Not sure which exact one, either MiCAR or something passed around the same time: https://www.investopedia.com/news/what-does-increased-government-regulation-mean-privacyfocused-coins/#:~:text=In%20the%20European%20Union%20in,or%20purchased%20via%20their%20services.