MiCA and TFR in 2026: Privacy Swap Rules Explained

The grace period ended, and it ended everywhere. On 1 July 2026 the longest transitional window under MiCA closed. As of 8 November 2026, an EU-facing crypto business cannot say it is “still waiting for grandfathering”: the maximum period in Article 143(3) has run out. ESMA’s interim register, last updated 5 November 2026, contains 397 rows for 394 unique entities; its non-compliant register lists 189 entries, 180 of them Italian, with 89 decisions dated in 2026. Those two numbers describe the same market from opposite ends — licensed entities on one side, public warnings on the other. Neither says anything about Monero or Zcash, because MiCA does not name either coin. The privacy-coin question is governed by three different instruments, and mixing them up is why most commentary answers the wrong question. (Zcash vs Monero 2026)

MiCA regulates the provider, not the asset. Article 59(1) prohibits anyone from providing crypto-asset services “within the Union” unless they are authorised as a CASP under Article 63, or belong to a class of financial entities allowed to notify under Article 60. The relevant service is defined in Article 3(1)(16)(d): “exchange of crypto-assets for other crypto-assets” means concluding purchase or sale contracts with clients for other crypto-assets using proprietary capital. That definition is the whole test. A website that only displays third-party quotes and never becomes the counterparty may sit outside it; the same website with a desk that fills the order does not. Article 61 keeps a narrow door for reverse solicitation — a third-country firm may serve an EU client who initiates the relationship on his own exclusive initiative — but any marketing or solicitation in the Union closes it. There is no “no-KYC exemption” in the text.

The transition was staggered before it was uniform. Article 143(3) let CASPs that were operating lawfully before 30 December 2024 continue until 1 July 2026, or until their authorisation was granted or refused, whichever came first. Member States could shorten that. ESMA’s table shows the result: Latvia, Hungary, the Netherlands, Poland, Slovenia and Finland chose 6 months; Sweden 9; Germany, Ireland, Lithuania, Austria, Slovakia and Norway 12; most others 18. So a Dutch or German user lost the grace period in 2025, not in 2026. By 1 July 2026 the outer limit expired for everyone in the EEA. “Application pending” is not a licence: the text ends the transitional regime on a refusal, and Article 59 applies from that moment.

The register is a phone book, not a seal of approval. The 394 entities are spread unevenly: Germany 122, France 36, the Netherlands 29, Cyprus 25, Malta 24. Germany’s number is not a crypto boom: 114 of its 122 entries are financial entities using the Article 60 notification route. The service column is free text — crypto-to-crypto exchange appears both as “d.” and spelled out — and a licence for custody or transfer is not a licence for exchange. ESMA’s non-compliant register is explicitly non-exhaustive (Article 110(1)): 189 entries, 180 from CONSOB in Italy, six from Belgium’s FSMA, one each from the Czech National Bank, the Dutch AFM and the Slovak NBS; 89 carry a 2026 date, the latest 4 November 2026. Absence from that list proves nothing; presence in the CASP list proves only that an NCA filed a row.

The travel rule is a data layer that never touches the chain. TFR Article 14 requires the sending CASP to pass the originator’s name, DLT address, account number, country, official personal document number and customer identification number, or date and place of birth, and LEI where available; and the beneficiary’s name, address, account and LEI. Article 14(4) says the data does not have to be attached to the transfer itself — it can travel separately, in advance or simultaneously. For a transfer to a self-hosted address above €1,000, Article 14(5) requires the sending CASP to take adequate measures to assess whether the address is owned or controlled by its client; Article 16(2) imposes the mirror obligation on the receiving CASP when funds arrive from a self-hosted address. Records are kept for five years (Article 26). This is the rule behind signature challenges, wallet-ownership proofs and small test transfers.

Where privacy coins actually stand. MiCA does not name XMR or Zcash and has no “anonymous coin” category; it regulates services, not the cryptography of the asset. The TFR does not ban them either. Recital 17 lists privacy wallets, mixers and tumblers as high-risk factors and asks the EBA to clarify how they should be treated, but a high-risk factor is a reason for enhanced checks, not a prohibition. The ban comes later, from a different text: AMLR Article 79, applying from 10 July 2027, prohibits CASPs from keeping anonymous crypto-asset accounts, or any account allowing anonymisation or increased obfuscation, “including through anonymity-enhancing coins”. Article 2(1)(25) defines those as assets with built-in features that make transfer information anonymous, systematically or optionally. XMR and shielded ZEC fit that wording. Recital 160 expressly excludes self-hosted wallet providers that do not have access to or control over the wallet. The 2027 line is about custodial accounts, not possession. (privacy coins vs mixers)

What this feels like at the interface. A licensed EU CASP checks your identity at onboarding; at a withdrawal to a self-hosted address it may ask for proof of control above €1,000 — a signature from the destination address, a small test transfer, or a third-party attestation. An offshore site that markets to EU residents and fills their orders without authorisation is not “unregulated but tolerated”; it is providing services in breach of Article 59, and reverse solicitation is the only narrow exception. Enforcement looks like public warnings more often than network blocks — 89 entries in the non-compliant register carry a 2026 decision date, 82 of them Italian. For a self-custodial swap, the TFR duty sits with the CASP that receives or sends the funds, not with your wallet; the interface’s job is to show you which entity is on the other side. A quote is not a licence. Between 14:03 and 14:06 UTC on 8 November 2026, our quote API returned 0.14563138 XMR for 100 USDT-TRC20, 1.636707 XMR for 1,000 (two routes, 148 bps), and 598.131 USDT for 1 XMR (two routes, 202 bps). Those numbers tell you the market, not anyone’s regulatory status. Quotes move; the live order page is the reference. (XMR to USDT exit)

Six things people get wrong. (1) “No KYC means outside MiCA” — the test is the service and the client, not the onboarding form. (2) “MiCA banned privacy coins” — it did not; the AMLR account rule is the 2027 change. (3) “The €1,000 threshold is a loophole” — below it, risk-based AML checks still apply, and splitting transfers to stay under it is itself a red flag. (4) “The ESMA register is a whitelist” — it is interim, NCA-fed and explicitly non-exhaustive; check the legal entity and the service codes. (5) “Reverse solicitation is a business model” — it covers an unsolicited client, not a campaign. (6) “The TFR applies to my wallet” — it binds CASPs; a transfer between two self-hosted wallets with no CASP involved is outside its scope.

What to watch next. Three dates matter now. 1 July 2026 was the end of grandfathering; if an EU-facing provider cannot name its authorisation, the lawful answer is no. 10 July 2027 is when AMLR Article 79 applies; before then, AMLA guidelines and national supervisors will decide how broadly “accounts allowing anonymisation” is read — the difference between delisting XMR and merely applying enhanced due diligence. 30 June 2027 is the Commission’s report on the TFR’s application (Article 37(3)); the self-hosted-address review was due by 1 July 2026 (Article 37(2)). For users, the practical rule is simple: verify the entity, know who receives your funds, and keep your own records. For providers, “we are offshore” is a narrower answer than it was; it works only if you do not solicit EU clients at all.