CASP and payment institution: dual licensing

Holding client funds, opening a euro balance for them, transferring e-money tokens (EMTs) on their behalf: in a crypto project, these operations often amount to payment services. Since 19 February 2026, the ACPR, the French prudential supervisor, has required a crypto-asset service provider (CASP) that holds or transfers EMTs for its clients to also hold a payment institution authorisation, or to rely on an authorised provider.

For a wallet, a marketplace or a fiat on- and off-ramp, the line is drawn flow by flow. ORWL Avocats qualifies each flow, settles the structure and handles the applications before the AMF, the French financial markets authority, and the ACPR.

Is your crypto business a payment service?

In France, as across the European Union, only authorised payment service providers (credit institutions, payment institutions and e-money institutions) may provide payment services as a regular business. PSD2, the EU Payment Services Directive, lists those services. A crypto project falls within scope as soon as:

• you keep a euro balance for your clients that they can top up, spend or withdraw: that balance may be a payment account;
• you collect funds on behalf of a third party, such as a merchant or a seller on your platform;
• you transfer funds or EMTs from a client to a third party;
• you issue or distribute a payment instrument, such as a card linked to a balance in crypto-assets or stablecoins.

Client funds in transit at a CASP

The MiCA Regulation allows a CASP to hold client funds for the purposes of its service, for instance the price of a crypto-asset purchase. It must then safeguard them, place them with a credit institution or a central bank by the end of the business day following receipt, and keep them in a separate account (Article 70 of the MiCA Regulation). The same article states that payment services connected with the crypto-asset service require authorisation under PSD2, held by the CASP itself or by a third party.

Our rule is therefore simple: in principle, a CASP does not receive client funds without a payment authorisation. Exceptions exist, in specific cases. We check them during the qualification, flow by flow, before any application is filed.

Marketplaces, limited networks, agents: the exclusions

PSD2 leaves certain transactions outside its scope. Two exclusions come up in crypto and Web3 projects.

• The commercial agent: the transaction goes through an intermediary authorised by contract to negotiate or conclude the sale on behalf of the payer only or the payee only. A marketplace that acts for both buyer and seller, with no real room to negotiate, cannot rely on it.
• The limited network: the payment instrument can only be used on the issuer’s premises, within a limited network of acceptors bound to it by a commercial agreement, or for a limited range of goods and services. Above €1 million in transactions over twelve months, the business must notify the ACPR.

In practice, these exclusions rarely help in crypto. Flows are often too large, and a limited network sits badly with tokens that circulate freely on an open blockchain. It can work for points usable within a single game. The commercial agent exclusion remains open where the model fits, provided the mandate is drafted accordingly. The firm also advises NFT marketplaces on these questions.

Acting as the agent of a payment institution or as a distributor of electronic money is not an exclusion: you act on behalf of an authorised institution, which registers you with the ACPR and is liable for your acts.

CASPs: when your EMT services become payment services

The MiCA Regulation deems EMTs to be electronic money. The European Banking Authority (EBA) drew a direct consequence from this, in its no-action letter of 10 June 2025 and then in its opinion of 12 February 2026: a CASP that holds or transfers EMTs for its clients also provides a payment service within the meaning of PSD2. Both documents are addressed to the national authorities of every Member State; in France, the ACPR applies them.

The ACPR adopted this position on 19 February 2026 and updated it on 24 September 2026. Two services trigger the requirement for payment institution authorisation:

• transfer services for EMTs on behalf of clients;
• custody and administration of EMTs on behalf of clients, where the wallets allow EMTs to be sent to and received from third parties.

A CASP that only exchanges crypto-assets for funds or other crypto-assets on its own account stays outside this scope. The compliance deadlines have passed: 2 March 2026 for most CASPs, 1 July 2026 for former PSANs (digital asset service providers registered under the French transitional regime). A CASP that provides these services today without a payment authorisation or an authorised partner is exposed to an order to cease its EMT services.

The firm disputes the basis of this doctrine: treating EMTs as electronic money concerns their issuance, not every transaction involving them. But the doctrine applies, and we build applications on that basis. For CASPs, the ACPR has opened a streamlined application (agrément allégé) for payment institution authorisation, which we conduct with them. The firm also advises stablecoin issuers, whose issuance of EMTs requires credit institution or e-money institution status.

How should the dual status be organised?

The right structure depends on the volume of flows, the place of payments in the business model and the resources available for a second authorisation.

What dual status changes for a CASP

The streamlined application shortens the file, not the governance and own funds requirements:

• Governance. A payment institution must have a supervisory body separate from its executive management, which is optional for a CASP. Many CASPs need to amend their articles of association.
• Own funds. The ACPR accepts, by way of exception, that the requirements of the two statuses be pooled. For a CASP whose services require only €50,000 of minimum capital under MiCA, payment institution status raises that minimum to €125,000.

A joint review, coordinated by the firm

The AMF reviews the CASP application and the ACPR the payment application; the ACPR also gives an opinion in the review of the CASP file. The two procedures run in parallel, on timetables that do not match. The firm coordinates both files, aligns the common documents and prepares each exchange with each authority. Allow about nine months. The firm also advises its clients on obtaining CASP authorisation from the AMF and on preparing for the Banque de France security review.

How does our engagement work?

Qualification also sets the strategic elements of the file: a well-qualified service can fall outside an authorisation and save months. When you choose a partner, we help you compare the structures (agent, distributor, outsourcing), we draft or negotiate the contract and the procedures, and we demonstrate the structure to the ACPR. After authorisation, the firm monitors ongoing compliance under both statuses, including AML/CFT.

What PSD3 and the PSR change

On 23 April 2026, the Council of the EU published compromise texts for a third Payment Services Directive (PSD3) and a Payment Services Regulation (PSR), which will replace PSD2 and the E-Money Directive. As at 16 October 2026, neither text has been adopted; application in 2028 is likely. For crypto projects, the compromise texts provide for:

• EMT-specific exclusions. The exchange of EMTs by a CASP, as intermediary or on its own account, and direct transfers between two self-hosted addresses fall outside scope. Custody and transfer of EMTs on behalf of clients remain within it.
• A one-way route. An authorised payment institution will be able to provide certain EMT services after a simple notification. Nothing equivalent is planned for a CASP that wants to provide payment services.
• The end of e-money institution status, merged into payment institution status, with a new authorisation required for all existing institutions.

For a CASP that holds or transfers EMTs for its clients, dual status is the target regime, not a stopgap. For a project where payments dominate, payment institution authorisation followed by a MiCA notification will have to be weighed against dual authorisation. The firm also helps payment and e-money institutions prepare for PSD3.

Why work with ORWL Avocats?

Since 2018, ORWL Avocats has focused on crypto-assets and digital finance. The firm advises CASPs active in EMTs, wallets, payment fintechs and issuers of stablecoin-backed cards, before both the AMF and the ACPR. The firm is ranked in Chambers FinTech and Leaders League.

The line between crypto-assets and payments is a question of legal qualification: it engages the liability of the business and of its directors. A lawyer settles it, protects your exchanges under legal professional privilege (secret professionnel) and answers for the advice given. Knowing both regimes and both authorities, the lawyer avoids building a file for one that contradicts the other.

ORWL Avocats is a focused firm: a partner leads every matter, from qualification to authorisation and throughout the life of the institution.

Does your project handle funds or EMTs? Contact us