Self-custodial wallet / non-custodial software in Italy
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Italy without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- Registration with OAM (Organismo per la gestione degli elenchi degli agenti e dei mediatori) is required for virtual currency services — Ministerial Decree Jan 17, 2022 (pre-MiCA; transitional until Dec 30, 2025).
- Post-MiCA (from June 30, 2025): CASP authorization may be required if the software provider is deemed to be providing a crypto-asset service (e.g., wallet provision). Publishing non-custodial software alone likely does not trigger CASP classification, but any ancillary services may.
- AML/CFT obligations under Legislative Decree 231/2007 (implementing AMLD5) apply to obliged entities that provide virtual currency services — mere software publication without custody or control of keys likely falls outside this scope.
- Travel Rule (EU TFR recast) applies to transfers of funds/crypto-assets — may not apply to pure non-custodial wallet software publishers who never handle the transfer.
- Sanctions screening obligations under EU Consolidated Sanctions List apply if the entity is a VASP/CASP; OFAC SDN list (extraterritorial) may apply for US nexus.
Key Restrictions
- Pure software publishing with no custody, control, or access to user private keys likely does not constitute a crypto-asset service under MiCA — wallet providers are listed as CASP services but the provider must hold or control the keys; mere publication of self-custodial software is not captured.
- If the wallet software includes any fiat on-ramp, swap, staking, or other intermediary service, it may become a CASP and require full MiCA authorization (capital €50k–€150k, governance, AML policies).
- No geofencing requirement from Italian law for pure software; however, if distributing in Italy, consumer protection rules (Codice del Consumo) on software licensing, liability, and disclaimers apply.
- Transparency obligations: Consumer protection rules require clear disclosure that the publisher does not hold or control funds, and that the user bears sole responsibility for private key custody.
Key Risks
- Regulatory reclassification risk: Italian authorities (Bank of Italy/Consob/OAM) could interpret wallet provision as a CASP service based on MiCAR Art. 3(1)(16) — 'crypto-asset service' includes 'custody and administration of crypto-assets on behalf of clients', which non-custodial wallets explicitly do not perform, but the line is debated.
- Transitional uncertainty: Until Dec 30, 2025, OAM registration regime exists alongside MiCA. A pure non-custodial wallet publisher that registered or was expected to register under the old regime may face scrutiny for non-registration.
- Consumer litigation risk: Users who lose private keys may bring claims under Italian consumer protection law (defective software, insufficient warnings), even if the publisher has no custody.
- OFAC extraterritorial risk: If the publisher has any US nexus (employees, servers, US entity), OFAC sanctions screening obligations attach even though Italian law alone would not impose them.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Pre-MiCA (until ~June 2025): Registration-only with OAM for VASPs (exchanges, custody); no full license needed but mandatory AML/KYC compliance. Investors urged to use registered firms.
Post-MiCA (from June 30, 2025): Licensing regime via CASP authorization; single EU passporting allows operation across member states without per-country re-licensing. Transitional grace until Dec 30, 2025, for existing operators.
Capital: €50,000–€150,000 minimum, scaled by services/risks.
AML/KYC: Strict compliance mandatory (Travel Rule, transaction monitoring, suspicious activity reporting); aligns with AMLD5 and GDPR for data protection.
Local Presence/Governance: Transparent ownership; board with finance/compliance experience; risk management systems; independent compliance/audit functions. No explicit branch required due to passporting, but Italian authorities oversee.
Primary national law: Legislative Decree No. 231/2007, the core Italian AML/CFT framework, transposed from EU AML Directives (e.g., 2015/849 as amended by 2018/843), covering prevention of money laundering and terrorist financing via the financial system.
Ministerial Decree (January 17, 2022), requiring registration with OAM for virtual currency services (e.g., exchanges, e-wallets) operating in Italy, implementing EU rules on virtual assets.
EU alignments: 5th AMLD (2018/843) and TFR recast extend rules to virtual assets and wallet providers.
MiCA Regulation: EU Regulation 2023/1114 – https://eur-lex.europa.eu/eli/reg/2023/1114/oj
Italian MiCA Decree: Legislative Decree no. 129/2024 – https://www.gazzettaufficiale.it/ (search decree)
OAM VASP Register: https://www.organismo-am.it/
OFAC: Applies to all U.S. persons and has extraterritorial reach; VASPs must block cryptoassets linked to SDN-listed persons/entities (including wallet addresses) and report to OFAC. Strict liability applies, with no crypto exceptions.
Primary Legislation: Regulation (EU) 2023/1114 — Markets in Crypto-Assets (MiCA)
Italian Implementation: Legislative Decree 2024 (approved to adapt national legislation to MiCA requirements); Law Decree 95/2025 (extending VASP registration deadlines)
Primary Supervisory Authority: Bank of Italy (financial stability, systemic risk, cross-border issuance)
Secondary Authority: CONSOB (securities-related aspects, investor protection, MiCAR disclosure compliance)
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Publishing pure self-custodial wallet software in Italy does not trigger VASP/CASP classification or AML obligations (since the publisher never holds or controls keys), but OAM registration may be expected during the transitional period, and any ancillary services (e.g., swaps, staking, fiat on-ramps) would bring the operator into full MiCA CASP licensing requirements.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?