer required for EMTs; non-compliant tokens withdrawn by 31 March 2025 | Delisting; issuer fines under Article 111 |
| MiCA Title V (CASP authorisation) | 30 December 2024 | Own funds EUR 50,000 (class 1), EUR 125,000 (class 2: custody, exchange), EUR 150,000 (class 3: trading platform), or 25% of fixed overheads | Fines of at least EUR 5 million or 3% of annual turnover for legal persons, EUR 700,000 for individuals (Article 111, pending re-check of the tier) |
| Article 143 transitional period | Up to 1 July 2026 | Max 18 months; NL 6 months, DE 12 months, FR 18 months | Operating without authorisation after the national deadline |
| Transfer of Funds Regulation 2023/1113 | 30 December 2024 | No de minimis; self-hosted wallet ownership check above EUR 1,000 | Transfer rejected or held; AML sanctions on the CASP |
| DORA 2022/2554 | 17 January 2025 | ICT risk framework, incident reporting, third-party register | Supervisory measures; loss liability under MiCA Article 75 |
| AMLR 2024/1624 | 10 July 2027 | Anonymous crypto accounts banned; EUR 10,000 cash cap | Fines of at least EUR 10 million or 10% of turnover for serious breaches |
| AMLA direct supervision | 2028 | Selected high-risk cross-border entities, CASPs included | Direct EU-level supervision |
| CASP authorisation decision | Rolling | 25 working days completeness check, 40 working days decision | Extension of up to 20 working days if the file is incomplete |
Milestones ahead
- 10 July 2027: AMLR applies. Casino and CASP AML programmes should be aligned to the Regulation, not to the national transpositions of the directives, by early 2027.
- 2027 into 2028: AMLA picks the entities it will supervise directly; the largest EU-facing crypto on-ramps expect to be on the first list.
- MiCA review: the Commission's review reports under Article 140 are due from 30 June 2027 and may extend the scope to lending, staking and decentralised protocols, which matters for casinos offering on-chain yield or token loyalty.
- Pending: the number of authorised CASPs on ESMA's register and whether any national authority has opened a MiCA case against a gambling operator. iGamingHub will update this piece when either figure is public.
- Your own deadline: if an EU-facing brand still settles player balances through a non-authorised wallet provider, the move to an authorised partner or a fiat-settled model is overdue; every month past 1 July 2026 is exposure.
Primary sources
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), EUR-Lex: Articles 3, 59-65, 75, 111, 143 and Annex IV.
- Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, EUR-Lex: Articles 14-22 on crypto transfers and self-hosted addresses.
- Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering (AMLR), EUR-Lex: obliged entities and Article 79.
- Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority, EUR-Lex.
- ESMA: Markets in Crypto-Assets Regulation: interim CASP register, Article 61 reverse solicitation guidelines, stablecoin statements.
- AMLA, the EU Anti-Money Laundering Authority.
- European Banking Authority: guidelines on ART and EMT issuers and on travel rule implementation.