--- title: "Crypto custody and wallet licence under MiCA · LT MiCA Desk" description: "Holding client crypto-assets, or the means of access to them, is a class 2 CASP service. The most-held permission in Europe, why its headline count is inflated, and what the custody policy has to prove." url: https://unbui.lt/business-models/crypto-custody/ lang: en-GB updated: 2026-10-24 --- [Home](/) / [Business models](/business-models/) / Custody and wallets # Custody and wallet services Rarely the business anyone sets out to be in, and the permission almost everyone ends up needing. It is also the one that quietly moves a firm from class 1 to class 2. ## What counts as custody **You hold clients’ crypto-assets, or the means of access to them. The phrase that does the work is _or the means of access_. You do not have to hold the asset to be a custodian. Holding the key, or holding enough of a key that the client cannot move the asset without you, is custody, and so is any arrangement where a client balance exists on your books between instructions.** This is why custody arrives uninvited. A payments firm holds balances to settle. An exchange holds balances between trades. A broker that lets a client leave funds on account is holding them. Each of those firms describes itself as something else and each of them is applying for custody, which is class 2 at €125,000 rather than class 1 at €50,000. Genuinely non-custodial products exist and the line is real. If the client holds the only key and your software merely helps them use it, you are outside. The question to put to your own architecture is blunt: can anyone at your company, alone or together, move a client's assets without the client? If yes, that is custody however the product is described. ### What the European register shows for this permission Register rows naming it **233** across 27 home states Recorded as Article 63 authorisations 58 Recorded as Article 60 notifications 30 No legal basis recorded 145 Held in Lithuania 6 **Largest home states:** France 28, Cyprus 24, Malta 22, Netherlands 21, Germany 18. **Most often held alongside:** providing transfer services for crypto-assets on behalf of clients (203 of 233) , exchange of crypto-assets for funds (147 of 233) , execution of orders on behalf of clients (131 of 233) , exchange of crypto-assets for other crypto-assets (115 of 233) . Counted from ESMA's interim register of crypto-asset service providers, file last updated 20 October 2026, counted 23 October 2026. The three basis figures do not sum to the total because the register's legal-basis column is optional and most national authorities leave it empty, Lithuania among them. [Why that gap matters](/insights/vasp-to-casp-under-mica/#register). Rows naming providing custody and administration of crypto-assets on behalf of clients are counted, whether or not the firm also holds other permissions. ## Why the biggest number on the register is the least informative Custody is named by more rows than any other service, and that is partly real and partly an artefact. The real part is the paragraph above: most models need it. The artefact is that custody is also where licensed institutions arrive when they notify an additional activity rather than apply for an authorisation. Lithuania shows six entries on the ESMA crypto-asset service provider register, not four. Two of them, Newrails UAB and UAB BLUE EMI LT, are recorded there as providing crypto-asset services under Article 60(4) of MiCA in relation to an e-money token they issue themselves. That is a notification by an institution already authorised for something else, not an authorisation under Article 63, and it cannot be applied for by a firm that has no other licence. [ESMA, Interim MiCA register, crypto-asset service providers (CASPS.csv)](https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv) (2026-10-20) · [EUR-Lex, Regulation (EU) 2023/1114 (MiCA), consolidated text](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1114) · Verified on 2026-10-23 · Next review 2026-11-23 Lithuania is a small, clean illustration. All six Lithuanian rows name custody, and two of the six are there under Article 60(4) in relation to an e-money token the firm issues itself. Read as a market figure, six overstates the number of firms that went through an authorisation to provide custody as a business. Across the register the same effect is larger and less visible, because most authorities do not record the basis at all. [The full extent of that gap](/insights/vasp-to-casp-under-mica/#register). ## Custody and transfers travel together Of the 233 rows naming custody, 203 also name transfer services. That is the highest pairing on the register and it is not a coincidence: a client who can hold an asset with you expects to be able to send it somewhere, and the moment they can, you are providing transfer services as well. If your application names custody without transfers, that should be a deliberate product decision you can explain, not an oversight. [What transfers add](/business-models/crypto-payments/). ## What the custody policy has to prove The extra Article 62(2) item is custody and administration policy (article 62(2)(m)). and the substance sits underneath it. A custody file is read for how client assets stay separate from yours and stay available if you fail, so it has to be concrete about where assets are held, how keys are generated and split, who can authorise a movement and under what quorum, what happens when someone with a share of a key leaves, and how a client's entitlement is reconstructed from your records rather than from the chain. None of that is satisfied by naming a technology vendor. Using a qualified custodian or a multi-party computation provider is an architecture decision you still have to describe, operate and evidence, and the authority is assessing your controls rather than your supplier's brochure. [Where it sits in the application](/licensing/application-documents/). ## The capital consequence Custody is the cheapest expensive service on the list. It adds no revenue for most firms, and it moves the floor from €50,000 to €125,000 by itself. That is the single most common surprise in scoping, and it is why the first question on this site is which services you are providing rather than which licence you want. Article 67(1) requires prudential safeguards of at least the higher of the Annex IV minimum and one quarter of the preceding year’s fixed overheads, reviewed annually. [EUR-Lex, Regulation (EU) 2023/1114 (MiCA), consolidated text](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1114) · Verified on 2026-09-14 · Next review 2027-03-14 [Pick your services and see the class](/requirements/service-classes/). ## What this page could not verify - **How much of the 233 is Article 60.** Only 30 rows record a notification and only 58 record an authorisation; the other 145 record nothing. The claim above is that the total overstates authorised custody businesses, not by how much. - **No supervisory expectation is quoted.** What a custody policy has to prove is our reading of Article 62(2)(m) and the client-asset provisions, not a published checklist from any authority. - **The register moves.** 387 rows counted 23 October 2026 from a file ESMA last updated four days earlier. Readiness assessment ## Find out whether you are already a custodian One question settles it, and it is architectural rather than legal: can anyone inside your company move a client's assets without the client. If the answer is yes, the class and the capital follow from there. [Request an assessment](/assessment/) [Check your licensing scope first](/requirements/service-classes/) Enquiries go by email for now. Nothing on this site collects your details, and [the assessment page](/assessment/) sets out what to include. Regulatory references on this page were read against the primary text on 23 October 2026. Every figure is held in the [source register](/sources/) with the document it came from.