Obtaining CASP authorisation from the AMF

Since 1 July 2026, no crypto-asset service may be provided in France without authorisation as a crypto-asset service provider (CASP) under the MiCA Regulation, or without a European passport. In France, the AMF (Autorité des marchés financiers, the French financial markets regulator) reviews the application and grants the authorisation, after consulting the ACPR (Autorité de contrôle prudentiel et de résolution, the French Prudential Supervision and Resolution Authority).

ORWL Avocats prepares the application file service by service, files it and answers the regulators’ questions until the decision. This page describes what the file contains, how the AMF reviews it and what it expects for each of the services most often requested: custody, exchange, reception and transmission of orders, and advice.

Who needs CASP authorisation?

Any legal person that provides, on a professional basis, one of the ten crypto-asset services listed in MiCA (Article 3(1), point (16)) must be authorised by the competent authority of the Member State where it has its registered office, and must provide at least part of its services there (MiCA, Article 59(1) and (2)). The authorisation is valid throughout the Union; it specifies the services covered, and each new service requires an extension (MiCA, Article 59(5) and (8)).

In France, the application is filed with the AMF, under the conditions set by its General Regulation (French Monetary and Financial Code (CMF), Article L. 54-10-7, I). The AMF obtains the binding opinion (avis conforme) of the ACPR on the internal control and anti-money laundering and counter-terrorist financing (AML/CFT) framework, and its non-binding opinion on the good repute and competence of managers and shareholders. These opinions are not required where the applicant is a portfolio management company (société de gestion de portefeuille) or intends to provide only advice, portfolio management, or both.

Three situations follow a different route:

• Institutions that are already authorised, such as credit institutions, investment firms, electronic money institutions or management companies, provide certain services after a notification rather than an application for authorisation (MiCA, Article 60); this procedure, closer to a lighter authorisation than to a formality, is described below.
• Providers authorised in another Member State serve French clients under the MiCA passport.
• The transitional period open to former French digital asset service providers (prestataires de services sur actifs numériques, PSAN) ended on 1 July 2026: the simplified procedure reserved for them is closed, and every application now follows the ordinary procedure described here. On 6 July 2026, the AMF reported that France ranks second in the Union by number of authorised CASPs.

The preliminary question remains that of qualification: which service, on which asset, for which clients, from where.

It determines the scope of the authorisation and the capital class, and it may conclude that some activities fall outside the authorisation or need not be included in it: setting them aside at this stage avoids a heavier file, a longer review and permanent obligations that serve no purpose. Where the question concerns the token itself, our page Qualifying a token under MiCA addresses it in detail.

Institutions that are already regulated: a notification that looks like an authorisation

Credit institutions, investment firms, electronic money institutions, management companies, central securities depositories and market operators may provide certain crypto-asset services after notifying the competent authority at least 40 working days before starting the activity (MiCA, Article 60).

In France, the notification is addressed to the ACPR or to the AMF depending on the institution’s status (CMF, Article L. 54-10-7, II and III), on the form shared by the two authorities under Regulations (EU) 2025/303 and 2025/304.

The word should not mislead. The notification contains the essentials of an application for authorisation: programme of operations, governance, internal control, AML/CFT, segregation, information systems, documents specific to each service. The regulators review it with the same rigour, and their questions often go beyond the letter of the Regulation. We prepare it as a lighter authorisation file, drawing on what the institution has already provided to its supervisor.

What does the CASP application file contain?

Article 62(2) of MiCA lists the information to be provided. Commission Delegated Regulation (EU) 2025/305 specifies its content, and Commission Implementing Regulation (EU) 2025/306 prescribes the form. The AMF, for its part, publishes three forms to be completed: the application form, the appointment form for members of the management body and a cybersecurity self-assessment form under DORA (AMF, forms for the MiCA authorisation file, 12 December 2025).

