Custodial wallet / SaaS in France
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in France with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP authorization under MiCA via AMF — custody is a licensed MiCA activity with EUR 50,000 minimum capital (fr.licensing.custody, fr.licensing.vasp)
- Mandatory KYC: collect, verify, and store identity documents (e.g., two forms of ID); use of third parties permitted (fr.aml.collect-verify-and-store-identity, fr.aml.amlcft-for-casps-since-december)
- Enhanced Due Diligence (EDD) required for PEPs, transactions over €1,000 to self-hosted wallets, and cross-border activities (fr.aml.enhanced-due-diligence-edd-for)
- Ongoing transaction monitoring, KYB for corporate clients (beneficial ownership), and ML/FT risk assessment systems (fr.aml.ongoing-transaction-monitoring-kyb-for)
- FATF Travel Rule compliance under MiCA for transfers above reporting thresholds (fr.aml.markets-in-crypto-assets-regulation-mica)
- Suspicious transaction reporting to TRACFIN (fr.licensing.tracfin-handles-suspicious-transaction-reports)
- Managers and beneficial owners verified during AMF registration (fr.aml.managers-and-beneficial-owners-verified)
- DAC8 obligation (effective Jan 1, 2026): CASPs must report user crypto transactions to tax authorities (fr.licensing.dac8-implementation-finance-bill-2025)
- AML/CFT policies, CDD, and registration obligations under 5AMLD implemented in France since Jan 2020 (fr.aml.eu-fifth-aml-directive-5amld)
- EU AML Regulation (AMLR) and 6AMLD: risk-based ongoing KYC, aligned with AMLA for cross-border supervision (fr.aml.eu-aml-regulation-amlr-and)
Key Restrictions
- CASP authorization is required — custody is a licensed MiCA activity; must hold EUR 50,000 minimum capital (fr.licensing.custody)
- Existing PSAN/DASP holders had to transition to CASP by June 30, 2025 — short transition window (fr.licensing.vasp)
- Local entity required: must be incorporated in France or another EU member state to obtain CASP authorization under MiCA (fr.licensing.vasp)
- ACPR prudential supervision applies alongside AMF licensing; possible consolidated supervision (fr.licensing.regulator-acpr, fr.licensing.autorit-de-contrle-prudentiel-et)
- SaaS operator likely bears direct AML obligations as the CASP-licensed custodian — cannot delegate all AML to white-label clients (fr.aml.amlcft-for-casps-since-december, fr.aml.markets-in-crypto-assets-regulation-mica)
Key Risks
- Short 6-month transition from PSAN to CASP (deadline June 30, 2025) creates cliff risk for unlicensed operators (fr.licensing.vasp)
- Allocation of AML obligations between SaaS custody provider and white-label client is not explicitly defined in French law — regulatory uncertainty on who performs CDD
- MiCA minimum capital requirements (EUR 50,000 for custody) are relatively low for institutional custody, but proof-of-reserves and insurance requirements are still being clarified under MiCA Level 2
- ACPR/AMF dual supervision may create coordination friction and higher compliance cost (fr.licensing.regulator-amf, fr.licensing.regulator-acpr)
- No specific segregated-custody or insurance requirements visible in provided facts — operator must assess MiCA Title V custody rules separately
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
The AMF is the French competent authority for MiCA CASP authorisation, and France is the second-largest EU home of authorised CASPs (AMF, 6 July 2026). Circle Internet Financial Europe SAS is listed by ESMA as an AMF-authorised CASP from 23 April 2026 and, separately, as an ACPR-supervised e-money institution issuing the EURC and USDC e-money tokens since 1 July 2024.
The ACPR (Autorité de contrôle prudentiel et de résolution) is the French prudential and AML/CFT supervisor for banks and insurers, applying Monetary and Financial Code articles L. 561-2 ff. and R. 561-1 ff.; under the PACTE regime it gave its AML/CFT opinion on each PSAN before AMF registration.
MiCA Regulation (EU) (2023) — CASP authorization, comprehensive crypto regulation
The loi PACTE of 22 May 2019 created the French regime for initial coin offerings and digital-asset service providers (PSAN). The AMF states that this national regime is to disappear under MiCA, and the PSAN transitional period ended on 1 July 2026.
France applied the full 18-month MiCA transitional period: PSANs registered or licensed under French law could keep serving clients until 1 July 2026. Since 2 July 2026 only crypto-asset service providers (PSCA) authorised under MiCA may provide crypto-asset services in France; the AMF reported 31 French authorisations on 6 July 2026.
