What organisational and conduct requirements applied to registered CASPs?

Everyone in a management position had to be honest and competent: of good reputation, with enough knowledge, skills and experience, and with enough time for the role. A lack of experience on the Board was a reason for CySEC to refuse registration. The Board itself had to have at least four such members, two of whom directed the business and two of whom were independent. The national rules set no residency requirement for directors; MiCA now requires at least one director to be resident in the EU.

Shareholders with a qualifying holding (the beneficiaries) had to be of good reputation and able to keep the CASP financially sound, and the CASP's close links with other persons must not prevent CySEC from supervising it effectively. Governance had to be sound, with clearly defined and transparent reporting lines. Staff had to be honest, professional and knowledgeable for their tasks, and could hold several functions only if that did not, and was not likely to, stop them working with diligence, honesty and professionalism.

Pay and performance assessment must not conflict with the CASP's duty to act in its clients' best interests. In particular, the CASP could not use remuneration, sales targets or similar arrangements that might push staff towards aggressive promotion of products or services.

A CASP had to have AML/CFT policies and procedures covering its executives, employees and anyone it outsourced functions to, and policies, systems and controls for prudent operation, including keeping to a minimum the risk that clients' crypto-assets are stolen or lost. It needed security mechanisms to protect the transfer of information, limit data corruption and unauthorised access and prevent leaks, and it had to hold enough own funds.

Other requirements were those of any well-run financial firm: sound administrative and accounting procedures, internal controls and risk assessment; an independent internal control function where the size and complexity of the business called for one; business continuity and data recovery arrangements; care when outsourcing critical functions, so that neither internal control nor CySEC's supervision suffered; records of all activities sufficient for supervision; and a complaints procedure. A CASP operating online needed a website that it owned and used exclusively, unless it had assessed and mitigated the risks and CySEC did not object.

Anything said to clients or prospective clients, marketing included, had to be accurate, clear and not misleading, with marketing labelled as marketing. The CASP had to tell clients in good time about itself, its services and what they would pay, in a way that let them understand the service, the crypto-assets on offer and their risks well enough to make an informed decision. A standard format could be used.

Breaches of the Directive count as breaches of Article 61E, so CySEC could impose administrative sanctions under Article 59(6) of the AML/CFT Law: fines of up to €1 million, or up to twice the benefit gained if higher, plus up to €1,000 for each day a breach continues. Since Law 96(I)/2025 made CASPs financial organisations, the higher ceiling for financial organisations, up to €5 million or 10% of annual turnover, also applies. Since October 2023, failing to register when required has been a criminal offence punishable by up to five years' imprisonment, a fine of up to €350,000, or both. The registration conditions did not cover market risk or the residency of directors.

Since 1 July 2026 these national rules have given way to MiCA, which sets comparable duties for authorised CASPs: a registered office and effective management in the EU, with at least one EU-resident director but no minimum Board size; acting honestly, fairly and professionally in clients' best interests and giving fair, clear and not misleading information; minimum capital of €50,000, €125,000 or €150,000 depending on the services, or a quarter of fixed overheads if higher; fit and proper management and shareholders; safekeeping of clients' crypto-assets and funds where the CASP holds them; complaints handling; conflicts of interest; outsourcing; and orderly wind-down plans for CASPs providing custody, trading platform, exchange, execution or placing services.