MiCA compliance for authorised CASPs

Authorisation opens an ongoing compliance phase: CASPs must honour their file commitments daily and comply with Title V of MiCA. Policies, disclosures, internal control, partner contracts: this guide outlines the AMF’s expectations for authorised entities and details how ORWL Avocats supports providers beyond authorisation.

Which obligations apply to an authorised CASP?

From the first service provided, the crypto-asset service provider (CASP, or prestataire de services sur crypto-actifs, PSCA, in French) is subject to the whole of Title V of Regulation (EU) 2023/1114 (MiCA). The general obligations apply to every service (Articles 66 to 74); rules specific to each authorised service apply on top (Articles 75 to 82).

The general obligations cover:

• conduct: acting honestly, fairly and professionally, giving clients clear and non-misleading information, warning them of risks, publishing the pricing, costs and fees policy (Article 66);
• prudential safeguards: holding at all times own funds, an insurance policy or both, equal to the higher of the minimum capital set in Annex IV and one quarter of the previous year’s fixed overheads (Article 67);
• governance: good repute and competence of the management body, policies and procedures, business continuity, ICT systems compliant with DORA, records of all services, orders and transactions (Article 68);
• informing the AMF of changes to the management body (Article 69);
• safekeeping of clients’ crypto-assets and funds (Article 70);
• complaints handling (Article 71), conflicts of interest (Article 72), outsourcing (Article 73) and the orderly wind-down plan (Article 74).

These obligations do not apply in the abstract. The AMF granted the authorisation on the basis of a programme of operations and specific policies; it reads that file as a description of what the provider will do once authorised. The commitments made therefore bind the CASP: a lasting gap between the file and actual practice is a breach, even if every document formally remains in place. Our page Obtaining CASP authorisation from the AMF describes the content of that file.

Three sets of obligations have their own page and are not covered here: AML/CFT for crypto-asset service providers, ICT resilience under DORA and matters of shareholders and management. DAC8 tax reporting, due since 1 January 2026, falls within the firm’s tax practice; our DAC8 and CARF data-exchange map (in French) sets out its scope.

Service-specific obligations

The table below summarises, for each MiCA service, the document the provider must hold or publish and the conduct obligations the AMF examines most often.

The compliance cycle of a CASP

The life of an authorised CASP follows a cycle. It begins with putting into operation what the file described and continues with periodic reviews, exchanges with the AMF, changes to the business model and, sooner or later, an inspection. Each stage has its own purpose and rhythm.

Stages 3 to 6 recur throughout the life of the CASP. The annual review of conflicts of interest is required by Article 72(3) of MiCA; the other frequencies reflect practice.

The first year is decisive. The provider puts into operation an organisation designed on paper; the first weeks of activity reveal the gaps between the file and reality: a procedure not applied, a provider without a contract, a flow of funds different from the one described, a policy published but never reviewed. For its part, the AMF monitors newly authorised providers through reporting requests and is gradually stepping up that monitoring.

A first-year review corrects those gaps before the regulator finds them. We conduct it in four stages: scoping, collection of documents and practices, gap analysis with an action plan, then remediation until each point is closed.

Policies and documents: what to publish, what to keep internal

MiCA distinguishes the information a CASP must publish on its website, the information it makes available to its clients and the information it keeps internally at the disposal of the AMF. Providers’ websites often mix the three: an internal policy published in full, a conflicts-of-interest summary missing or impossible to find, a pricing policy that omits some fees.

Two pitfalls recur. The first is the policy published exactly as it was filed with the application, without adapting it to the reader: a client does not need the internal control organisation chart, and the AMF does not need marketing copy. The second is the policy that lives on the website but no longer in the company: the annual review required by Article 72(3) for conflicts of interest must leave a trace, and it is prudent to extend that discipline to every policy.

Terms and conditions, client agreements and contracts with partners

Contractual documents are the first the AMF reads when it requests information and the first that clients rely on against the provider. They are not only regulatory: they determine the CASP’s civil liability.