A complete file is made up of eight blocks:

• Identification of the applicant: name, legal entity identifier, legal form, articles of association, website and contact details (Article 62(2), points (a) to (c)).
• The programme of operations: the services envisaged, where and how they will be marketed, the type of crypto-assets concerned (points (d) and (s)). It is developed below.
• Prudential safeguards: evidence that the applicant meets Article 67 (point (e)), with the business plan that supports it.
• Governance, managers and shareholders: a description of the governance arrangements; good repute, knowledge, skills and experience of the members of the management body; identity and good repute of any direct or indirect holder of a qualifying holding (points (f) to (h) and paragraph 3). Later notifications of changes are covered on the page Shareholders and managers of a CASP.
• Internal control and AML/CFT: mechanisms, policies and procedures to identify, assess and manage risks, including money laundering and terrorist financing risks, and the business continuity plan (point (i)). This is the block on which the ACPR issues its binding opinion. The framework itself is described on the page AML/CFT for crypto-asset service providers.
• Information systems and security: technical documentation of the ICT systems and security arrangements, with a description in non-technical language (point (j)). The AMF’s DORA self-assessment form belongs here; the resilience requirements are detailed on the page DORA for CASPs.
• Client protection: the procedure for segregating clients’ crypto-assets and funds (point (k)) and the complaints-handling procedure (point (l)).
• Documents specific to each service: custody policy, operating rules of a trading platform and market abuse detection, commercial policy and pricing method for exchange, execution policy, competence of the persons who advise or manage portfolios, arrangements for transfer services (points (m) to (r)). They are covered in the ‘service by service’ section.

An applicant already authorised under the Electronic Money Directive, MiFID II or PSD2 need not provide again information that the authority already holds, provided it is up to date (Article 62(4)).

The programme of operations

The programme of operations is the central document. It describes each service as it will be provided:

• the target clients and the countries where the services will be marketed;
• the crypto-assets covered and the method for adding new ones;
• the distribution channels, partners and outsourced functions;
• the flows of funds and crypto-assets;
• the organisation and the staff.

Commission Delegated Regulation (EU) 2025/305 details its content; the AMF reads it as the promise that the provider will have to keep once authorised.

It must demonstrate real substance in France:

• effective managers (dirigeants effectifs) established in the Union, at least one of them in France;
• a compliance and AML/CFT officer working from France;
• an information security officer, outsourced where appropriate;
• staff proportionate to the activity; for the most demanding services, the AMF requires at least five full-time equivalents dedicated to the regulated activity.

A registered address without an effective presence is not enough, and a programme that outsources essential functions without the provider’s control is refused.

The business plan and prudential safeguards

The business plan puts figures on the programme of operations over three years: volumes, revenue, costs, headcount and cash, with justified assumptions. The AMF uses it to check the viability of the model and the ability to meet the prudential requirement at all times.

That requirement is set by Article 67 of MiCA. The provider must at all times hold prudential safeguards at least equal to the higher of two amounts: the minimum capital requirement set out in Annex IV, which depends on the services provided, and one quarter of its annual fixed overheads. They take the form of own funds, an insurance policy covering the territories of the Union where the services are provided, or a combination of both.

The business plan must show that this requirement is covered over the three years projected, start-up losses included. For a young company, a few hundred thousand euros is a minimum at the time of filing: the minimum capital for the most requested services is €125,000, and one quarter of the fixed overheads of a team of at least five people quickly exceeds that amount. This requirement is quantified from the scoping phase onwards.

How does the AMF review the application?

Article 63 of MiCA sets out the procedure. The AMF acknowledges receipt within five working days. It then has 25 working days to check that the file is complete; if it is not, the AMF sets a deadline for completing it and may refuse to examine a file that remains incomplete when that deadline expires (paragraphs 1 to 3).

Once the file has been declared complete, the AMF has 40 working days to assess compliance with Title V and to adopt a reasoned decision, notified within five working days (paragraph 9). Until the twentieth working day of that period, it may request additional information in writing; the request suspends the period for 20 working days at most, and later requests no longer suspend it (paragraphs 11 and 12).

The AMF forwards its decision to ESMA within two working days, for entry in the European register (paragraph 13); in France, it publishes the list of authorised providers (CMF, Article L. 54-10-7, V).

Time limits in working days, running from receipt of each document or decision. Observed duration between filing and decision: six to nine months on average.

Before deciding, the AMF consults the ACPR under the conditions described above, the competent authorities of other Member States where the applicant belongs to a financial group authorised there, and may consult the anti-money laundering authorities and the financial intelligence unit (paragraphs 5 and 6).

It refuses the authorisation in three cases (paragraph 10):

• the management body poses a threat to the sound and prudent management of the provider or exposes it to a serious risk of money laundering;
• the managers or shareholders do not meet the criteria of Article 68;
• the applicant does not meet, or is likely not to meet, one of the requirements of Title V.

