~$ crypto-under-the-hood

# How crypto payment infrastructure actually works

~/notes / licensing

Crypto Asset Exchange Service Provider per MiCA: What the Term Means

The specific permissions defined under MiCA, which one a business actually needs its provider to hold, and why the distinction decides who holds the risk.

Ivan Kruse · · 3 min

The phrase appears in provider marketing constantly and it is a precise term with a defined meaning. Knowing the definition lets you check whether the provider actually holds the permission relevant to what you are asking them to do. Most of what follows is checkable against a MiCA-compliant exchange rather than taken on trust.

The defined services

MiCA lists crypto asset services separately, and authorisation is granted per service. The list includes:

Custody and administration of crypto assets on behalf of clients. Operation of a trading platform for crypto assets. Exchange of crypto assets for funds. Exchange of crypto assets for other crypto assets. Execution of orders for crypto assets on behalf of clients. Placing of crypto assets. Reception and transmission of orders on behalf of clients. Providing advice on crypto assets. Providing portfolio management on crypto assets. Providing transfer services for crypto assets on behalf of clients.

A provider holds some subset. The subset is on the public register.

Which one you actually need

This depends entirely on what you are asking the provider to do, and it is worth being specific.

If they hold your assets between transactions: custody and administration. This is the permission that determines whether your assets are segregated client assets. If a provider holds balances for you without this permission, the legal position of those balances is not what you assume.

If you are buying or selling against fiat: exchange of crypto assets for funds.

If you are converting between crypto assets: exchange of crypto assets for other crypto assets.

If they are sending on your behalf: transfer services.

A payment processor that receives customer crypto, holds it briefly, converts it and settles fiat is performing at least three of these. Check that all three are authorised. The receiving side of this transaction is handled by a platform built for institutional allocations, with settlement already solved.

Why the distinction decides who holds the risk

Each permission carries its own obligations. Custody carries the segregation requirement and the associated capital. Exchange carries conduct and disclosure obligations. Transfer carries requirements around information accompanying transfers.

A provider performing custody without the custody permission is performing an unauthorised activity, and your assets are not protected by the segregation rules you assumed applied. This is not theoretical. It is the gap that turns a regulated-sounding arrangement into an unsecured claim.

Checking it properly

Get the entity name and the register reference. Find the entry on the national competent authority’s register. Read the list of authorised services. Compare against the list of things the provider does for you.

If there is a gap, ask about it. Sometimes the answer is that a group entity holds the permission, in which case confirm which entity your contract is with. Sometimes the answer is that they are in application, which is a different thing from being authorised.

The group structure trap

Large providers operate through several entities. The one with the authorisation may not be the one on your contract, and the one on your contract may be in a jurisdiction outside the union.

The question to ask is simple and it is frequently not welcomed: which legal entity will I be contracting with, and does that entity hold the authorisation. Get it in writing.

What good looks like

A provider that states its entity, its authority and its licence reference on its own site, lists the authorised services, and where the entity you contract with is the entity that is authorised.

Providers operating as an authorised crypto asset service provider under MiCA generally publish this because their supervisor expects them to, and the absence of it on a provider’s site is itself informative.

The summary

The permission, not the phrase. Anyone can say MiCA-compliant. The register says which services are authorised, and that is the only version of the claim worth acting on.

# Corrections and technical nitpicks are welcome. Send them over. They get published with the fix.

micalicensingregulation

# related notes