Terms and conditions and the custody agreement

A provider that holds crypto-assets in custody enters into an agreement with each client which sets out at least (MiCA, Article 75(1)):

• the identity of the parties;
• the nature of the service and a description of it;
• the custody policy;
• the means of communication, including the client’s authentication system;
• a description of the security systems;
• fees, costs and charges;
• the applicable law.

The transfer agreement follows a similar logic (Article 82). The terms and conditions of former PSANs (digital asset service providers under the pre-MiCA French regime) are often still built on French rules: they ignore the register of positions, the custodian’s liability for losses caused by its own fault (Article 75(8)) and the exercise of rights attached to the crypto-assets. Redrafting them is one of the first post-authorisation projects.

Contracts with service providers and outsourcing

A CASP that entrusts a function to a third party remains fully responsible for its obligations (MiCA, Article 73). Outsourcing must not impair internal control or the AMF’s ability to supervise the provider. It rests on a written agreement that sets out the rights and obligations of each party, allows the CASP to monitor the third party and to terminate the arrangement, and gives the AMF access to the information it needs.

The contracts we review most often are:

• the agreement with the technical custodian or wallet provider;
• the agreement with the liquidity provider or the platform that executes orders;
• the agreement with the identity verification provider;
• the account agreement with the institution that receives clients’ funds (Article 70);
• the agreements with ICT providers, which also fall under DORA.

Outsourcing a critical or important function within the meaning of DORA adds its own clauses and a register of information; our page DORA for CASPs covers them. Where the receipt of funds goes beyond the mere transit of a transaction, the question of a payment authorisation arises; it is addressed on our page Crypto-assets and payments.

Best execution, conflicts of interest, records and market abuse

Best execution

A provider that executes orders must take all necessary steps to obtain the best possible result for its clients, taking into account price, costs, speed, likelihood of execution and settlement, size, nature of the order and conditions of custody (MiCA, Article 78). It establishes an order execution policy, informs its clients of it and must be able to demonstrate to them that it has complied with it.

The weak point is rarely the policy itself; it is the evidence. The provider must keep the elements that show, order by order, the execution venue chosen and the result obtained, and review its policy whenever its venues or partners change.

Conflicts of interest

The CASP implements policies and procedures to identify, prevent, manage and disclose conflicts of interest between itself, its shareholders, its management, its staff and its clients, and between clients (MiCA, Article 72). It publishes the nature and sources of those conflicts and the steps taken, and reviews its policy at least once a year.

The most frequent conflicts among crypto providers are:

• a technical provider linked to the CASP through its capital or its people;
• an inventory of crypto-assets held on own account;
• the remuneration of sales teams;
• a shareholder that is also a platform or a liquidity provider.

The method we recommend is a mapping exercise: each conflict scenario is described, rated before and after mitigating measures, and tied to an action plan and an owner. That document is what gives the annual review its substance.

Records

The CASP keeps records of all its services, activities, orders and transactions for five years, and for up to seven years if the AMF so requests before the five years expire; it provides them to clients on request (MiCA, Article 68(9)). These records overlap with the data that DAC8 reporting has required since 1 January 2026; a shared data architecture avoids keeping the same register twice.

Market abuse

Title VI of MiCA prohibits insider dealing, unlawful disclosure of inside information and market manipulation in crypto-assets admitted to trading. Providers that professionally arrange or execute transactions must have detection arrangements in place and report suspicious orders and transactions (Article 92); the operator of a trading platform is bound under Article 76. The subject grows as the market becomes more structured: detection procedure, alert scenarios, staff training and reporting channel are post-authorisation projects.

Insurance and internal control

Insurance

The prudential safeguards of Article 67 of MiCA may be covered by own funds, by an insurance policy or by a combination of the two. The policy must be taken out with an undertaking authorised in the Union, cover the territories where the services are provided and cover the risks listed in the Regulation: loss of documents, false or misleading statements, acts, errors or omissions, failure to establish procedures to prevent conflicts of interest, losses arising from business disruption or system failures, gross negligence in the safekeeping of clients’ assets.

