Commission act C(2026) 6179: central contact points for crypto-asset service providers

On 8 September 2026 the European Commission adopted Delegated Regulation C(2026) 6179. It extends the regulatory technical standards on central contact points in Delegated Regulation (EU) 2018/1108, which currently covers only e-money issuers and payment service providers, to crypto-asset service providers. The existing rules for e-money and payment firms stay as they are.

The legal basis is Article 45(11) of the fourth Anti-Money Laundering Directive, Directive (EU) 2015/849. Regulation (EU) 2023/1113 on information accompanying transfers of funds and crypto-assets rewrote Article 45(9) of that Directive so that Member States may also ask CASPs established on their territory in forms other than a branch, with a head office in another Member State, to appoint a central contact point. The act is based on EBA draft standards, consulted on from 4 December 2024 to 4 February 2025. A CASP has its MiCA meaning, but firms that only give advice on crypto-assets are excluded.

A host Member State may require a CASP that has establishments on its territory other than a branch, and a head office elsewhere in the EU, to appoint a central contact point where any of three tests is met: it has 10 or more such establishments; the value of the services and activities carried out by those establishments is expected to exceed EUR 3 million in a financial year, or exceeded it in the previous one; or the firm does not give the host supervisor, on request and in time, the information needed to apply the first two tests.

Host States may also require a central contact point from categories of CASPs where this is commensurate with the money laundering and terrorist financing risk of their establishments. In exceptional cases they may empower their supervisor to require one from an individual firm where there are reasonable grounds to believe that its establishments present a high risk.

The central contact point acts for the CASP in the host State. It informs the firm of local AML/CFT requirements for its policies and procedures, oversees whether the establishments comply with them and with the firm's own controls, reports breaches to head office, makes sure corrective action is taken and makes sure staff attend AML/CFT training. It also represents the firm before the host supervisor and financial intelligence unit, answers their requests and provides information, reporting regularly where appropriate. Host States may add further functions where the overall risk justifies it.

The act has been adopted but is not yet in force. It enters into force 20 days after its publication in the Official Journal, which follows the scrutiny period of the European Parliament and the Council; as at 3 October 2026 we found no publication. Even then, a central contact point is needed only where a host Member State has chosen to require one.

The regime may be short-lived. Directive (EU) 2015/849 is repealed with effect from 10 July 2027, when Article 41 of Directive (EU) 2024/1640 becomes the basis for central contact points. That article also covers activity through agents, distributors and other infrastructure, and gave AMLA the task of drafting new standards. In the meantime, Cyprus-authorised CASPs should map any establishments in other Member States that are not branches, estimate their yearly activity against the EUR 3 million test and check what each host State requires. For the wider picture, see our study note on the AML obligations of CASPs.