← Regulations / France / Operating Models / Custodial SaaS

Custodial wallet / SaaS in France

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in France with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • CASP authorization under MiCA via AMF — custody is a licensed MiCA activity with EUR 50,000 minimum capital (fr.licensing.custody, fr.licensing.vasp)
  • Mandatory KYC: collect, verify, and store identity documents (e.g., two forms of ID); use of third parties permitted (fr.aml.collect-verify-and-store-identity, fr.aml.amlcft-for-casps-since-december)
  • Enhanced Due Diligence (EDD) required for PEPs, transactions over €1,000 to self-hosted wallets, and cross-border activities (fr.aml.enhanced-due-diligence-edd-for)
  • Ongoing transaction monitoring, KYB for corporate clients (beneficial ownership), and ML/FT risk assessment systems (fr.aml.ongoing-transaction-monitoring-kyb-for)
  • FATF Travel Rule compliance under MiCA for transfers above reporting thresholds (fr.aml.markets-in-crypto-assets-regulation-mica)
  • Suspicious transaction reporting to TRACFIN (fr.licensing.tracfin-handles-suspicious-transaction-reports)
  • Managers and beneficial owners verified during AMF registration (fr.aml.managers-and-beneficial-owners-verified)
  • DAC8 obligation (effective Jan 1, 2026): CASPs must report user crypto transactions to tax authorities (fr.licensing.dac8-implementation-finance-bill-2025)
  • AML/CFT policies, CDD, and registration obligations under 5AMLD implemented in France since Jan 2020 (fr.aml.eu-fifth-aml-directive-5amld)
  • EU AML Regulation (AMLR) and 6AMLD: risk-based ongoing KYC, aligned with AMLA for cross-border supervision (fr.aml.eu-aml-regulation-amlr-and)

Key Restrictions

  • CASP authorization is required — custody is a licensed MiCA activity; must hold EUR 50,000 minimum capital (fr.licensing.custody)
  • Existing PSAN/DASP holders had to transition to CASP by June 30, 2025 — short transition window (fr.licensing.vasp)
  • Local entity required: must be incorporated in France or another EU member state to obtain CASP authorization under MiCA (fr.licensing.vasp)
  • ACPR prudential supervision applies alongside AMF licensing; possible consolidated supervision (fr.licensing.regulator-acpr, fr.licensing.autorit-de-contrle-prudentiel-et)
  • SaaS operator likely bears direct AML obligations as the CASP-licensed custodian — cannot delegate all AML to white-label clients (fr.aml.amlcft-for-casps-since-december, fr.aml.markets-in-crypto-assets-regulation-mica)

Key Risks

  • Short 6-month transition from PSAN to CASP (deadline June 30, 2025) creates cliff risk for unlicensed operators (fr.licensing.vasp)
  • Allocation of AML obligations between SaaS custody provider and white-label client is not explicitly defined in French law — regulatory uncertainty on who performs CDD
  • MiCA minimum capital requirements (EUR 50,000 for custody) are relatively low for institutional custody, but proof-of-reserves and insurance requirements are still being clarified under MiCA Level 2
  • ACPR/AMF dual supervision may create coordination friction and higher compliance cost (fr.licensing.regulator-amf, fr.licensing.regulator-acpr)
  • No specific segregated-custody or insurance requirements visible in provided facts — operator must assess MiCA Title V custody rules separately

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 90% confidence

The AMF is the French competent authority for MiCA CASP authorisation, and France is the second-largest EU home of authorised CASPs (AMF, 6 July 2026). Circle Internet Financial Europe SAS is listed by ESMA as an AMF-authorised CASP from 23 April 2026 and, separately, as an ACPR-supervised e-money institution issuing the EURC and USDC e-money tokens since 1 July 2024.

licensing 92% confidence

The ACPR (Autorité de contrôle prudentiel et de résolution) is the French prudential and AML/CFT supervisor for banks and insurers, applying Monetary and Financial Code articles L. 561-2 ff. and R. 561-1 ff.; under the PACTE regime it gave its AML/CFT opinion on each PSAN before AMF registration.

licensing 20% confidence

MiCA Regulation (EU) (2023) — CASP authorization, comprehensive crypto regulation

licensing 92% confidence

The loi PACTE of 22 May 2019 created the French regime for initial coin offerings and digital-asset service providers (PSAN). The AMF states that this national regime is to disappear under MiCA, and the PSAN transitional period ended on 1 July 2026.

licensing 95% confidence

France applied the full 18-month MiCA transitional period: PSANs registered or licensed under French law could keep serving clients until 1 July 2026. Since 2 July 2026 only crypto-asset service providers (PSCA) authorised under MiCA may provide crypto-asset services in France; the AMF reported 31 French authorisations on 6 July 2026.

