CySEC’s Post-MiCA AML Guidance: Why Client Due Diligence May Increase

CySEC Circular C790 warns that the end of the MiCA transition can create financial-crime risks during provider wind-downs and rapid customer migration. Authorised providers should assess incoming clients individually.

Key facts

• CySEC issued Circular C790 on July 7, 2026.
• The MiCA transitional period ended July 1.
• Unauthorised providers face wind-down and transparency risks.
• Authorised CASPs should scale monitoring and assess incoming clients individually.

What Circular C790 says

CySEC drew regulated entities’ attention to money-laundering and terrorist-financing risks after the MiCA transition ended. It said unauthorised providers may face weakened controls, compressed exit timelines and risks that illicit flows are concealed during wind-down.

For authorised CASPs receiving clients, rapid inflows can change risk profiles and strain onboarding and transaction monitoring. CySEC points to adequate staffing, scalable systems and proportionate customer due diligence.

Why clients may see more questions

A provider receiving accounts or assets from an unauthorised service may need to understand the source of funds, transaction history and customer risk. That can lead to requests for identity, address, wealth or transfer evidence.

CySEC also says clients should not be rejected solely because they came from an unauthorised VASP. The assessment should be individual and risk-based, with enhanced due diligence where higher risks are identified.

What clients should do now

Preparation can reduce delays without bypassing legitimate controls.

• Verify the receiving provider’s MiCA status.
• Keep statements and transaction history from the previous provider.
• Prepare evidence for source of funds and ownership.
• Confirm supported assets and networks before transfer.
• Use verified support channels and record every request.

What this alert does not mean

C790 is guidance to regulated entities, not an accusation against every migrating customer or every former provider. It does not require blanket account closures.

SafeGate should monitor whether firms explain verification requests, provide workable transfer processes and avoid presenting routine due diligence as a security incident.

Verify a provider

Read regulatory alerts

Frequently asked questions

Sources and verification

• CySEC Circular C790: ML/TF risks following the end of the MiCA Transitional Period — published July 7, 2026; jurisdiction: Cyprus / EU; accessed August 25, 2026.

Last reviewed: August 25, 2026. Recheck dates, status, legal entities and live terms immediately before publication.

Image brief: Post-MiCA migration flow from unauthorised VASP to authorised CASP, with individual risk assessment and transaction-monitoring controls.

Disclosure

SafeGate Advisors is not a broker and does not accept deposits. This article is general information, not investment advice. SafeGate may receive compensation from some brokers through affiliate partnerships, but editorial assessments should follow the published methodology and verified evidence.