Self-custodial wallet / non-custodial software in European Union
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in European Union without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- Self-custodial wallet software publishers that never hold, control, or have access to user private keys or funds are generally not considered CASPs under MiCA (EU 2023/1114) because they do not provide any of the nine listed crypto-asset services — custody and administration on behalf of clients (Class 1) specifically requires the provider to hold or control client crypto-assets on behalf of clients.
- However, if the software includes any ancillary services that involve the provider handling assets (e.g., an integrated swap feature where the publisher routes or momentarily controls funds), the provider may be reclassified as a CASP and subject to full MiCA authorization, including AML/CFT obligations under AMLD6 and Travel Rule obligations under the Transfer of Funds Regulation (recast) at EUR 0 threshold.
- If the publisher merely provides software without any custody, execution, or transmission role, no AML/CFT registration or licensing obligation attaches under MiCA or AMLD6, as the publisher is not a 'crypto-asset service provider.'
- Travel Rule obligations under the Transfer of Funds Regulation (recast) — EUR 0 threshold (no de minimis) — apply only to CASPs; non-custodial software publishers without CASP classification are not subject to Travel Rule reporting.
Key Restrictions
- Publisher must not hold, control, or have access to user private keys or funds at any point; any custody-like feature (e.g., key sharding, backup services, integrated swap routing) could trigger CASP classification under MiCA.
- If the software offers integrated non-custodial exchange/swap features (e.g., through DEX aggregators), the publisher must ensure it does not take custody, execute orders, or transmit funds on behalf of users — doing so would trigger CASP authorization under one or more MiCA service classes (exchange, order execution, transfer services).
- DAC8 (tax reporting) obligations effective 2026 apply to CASPs, not to software publishers per se; however, if the wallet includes fiat on-ramp/off-ramp features that involve a CASP partner, the partner is the reporting entity.
- Consumer protection and disclosure rules under MiCA (transparency, white papers) apply to certain token offerings and CASPs, not to non-custodial software publishers as such — however, if the wallet promotes or facilitates access to specific tokens, general consumer protection laws (e.g., Unfair Commercial Practices Directive) may apply.
Key Risks
- Regulatory creep risk: NCAs may increasingly interpret self-custodial wallet software as providing 'crypto-asset services' if the software generates revenue from transaction routing, swap fees, or user activity, potentially reclassifying the publisher as a CASP.
- Fragmentation risk: Some member states (e.g., France, Germany) have adopted transitional periods of different lengths and may impose stricter interpretations of what constitutes 'custody' or 'transfer services', creating uncertainty for publishers serving EU-wide users.
- Travel Rule exposure: If an NCA determines that the wallet publisher's role in facilitating transactions (even non-custodially) constitutes a 'transfer service', the publisher could be retrospectively subject to Travel Rule obligations with no de minimis threshold.
- Enforcement precedent risk: The French AMF's January 2026 enforcement action against an unregistered non-EU CASP and the Dutch AFM's warnings to firms without complete applications signal increasing scrutiny of all crypto-adjacent service providers operating in the EU.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
MiCA, Regulation (EU) 2023/1114 of 31 May 2023 (OJ L 150, 9.6.2023, p. 40), governs CASP authorisation, crypto-asset white papers and ART/EMT issuance; Titles III and IV (ARTs and EMTs) apply from 30 June 2024 and the rest, including CASP rules, from 30 December 2024 (Art 149).
MiCA lists 10 crypto-asset services (Art 3(1)(16)) grouped in three minimum-capital classes (Annex IV): Class 1 EUR 50,000 (execution, placing, transfer, reception/transmission, advice, portfolio management); Class 2 EUR 125,000 (adds custody, exchange for funds, exchange crypto-for-crypto); Class 3 EUR 150,000 (trading platform); the requirement is the higher of that amount or one quarter of prior-year fixed overheads (Art 67(1)).
Under MiCA a CASP providing custody and administration of crypto-assets on behalf of clients is a Class 2 provider with minimum capital of EUR 125,000, or one quarter of prior-year fixed overheads if higher (Art 67(1), Annex IV), and must segregate client crypto-assets from its own holdings, including on the distributed ledger (Art 75(7)).
The recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, has applied since 30 December 2024 and requires originator and beneficiary information on every crypto-asset transfer regardless of amount; transfers exceeding EUR 1,000 to or from a self-hosted address also trigger a CASP check of ownership or control of that address.
AMLD6, Directive (EU) 2024/1640 of 31 May 2024, sets the national AML/CFT supervisory and FIU framework; Member States must transpose it by 10 July 2027, when it repeals Directive (EU) 2015/849, the AML directive that still applies to CASPs until then.
DAC8, Council Directive (EU) 2023/2226 of 17 October 2023, extends EU automatic exchange of tax information to crypto-assets; Member States had to transpose it by 31 December 2025 and apply it from 1 January 2026, with first reports covering calendar year 2026.
In January 2026, the French Autorité des Marchés Financiers (AMF) became the first NCA to publicly announce a formal enforcement action under MiCA, issuing a cease-and-desist order against an unregistered non-EU CASP (CryptoFlow Ltd., registered in the Cayman Islands) for soliciting French residents without authorization; the AMF noted this action as a "test case" for MiCA enforcement coordination across NCAs AMF MiCA Enforcement Action January 2026
A March 2026 analysis by the European Systemic Risk Board (ESRB) identified that 8 of the 27 EU NCAs had not yet finalized their MiCA enforcement guidelines by Q1 2026, creating "supervisory fragmentation risks" for CASPs operating across multiple member states; the ESRB warned that this could lead to inconsistent application of authorization requirements and investor protections by the April 2026 enforcement date ESRB Analysis of MiCA Supervisory Fragmentation
The European Commission's March 2026 enforcement update confirmed that the Netherlands Authority for the Financial Markets (AFM) had issued formal warnings to 14 crypto-asset firms for failing to submit complete authorization applications by the February 28, 2026 deadline; the AFM warned that firms without approved authorization by April 1, 2026, would face immediate suspension orders European Commission MiCA Enforcement Update March 2026
Practical enforcement examples by April 2026 remain limited; however, in late 2025, the Dutch Authority for the Financial Markets (AFM) issued warnings against several unregistered crypto firms operating without transitional provisions AFM Crypto Warnings
MiCA Art 143(3), not Art 127, lets crypto-asset service providers that operated lawfully before 30 December 2024 continue until 1 July 2026 and lets each Member State shorten or disapply that period; per ESMA's list, Germany chose 12 months and France the full 18 months, while Latvia, Hungary, the Netherlands, Poland, Slovenia and Finland chose 6 months.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Pure non-custodial wallet software publishing does not trigger CASP/VASP classification under MiCA because the publisher never holds or controls user funds, but the publisher must rigorously avoid any custody-like ancillary features (e.g., key backup, integrated swap routing that touches funds) or revenue models tied to transaction execution, which would reclassify it as a CASP subject to full MiCA authorization, AML/CFT obligations under AMLD6, and Travel Rule requirements at a EUR 0 threshold.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?