CMS Expert Guide to Crypto Regulation in Italy

For the general MiCAR framework please click here.  

The Italian reference legislation is Legislative Decree No. 129 of 5 September 2024, which adapts national legislation to the MiCAR Regulation, as amended and supplemented by Decree Law 95/2025, converted into Law No. 118 of 8 August 2025 (the “MiCAR Decree”).

The MiCAR Decree modified the transitional regime originally set out in Article 45 of D.Lgs. 129/2024, extending the deadline for filing a CASP authorisation application from 30 June 2025 to 30 December 2025, and the long-stop date for continued operations from 30 December 2025 to 30 June 2026.

Pursuant to Article 93 of MiCAR, the MiCAR Decree designates the Bank of Italy and Consob as the competent authorities, without prejudice to the Bank of Italy’s competence regarding issuers of electronic money tokens.

Prior to the implementation of MiCAR, the relevant legislation was Legislative Decree 231/2007 (the “AML Decree”), under which crypto-service providers were required to enrol in a registry maintained by the OAM (Organismo Agenti e Mediatori).

Under the interim regime provided by MiCAR and the MiCAR Decree, legal entities that, as of 27 December 2024, were duly registered in the special section of the register maintained by OAM and applied for authorisation under MiCAR by 30 December 2025 could continue to provide services related to virtual currencies or digital wallets until 30 June 2026, or until their MiCAR authorisation was granted or denied, whichever came first. The transitional regime expired definitively on 1 July 2026. Since that date, only MiCAR-authorised CASPs may provide crypto-asset services to EU clients.

Additionally, such entities did not need to apply for a MiCAR licence for crypto and digital wallet services if they belonged to the same group as a company that applied for a MiCAR licence in Italy or another Member State by 30 December 2025.

Also the following law provisions are relevant for the provision of crypto-related services to Italian customers:

• AML Decree, meaning legislative decree 231/2007,
• Privacy Regulation, meaning the Legislative Decree 101/2018 implementing GDPR
• Consumer Law, meaning legislative Decree n. 206/2005, as from time to time amended and supplemented.
• Legislative Decree n. 385/1993 (Consolidated Banking Act) in relation to e-money and payment services.
• Additionally, from 2 March 2026, CASPs offering EMT transfer or custody services must hold a PSD2 authorisation or partner with an authorised payment service provider, following a joint communication issued by Consob and the Bank of Italy on 4 September 2025 on the interplay between PSD2 and MiCAR. The selection process for direct AML supervision of CASPs by the new EU Anti-Money Laundering Authority (AMLA) commenced in January 2026, with direct oversight expected from July 2027. The Bank of Italy is still finalising secondary rules, including AML data conservation requirements specific to CASPs.

There are no departures from the MiCAR provisions.

Direct sales of tokens by issuers

• Regulated if the tokens fall within MiCAR’s scope (i.e., ARTs, EMTs, or other crypto-
  assets).
• Issuers must publish a white paper and may need authorisation, depending on
  the type of token, unless an exemption applies.

Exchange (buy/sell)

• Regulated as a crypto-asset service under MiCAR.
• CASPs offering exchange, broker and trading services in relation to crypto-assets
  must obtain a license to provide their services in the EU. 

Custody (hold)

• Regulated as a crypto-asset service under MiCAR.
• CASPs that provide safekeeping or control of crypto-assets on behalf of clients—
  such as custodial wallet services or the custody of private cryptographic keys
  granting access to such assets— obtain a license to provide their services in the
  EU.

Borrowing/lending

• MiCAR does not explicitly regulate borrowing and lending as a crypto-asset
  service under MiCAR.
• MiCAR excludes lending and borrowing of crypto-assets, including e-money
  tokens, from its scope and does not affect applicable national laws governing
  such activities. At the moment it is uncertain whether lending of crypto assets qualifies as a lending activity that in Italy is subject to licensing and supervision granted by the Bank of Italy.

