Compliance & Legal

The EU Compliance Calendar: DAC7, AMLA, MiCA & PSD3 for Fans Agencies

A few years ago the creator economy operated in a regulatory grey zone. That zone has closed — and this month another door shut behind it. On 1 July 2026, MiCA's transitional period ended across the EU, and any crypto provider still serving European customers without a licence is now operating illegally.

A European fans agency today sits under at least seven EU frameworks: tax reporting, anti-money-laundering, crypto, instant payments, payment-services law, operational resilience, and soon digital identity. Each moves on its own timetable. The risk isn't any single rule — it's losing track of all of them at once. This guide is the single calendar: what already applies, what's imminent, what's coming, and for every date, the one thing a fans agency should actually do about it.

Already in force: January 2024 to July 2026

DAC7 — platform income reporting (routine since 2024)

DAC7 requires digital platforms — OnlyFans via Fenix International, Fansly, and the rest — to report creator earnings to EU tax authorities every year. The threshold is low: €2,000 in annual earnings or 30 transactions. The first exchanges happened in 2024, which means tax authorities now hold more than two years of creator income data and are actively cross-checking it against personal declarations.

What to do: reconcile your agency's records against platform statements every January — per creator, per platform. A creator running three platforms generates three separate DAC7 reports, and it's the sum that has to match the declaration. If it doesn't, the tax office sees the gap before the creator does. Full detail in DAC7 explained.

Instant payments — receive since January 2025, send since October 2025

The Instant Payments Regulation (EU) 2024/886 turned ten-second euro transfers into a legal baseline. Eurozone providers — banks, EMIs and payment institutions alike — have had to receive instant transfers since 9 January 2025 and send them since 9 October 2025, at no premium over a standard transfer, 24/7/365, with the old €100,000 scheme cap removed.

The October date also switched on Verification of Payee: a free name-and-IBAN check before every transfer. What to do: two things. First, treat instant payouts as table stakes — a provider that still charges extra for them or can't send at 2 a.m. on a Sunday isn't behind the market, it's behind the law. Second, clean your payout records: VoP flags name/IBAN mismatches, and a stage name entered against a legal-name IBAN will trip it. See SEPA Instant vs SEPA Credit Transfer.

DORA — your providers' resilience (since 17 January 2025)

The Digital Operational Resilience Act applies to financial entities, including the payment institutions and EMIs agencies rely on — not to agencies themselves. It forces them to run documented ICT risk frameworks, report major incidents within hours, test their systems, and supervise their tech vendors.

What to do: nothing operational, but keep it as a due-diligence filter. An EU-regulated provider has been through DORA implementation and supervision; an offshore processor has not, and no equivalent regime is checking whether its systems survive an outage with your month's payouts in flight.

One more 2025 date worth a line: the European Accessibility Act began applying on 28 June 2025 to consumer-facing e-commerce and banking services. Most fans agencies are B2B microenterprises and fall outside it — but if you run your own consumer storefront and have grown past ten employees or €2 million turnover, check your exposure.

AMLA opens (July 2025) and takes over (January 2026)

The EU's new Anti-Money Laundering Authority has been operational in Frankfurt since 1 July 2025. On 1 January 2026 the EBA handed it every AML/CFT mandate, and it is delivering 24 of its 40 Single Rulebook mandates during 2026 — the first public consultations closed in May.

What to do: the direction is now fixed, and for adult-content and other sectors classed as higher-risk, enhanced due diligence is becoming mandatory rather than discretionary. In practice that means verified identity for everyone in the payment chain, documented source of funds, and ongoing monitoring rather than one-off checks at onboarding. Start keeping that documentation and clean transaction trails as a habit, not a scramble. Background in AMLA 2025.

DAC8 — crypto data collection (since 1 January 2026)

DAC8 extends DAC7's logic to crypto. Since 1 January 2026, crypto-asset service providers have been collecting transaction data on all EU-resident users, aligned with the OECD's CARF standard. What to do: treat crypto income as visible from the day it's earned. Everything from 2026 reaches tax authorities in 2027, so creators should declare as they go — retroactive honesty is a worse conversation.

MiCA — the grandfathering window closed (1 July 2026)

Two days before this update, MiCA's transitional period ended EU-wide. Germany and Ireland had already closed it on 31 December 2025. Of roughly 3,500 pre-MiCA national VASP registrations, only about 220 firms held a full MiCA licence by mid-2026, with the industry expecting around 400 once the shake-out settles; unlicensed exchanges are exiting the EU or blocking European users. One nuance survives the deadline: already-authorised institutions such as banks and EMIs can still notify their regulator to provide certain crypto services under Article 60 — that route is permanent, and it's why some EU payment providers offer compliant crypto payouts without holding a standalone CASP licence.

What to do this week: check every crypto counterparty in your payout chain against ESMA's MiCA registers. If a provider isn't listed, move the flow — an unlicensed counterparty is now a legal problem, not a pricing choice. And remember the travel rule already applies to crypto transfers. Deep dives: MiCA and crypto payouts and crypto vs SEPA.

Imminent: the second half of 2026

PSD3 / PSR — publication expected within weeks

Political agreement came in November 2025; the European Parliament voted the texts through in May 2026. Publication in the Official Journal is anticipated in mid-to-late 2026, possibly slipping to September. The package repeals both PSD2 and the E-Money Directive — EMIs become a category of payment institution under one harmonised framework — and tightens fraud, liability, and open-banking rules. For an agency, the practical meaning is continuity with better protection: your EMI account keeps working, but the institution behind it will re-authorise under the new regime, and fraud-liability rules get clearer. The PSR applies 18 months after entry into force, pointing at late 2027 or early 2028.

