European Union -- Custody Regulations Regulatory Overview

MiCA, Regulation (EU) 2023/1114, Art 75 sets the custody rules for CASPs: a client agreement and custody policy, a register of positions per client, statements of position at least every three months, segregation of client crypto-assets, and liability for losses from incidents attributable to the custodian, capped at the market value of the lost crypto-asset (Art 75(8)).

Providing custody and administration of crypto-assets on behalf of clients is a crypto-asset service under MiCA, Regulation (EU) 2023/1114, Art 3(1)(16)(a); it requires CASP authorisation under Art 59 (or an Art 60 notification) and Class 2 minimum capital of EUR 125,000 under Art 67(1)(a) and Annex IV, not a CRD licence.

A CASP authorisation application under MiCA, Regulation (EU) 2023/1114, Art 62(2) must include a programme of operations, proof of Art 67 prudential safeguards, governance and fit-and-proper evidence, AML/CFT risk controls, ICT technical documentation, the procedure for segregating client assets and, for custody, the custody and administration policy; the NCA checks completeness within 25 working days (Art 63(2)).

MiCA, Regulation (EU) 2023/1114, is enforced against CASPs, including custodians, by the national competent authorities each Member State designates under Art 93, using the Art 94 powers (including suspension of services for up to 30 consecutive working days) and Art 111 administrative penalties; the ECB has no MiCA enforcement role over CASPs.

The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 (OJ L 150, 9.6.2023), is directly applicable in all Member States; its CASP rules, including custody (Art 75), apply from 30 December 2024 and its ART/EMT titles from 30 June 2024 (Art 149). CASPs are also financial entities under DORA, Regulation (EU) 2022/2554, applicable from 17 January 2025.

Under MiCA, Regulation (EU) 2023/1114, crypto-asset custody may be provided in the EU only by a crypto-asset service provider authorised under Art 59 and Art 63, or by a credit institution, investment firm or other listed financial entity that notifies under Art 60; CASP rules have applied since 30 December 2024 (Art 149).

CASP (crypto-asset service provider) is MiCA's own term: Regulation (EU) 2023/1114, Art 3(1)(15) defines it, and a firm offering crypto-asset custody must hold CASP authorisation under Art 59 and Art 63; there is no separate older EU-level CASP scheme that MiCA replaced.

Under MiCA, Regulation (EU) 2023/1114, an applicant for CASP authorisation, including for custody, applies to the competent authority of its home Member State (Art 62(1)); that authority decides under Art 63, and the authorisation is then passported to other Member States by notification under Art 65.

MiCA, Regulation (EU) 2023/1114, Art 75(7) requires crypto-asset custodians to segregate client crypto-assets from their own holdings, hold them separately on the distributed ledger, and keep them legally segregated from the CASP's estate so creditors have no recourse in insolvency; Art 70(1) adds safekeeping arrangements for client ownership rights.

The Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027; until then CASPs, including custodians, apply customer due diligence under Directive (EU) 2015/849 as transposed nationally, which Regulation (EU) 2023/1113 Art 38 extended to crypto-asset service providers and Directive (EU) 2024/1640 repeals from 10 July 2027.

MiCA, Regulation (EU) 2023/1114, Art 111(3) requires Member States to empower competent authorities to fine legal persons up to at least EUR 5,000,000 or 5% of total annual turnover for infringements of the CASP provisions (Arts 59, 60, 64 and 65 to 83, which include the custody rules), or twice the profit gained or loss avoided.

Under MiCA, Regulation (EU) 2023/1114, a national competent authority must withdraw a CASP's authorisation in the cases listed in Art 64(1), including serious infringement of the Regulation or failure to maintain effective AML/CFT systems under Directive (EU) 2015/849, and may suspend its crypto-asset services for up to 30 consecutive working days under Art 94(1)(b).