What a CASP authorisation covers: services a to j

A CASP authorisation is not a generic permission “to operate in crypto”. Regulation (EU) 2023/1114, Article 3(1)(16), defines a crypto-asset service as any of ten activities. The Article 62 application and the Article 63 decision refer to the services the applicant says it will provide. How that is applied for in Spain is in the application guide. What the authorisation is, as a whole, is in the licence guide. Here is the list, letter by letter, in the article’s own names.

The ten letters

The same article then defines several of those activities. Custody, point (17), is the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to them, where applicable in the form of private cryptographic keys. A trading platform, point (18), is the management of one or more multilateral systems which bring together third-party buying and selling interests. Funds, point (14), point to the definition in Directive (EU) 2015/2366. You do not need the definitions by heart to read a row. You do need to avoid treating a letter the cell does not carry as covered.

In CASPS.csv the code sits in *ac_serviceCode*. Sometimes the cell carries the letter. Sometimes it describes the service in a sentence. On a profile, this site shows the codes it can read. Where the row has no letter, the profile does not invent one. The alternatives page flags that case in the comparison. Counts of how many providers carry each letter, in the loaded cut, are on register data.

What the letter requires, beyond the name

Letter a is not just “holding”. Article 75 requires a custody agreement, a register of positions, a policy that minimises loss, a statement to the client at least every three months, return of the crypto-assets or of the means of access, legal and operational segregation from the provider’s estate, and liability for loss attributable to the provider, capped at the market value at the time of the loss. Article 70 requires arrangements to safeguard clients’ ownership rights, especially in insolvency, and to prevent the use of clients’ crypto-assets for the provider’s own account. What that does not guarantee is set out in custody and client funds.

Letter j, transfer on behalf of clients, is the service in which much of the Travel Rule sits when a transfer leaves a CASP or arrives at one. The concept stays in the blog article. The practical point with a wallet you control is in self-custody and the Travel Rule. A transfer between two people with no CASP involved is outside the scope of that transfer regulation, under its own exclusion. It is not, for that reason, outside every other rule.

What the list does not include

Lending crypto-assets, or lending money against crypto-assets, is not among the letters. An “earn” button may be staking ancillary to custody, or it may be something else. The first case is in staking under MiCA, with Q&As 2067 and 2607. The second is in lending and earn. Issuing an EMT or an ART is not one of the ten letters either: it is the Title III and Title IV regime, summarised in stablecoins.

Article 60 lets certain firms that are already authorised — a credit institution, a central securities depository, an investment firm, a market operator, an electronic-money institution, a UCITS management company or an alternative investment fund manager — provide equivalent crypto-asset services by notification, at least forty working days in advance, instead of a fresh Article 63 authorisation. It is still a service on the list, not an eleventh letter. The row in the file, if there is one, is what says which.

To see the letters for a given firm, open its profile from the home page or from the page for its home country. A profile that shows codes links to this guide. The comparison of some brands stays on the alternatives page, not here.

Common questions