Yield/staking services

• Yielding/staking, which involves the process of immobilising crypto-assets to
  support the operations of proof-of-stake and proof-of-stake-like blockchain
  consensus mechanisms in exchange for the granting of validator privileges that
  can generate block rewards, is not explicitly regulated as a crypto-asset service
  under MiCAR.
• However, a provider that offers staking services on behalf of clients—by directly
  interacting on a proprietary basis with a distributed ledger protocol to stake
  assets for validator privileges and block rewards, or by committing assets to a
  liquidity pool in exchange for yield—typically holds clients’ crypto-assets in
  custody. As a result, such providers must be authorised under MiCAR to provide
  custody and administration services of crypto-assets on behalf of clients.

Staking on proof of stake consensus mechanisms

• Although staking under proof-of-stake consensus mechanisms is not explicitly
  classified as a regulated service under MiCAR, providers offering staking services
  on behalf of clients must obtain a license to provide custody and administration
  services if they hold clients’ crypto-assets in custody.

NFTs

• MiCAR generally excludes non-fungible tokens (NFTs) unless they are part of a
  larger fungible series or collection, in which case they might be treated as
  regulated cryptoassets. ESMA published Guidelines on the qualification of crypto-assets as financial instruments on 19 March 2025, which are relevant for NFT classification.

The same provisions of MiCAR apply. 

For lending activities, the Consolidated Banking Act (D.Lgs. 385/1993) is also relevant, as professional lending to the public requires authorisation from the Bank of Italy. Consumer credit regulation may also apply in case of lending to consumers.

Same provisions of MiCAR.

Reverse solicitation YES 

on strict basis.

Active solicitation: NO

but the firm can seek authorisation as a CASP within the EU and operate on a cross-border basis pursuant to Article 65 of MiCAR. 

Consob issued some resolutions in the past in relation to criteria for reverse solicitation in relation to the offering of financial instruments and services.

ESMA published final Guidelines on reverse solicitation on 17 December 2024 (applicable from 26 February 2025), adopting a restrictive interpretation. Indicators of solicitation include: having a website in an official EU language not customary in international finance, sponsoring EU-centric events, using EU-based influencers, and redirecting EU potential clients through training or educational materials.

Consob has expressly applied these Guidelines in its enforcement practice. 

Article 60 of MiCAR provides a simplified procedure for traditional financial operators already subject to regulation by facilitating their entry into the crypto assets market. Such operators can start offering services related to crypto assets following a mere notification, significantly reducing the time and cost required for market entry, instead of the authorization process under Article 62.

Entities benefiting from this facilitated treatment include credit institutions, central securities depositories, investment firms, electronic money institutions, UCITS (Undertakings for Collective Investment in Savings) management companies and market managers.

Outside of these cases, the two-phase procedure conducted by Consob (with the Bank of Italy’s opinion) requires: 25 working days for completeness assessment, followed by 40 working days for substantive assessment. In practice, the procedure requires a minimum of approximately 70 days and can easily take longer. Based on the first wave of authorisations (applications filed December 2025, authorisations granted May-June 2026), the process takes approximately 5-6 months from filing to grant.

The costs for obtaining a license are mostly related to consultancy (legal, compliance and technical advisors). Capital requirements (which vary depending on the services to be provided) are not included in this estimate.

Additional costs accrue for the implementation of internal procedures organisational measures, IT infrastructure and governance arrangements.

High, provided that the applicant meets the regulatory requirements.

Major roadblocks could be seen in the ownership structure and credibility of the business plan.

Compliance requirements, capital requirements and shareholders/management reliability may result in practical limitations. The first wave of authorisations demonstrated that well-prepared applicants can successfully obtain authorisation within the expected timeframe.

Compliance requirements, capital requirements and, shareholders/management reliability may result in practical limitations. CASPs must have their registered office in an EU Member State and carry out substantial business activities there. Physical presence in Italy is required for entities seeking authorisation from Consob.

From 2 March 2026, CASPs offering EMT transfer or custody services must also hold a PSD2 authorisation or partner with an authorised payment service provider.

Forward look: Key topics for the remainder of 2026 and beyond include: (i) completion of the CASP authorisation wave and market consolidation as non-compliant operators exit; (ii) PSD3/PSR reform expected to resolve PSD2-MiCAR interplay issues; (iii) AMLA direct oversight of CASPs expected from July 2027; (iv) Bank of Italy finalising secondary rules on AML data conservation for CASPs; (v) cross-border passporting, NFT qualification under ESMA Guidelines, and stablecoin regulation framework.