Beyond that prudential function, insurance covers the CASP’s liability towards its clients, in particular the custodian’s liability for losses (Article 75(8)). Professional indemnity and cyber policies taken out before authorisation rarely cover that scope without adjustment: crypto-asset exclusions, limits set too low, scope confined to the French regime. We audit policies against the authorised services and work with brokers to bring them up to standard.

Internal control

Governance and internal control arrangements are proportionate to the scale, nature and range of the services provided (MiCA, Article 68). For a team of five full-time equivalents, the challenge is not to multiply layers of control but to show that each control exists, is performed and leaves a trace. Three strands work together: control of the MiCA model, AML/CFT and ICT resilience.

The compliance officer carries these arrangements. He or she must have the time, access to information and independence required, even when combining other roles. The firm does not perform that function: it advises on it, reviews the arrangements and steps in on matters beyond its scope.

When must the AMF be informed?

MiCA requires three specific notifications:

• any change to the management body, without delay and before a new member takes up office (Article 69);
• any acquisition, increase or disposal of a qualifying holding, subject to prior notification and assessment by the AMF (Articles 83 and 84), covered on our page Shareholders and management of a CASP;
• any new service, which requires an extension of authorisation processed like the initial application (Article 59(8)).

Beyond those cases, the Regulation sets no list. The deciding question is this: could the change affect the provider’s MiCA compliance? A new critical provider, a new country served, a new revenue model or a change in the flow of clients’ funds call for informing the AMF, and sometimes for waiting for its position. An update to the way a service is delivered or to the handling of a conflict of interest already identified does not.

We help our clients answer that question before acting, then prepare the exchange with the AMF when it is required. Ceasing a service or the business follows its own procedure, described on our page Winding down a CASP.

AMF inspections: why a lawyer is needed

The AMF may inspect a CASP at any time, on documents or on site. An inspection begins with a request for documents, continues with interviews and ends with a report to which the provider responds. It may lead to observations, to remediation commitments or to proceedings before the AMF Enforcement Committee (Commission des sanctions), whose decision can be challenged before the courts.

Three reasons make a lawyer’s involvement necessary from the first request:

• experience of the regulation and of the regulator’s expectations, alongside in-house skills or those of a consultant;
• professional secrecy: under the French rules governing lawyers, the response strategy and the analyses prepared with the lawyer are protected and cannot be turned against the provider;
• a pre-litigation perspective: an inspection may end in a sanction, and every response must be written with the Enforcement Committee and the courts that may hear the case in mind.

The firm prepares responses with your teams, reviews every document before it is sent, attends interviews and, where needed, drafts remediation commitments. Our page CASP lawyers in France presents our regulatory enforcement practice as a whole.

How ORWL Avocats supports authorised CASPs

The firm works in whatever form suits the provider:

• a retainer with a block of hours, for day-to-day questions;
• a one-off audit, in particular the first-year review;
• a direct line for urgent questions;
• the secondment of a lawyer into the team, for the largest matters or during an inspection.

Our scope is regulatory, strategic and legal advice: qualification of a new product or activity, review of published policies and contracts, insurance audit, preparation of notifications and exchanges with the AMF, assistance during inspections. Day-to-day maintenance of policies and performance of controls fall to the compliance officer, sometimes supported by a consultant; we work with them.

What we bring comes down to three things. A precise knowledge of the regulation and of crypto business models, built by conducting many authorisation procedures and following authorised providers. The ability to engage with the regulator, grounded in that experience of regulatory qualification. Command of contracts, where a lawyer remains indispensable. Most of the providers we have supported through to authorisation keep calling on us at this stage, on regulatory questions, their communications, their reporting and their exchanges with the AMF.

A question about your CASP’s compliance? Contact us