Remote VASP serving residents in European Union
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in European Union with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP authorization required under MiCA (EU 2023/1114) via home Member State NCA — covers custody, exchange, transfer, execution, placement, advice, portfolio management, reception/transmission, and trading platform services
- Travel Rule applies at EUR 0 threshold (no de minimis) under TFR recast (EU 2023/1113) — originator and beneficiary data must be transmitted on all crypto-asset transfers
- Minimum capital requirements per service class: custody (EUR 50K), exchange (EUR 125K), trading platform (EUR 150K), transfer services (EUR 50K), order execution (EUR 50K), etc.
- Asset segregation and client asset trust obligations mandatory for custody services
- Transitional provisions under Article 127 MiCA — up to 18 months (varies by Member State; e.g. France 6 months, Germany 12 months); existing operators without authorization after transition face enforcement
- AML/CFT harmonization obligations under AMLD6 apply
- DAC8 tax reporting obligations effective 2026
- EBA Travel Rule Guidelines (final July 2024, applicable Dec 30, 2024) specify handling of missing/incomplete beneficiary data
Key Restrictions
- Must be authorized as a CASP by the home Member State NCA (e.g. AMF, BaFin, CNMV, CBI) — remote non-EU entities cannot serve EU residents without EU establishment
- EU-wide passporting available after authorization (notify home NCA, 20 business days) — but requires a local entity in at least one Member State
- No de minimis threshold for Travel Rule — applies to all transfers, including peer-to-peer where a CASP is involved
- Transitional periods vary by Member State — creates compliance complexity for operators serving multiple EU jurisdictions
- National transitional provisions are optional — operators must check each Member State's stance
Key Risks
- Enforcement risk: NCAs have mandate under Article 114 MiCA to pursue unauthorized operators; ESMA (Dec 2024) warned unregulated entities serving EU retail clients face enforcement
- Precedent: AMF (Jan 2026) issued cease-and-desist against unregistered non-EU CASP (CryptoFlow Ltd.) soliciting French residents — demonstrates active enforcement against remote operators
- Supervisory fragmentation risk: 8 of 27 NCAs had not finalized MiCA enforcement guidelines by Q1 2026 (ESRB March 2026 analysis) — uneven enforcement landscape across Member States
- Dutch AFM issued formal warnings to 14 firms for incomplete authorization applications by Feb 28, 2026 deadline
- Practical enforcement examples still limited as of April 2026, but trajectory is toward increasing NCA action against unauthorized cross-border service
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
MiCA lists 10 crypto-asset services (Art 3(1)(16)) grouped in three minimum-capital classes (Annex IV): Class 1 EUR 50,000 (execution, placing, transfer, reception/transmission, advice, portfolio management); Class 2 EUR 125,000 (adds custody, exchange for funds, exchange crypto-for-crypto); Class 3 EUR 150,000 (trading platform); the requirement is the higher of that amount or one quarter of prior-year fixed overheads (Art 67(1)).
A CASP authorised for exchange of crypto-assets for funds or other crypto-assets is a Class 2 provider (EUR 125,000 minimum capital, MiCA Annex IV); to passport, it notifies its home NCA, which forwards the notice to host states within 10 working days, and services may start on receipt or at the latest on the 15th calendar day (Art 65). France kept the full 18-month transition; Germany chose 12 months.
Under MiCA a CASP providing custody and administration of crypto-assets on behalf of clients is a Class 2 provider with minimum capital of EUR 125,000, or one quarter of prior-year fixed overheads if higher (Art 67(1), Annex IV), and must segregate client crypto-assets from its own holdings, including on the distributed ledger (Art 75(7)).
MiCA, Regulation (EU) 2023/1114 of 31 May 2023 (OJ L 150, 9.6.2023, p. 40), governs CASP authorisation, crypto-asset white papers and ART/EMT issuance; Titles III and IV (ARTs and EMTs) apply from 30 June 2024 and the rest, including CASP rules, from 30 December 2024 (Art 149).
The recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, has applied since 30 December 2024 and requires originator and beneficiary information on every crypto-asset transfer regardless of amount; transfers exceeding EUR 1,000 to or from a self-hosted address also trigger a CASP check of ownership or control of that address.