Custody and administration of crypto-assets on behalf of clients is a MiCA Class 2 service requiring minimum capital of €125,000 (Regulation (EU) 2023/1114, Annex IV). In France the AMF authorises CASPs offering it; the ESMA interim register listed 36 AMF-authorised French entries on 14 October 2026.
The AMF is the French competent authority that authorises and supervises crypto-asset service providers (PSCA) under MiCA, replacing the PSAN registration and licensing regime of the loi PACTE; it also oversees offers of crypto-assets other than asset-referenced and e-money tokens, whose issuers must be authorised by the ACPR.
The ACPR is the French authority for stablecoin issuers under MiCA: an e-money token issuer must be authorised as a credit institution or electronic money institution and notify the ACPR of its intention to issue and of its white paper. On 14 October 2026 the ESMA register listed 8 French EMT white papers from 6 ACPR-supervised issuers, including Circle Internet Financial Europe SAS, Société Générale – Forge and SALVUS (schuman.io).
Tracfin, the French financial intelligence unit under the Ministry of the Economy, receives AML/CFT suspicious-transaction declarations; the ACPR and Tracfin have issued joint guidelines on vigilance obligations and on declarations and information to Tracfin.
France has replaced the PSAN regime with MiCA authorisation: the AMF stated on 6 July 2026 that the transition from the loi PACTE regime ended on 2 July 2026, that France had authorised 31 crypto-asset service providers and that 283 were authorised across the EU. The ESMA interim register listed 36 AMF-authorised French entries on 14 October 2026.
France's transposition of DAC8 (Council Directive (EU) 2023/2226), including the instrument, its date and the reporting duties of crypto-asset service providers, has no French primary source reachable on 14 October 2026.
AML/CFT for CASPs (since December 30, 2024): Mandates KYC, transaction monitoring, and sanctions compliance.
The loi PACTE of 22 May 2019 created the French PSAN regime, which required at a minimum an AML/CFT framework; the ACPR gave its AML/CFT opinion on each digital-asset service provider before AMF registration because these providers present high money-laundering risks.
The ACPR lists Directive (EU) 2015/849 as amended by Directive (EU) 2018/843 (the fifth AML directive) among the EU AML/CFT texts in force in France, alongside Monetary and Financial Code articles L. 561-2 ff.; the AMLR (2024/1624) applies from 10 July 2027 and AMLD6 (2024/1640) must be transposed by that date.
MiCA sets CASP minimum capital at €50,000 (Class 1), €125,000 (Class 2, including custody and exchange) or €150,000 (Class 3, trading platforms) under Annex IV of Regulation (EU) 2023/1114. French PSANs had until 1 July 2026 to obtain AMF authorisation, and transfers of crypto-assets follow Regulation (EU) 2023/1113, which the ACPR lists as in force.
EU AML Regulation (AMLR) and Sixth AML Directive (AMLD6): Standardizes KYC as ongoing, risk-based processes across EU, explicitly including CASPs/VASPs; aligns with AMLA for cross-border supervision.
Collect, verify, and store identity documents (e.g., two forms of ID); use third parties permitted.
Under Regulation (EU) 2023/1113, which the ACPR lists among AML/CFT texts in force in France, a CASP handling a transfer exceeding €1,000 to or from a self-hosted address must verify whether that address is owned or controlled by its client; enhanced vigilance for politically exposed persons is covered by ACPR guidelines under Monetary and Financial Code articles L. 561-2 ff.
Ongoing transaction monitoring, KYB for corporate clients (beneficial ownership), and ML/FT risk assessment systems.
Since the PSAN regime ended on 1 July 2026, management and shareholder checks run through AMF authorisation under MiCA: the AMF must refuse a CASP whose management body members lack sufficiently good repute and competence (Art 68(1)) or whose qualifying shareholders are unsuitable (Regulation (EU) 2023/1114, Art 63(10)). Under the former PSAN regime the ACPR gave an AML/CFT opinion before AMF registration.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Custodial wallet / SaaS is permitted in France as a MiCA CASP-licensed custody service (EUR 50,000 minimum capital), requiring a local entity, AMF authorization, ACPR prudential supervision, and full AML/CFT obligations including KYC, EDD, Travel Rule compliance, and TRACFIN reporting; however, the allocation of AML duties between the SaaS provider and white-label clients is not explicit in the provided facts, and MiCA Level 2 segregation/insurance/proof-of-reserves rules require further investigation.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?