The decision may be challenged before the courts (MiCA, Article 113).

Added together, these periods give a theoretical minimum of about 70 working days, a little over three months, without a request for additional information, and about 90 working days, more than four months, with a suspension.

Practice departs from this: requests for additional information and exchanges with the AMF interrupt the time limits, and the review of a custody or execution application takes six to nine months on average between filing and decision.

For the most innovative business models, an exchange with the AMF before filing is possible and recommended: it makes it possible to present the project, to test the qualification chosen and to anticipate the questions. During the review, the provider remains the regulator’s counterpart; the firm prepares each exchange, takes part in it and handles the follow-up.

The AMF’s questions

The regulator’s questions follow consistent lines:

• Business model: consistency between the programme of operations, the business plan and the headcount announced; dependence on a partner or on a market.
• Substance: who decides in France, who controls outsourced providers, how the provider keeps control of critical functions.
• Custody: where the keys are, who has access to them, how clients’ crypto-assets are segregated and returned.
• Flows of funds: how clients’ funds are received and deposited (MiCA, Article 70), and whether the activity involves a payment service that calls for the ACPR, a question addressed on the page Crypto-assets and payment services.
• AML/CFT: risk classification, monitoring scenarios, blockchain analytics tool, travel rule.
• Conflicts of interest and pricing: pricing method, remuneration received from third parties, own-account transactions.
• Cybersecurity: testing, incident management, ICT third-party providers.

We prepare each answer with your teams and, where a question reveals a weakness in the arrangements, we fix the arrangements rather than the answer.

What does each service require?

Each service included in the authorisation adds documents to the file (MiCA, Article 62(2), points (m) to (r)) and ongoing obligations (Articles 75 to 82). The four services below are the most requested in France. Operation of a trading platform (Article 76), execution of orders (Article 78), placing (Article 79) and transfer (Article 82) follow the same logic; we handle them within the application.

Custody and administration of crypto-assets

The file describes the custody and administration policy (Article 62(2), point (m)). Once authorised, the provider (MiCA, Article 75):

• enters into an agreement with each client specifying the parties, the nature of the service, the means of communication, security, fees and the applicable law;
• keeps a register of positions for each client;
• applies a custody policy that reduces the risk of loss due to fraud, cyber threats or negligence;
• facilitates the exercise of the rights attached to the crypto-assets;
• segregates clients’ holdings from its own and from those of other clients;
• is liable to its clients for the loss of crypto-assets or of the means of access attributable to it, up to their market value at the time of the loss.

Custody falls within Class 2 of Annex IV. The AMF pays particular attention to the key architecture: generation, storage, signing, use of a sub-custodian, back-up procedures.

It examines with equal care the segregation of clients’ crypto-assets, to rule out any risk of commingling with the provider’s own holdings: the collapse of FTX in 2022, where client assets had financed the group’s operations, showed what it costs when that separation is missing. The file must establish that client holdings are identifiable at all times, kept at separate addresses and beyond the reach of the provider’s operations.

Exchange of crypto-assets for funds or for other crypto-assets

The file describes a non-discriminatory commercial policy governing relations with clients and the method for determining the price of the crypto-assets exchanged (Article 62(2), point (o)). The authorised provider publishes that policy and either a firm price or the method for determining the price, executes orders at the price displayed when they are received, and publishes after trading the volumes and prices of the transactions concluded (MiCA, Article 77). Exchange falls within Class 2.

Two questions come up in every review:

• the management of crypto-asset inventories and the market risk the provider carries on its own account;
• the circuit of clients’ funds, which must be deposited with a credit institution or a central bank by the end of the working day following their receipt at the latest (Article 70(3)); where the provider receives funds in order to transmit them or holds them beyond the transaction, a payment authorisation may become necessary.

The AMF also pays close attention to the qualification of the exchange service and to its distinction from execution of orders. The question looks simple; it is not.

MiFID II draws a similar distinction between dealing on own account and execution of orders on behalf of clients, but it does not carry over as such: the wording of MiCA and the positions of the authorities depart from it, and crypto-assets have features of their own, in particular holding in units rather than in accounts and the place of e-money tokens in the pairs traded. The file must therefore describe precisely who is the client’s counterparty, at what price and at what point ownership of the crypto-assets is transferred.

