Managing crypto-assets for third parties: when is CASP authorisation required?

Updated on 25 October 2026

Trading on your own account remains unregulated. Managing other people’s crypto-assets, by contrast, is a regulated service under the MiCA Regulation: since the end of the transitional period on 1 July 2026, it requires authorisation as a crypto-asset service provider (CASP) to serve clients in France. The question is where the line falls, especially for copy trading, trading signals and trading bots.

Trading on your own account: an unregulated activity

A trader who invests their own funds, even professionally and through a company, does not provide a crypto-asset service within the meaning of MiCA. Two caveats apply. A trader who acts as counterparty to clients, buying crypto-assets from them or selling crypto-assets to them for funds or other crypto-assets, provides an exchange service that requires authorisation. A trader who uses third-party funds falls within one of the regimes described below. The taxation of gains is a separate question.

Managing a client’s portfolio: an authorised service

MiCA defines portfolio management on crypto-assets as managing portfolios that include one or more crypto-assets, on a discretionary client-by-client basis, under a mandate given by clients (Art. 3(1)). This covers a provider who places orders on a client’s exchange account through API access without submitting each decision to the client.

This service requires CASP authorisation from the AMF (Art. 59) or, for a provider authorised in another EU Member State, a passport. The manager must hold own funds of at least EUR 50,000, or a quarter of the previous year’s fixed overheads if higher (Art. 67 and Annex IV). It must also assess the suitability of its management for each client (knowledge, experience, objectives, ability to bear losses) and report periodically on its activity (Art. 81).

A manager that holds its clients’ private keys or crypto-assets also provides a custody service, which requires authorisation for that service and higher own funds.

Operating without authorisation exposes the provider to criminal and administrative penalties and to inclusion on the AMF blacklist. It may also give rise to civil liability towards clients.

Copy trading, signals and bots: where is the line?

The test is simple: who takes the investment decision, and on whose account is it executed?

• The client gives a third party the power to place orders on its account, including by automatically copying a trader’s positions, without approving each trade: the service comes close to portfolio management.
• The provider gives a client personalised recommendations on crypto-assets, without executing them: this is advice on crypto-assets, which also requires authorisation.
• The provider receives the client’s orders and passes them on to a platform for execution: this is reception and transmission of orders, which requires authorisation.
• The provider publishes general signals or sells software that the client configures and runs alone: the activity may fall outside MiCA, although its promotion remains regulated.

Each case turns on its facts: the flows of funds and assets, the contracts and the user journey. An offer that combines several of these features often amounts to several services at once.

Collective management and financial instruments: other regimes

Pooling several investors’ money to invest it under a defined policy is collective management, not a MiCA service. The vehicle is usually an alternative investment fund (AIF), managed by a management company authorised by or registered with the AMF.

Where the portfolio includes financial instruments, such as security tokens or derivatives, their management falls under MiFID II and requires authorisation as an investment firm.

What to plan for

• Qualify the service precisely before launch.
• Obtain CASP authorisation, or operate on behalf of an authorised CASP under a suitable contractual framework.
• Sign a written management mandate setting out objectives, limits and fees.
• Comply with consumer law (pre-contractual information, commercial practices, unfair terms).
• For a provider based outside France, check the conditions for serving the French crypto market from abroad.