Menu
Avocats spécialistes des prestataires de services sur crypto-actifs
Retour à l’expertise

Crypto-asset service providers (CASP)

ORWL is the leading law firm advising CASPs in France. The firm assists all crypto and Web3 participants with the regulatory compliance of their activities. As a pioneer in this sector, the firm actively participates in the development of relevant legislation and the securing of this industry to provide clients with solutions and visibility within a regulatory framework that is still evolving.

Financial activities involving crypto-assets are subject to a European framework under the MiCA regulation. This regime aims to regulate companies wishing to provide crypto-asset services in France and within the European Union. The supervision of CASPs and investor protection are entrusted to the Autorité des Marchés Financiers (AMF) and, in respect of certain aspects, to the Autorité de Contrôle Prudentiel et de Résolution (ACPR).

What is the CASP regime?

The CASP regime governs the provision of services in relation to crypto-assets in France.

The concept of crypto-assets under the MiCA regulation

Crypto-assets within the meaning of Article 3 of the MiCA regulation include four main categories:

  • electronic money tokens (e-money tokens), which refer to crypto-assets whose value is stable in relation to one official currency,

  • asset-referenced tokens, which refer to crypto-assets whose value is stable by referencing another value or right or a combination thereof,

  • utility tokens, which refer to crypto-assets intended only to provide access to a good or a service supplied by their issuer,

  • and finally, other crypto-assets, which refer to cryptocurrencies whose value is not guaranteed by an issuer, such as bitcoin or ether.

Tokens having the characteristics of a financial instrument are explicitly excluded from the scope of the MiCA regulation. Similarly, most crypto-assets that are unique and not fungible do not fall within this framework, provided they are not economically fungible.

Contact us

Crypto-asset services

In order to regulate participants providing services related to crypto-assets, the MiCA regulation governs crypto-asset services strictly:

  • providing custody and administration of crypto-assets on behalf of clients,

  • operation of a trading platform for crypto-assets,

  • exchange of crypto-assets for funds,

  • exchange of crypto-assets for other crypto-assets,

  • execution of orders for crypto-assets on behalf of clients,

  • placing of crypto-assets,

  • reception and transmission of orders for crypto-assets on behalf of clients,

  • providing advice on crypto-assets,

  • providing portfolio management on crypto-assets,

  • providing transfer services for crypto-assets on behalf of clients.

CASP authorisation

The procedure for authorisation as a CASP is detailed in the MiCA regulation. It requires demonstrating full compliance with all obligations set out in this regulation regarding:

  • own funds and financial soundness,

  • prevention of money laundering and terrorist financing (Travel rule),

  • cybersecurity and operational resilience,

  • protection of investors and prevention of market abuse,

  • governance and internal control,

  • compliance with disclosure requirements for the environmental impact of crypto-assets.

In addition to general information, the applicant must provide several pieces of information, notably its programme of operations, to allow the competent authority to evaluate the application. The applicant’s programme of operations details the scope of services provided by the provider.

Contact us

Why use a lawyer for CASP regulation?

Seeking advice from our lawyers allows you to benefit from:

  • sophisticated expertise in regulatory support for crypto-assets: our lawyers closely follow all legal developments in this field and are able to advise you in an enlightened and pragmatic manner on all characteristics of your business. This expertise allows us to provide you with pragmatic and operational solutions, avoiding friction or sanctions from the regulator,

  • personalised advice regarding your business and business model: since the firm’s creation, ORWL’s regulatory team has supported a very large number of players in their procedures to obtain CASP authorisation. Furthermore, the entire team is trained on the functioning of crypto technologies. This perspective allows the firm to deliver advice tailored to each situation, drawing on experience gained from previous cases to save you time,

  • a connection to the crypto-asset industry: in constant discussion with regulators, the administration, trade associations, professional advisors (notaries, accountants, cybersecurity consulting firms, etc.) and crypto-asset industry players, ORWL’s lawyers have a precise vision of the industry and upcoming regulatory developments. Our lawyers will not hesitate to put you in touch with the best professionals or provide you with the market best practices to move your project forward.

Our expertise, experience, and network of partners (banks, accountants, cybersecurity consultants) allow us to provide tailored and comprehensive advice to secure the regulatory aspects of your business or obtain a CASP authorisation.

