Crypto-asset service provider

Regulation (EU) 2023/1114 builds the status out of two halves: the business of serving clients professionally, and the permission to do so. The application clock is fixed at 40 working days from a complete file to a reasoned decision. Knowing which services a platform's license names tells you whether it may legally hold your coins.

How it works

The definition of a crypto-asset service provider is unusual because it carries its own permission clause inside it. Article 3(1)(15) describes a legal person or other undertaking whose occupation or business is providing one or more crypto-asset services to clients on a professional basis, and that is allowed to provide them in accordance with Article 59. Both halves have to be true at once. A firm doing the work without the permission is not an unlicensed provider; it sits outside the category entirely and breaches Article 59(1), which says no person may provide these services in the Union on any other footing.

Ten activities count, and the list is closed. Article 3(1)(16) names custody and administration for clients, running a trading platform, exchanging crypto-assets for money, exchanging them for other crypto-assets, executing orders, placing crypto-assets, receiving and transmitting orders, advice, portfolio management, and transfers made for clients. Article 59(6) then obliges the regulator to write into each authorization which of the ten it covers, and Article 59(8) sends a firm that later wants another one back for an extension, assessed on the same terms as the original file. Permission is granted per service, never to the company as a whole.

Where the firm sits is fixed too. Article 59(2) requires a registered office in a member state where it genuinely performs part of its services, effective management inside the Union, and at least one director resident there. Article 59(5) protects the label itself: a person who is not a crypto-asset service provider may not use a name, a corporate name or marketing communications suggesting otherwise, or likely to create confusion on the point.

The assessment runs on a published clock. A regulator acknowledges the application within five working days, decides within 25 working days whether the file is complete, then reaches a fully reasoned grant or refusal within 40 working days of that completeness and tells the applicant within five working days of deciding. Serving a second member state is a notification rather than a fresh application: the home regulator forwards the details within 10 working days, and the firm may begin at the latest on the 15th calendar day after filing.

Why this matters when you buy bitcoin

Crypto-asset service provider status decides which European platforms may take your money, and it is a much narrower fact than a "MiCA licensed" badge on a landing page suggests.

A venue cleared only to receive and transmit orders is not cleared to safekeep coins, and nothing in a marketing badge shows the difference. What does show it is ESMA's public register, which Article 109 requires. Under Article 109(5) it carries, for each provider, the list of services that firm is authorized to provide, the competent authority that granted the authorization with its address and contact details, the host member states it intends to serve, and the date of any withdrawal. The 32 crypto-license guides here are built around exactly that question, naming the national authority that grants and supervises each authorization, because that authority is who you write to when a platform stops answering. Article 59(7) lets an authorized firm serve clients throughout the Union, through a branch or under the freedom to provide services, without a physical presence in the host member states it serves, which is why the buying advice converges across the European country guides in a way it does not anywhere else in the 231.

The status also explains a silence worth reading correctly. Most of the 41 wallet reviews here cover software whose maker never holds anything, and Article 3(1)(17) defines custody as safekeeping or controlling crypto-assets, or the means of access to them such as private keys, on behalf of clients. A wallet where only you hold the keys does none of that, so its maker provides no crypto-asset service and needs no permission. Absence from a register proves nothing about it. The same caution applies to a bank, which reaches these activities by notifying its home regulator under Article 60 rather than by applying for an authorization of its own.

One retail purchase, four of the ten services

A single euro-to-bitcoin purchase touches four of the ten listed services, which is why the class a firm sits in tells you more than the word license does.

Say you send euros to a platform, buy bitcoin, leave it there a week, then withdraw to an address you control. If the platform sells you the coins off its own book, that is exchange of crypto-assets for funds, which Article 3(1)(19) pins to the use of proprietary capital. If your order is instead matched against another customer, the venue is operating a trading platform under Article 3(1)(18), a multilateral system bringing third-party buying and selling interests together so that a contract results, and putting your order into it on your instruction is execution of orders. The week the coins sit there is custody. The withdrawal is a transfer service performed for a client.

Annex IV prices those services in three tiers. Execution, placing, transfers, reception and transmission, advice and portfolio management make up class 1, at a permanent minimum capital of 50,000 euros. Adding custody or either of the two exchange services moves the firm into class 2 at 125,000 euros. Running the trading platform lifts it to class 3 at 150,000 euros. Article 67(1) then demands the higher of that figure and one quarter of the previous year's fixed overheads, so the annex is a floor and not the answer.

Two duties follow your money rather than the permission. Article 70(3) requires client funds other than e-money tokens to be placed with a credit institution or a central bank by the end of the business day after they arrive, in an account identifiable separately from the firm's own. Article 75(5) makes a custodian send you a statement of your positions at least once every three months in electronic form, listing the assets, the balance, the value and the transfers made in the period.

Crypto-asset service provider vs MiCA

MiCA is the regulation; crypto-asset service provider is one status the regulation defines, and much of the text has nothing to do with that status. The titles on offers of crypto-assets to the public, asset-referenced tokens and e-money tokens bind issuers and offerors, who may never serve a client at all. The confusion runs the other way as well, because the definition points at Article 59, and Article 59 opens two doorways rather than one. A firm can arrive through authorization under Article 63, or, where it already holds a license as a credit institution, investment firm, market operator, central securities depository, electronic money institution, UCITS management company or alternative investment fund manager, through the notification in Article 60, which a bank files at least 40 working days before it starts. Both are crypto-asset service providers and both carry the conduct duties, but only the first went through the application clock above. "Regulated under MiCA" and "holds a crypto-asset service provider authorization" are therefore not the same claim.

Crypto-asset service provider vs cryptocurrency exchange

A cryptocurrency exchange is one shape a crypto-asset service provider can take, and the regulation splits apart what everyday language merges. Operating a trading platform means running a multilateral system for third-party orders; selling you bitcoin from the firm's own balance sheet is a separate listed service defined by proprietary capital. A broker app with a buy button and no order book performs the second and not the first, which is why it can be fully permitted without any trading-platform duty and why its capital floor is 125,000 euros rather than 150,000. Read from the other direction, a firm authorized to operate a trading platform is still not permitted to hold your coins, because custody is a third entry on the list and has to be applied for by name.