Supervisory expectations
1) If your firm will not be authorized by 1 July 2026, prepare the orderly wind-down
ESMA expects unauthorized CASPs to have operational, credible, immediately executable wind‑down plans, designed to protect clients and avoid undue economic harm. That means, inter alia:
- Client offboarding must be organized (e.g., transfer client crypto-assets to an authorized CASP or to a self-hosted wallet)
- Advance notice to clients before executing the wind-down
- Plans must comply with conduct, prudential and AML/CFT obligations
2) If your firm will be authorized, client migration must be proactively managed
ESMA expects authorized CASPs to actively manage migration of clients ahead of the deadline. This includes onboarding EU clients before the transitional period ends and applying robust onboarding and AML/CFT processes.
3) Reminder about outsourcing and delegation
A key ESMA message is that firms must ensure outsourcing and delegation do not result in services being provided to EU clients via unauthorized third-country entities. Many operating models rely on group hubs, technology stacks, wallet infrastructure, customer support, and execution venues outside the EU. Under MiCAR, supervisors will look through contractual structures and assess whether the regulated service is effectively performed by an unauthorized entity, which can trigger enforcement, forced remediation, or a requirement to cease servicing EU clients.
CSSF expectations for IFMs with crypto exposure
Luxembourg IFMs managing AIFs with meaningful crypto exposure face specific CSSF expectations. If an IFM intends to manage an AIF investing >10% of NAV in crypto-assets, the IFM must obtain prior CSSF authorization for the strategy “Other‑Other Fund‑Crypto-assets” (and the initiator is expected to present the project to the CSSF beforehand). IFMs should also analyze whether their performed services map to activities listed in Article 60(5) of MiCAR. For indirect exposure via target funds (TFs), the CSSF does not require the “Other-Other Fund-Crypto-assets” license, but still expects robust risk assessments.