Market entry into the EU in 2026: MiCA and PSD3/PSR as the new regulatory framework for FinTech and Crypto

Author: NEXORA Unternehmensberatung GmbH Date: January 2026 Reading time: approx. 9 minutes

In brief

• In 2026, many EU countries will become a practical “filter”: Without a CASP license according to MiCA, it will become increasingly difficult to offer crypto services for most commercially relevant business models.

• The PSD3/PSR package is in the formal adoption phase after a political agreement: Payment FinTechs should already be considering the new requirements in product design and IT architecture.

• Austria remains an attractive jurisdiction for FinTech/Crypto, but the FMA's expectations for substance (actual presence) and governance (corporate management and controls) are increasing noticeably.

• The “wait until the deadline” strategy will become a regulatory, reputational and business risk in many constellations in 2026 – especially for B2B and white label models.

What changes are coming in 2026?

The EU will enter 2026 with a largely complete set of regulations for crypto assets and payment transactions. For new market participants, this means higher barriers to entry, but also significantly more legal certainty and predictability. Austria is positioning itself as a potential hub – with clear FMA supervision, proven procedures and EU-wide market access via passporting mechanisms.

Typical companies addressed include crypto exchanges, brokers, wallet/custody providers, payment gateways, banking-as-a-service platforms and hybrid business models (crypto + fiat).

1. MiCA: Why 2026 will become a “filter” for CASPs

MiCA (Markets in Crypto-Assets Regulation) introduces a uniform license for Crypto-Asset Service Providers (CASP) with EU-wide passporting.

Important timeline aspects:

• The main regime for CASPs has been in effect since December 30, 2024.

• Certain categories of stablecoin issuers have been subject to MiCA since June 2024.

Affected: Anyone who professionally provides services with crypto assets – such as exchange, custody, order execution, brokerage, operation of trading platforms, placement of tokens or similar services.

Practical consequence: Even models such as “we only manage keys” or “we only execute orders” are becoming increasingly difficult to reconcile with supervisory practice and market expectations if there is no CASP authorization.

Regarding transitional arrangements (grandfathering): MiCA provides for transitional arrangements for providers who were already registered as VASPs under national AML regimes before MiCA was fully applied. The duration of the transitional period is determined by the member states (up to 18 months after full application of MiCA); accordingly, the actual deadlines vary between 2025 and 2026 depending on the jurisdiction. In some countries, the use of the transitional regime is also linked to the submission of a complete CASP application within a specific period.

For new players, this means that the EU market is developing towards a “licensed club” – in the medium to long term, a sustainable crypto business without CASP status will only be conceivable in very limited niches.

2. PSD3/PSR: The next level for payment institutions

The package of PSD3 and Payment Services Regulation (PSR) is the further development of PSD2. It brings the e-money regime closer to the payment transaction regime, specifies rules of conduct and strengthens consumer protection.

Status on January 29, 2026: The political agreement between the European Parliament and the Council was reached at the end of 2025. The formal adoption of the final texts is expected for 2026; this will be followed by a transitional period, the exact duration and structure of which will depend on the final version.

Key points:

• Alignment of e-money and payment transactions: E-money issuers are moving towards uniform authorization, capital and governance requirements with payment institutions.

• PSR as a directly applicable regulation: A large part of the rules of conduct, transparency obligations, SCA requirements, fraud controls and open banking obligations will apply directly throughout the EU – with fewer national deviations.

• Strengthening Verification of Payee and Open Banking: Extended API access requirements, clearer liability rules for fraudulent transactions and designed compensation mechanisms for customers.

• Synergy with MiCA: The drafts discuss simplifying or optimizing authorization if actors are already licensed as CASPs and want to add additional payment services; however, the specific conditions depend on the final text.

Conclusion for product and business design: Payment transaction or hybrid models (crypto + fiat, account-to-account solutions, embedded payments) should be designed as if PSD3/PSR is already “around the corner”. Anyone who only optimizes for PSD2 today risks costly conversions within the next 12–24 months.

3. Austria as a hub: Licensing and substance requirements

The Austrian FMA has been maintaining a VASP register for several years and is now gradually switching to the MiCA regime by preparing CASP procedures and national specifications. The central signal to the market: Companies that want to operate from Austria in 2025–2026 should expect a fully-fledged CASP authorization – not a “minimalist” AML registration.

3.1 Licensing options

• CASP under MiCA with EU-wide passporting (exchange, custody, brokerage, trading platforms, token placement, etc.).