Contact us

Our free resources on CASP regulation

Involved in the democratisation of the crypto-asset industry, ORWL produces numerous freely accessible works to help companies and investors in the sector understand the regulatory framework applicable to crypto-assets. Regarding the CASP regime, ORWL publishes many explanatory articles on its blog:

Furthermore, ORWL offers its clients a dedicated newsletter to keep them informed as a priority of all developments likely to impact their activities.

FAQ - CASP

Crypto-asset services correspond to financial activities provided by a provider to its clients (“on behalf of third parties”). Due to the risks inherent in this type of activity (money laundering, hacking, fraud, etc.), French and European legislators have subjected these providers to a protective regime for investors.

To fall outside of the scope of the crypto-asset service notion within the meaning of MiCA, it is generally necessary to prove:

  • either that the activity does not fall within the scope of crypto-asset services exhaustively defined by MiCA. For example, providing general financial information cannot be qualified as investment advice,

  • or that the service does not concern a crypto-asset, such as most non-fungible tokens (NFTs),

  • or that the service is not provided on behalf of third parties, i.e., all proprietary activities: treasury management, intra-group activities, purchase or sale of crypto-assets for one’s own company, etc.

Market players located abroad fall within the scope of French regulation provided they target the national market based on a bundle of indices such as (i) having a commercial presence in France, (ii) making promotional communications, regardless of the medium, to clients residing or established in France, (iii) marketing its services via a distribution network aimed at clients residing or established in France, (iv) having a postal address or telephone contact details in France, or (v) having a “.fr” domain name.

In contrast, offering services in euros or in French, which are not currencies or a language exclusive to the French territory, does not in itself qualify as targeting the French market.

From our experience, the main difficulties in obtaining a CASP authorisation are not legal.

In our view, the three main obstacles are:

  • failing to anticipate the effect of a regulated status on the company’s functioning in the short and long term,

  • failing to invest sufficiently in human or intellectual resources (recruitment, training, etc.). For illustration, at least 5 full-time equivalents (FTEs) dedicated to the CASP activity are required to file an authorisation application (MLCO, MLRO, CISO, Customer support, etc.),

  • failing to anticipate regulatory changes. Thus, it is necessary to properly consider what this new framework will change for French and European players.

Once authorised, the CASP is subject to supervision and monitoring by the regulators.

Monitoring can be carried out on-site directly at the provider’s premises, to verify compliance with security, asset management, and client protection procedures. Monitoring can cover all of the CASP’s obligations (financial, AML/CFT, prudential rules, marketing) and lead to remediation measures and sanctions.

In France, exercising a crypto-asset service without obtaining a CASP authorisation is punishable by two years’ imprisonment and a EUR 30,000 fine. Administrative penalties are based on the following provisions of the MiCA regulation:

  • a public statement specifying the identity of the natural or legal person responsible and the nature of the infringement,

  • an order to cease the infringement,

  • administrative fines that can reach:

    • for natural persons: at least EUR 700,000,

    • for legal persons: at least EUR 5,000,000 or 3% to 12.5% of the annual turnover, depending on the severity of the infringement,

  • the withdrawal or suspension of the authorisation for CASPs,

  • a temporary ban for members of the CASP’s management body from exercising management functions within a CASP.

The substance requirement, within the meaning of the MiCA regulation, implies a real and operational presence in France. Supervisory authorities notably expect:

  • two effective managers residing in the European Union, at least one of whom is based in France,

  • an AML-CFT officer, whose function can, for small structures, be combined with that of the compliance officer (RCCI) and Tracfin declarant. This function must be performed from France,

  • an Information Systems Security Officer (ISSO), which can be outsourced if necessary,

  • depending on the nature of the activity, one or more employees responsible for complaints management, operational monitoring, and client relations (notably for custody or order execution services) from France.

These functions must have effective delegations and be attached to the operational headquarters in France. The level of substance required is proportionate to the size and activity of the provider, but it must ensure autonomous governance and effective internal control. Finally, a mere commercial domiciliation (P.O. box, shared address, or coworking without an effective presence) is not sufficient to characterise an operational office.

Are you developing a crypto project or seeking to provide services related to crypto-assets? Contact us today.