This is Part 5 — the final instalment of our "MiCA in Practice" series. In Part 4, we covered governance and risk management. Here, we address the financial backbone of CASP compliance: how you safeguard client assets and meet prudential capital requirements.
The collapse of FTX in November 2022 demonstrated what happens when client asset safeguarding fails. Over $8 billion in customer funds were misappropriated, commingled with proprietary trading operations, and ultimately lost. MiCA was already in legislative drafting when FTX collapsed, but the event accelerated and strengthened the final text's safeguarding provisions.
For CASPs operating in the EU, client asset protection is not optional good practice — it is a detailed, enforceable legal obligation with specific technical requirements.
Client Asset Safeguarding Under MiCA
MiCA Article 70 establishes the core safeguarding obligations for CASPs that hold client funds or crypto-assets. The requirements apply to two categories of assets:
Client Funds (Fiat)
Where a CASP holds fiat currencies on behalf of clients (e.g., pending trade execution, withdrawal processing, or account balances), these funds must be:
- Deposited in a separate account at a credit institution or central bank, clearly designated as client money and held on trust or under equivalent legal arrangements
- Segregated from the CASP's own funds — at no point may client fiat be commingled with proprietary funds or used for the CASP's own operational expenses
- Protected from the CASP's creditors — in the event of insolvency, client funds must not form part of the CASP's estate
Client Crypto-Assets
For CASPs providing custody services, Article 70 requires:
- Segregation of client crypto-assets from the CASP's own holdings — either through separate wallets per client (omnibus segregation with reconciliation is permitted) or through sub-accounts within an omnibus structure that enable individual client entitlements to be identified at all times
- No use of client crypto-assets for the CASP's own account or for any other purpose unless the client has provided explicit, informed, prior consent (and even then, the CASP must maintain sufficient reserves to honour withdrawal requests)
- Adequate organisational arrangements to minimise the risk of loss — including secure private key management, multi-signature controls, cold storage for the majority of assets, and tested recovery procedures
- Insurance or guarantee — CASPs must either hold insurance against the loss of client crypto-assets, or maintain a guarantee from a credit institution, covering the custodied value
Custody Best Practices
- Maintain at least 90–95% of client crypto-assets in cold storage (offline, air-gapped signing devices)
- Implement multi-signature controls requiring multiple key holders to authorise transactions
- Conduct daily reconciliation between on-chain balances and internal ledger records
- Test disaster recovery procedures at least semi-annually, including key recovery scenarios
- Ensure your insurance coverage is adequate — many crypto insurance policies have exclusions that leave significant gaps
Prudential Requirements: Own Funds
MiCA Article 67 requires CASPs to maintain permanent minimum own funds. The required amount depends on the type of service provided:
However, these are minimum floors. The actual own-funds requirement is the higher of:
- The applicable minimum amount (€50K / €125K / €150K)
- One quarter of the fixed overheads of the preceding year (the "fixed-overhead requirement")
This means a CASP with annual fixed overheads of €2 million would need to hold at least €500,000 in own funds — regardless of which service category it falls into.
What Counts as Own Funds?
Own funds are calculated in accordance with the Capital Requirements Regulation (CRR) framework, adapted for CASPs. Eligible items include:
- Common Equity Tier 1 (CET1) — paid-up capital, retained earnings, share premium
- Additional Tier 1 (AT1) — perpetual instruments meeting specific conditions
- Tier 2 — subordinated debt and other eligible instruments
Crypto-assets held by the CASP do not qualify as own funds due to their volatility. Own funds must be denominated in fiat currencies and held in liquid, low-risk form.
Alternative: Insurance Policy
Article 67(2) permits CASPs to substitute part of the own-funds requirement with an insurance policy or comparable guarantee from a credit institution, provided the policy covers the geographic scope of operations and provides equivalent protection. In practice, obtaining crypto-specific insurance at commercially viable terms remains challenging, and most NCAs prefer to see actual own funds.
Ongoing Prudential Obligations
Maintaining minimum own funds is not a one-time licensing requirement — it is a continuous obligation:
- Capital monitoring — CASPs must monitor their own-funds position on an ongoing basis and notify the NCA immediately if own funds fall below the required level
- Periodic reporting — quarterly or semi-annual prudential reports to the NCA, in the format specified by ESMA's technical standards
- Recovery planning — CASPs should maintain a capital recovery plan that can be activated if own funds approach the minimum threshold
- Wind-down planning — under MiCA Article 64(2), the authorisation application must include arrangements for the orderly wind-down of the CASP's activities, including how client assets would be returned and business transferred
Client Disclosure and Transparency
MiCA Articles 71–73 require CASPs to provide clients with clear, accurate information about:
- The safeguarding arrangements applied to their funds and crypto-assets
- Whether client crypto-assets may be used by the CASP (and the terms under which consent is sought)
- The risks associated with crypto-asset services, including the risk of total loss of value
- Fee structures — all costs, charges, and fees must be disclosed before the provision of services, and presented in a standardised format
- The CASP's complaints-handling policy and the client's right to refer complaints to the relevant NCA
These disclosure obligations apply both at the onboarding stage and on an ongoing basis. Changes to safeguarding arrangements or fee structures must be communicated to existing clients with adequate notice.
How BlockchainAnalysis Supports Prudential Compliance
Prudential compliance requires accurate data and auditable records. BlockchainAnalysis helps CASPs demonstrate their compliance posture to NCAs through comprehensive audit trails, compliance reporting, and independent assessments of AML/CFT programme effectiveness.
Our platform enables CASPs to generate the evidence that NCAs and external auditors require: screening logs, monitoring statistics, investigation records, and risk exposure reports. For custody providers, our on-chain analytics can verify wallet segregation, reconcile on-chain balances with declared holdings, and detect any unauthorised movement of client crypto-assets.
Asset Safeguarding & Prudential Checklist
- Segregate client funds in designated accounts at credit institutions — never commingled
- Implement secure custody with cold storage, multi-sig, and daily reconciliation
- Obtain insurance or a guarantee covering custodied crypto-asset values
- Calculate your own-funds requirement: the higher of the class minimum or ¼ of fixed overheads
- Ensure own funds are in fiat-denominated, liquid instruments (crypto-assets do not count)
- Establish continuous capital monitoring with NCA notification triggers
- Prepare a capital recovery plan and an orderly wind-down plan
- Disclose safeguarding arrangements, risks, and fees to clients in clear, standardised formats
- Submit periodic prudential reports in the format required by your NCA
This concludes our "MiCA in Practice" series. For a high-level overview of MiCA, see our MiCA Compliance Guide. For ongoing regulatory updates, follow BlockchainAnalysis on LinkedIn.
BlockchainAnalysis provides the compliance and audit infrastructure that CASPs need to demonstrate asset safeguarding controls and regulatory reporting readiness.
Screen wallets, monitor entities, and generate compliance reports with 1B+ labeled addresses and 305+ data sources.
See Compliance Solutions