• Payment institution/e-money license (taking into account the future PSD3/PSR framework) for classic payment transaction and open banking models.

• Combination model (CASP + payment institution in one group) with a well-thought-out governance, risk management and AML framework – especially for companies that integrate crypto and fiat flows.

Early decisions about the target license and group configuration save later conversion needs.

3.2 Substance: What is being checked

MiCA and the future PSD3/PSR place particular emphasis on actual presence in the licensing state. The FMA focuses on, among other things:

• Managing directors who factually manage the business from Austria – no purely “letterbox” constructions.

• Appropriately designed compliance, AML officer, risk management and internal audit functions that are clearly described in business programs and guidelines.

• IT and security processes that meet the expectations of operational resilience and digital risks (including consideration of DORA for financial institutions).

In practice, the FMA recommends an early dialogue to coordinate expectations, the scope of documentation and timelines and to avoid “nasty surprises” in the actual approval process.

3.3 Practical roadmap for FMA interaction

• Pre-assessment: Initial analysis of the business model – which services fall under MiCA/PSD3, what type of license is realistic and makes sense.

• Initial contact with the FMA: Brief description of the model, initial questions about substance, governance and planned structures (possibly informal feedback).

• Package preparation: Business program, IT/security description, AML policy, risk framework, financial plan, group structure, organization and function matrix.

• Application: Formal CASP/payment transaction application including answering questions from the regulator and possible model fine-tuning.

• Operational start: Implementation of the approved structure, establishment of reporting systems, internal controls and a clear update and review cycle of the guidelines.

Companies that do not yet have a clear licensing strategy should at least carry out a structured options check in the next few months – for example, together with specialized consulting or legal partners.

4. “Wait or act?”: Why the waiting strategy is becoming risky

In the years 2024–2025, the transitional arrangements initially seemed attractive: VASPs were able to continue their activities under national frameworks and prepare for the CASP license in parallel. In 2026, however, “waiting until the last moment” will increasingly become a bet against supervisory practice and market development in many constellations.

Why the risk is increasing:

• Different deadlines between countries: The duration of the transitional periods varies; in some jurisdictions, a complete application had to be submitted within a short period to maintain the transitional regime. Anyone who misses these deadlines loses the protective shield.

• Stricter supervision of “light” VASP models: Minimalist AML registrations without visible progress towards MiCA increase the risk of orders, restrictions or orderly cessation of business.

• Risk of market loss: The first CASPs gain the trust of banks, institutional clients and partners – especially in the B2B and white label segment. Late applicants run the risk of missing important cooperation windows.

• Loss of potential synergies with PSD3/PSR: If MiCA licensing is postponed, future simplifications when adding payment services (if they are provided for in the final PSD3/PSR text) can hardly be used.

The question in 2026 is therefore no longer “Do we need a license?”, but “How quickly and in which jurisdiction do we approach it?” – and which options we are already closing off today by doing nothing.

Checklist for 30/60/90 days (The following steps are deliberately generic and must be adapted to the specific business model and the respective legal situation.)

• 30 days: Service mapping (MiCA/PSD3), definition of target countries, initial gap analysis of the guidelines (AML, risk, IT/security), fundamental decision on the licensing path.

• 60 days: Design of the substance structure (managing directors, key functions), drafts of the most important guidelines and business programs, preparation of a preliminary regulator contact.

• 90 days: Finalization of the document package, establishment of internal control procedures, organizational and content readiness for formal submission or pre-submission.

5. Central conclusions

• MiCA increases the predictability of the market for crypto services in the EU, but closes the space for semi-regulated models: Without a CASP license, a sustainable EU business will hardly be possible for most business models in the long term.

• PSD3/PSR form the next level for payment transactions and open banking. New applications should already reflect these rules today in order to avoid duplication of work and later conversions.

• Austria can be a strong hub for FinTech/Crypto, but the FMA expects real presence, mature governance structures and an early, transparent dialogue – no “letterbox” constructions.

• 2026 is therefore less a question of “Whether we need a license”, but “How quickly and from which location we implement our licensing and transformation strategy”.

Disclaimer: This text is for informational purposes only and does not constitute individual legal or investment advice. Separate professional advice is required for the specific structuring of the business model and the choice of jurisdiction.

Nexora Unternehmensberatung GmbH Strategic Consulting | Regulatory Compliance | Digitalization Vienna, Austria | www.nexora-consulting.at