Guides · x402 and agent payments
Charging AI agents over x402 in the EU: which rules apply
By Arturo Ferrándiz Fernández, regulatory compliance consultant · Last reviewed 29 September 2026 · 7-minute read
In short. An API that charges agents in USDC for its own data or service is, in principle, a business being paid in crypto-assets, not a crypto-asset service provider. The regulatory weight changes when you hold or move other people's funds, when you pay rewards on stablecoin balances, or when you issue your own token. Whatever the model, ordinary online-business rules still apply: provider identification, fair terms, VAT and data protection.
Start with the flow of funds
MiCA regulates crypto-asset services provided to clients, such as custody and administration of crypto-assets and transfer services on behalf of clients, and requires authorisation to provide them (Regulation (EU) 2023/1114, Art. 59). Being paid for your own service is not on that list. The question is always who controls the keys and whose money moves.
| Your model | Likely position | Main rules |
|---|---|---|
| Your API is paid in USDC or EURC to your own wallet | A merchant paid in crypto-assets. In principle no CASP authorisation. | E-commerce, consumer and VAT rules; GDPR |
| You receive payments for other merchants and pay them out (a facilitator) | May be a transfer service and, if you hold balances, custody. | MiCA Arts. 59, 70, 75 and 82; Travel Rule |
| Users keep a prepaid balance with you that agents spend | Custody and administration on behalf of clients, possibly payment services. | MiCA Arts. 59 and 70; PSD2 |
| You reward users for holding stablecoin balances | Interest on e-money tokens is prohibited for CASPs. | MiCA Art. 50(2) and (3) |
| You launch a token for credits, discounts or governance | An offer of crypto-assets, unless an exemption applies. | MiCA Arts. 4 to 14; see our white paper guide |
A description as "non-custodial" does not settle it. If your server holds keys that can move a user's funds, or you sign transfers for them, the substance is custody or transfer, whatever the product page says.
If you are only a merchant
Identify yourself
An API sold online is an information society service. Show the legal name, geographical address, email and register details of the provider, in the terms and on the site (Directive 2000/31/EC, Art. 5; in Spain, LSSI Art. 10).
Write terms for paid calls
Say what a call buys, what happens when it fails or returns a malformed response, how and when failed calls are refunded, and which law applies. "All payments are final and we accept no liability" is a problem as soon as consumers can pay (Directive 93/13/EEC, Annex point 1(b)). Our terms guide lists the clauses that fail most often.
Handle VAT and accounting in euros
Payment in USDC does not change the VAT treatment of the service you sell. For a seller established in the EU, services to businesses in other Member States are generally invoiced under the reverse charge, and electronically supplied services to consumers are taxed where the consumer lives, which the EU One-Stop Shop lets you declare in one country. Record each receipt at its euro value on the day. Ask your tax adviser how this applies to your setup.
Treat agent requests as data
Requests made by an agent on behalf of a person can carry personal data, and wallet addresses that can be linked to a person are personal data. Say what you log, why and for how long in your privacy notice (GDPR Art. 13).
If you hold or move other people's funds
Then the CASP rules are likely to apply, and since 1 July 2026 there is no transitional period left for existing providers. Expect, among others:
- authorisation by your home authority before providing the service (MiCA Art. 59);
- arrangements to protect clients' crypto-assets and to keep them apart from your own, and, for client funds other than e-money tokens, placement with a credit institution or central bank by the end of the next business day (Art. 70);
- an agreement with clients covering at least the parties, how the transfer service works, security systems, fees and applicable law (Art. 82(1));
- payment services only under your own payment licence or through an authorised third party, and telling clients which (Art. 70(4));
- Travel Rule information for transfers, including checks on self-hosted addresses above EUR 1,000 (Regulation (EU) 2023/1113, Arts. 14 to 16).
For infringements of the CASP provisions, Member States must provide for fines of at least up to EUR 5 million or 5% of annual turnover for legal persons (MiCA Art. 111(3)).
Which stablecoin
Merchants can generally accept the stablecoin they choose. EU crypto-asset service providers, including the exchanges you may use to convert to euros, can only offer e-money tokens that comply with MiCA, so check that your off-ramp supports the token you are paid in. USDC and EURC are issued in the EU as e-money tokens under MiCA.
Checklist
- Draw the flow of funds and mark every point where you control someone else's keys or balance.
- If there is none, you are a merchant: provider identity, terms for paid calls, VAT and privacy.
- If there is one, assess CASP authorisation before you onboard EU users.
- No rewards linked to how long users hold stablecoin balances.
- No token without checking the offer rules and exemptions.
- Confirm your off-ramp supports the stablecoin you are paid in.
A note on independence. The same person runs the 402Scope observatory, which measures x402 providers for free. Measurement is never sold. If a measured provider buys a review, it is disclosed on its observatory page and has no effect on its measurements.
Want your model checked? The MiCA Readiness Review maps your flow of funds, your terms and your marketing against these rules and gives you a fix list within 72 working hours.
This guide is general information about EU law as it stood on the date above. It is not legal, tax or investment advice and does not create a client relationship. Sources: Regulation (EU) 2023/1114 (MiCA), Regulation (EU) 2023/1113, Directive 2000/31/EC, Directive 93/13/EEC.