The rules introduce tough consumer-protection measures for crypto firms, and in principle kick in at the end of next year for companies seeking a new license. Companies already operating under national law, however, can carry on for a further 18 months, and regulators are anxious that an overlong implementation period would place customers of the bloc’s roughly 2,000 registered crypto companies at a disadvantage.