AMLD6, Directive (EU) 2024/1640 of 31 May 2024, sets the national AML/CFT supervisory and FIU framework; Member States must transpose it by 10 July 2027, when it repeals Directive (EU) 2015/849, the AML directive that still applies to CASPs until then.
DAC8, Council Directive (EU) 2023/2226 of 17 October 2023, extends EU automatic exchange of tax information to crypto-assets; Member States had to transpose it by 31 December 2025 and apply it from 1 January 2026, with first reports covering calendar year 2026.
Regulation (EU) 2023/1113 sets no de minimis threshold for crypto-asset transfers: recital 30 states they are subject to the same requirements regardless of amount and whether domestic or cross-border. The only EUR 1,000 figure for crypto-assets is the self-hosted address ownership check in Arts 14(5) and 16(2).
Under Article 14 of Regulation (EU) 2023/1113 the originator's CASP must send the originator's name, distributed ledger address or account number, address or official document number or date and place of birth, and LEI where available, plus the beneficiary's name and address or account, in advance of or simultaneously with the transfer and securely. EBA Guidelines EBA/GL/2024/11 of 4 July 2024 on detecting and handling missing information apply from 30 December 2024 and repeal Guidelines JC/GL/2017/16.
EBA Guidelines EBA/GL/2024/11 of 4 July 2024 on information requirements for transfers of funds and certain crypto-assets under Regulation (EU) 2023/1113 set how payment service providers and CASPs detect and handle missing or incomplete originator and beneficiary information; they apply from 30 December 2024.
In January 2026, the French Autorité des Marchés Financiers (AMF) became the first NCA to publicly announce a formal enforcement action under MiCA, issuing a cease-and-desist order against an unregistered non-EU CASP (CryptoFlow Ltd., registered in the Cayman Islands) for soliciting French residents without authorization; the AMF noted this action as a "test case" for MiCA enforcement coordination across NCAs AMF MiCA Enforcement Action January 2026
A March 2026 analysis by the European Systemic Risk Board (ESRB) identified that 8 of the 27 EU NCAs had not yet finalized their MiCA enforcement guidelines by Q1 2026, creating "supervisory fragmentation risks" for CASPs operating across multiple member states; the ESRB warned that this could lead to inconsistent application of authorization requirements and investor protections by the April 2026 enforcement date ESRB Analysis of MiCA Supervisory Fragmentation
The European Commission's March 2026 enforcement update confirmed that the Netherlands Authority for the Financial Markets (AFM) had issued formal warnings to 14 crypto-asset firms for failing to submit complete authorization applications by the February 28, 2026 deadline; the AFM warned that firms without approved authorization by April 1, 2026, would face immediate suspension orders European Commission MiCA Enforcement Update March 2026
Under MiCA (Regulation (EU) 2023/1114), the NCAs designated under Art 93 hold the supervisory and investigative powers in Art 94, including suspending a CASP's services for up to 30 consecutive working days, prohibiting crypto-asset services and publicly naming a CASP that fails its obligations; Art 111 requires administrative penalties and Art 114 requires penalty decisions to be published. Since the Art 143(3) transitional regime ended on 1 July 2026, no unauthorised CASP has grandfathering cover.
On 17 December 2024 ESMA published a Statement on MiCA transitional measures (ESMA75-453128700-1396) explaining that Member States chose different grandfathering periods under MiCA Art 143(3) and that a CASP serving clients in several Member States must comply with each state's law, so that a shorter national transitional period does not expire before it holds a MiCA authorisation.
Practical enforcement examples by April 2026 remain limited; however, in late 2025, the Dutch Authority for the Financial Markets (AFM) issued warnings against several unregistered crypto firms operating without transitional provisions AFM Crypto Warnings
MiCA Art 143(3), not Art 127, lets crypto-asset service providers that operated lawfully before 30 December 2024 continue until 1 July 2026 and lets each Member State shorten or disapply that period; per ESMA's list, Germany chose 12 months and France the full 18 months, while Latvia, Hungary, the Netherlands, Poland, Slovenia and Finland chose 6 months.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-resident VASP cannot serve EU residents remotely without establishing a local entity and obtaining CASP authorization under MiCA via a home Member State NCA, with full AML/Travel Rule obligations (EUR 0 threshold), and faces active enforcement risk for non-compliance.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?