Yes. Under MiCA, "custody and administration of crypto-assets on behalf of clients" is a regulated crypto-asset service, so offering custody alone requires authorization as a CASP (crypto-asset service provider). There is no custody-only carve-out. Holding clients' crypto-assets or the means to access them puts you inside the regulated perimeter and triggers capital, governance, and safeguarding obligations.
*As of 2026, under MiCA - Regulation (EU) 2023/1114.*
Why custody-only crypto models still require CASP authorization under MiCA.
Yes - explicitly. MiCA (Regulation (EU) 2023/1114) lists "the custody and administration of crypto-assets on behalf of clients" as one of the crypto-asset services. Providing any listed service in the EU on a professional basis requires authorization as a CASP. Custody is not an exception; it is one of the named services the regime was built to cover.
The reason is straightforward: custody means you hold clients' assets or the cryptographic means to control them, which is exactly the consumer-protection risk MiCA targets. So a custody-only model is a CASP model. The narrow scope does not exempt you - it just defines which service(s) your authorization will list.
Founders hear "we only hold the keys, we don't trade" and assume that keeps them outside the rules. Under MiCA it does the opposite - holding client assets is precisely the activity the custody service was written for.
CASP capital is tiered by the services provided. MiCA sets prudential minimums of €50,000, €125,000, or €150,000 depending on the service class, and custody and administration of crypto-assets falls in the €125,000 minimum-capital class *(per MiCA Annex IV; confirm the applicable class and the higher-of own-funds calculation with the regulator)*. As with other regimes, the minimum is a floor, and CASPs must also meet ongoing own-funds requirements.
Beyond capital, a custody CASP must demonstrate safekeeping arrangements, segregation of client assets, governance, and the operational controls to keep client crypto-assets secure. The capital number is the easy part to state; the safekeeping and governance build is where the real work sits.
If you were registered as a VASP (virtual asset service provider) under a national regime, MiCA replaces that with a single EU CASP authorization, and transitional arrangements let existing VASPs continue for a limited period while they apply - but the length of that grandfathering window is set per member state and is closing. The direction is one-way: VASP registration is being superseded by CASP authorization across the EU.
A custody-only VASP does not get to stay a VASP; it transitions to a CASP whose authorization lists the custody service. The practical risk is leaving the application late and running past your national transition deadline. Advapay tracks these deadlines as part of the crypto licensing service - see our note on the MiCAR transition.
Sometimes, depending on where and how you operate. Switzerland sits outside MiCA, and crypto-asset financial intermediaries there often operate via SRO (self-regulatory organization) membership for AML compliance rather than direct FINMA licensing - a different route with different obligations. It is not a loophole around EU rules; it is a separate jurisdiction with its own regime.
If your customers and activity point to the EU, CASP is the route. If Switzerland fits your model, Swiss SRO membership may be the cleaner path. The right answer depends on where the assets and customers sit - which is the assessment to do before you apply anywhere.
The instinct that "custody-only is lighter touch" is exactly backwards under MiCA. Holding client assets is the headline risk the regime was written for, so custody alone is enough to require CASP authorization, capital, and safekeeping controls. The only real choice is *where* - an EU CASP route or a separate path like Swiss SRO membership - and that turns on where your assets and customers sit, not on how narrow your service is.
For a straight read on whether you are a CASP and where to apply, talk to our crypto team. Advapay handles the license, the platform, and banking access as one launch.
Yes. Custody and administration of crypto-assets is its own regulated service under MiCA - trading is a separate service, and you can be a CASP for custody alone.
Holding clients' crypto-assets or the means of access (including keys) on their behalf is custody and administration under MiCA, so it falls inside CASP authorization.
Custody sits in MiCA's €125,000 minimum-capital class, with ongoing own funds on top. Confirm the exact class and calculation with the regulator.
Yes. A CASP authorization can be passported across the EU, so you license in one member state and notify others rather than re-applying per country.
Through a national competent authority under MiCA. Malta is a common route for CASP/MiCA authorization; Switzerland offers a separate SRO-based path outside the EU.
