Mariona Pericas: "The European Crypto Sector Urgently Needed Regulation to Gain Legal Security, Attract Investment, and Retain Talent"

Mariona Pericas Estrada is a leading expert in financial regulation and digital assets, with a special focus on crypto assets and blockchain technology. With a degree in Law and Business Administration from Abat Oliba University (CEU), she brings over 9 years of experience advising financial institutions. As director and principal associate at finReg360, a leading regulatory consulting firm, she has led numerous authorization projects for payment institutions, e-money providers, and aggregators. Previously an associate in KPMG Legal's financial regulatory department, she possesses specialized expertise in payment services regulations, AML/CFT, and emerging regulations like MiCA. Her expertise has been recognized through her classification as a Star Associate in the Individual Fintech Ranking by Chambers & Partners for several consecutive years.

"Right now, in the crypto space, we're in the year of MiCA. This regulation means going from zero to sixty in terms of requirements," states Mariona about the regulation that's transforming the sector. For Mariona, MiCA was exactly what the sector needed: "Until now, there was significant legal uncertainty: you didn't know if your activity was violating any rule, or if your crypto assets would be seized if the platform went bankrupt... With regulation comes asset segregation obligations, licensing requirements, supervision... All this provides more guarantees to investors and improves confidence."

Question: How did you come to specialize in financial regulation?

Answer: I've always been fascinated by macroeconomics, economics, market movements, and how humans try to learn and improve after disasters. That's how economic theory works: after a crisis, we try to learn, see how to improve, and develop a new model. I had studied law because I loved it, but I was also drawn to economics, and eventually found my professional niche in financial regulation.

Financial regulation encompasses all the rules that, especially after the 2008 crisis, exhaustively regulate financial activities and services: banks, investment services, payment services, market infrastructures, insurance companies, and so on. These are highly technical regulations that may seem 'invisible' to the public but have an enormous impact on our daily lives. For example, the PSD2 regulation changed the threshold for PIN entry at point-of-sale terminals from 20 euros to 50 euros. These are small things people don't associate with regulation, but they have real-world impact.

I was working in this field when, around 2016 or 2017, I attended a talk about Bitcoin from an economic theory perspective. It fascinated me, partly because I've always been a big fan of game theory and John Nash's work. To me, Bitcoin represented a libertarian phenomenon—even anarchic to some—and I wanted to dive deeper. I began researching and taking courses.

At the same time, in 2018, regulators began to show real concern about phenomena like ICOs, which were raising massive amounts of funds in very short timeframes through token placements without the safeguards established in the traditional financial sector, including anti-money laundering measures. These were areas where I was already specialized, but from a traditional finance perspective. I saw regulatory movement heading toward this new world. At my firm (finReg360), which specializes in financial regulation, they recognized my passion for this field, so we formed a digital assets team and began advising clients entering the crypto space.

Q: What are the most urgent challenges organizations face in the compliance area?

A: Right now, in the crypto space, we're in the year of MiCA. This regulation represents going from zero to sixty in terms of requirements. Until recently, there were only anti-money laundering obligations, but MiCA brings substantial change.

When Bitcoin emerged, regulators tried to fit it into existing legal frameworks: was it a currency, a financial instrument? There wasn't a clear category. Then came Ethereum and various tokens, and it became apparent that depending on each token's nature, existing regulations might apply (financial instruments, payment services, etc.). But there remained a legal vacuum for some crypto assets and, above all, enormous concern about the uses and expansion of stablecoins, especially following the Libra announcement, which raised concerns among authorities about monetary policy stability.

In 2018, a directive was rushed out that included cryptocurrency service providers as obligated entities under anti-money laundering and counter-terrorism financing regulations. From there, there was a push to substantially regulate the entire crypto asset space, giving rise to MiCA. The first draft was published in 2020, and it finally came into full application in December 2024.

And what does this mean? That all crypto asset service provision will require a license. Companies must meet numerous requirements: sufficient capital, three lines of defense (risk control, compliance, and internal audit), corporate governance structure, policies and procedures, asset segregation... It's quite similar to the requirements placed on traditional financial institutions.

This represents a massive change and, from a compliance perspective, means that companies need specific policies, locked-up capital reserves, boards of directors with crypto expertise... Many won't be able to meet these requirements, and not all will survive in this more regulated environment.

