Custodial wallet / SaaS in France
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in France with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP authorization under MiCA via AMF — custody is a licensed MiCA activity with EUR 50,000 minimum capital (fr.licensing.custody, fr.licensing.vasp)
- Mandatory KYC: collect, verify, and store identity documents (e.g., two forms of ID); use of third parties permitted (fr.aml.collect-verify-and-store-identity, fr.aml.amlcft-for-casps-since-december)
- Enhanced Due Diligence (EDD) required for PEPs, transactions over €1,000 to self-hosted wallets, and cross-border activities (fr.aml.enhanced-due-diligence-edd-for)
- Ongoing transaction monitoring, KYB for corporate clients (beneficial ownership), and ML/FT risk assessment systems (fr.aml.ongoing-transaction-monitoring-kyb-for)
- FATF Travel Rule compliance under MiCA for transfers above reporting thresholds (fr.aml.markets-in-crypto-assets-regulation-mica)
- Suspicious transaction reporting to TRACFIN (fr.licensing.tracfin-handles-suspicious-transaction-reports)
- Managers and beneficial owners verified during AMF registration (fr.aml.managers-and-beneficial-owners-verified)
- DAC8 obligation (effective Jan 1, 2026): CASPs must report user crypto transactions to tax authorities (fr.licensing.dac8-implementation-finance-bill-2025)
- AML/CFT policies, CDD, and registration obligations under 5AMLD implemented in France since Jan 2020 (fr.aml.eu-fifth-aml-directive-5amld)
- EU AML Regulation (AMLR) and 6AMLD: risk-based ongoing KYC, aligned with AMLA for cross-border supervision (fr.aml.eu-aml-regulation-amlr-and)
Key Restrictions
- CASP authorization is required — custody is a licensed MiCA activity; must hold EUR 50,000 minimum capital (fr.licensing.custody)
- Existing PSAN/DASP holders had to transition to CASP by June 30, 2025 — short transition window (fr.licensing.vasp)
- Local entity required: must be incorporated in France or another EU member state to obtain CASP authorization under MiCA (fr.licensing.vasp)
- ACPR prudential supervision applies alongside AMF licensing; possible consolidated supervision (fr.licensing.regulator-acpr, fr.licensing.autorit-de-contrle-prudentiel-et)
- SaaS operator likely bears direct AML obligations as the CASP-licensed custodian — cannot delegate all AML to white-label clients (fr.aml.amlcft-for-casps-since-december, fr.aml.markets-in-crypto-assets-regulation-mica)
Key Risks
- Short 6-month transition from PSAN to CASP (deadline June 30, 2025) creates cliff risk for unlicensed operators (fr.licensing.vasp)
- Allocation of AML obligations between SaaS custody provider and white-label client is not explicitly defined in French law — regulatory uncertainty on who performs CDD
- MiCA minimum capital requirements (EUR 50,000 for custody) are relatively low for institutional custody, but proof-of-reserves and insurance requirements are still being clarified under MiCA Level 2
- ACPR/AMF dual supervision may create coordination friction and higher compliance cost (fr.licensing.regulator-amf, fr.licensing.regulator-acpr)
- No specific segregated-custody or insurance requirements visible in provided facts — operator must assess MiCA Title V custody rules separately
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
AMF — CASP authorization — most experienced EU NCA for crypto. Circle chose France for EU MiCA authorization.
MiCA Regulation (EU) (2023) — CASP authorization, comprehensive crypto regulation
PACTE Law (Loi PACTE) (2019) — Prior PSAN/DASP regime — EU's most mature pre-MiCA framework, replaced by MiCA
VASP: CASP authorization under MiCA via AMF. SHORT 6-month transition (existing PSANs had to apply by June 30, 2025). 3-6 months (AMF is experienced). France positioning as EU crypto hub.
CUSTODY: CASP authorization — custody is a licensed MiCA activity (EUR 50,000 minimum capital)
Autorité des Marchés Financiers (AMF): Primary authority for registering/licensing Crypto-Asset Service Providers (CASPs, formerly Digital Asset Service Providers or DASPs), supervising crypto offerings (except stablecoins), and enforcing investor protection, AML, and financial regulations.
Autorité de Contrôle Prudentiel et de Résolution (ACPR): Oversees prudential supervision, AML compliance (with AMF), stablecoin issuers (e.g., authorizing Circle France, Schuman Financial, Société Générale Forge), and certain DLT infrastructures.
TRACFIN: Handles suspicious transaction reports for AML/CFT.
French adaptations to MiCA: Order (October 15, 2024), Decree (February 21, 2025), Law (April 30, 2025); replaced DASP regime with CASP licensing, integrated electronic money tokens (EMTs), and aligned with EU standards. Over 100 DASPs registered previously.
DAC8 implementation (Finance Bill 2025, effective January 1, 2026): Requires CASPs and tied providers to report user crypto transactions to tax authorities.
AML/CFT for CASPs (since December 30, 2024): Mandates KYC, transaction monitoring, and sanctions compliance.
PACTE Law (Loi PACTE, 2019): Introduced mandatory registration for DASPs (e.g., crypto exchanges, custodians, wallet services, crypto-to-crypto platforms) and imposed AML standards.
EU Fifth AML Directive (5AMLD): Implemented in France in January 2020, requiring AML/CFT policies, CDD, and registration for all crypto firms serving French clients.
Markets in Crypto-Assets Regulation (MiCA): Enhances transparency, security, and AML for crypto providers; DASPs must transition to CASP licensing with minimum capital (€125,000–€350,000) and FATF Travel Rule compliance.
EU AML Regulation (AMLR) and Sixth AML Directive (AMLD6): Standardizes KYC as ongoing, risk-based processes across EU, explicitly including CASPs/VASPs; aligns with AMLA for cross-border supervision.
Collect, verify, and store identity documents (e.g., two forms of ID); use third parties permitted.
Enhanced Due Diligence (EDD): For high-risk cases like PEPs, transactions over €1,000 to self-hosted wallets, or cross-border activities.
Ongoing transaction monitoring, KYB for corporate clients (beneficial ownership), and ML/FT risk assessment systems.
Managers and beneficial owners verified during AMF registration.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Custodial wallet / SaaS is permitted in France as a MiCA CASP-licensed custody service (EUR 50,000 minimum capital), requiring a local entity, AMF authorization, ACPR prudential supervision, and full AML/CFT obligations including KYC, EDD, Travel Rule compliance, and TRACFIN reporting; however, the allocation of AML duties between the SaaS provider and white-label clients is not explicit in the provided facts, and MiCA Level 2 segregation/insurance/proof-of-reserves rules require further investigation.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?