licensing 95% confidence

Custody and administration of crypto-assets on behalf of clients is a MiCA Class 2 service requiring minimum capital of €125,000 (Regulation (EU) 2023/1114, Annex IV). In France the AMF authorises CASPs offering it; the ESMA interim register listed 36 AMF-authorised French entries on 14 October 2026.

licensing 90% confidence

The AMF is the French competent authority that authorises and supervises crypto-asset service providers (PSCA) under MiCA, replacing the PSAN registration and licensing regime of the loi PACTE; it also oversees offers of crypto-assets other than asset-referenced and e-money tokens, whose issuers must be authorised by the ACPR.

licensing 92% confidence

The ACPR is the French authority for stablecoin issuers under MiCA: an e-money token issuer must be authorised as a credit institution or electronic money institution and notify the ACPR of its intention to issue and of its white paper. On 14 October 2026 the ESMA register listed 8 French EMT white papers from 6 ACPR-supervised issuers, including Circle Internet Financial Europe SAS, Société Générale – Forge and SALVUS (schuman.io).

licensing 88% confidence

Tracfin, the French financial intelligence unit under the Ministry of the Economy, receives AML/CFT suspicious-transaction declarations; the ACPR and Tracfin have issued joint guidelines on vigilance obligations and on declarations and information to Tracfin.

licensing 92% confidence

France has replaced the PSAN regime with MiCA authorisation: the AMF stated on 6 July 2026 that the transition from the loi PACTE regime ended on 2 July 2026, that France had authorised 31 crypto-asset service providers and that 283 were authorised across the EU. The ESMA interim register listed 36 AMF-authorised French entries on 14 October 2026.

licensing 0% confidence

France's transposition of DAC8 (Council Directive (EU) 2023/2226), including the instrument, its date and the reporting duties of crypto-asset service providers, has no French primary source reachable on 14 October 2026.

licensing 20% confidence

AML/CFT for CASPs (since December 30, 2024): Mandates KYC, transaction monitoring, and sanctions compliance.

aml 90% confidence

The loi PACTE of 22 May 2019 created the French PSAN regime, which required at a minimum an AML/CFT framework; the ACPR gave its AML/CFT opinion on each digital-asset service provider before AMF registration because these providers present high money-laundering risks.

aml 88% confidence

The ACPR lists Directive (EU) 2015/849 as amended by Directive (EU) 2018/843 (the fifth AML directive) among the EU AML/CFT texts in force in France, alongside Monetary and Financial Code articles L. 561-2 ff.; the AMLR (2024/1624) applies from 10 July 2027 and AMLD6 (2024/1640) must be transposed by that date.

aml 92% confidence

MiCA sets CASP minimum capital at €50,000 (Class 1), €125,000 (Class 2, including custody and exchange) or €150,000 (Class 3, trading platforms) under Annex IV of Regulation (EU) 2023/1114. French PSANs had until 1 July 2026 to obtain AMF authorisation, and transfers of crypto-assets follow Regulation (EU) 2023/1113, which the ACPR lists as in force.

aml 20% confidence

EU AML Regulation (AMLR) and Sixth AML Directive (AMLD6): Standardizes KYC as ongoing, risk-based processes across EU, explicitly including CASPs/VASPs; aligns with AMLA for cross-border supervision.

aml 20% confidence

Collect, verify, and store identity documents (e.g., two forms of ID); use third parties permitted.

aml 85% confidence

Under Regulation (EU) 2023/1113, which the ACPR lists among AML/CFT texts in force in France, a CASP handling a transfer exceeding €1,000 to or from a self-hosted address must verify whether that address is owned or controlled by its client; enhanced vigilance for politically exposed persons is covered by ACPR guidelines under Monetary and Financial Code articles L. 561-2 ff.

aml 20% confidence

Ongoing transaction monitoring, KYB for corporate clients (beneficial ownership), and ML/FT risk assessment systems.

aml 90% confidence

Since the PSAN regime ended on 1 July 2026, management and shareholder checks run through AMF authorisation under MiCA: the AMF must refuse a CASP whose management body members lack sufficiently good repute and competence (Art 68(1)) or whose qualifying shareholders are unsuitable (Regulation (EU) 2023/1114, Art 63(10)). Under the former PSAN regime the ACPR gave an AML/CFT opinion before AMF registration.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — Custodial wallet / SaaS is permitted in France as a MiCA CASP-licensed custody service (EUR 50,000 minimum capital), requiring a local entity, AMF authorization, ACPR prudential supervision, and full AML/CFT obligations including KYC, EDD, Travel Rule compliance, and TRACFIN reporting; however, the allocation of AML duties between the SaaS provider and white-label clients is not explicit in the provided facts, and MiCA Level 2 segregation/insurance/proof-of-reserves rules require further investigation.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?