Reception and transmission of orders

This service covers the provider that collects its clients’ orders and transmits them to a third party for execution, without executing them itself: a broker, a comparison service with order routing, an application built on a partner platform. The file describes it in the programme of operations and in the conflicts of interest policy.

The authorised provider (MiCA, Article 80):

• establishes procedures and arrangements for the prompt and proper transmission of orders;
• receives no remuneration, discount or non-monetary benefit for routing orders to a trading platform or to another provider;
• does not misuse information relating to pending orders.

Reception and transmission falls within Class 1. The main review issue concerns remuneration models: payments received for routing orders, known as payment for order flow, which Article 80 prohibits and which the MiFIR review also prohibited for financial instruments. The AMF examines each flow of remuneration between the provider and the platform or provider that receives its orders, to check that none of them rewards the routing itself.

It also checks how the service fits with execution of orders (Article 78) and with exchange: who is the client’s counterparty, and at what point.

Advice on crypto-assets

Advice is a personalised recommendation made to a client on one or more transactions or on the use of a service (MiCA, Article 3(1), point (24)). The file provides evidence that the natural persons giving advice on behalf of the provider have the necessary knowledge and expertise (Article 62(2), point (q)).

The authorised provider (MiCA, Article 81):

• assesses whether the advice is suitable for the client’s situation, risk tolerance and ability to bear losses;
• states whether the advice is provided on an independent basis and which range of crypto-assets it covers;
• informs the client of the costs and risks, and provides a suitability report.

Advice falls within Class 1 and, where it is requested alone or together with portfolio management, the application does not give rise to an ACPR opinion (CMF, Article L. 54-10-7, I). The review focuses on the line between advice and general information, on the client questionnaire and on the competence of the advisers.

How ORWL Avocats runs a CASP authorisation project

Every engagement begins with a scoping phase. We get to know the project in detail, we qualify each part of the activity under MiCA and we settle the strategy of the application with you: which services to request, in what order, with what organisation, and how to present the project to the regulator. An effective application is decided at this stage.

The engagement then takes one of two forms, depending on your resources and your experience of the regulator:

• the firm holds the pen: it drafts the programme of operations, the policies and the procedures, assembles the documents and conducts the filing;
• your teams, or a consultant, draft, and the firm advises, reviews and settles the points of qualification and strategy.

In both cases, we manage the project: timetable, document matrix, tracking of questions, coordination of contributors. A young company and an institutional player, a provider already known to the French regulator and a foreign group do not have the same needs; we adjust the arrangements to each.

Where needed, we call on a network of partners used to crypto-asset projects:

• financial and accounting experts for the business plan and the prudential safeguards;
• cybersecurity providers for the DORA self-assessment;
• insurance brokers for the Article 67 policy;
• banks for the deposit of clients’ funds.

We coordinate their work with the application.

During the review, you remain the regulator’s counterpart; we prepare each exchange with the AMF and the ACPR, take part in it and handle the follow-up, and we provide legal analyses signed by the firm where useful.

After the decision, we support you in implementing what the file described, then throughout the life of the authorised provider: ongoing compliance, described on the page MiCA compliance for authorised CASPs, extensions of authorisation, changes in shareholding.

Why entrust your CASP authorisation to ORWL Avocats?

An application for authorisation is a procedure you will go through once; we go through it continuously. The firm has supported crypto-asset service providers since the creation of the French PSAN regime by the PACTE Act of 22 May 2019 (loi PACTE), then under MiCA, through to the grant of their authorisation, across the full range of services: reception and transmission of orders and distribution, custody, execution, exchange, up to the operation of trading platforms. Most of them then entrust us with the follow-up of their obligations as authorised providers. This practice gives us a precise knowledge of what the AMF and the ACPR expect and of the questions they ask; it saves you time.

Our specialisation gives us a technical understanding of the activities we qualify: the line between exchange and execution, the treatment of staking and yield activities, the architecture of a custody service. It allows us to demonstrate the compliance of activities that the Regulation does not describe word for word, and to leave out of the file those that need not be in it.

As a boutique firm, we work in close contact with market participants, industry associations and the regulators, and the partners are involved in every engagement. You gain counterparts who know your business model as well as the regulation. For an overview of our work, see the page CASP lawyers in France.

Preparing a CASP authorisation application? Contact us