What to do: nothing yet except note that the clock starts at publication. Expect your provider to communicate re-authorisation plans during 2027; a provider that says nothing about PSD3 all year is telling you something too. Detail in PSD3 and PSR.

eIDAS 2 — EU Digital Identity Wallets (December 2026)

Every member state must offer at least one EU Digital Identity Wallet by late December 2026, and financial-services firms must accept wallet authentication by late December 2027. Use of the wallet stays voluntary and free for individuals — the obligation sits with governments to issue and with regulated firms to accept. What to do: nothing to build — but watch onboarding. Wallet-based KYC could cut creator verification from days to minutes once providers support it, which matters when you're onboarding ten creators a month.

Coming: 2027 and beyond

10 July 2027 — the AMLR applies

The Anti-Money Laundering Regulation — the single rulebook — applies directly in all 27 member states from 10 July 2027: harmonised customer due diligence, beneficial-ownership rules, and mandatory enhanced due diligence for high-risk sectors. What to do: spend the first half of 2027 tidying your corporate structure and UBO documentation. Your provider will be obliged to verify it, and messy paperwork is the most common reason payouts freeze.

January–July 2027 — first DAC8 filings

CASPs file their first crypto reports to tax authorities. What to do: make sure creators' 2026 crypto earnings are declared before the data lands, not after.

9 July 2027 — VoP for non-euro-area providers

Payment providers outside the eurozone hit their instant-payments and Verification of Payee deadline. What to do: only relevant if part of your flow runs through providers in Sweden, Poland, Czechia or other non-euro states — if so, expect the same name-matching discipline there.

Late 2027 / early 2028 — the PSR applies

Eighteen months after publication, the PSR becomes directly applicable; the payee-verification liability rules follow at 24 months. What to do: read the updated terms your provider sends — liability for fraud and mismatched payouts is shifting, mostly in your favour.

2028 — AMLA direct supervision

AMLA begins directly supervising roughly 40 of the highest-risk cross-border financial institutions. Even if your provider isn't among them, national supervisors will align with AMLA's methods — expect KYC refreshes to get more standardised, not lighter. The upside of harmonisation is real, though: one consistent rulebook across 27 states beats 27 different national interpretations for any agency working with creators in more than one country.

2028 and 2030 — ViDA

The VAT in the Digital Age package phases in: deemed-supplier rules for short-term accommodation and road transport (not content platforms) on 1 July 2028, and mandatory e-invoicing and digital reporting for intra-EU B2B from 1 July 2030. What to do: distant but real — if you invoice creators or platforms across borders, your commission invoices will eventually need to be structured e-invoices. Content-platform VAT itself doesn't change: platforms already account for VAT on consumer sales, and agency commission remains a B2B reverse-charge service.

The next 18 months, quarter by quarter

If the sections above are the map, this is the to-do list. None of these items takes more than an afternoon if you start on time.

• Q3 2026: verify every crypto counterparty against ESMA's MiCA registers; reconcile first-half payout records; watch the Official Journal for PSD3/PSR publication.
• Q4 2026: reconcile full-year records ahead of DAC7 reporting; first eIDAS wallets appear; if PSD3/PSR is published, diarise the PSR application date — publication plus 18 months.
• Q1 2027: platforms file DAC7 reports for 2026; first DAC8 crypto filings begin — confirm creators declared 2026 crypto income; start AMLR prep (UBO and corporate documents).
• Q2 2027: finish AMLR preparation — source-of-funds records in order; ask your provider what changes for you on 10 July.
• Q3 2027: AMLR applies 10 July; non-euro VoP lands 9 July; respond quickly to refreshed KYC requests to keep payouts moving.
• Q4 2027: eIDAS private-sector acceptance arrives late December; PSR application is close — review provider communications on new terms and liability.

How to Use This Calendar

Notice where the weight falls: DORA, instant payments, MiCA authorisation, AMLR obligations, PSR re-authorisation — nearly all of it lands on your payment provider, not on you. That makes provider choice the biggest single compliance decision an agency takes. An EU-licensed EMI under a national regulator carries these frameworks natively; infrastructure outside the EU carries none of them, and every date on this page widens that gap.

Beyond that, three habits cover most of it:

• Diarise the recurring ones. DAC7 is annual now; DAC8 joins it from 2027.
• Watch the moving ones. PSD3/PSR publication and AMLA's technical standards are the two streams still firming up.
• Hold funds where compliance is built in. Traceability is the common thread across DAC7, AMLA, MiCA and VAT alike.

Bottom Line

Seven frameworks, one business under all of them. DAC7 data has flowed for two years, instant payments are the legal baseline, MiCA's window closed on 1 July, the AMLR is one year out and the PSR sits just behind it. None is overwhelming on its own — the discipline is keeping them on one calendar so none of them arrives as a surprise.

Compare the providers that make EU-grade compliance the default in our free calculator.

---

AgencyPayments.eu is an independent informational resource and does not provide legal advice. Regulatory dates are current as of July 2026 and may change as measures are finalised. Confirm specifics with a qualified adviser.