Regulatory & Compliance

Financial regulation no longer applies only to banks and investment firms. Crypto-asset service providers, payment and e-money institutions, fintech platforms and token issuers now operate under rules that are just as detailed. Supervisors expect those rules to be applied from day one.

The EU framework has grown quickly. It now includes MiCA, the payment services and e-money directives (soon to be replaced by PSD3 and the Payment Services Regulation), MiFID II, DORA, and the new AML package with its dedicated authority, AMLA. These rules overlap, and a single business model can fall under several of them at once.

We help you work out which rules apply, what they require in practice, and how to build compliance into your operations rather than bolting it on afterward. We work with startups preparing their first license application. We also work with established operators expanding into new markets or adapting to new requirements.

How we can help

• Regulatory assessments: mapping the rules that apply to your business model, identifying gaps and setting out a practical implementation roadmap
• Licensing and authorization: CASP, payment institution and EMI applications, from the business plan and internal policies to dialogue with the competent authorities
• Payment services and e-money: licensing perimeter and exemptions, agents and distributors, safeguarding of client funds, EU passporting and preparation for PSD3 and the Payment Services Regulation
• MiCA compliance: ongoing obligations for CASPs and token issuers, including conduct rules, disclosures and market abuse requirements
• Token classification and securities law: assessing whether a token qualifies as a financial instrument under MiFID II, and structuring offerings under the Prospectus Regulation
• AML/CFT programs: risk assessments, customer due diligence, transaction monitoring, suspicious transaction reporting, travel rule compliance and staff training
• DORA and ICT risk: ICT risk management frameworks, incident reporting, contracts with ICT third-party providers and the register of information
• Governance and internal controls: setting up the compliance function, drafting policies and procedures, compliance audits and escalation procedures
• Regulatory engagement: responses to public consultations, sandbox and innovation hub applications, and support during supervisory inspections and requests for information

Compliance that holds up under supervision

A license is only the starting point. Once authorized, you must meet capital, governance, reporting and conduct requirements on an ongoing basis. Supervisors increasingly check how your policies work in practice, not just whether they exist on paper.

We help you design procedures your team can actually follow and keep your documentation aligned with how the business really operates. We also prepare you for inspections, audits and requests from supervisory authorities. When you expand to other EU countries, we handle passporting and host-state requirements. Outside the EU, we work alongside trusted local counsel from our international network.

Our approach

We don't treat compliance as a checklist. We start from how your business actually works, focus on the risks that matter most, and look for solutions that satisfy regulators without slowing down your product. The goal is a compliance framework you can grow with, not one you have to rebuild with every new license or market.