Q: Do you think all these regulations will improve retail public perception?

A: I'm certain they will. I believe MiCA is exactly what the sector needed. Until now, there was significant legal uncertainty: you didn't know if your activity was violating any rules, or if your crypto assets would be seized if the platform went bankrupt... With regulation comes asset segregation obligations, licensing, supervision... All this provides more guarantees to investors and improves confidence.

Additionally, for crypto companies, this is an opportunity to attract talent and investment, to expand across Europe with a single 'passport.' It also encourages traditional financial institutions to enter the sector, fostering global growth in the crypto industry.

Q: Do you believe compliance culture is already established in companies, or is it still a major challenge?

A: It's an ongoing challenge. Complying with all these regulations requires significant resources and a strong team. In the traditional financial sector, the compliance function is well-known and has been implemented for years. But in the crypto world, regulation came later, and I've been positively surprised by how many crypto companies have invested from the beginning in fraud prevention systems, Know Your Customer tools, transparency... They've tried to anticipate the coming regulations.

In Spain, additionally, the 2010 Criminal Code reform introduced criminal liability for legal entities, requiring all companies to implement criminal risk prevention systems with all that entails, consequently forcing them to seriously consider creating a regulatory compliance department. In the financial sector, it's more complex because regulation is constantly renewed and covers diverse areas. But despite everything, there's a compliance culture that's growing stronger all the time.

Q: Do you consider blockchain technology to be the industrial revolution of the 21st century?

A: It brings major changes and efficiencies. Blockchain allows some models to reduce intermediaries and automate processes very transparently. However, many factors can influence whether this technology will completely transform certain sectors.

An example: if stock trading and settlement can be executed in a single blockchain transaction, it changes the paradigm of market infrastructures. But it also means traditional intermediaries must adapt and offer real added value.

In my opinion, blockchain makes many intermediaries dispensable. That doesn't mean they'll automatically cease to exist: some provide advisory services, customer support, guarantees... and will remain useful. But it is a technology with the capacity to change many rules of the game, just as happened with the arrival of the internet.

Q: We've talked about MiCA, but there's also the DORA regulation. What stands out to you about it, and what tips would you give for adaptation?

A: I'm not a DORA expert, but I know it significantly affects my clients because it aims to ensure the digital resilience of financial institutions. It's part of the EU's digital strategy package, which also includes MiCA and the Pilot Regime.

DORA requires financial sector companies to have robust contingency plans, business continuity measures, cybersecurity controls, and audit procedures. It also impacts technology service providers, especially those delivering essential functions like cloud services such as AWS, as they'll be subject to more demanding supervision and reporting obligations.

In summary, it's a framework to ensure operational resilience and minimize the risks of technological disruptions. My advice would be to dedicate a cross-functional team (technology, cybersecurity, compliance) to review the new requirements and develop specific action plans, because proper implementation will require time and resources.

Q: Do you think excessive regulation is perceived as a barrier to innovation?

A: Yes, and I think we've gone a bit overboard with so many regulations. It's true that stability and consumer protection are the goals, but the sheer number of rules can slow down or make innovation more expensive. Still, look at banks: they're among the most heavily regulated entities and continue to post record profits, so innovating under regulatory pressure isn't impossible; it's just more expensive and requires more talent.

On the other hand, I believe the EU will eventually take a step back to simplify things. There are so many rules that sometimes it's difficult to even know which one applies. And it's normal and good for regulation to lag somewhat behind technology, because legislating something that isn't fully understood could be worse.

Q: What regulatory trends do you consider will be most relevant in the coming years?

A: The immediate challenge is to settle the regulatory avalanche we're facing. MiCA, DORA, the Pilot Regime for market infrastructures, the changes in anti-money laundering with the new AMLA authority in Frankfurt, accessibility standards... All of this is coming into force or will do so in the next few years, and it represents an enormous volume of changes.

First, all of this needs to be properly implemented. Then, the other big unknown is what will happen with artificial intelligence. When AI is used in the provision of financial services and decision-making, how will its regulatory compliance be controlled? It's going to be a challenge: tracing AI decisions isn't so simple. But there will also be AI solutions to facilitate the work of compliance teams. It's a new world that's going to grow substantially.