Introduction
Outsourcing allows crypto-asset service providers (“CASPs”) to use external expertise and technology without building every function internally. Common examples include cloud infrastructure, customer support, identity verification, blockchain analytics, internal audit and specialist compliance support.
However, outsourcing cannot transfer the CASP’s regulatory responsibility or leave the licensed entity without sufficient personnel, knowledge and decision-making capacity. Under the Regulation (EU) 2023/1114 on markets in crypto-assets (“MiCA”), the CASP must remain fully responsible for its obligations and must retain effective control over outsourced functions.
MiCA outsourcing requirements: what does Article 73 require?
Article 73 of MiCA permits outsourcing but imposes several conditions. In particular, outsourcing must not:
- result in the delegation of the CASP’s responsibility;
- alter its relationship with clients or its obligations towards clients;
- prevent the competent authorities from exercising their supervisory functions, including obtaining relevant information through on-site access;
- deprive the CASP of the expertise and resources necessary to assess service quality and manage outsourcing risks on an ongoing basis;
- restrict its direct access to relevant information concerning the outsourced services.
The CASP outsourcing policy must also cover contingency arrangements and exit strategies. The CASP and the service provider must set out their rights and obligations in a written agreement, and the CASP must retain the information and access needed to supervise the arrangement and demonstrate compliance.
Which CASP functions can be outsourced?
MiCA does not establish a fixed list of functions that must always remain in-house. The assessment depends on the function’s importance, the business model, and the CASP’s ability to control the provider.
According to the Supervisory Briefing on the Authorization of CASPs under MiCA of the European Securities and Markets Authority (“ESMA”), supporting functions such as non-management-level IT support, human resources support or customer support generally create less substance risk. By contrast, ESMA expects greater scrutiny where the CASP outsources:
- compliance personnel;
- risk personnel;
- key functions or staff required to operate ICT systems and related security arrangements.
Where outsourcing involves ICT services, it must also be assessed under Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (“DORA”), including its requirements concerning ICT third-party risk management, contractual arrangements, ongoing monitoring and exit strategies.
CASP substance requirements: retaining internal competence
A CASP must retain sufficient internal competence to effectively control outsourced activities. According to ESMA, CASPs should demonstrate this by having adequate personnel, taking into account the level of outsourcing, who have the skills and experience needed to manage and oversee outsourcing risks.
The person directly employed by the CASP and responsible for an outsourced activity should have sufficient technical knowledge and expertise to request changes, monitor deployment and assess service quality. ESMA also notes that assigning oversight of numerous outsourced functions to a single person may be inadequate if that person lacks sufficient knowledge, experience, or time.
The CASP must also understand and retain control over any sub-outsourcing arrangements. The relevant service-level agreement should provide the CASP with visibility over the entire outsourcing chain.
When does CASP outsourcing create a letter-box entity?
ESMA describes a letter-box risk as outsourcing functions or services to such an extent that the licensed entity no longer performs or effectively controls its own regulated business.
Indicators of insufficient substance include:
- key decisions being taken by the parent company or service provider;
- the CASP having no personnel capable of supervising critical functions;
- management lacking direct access to systems, data or providers;
- extensive sub-outsourcing that the CASP cannot identify or control;
- restrictions on the competent authority’s access to information;
- the CASP being unable to continue the function or implement an exit strategy.
Regulators assess not only the number of outsourced functions but also their importance, the resources allocated to them and the effect of outsourcing on the CASP’s operational autonomy.
Intra-group outsourcing under MiCA
The same outsourcing requirements apply where a CASP uses a parent company or another group entity.
According to ESMA, the competent authority should examine the due diligence performed and verify that the group provider was selected for objective reasons. It should also assess whether the arrangement affects the CASP’s ability to make autonomous decisions concerning its EU activities.
Decisions relating to the CASP’s EU business should be driven by the interests of those activities rather than by the interests of other entities within the group.
Conclusion
Outsourcing is compatible with MiCA, but the licensed CASP must remain a functioning and accountable business.
A compliant CASP outsourcing model requires the CASP to retain responsibility for all regulatory obligations, sufficient competent personnel, effective control over service providers and sub-outsourcing, direct access to relevant systems, information and records, independent decision-making capacity, and workable contingency and exit arrangements.
Where external providers effectively run the CASP’s core activities and the CASP no longer has sufficient internal expertise, control or decision-making power, the company risks becoming a letter-box entity.
At Manimama Law Firm
At Manimama Law Firm, we help businesses navigate this regulatory environment. We support documentation, manage application processes, and develop long-term compliance strategies for crypto-related businesses.
Contact information
Leave a request, and we will assemble not just candidates, but a team that will work toward a common goal.
If you want to become our client or partner, write to us at support@manimama.eu.
Or use our Telegram @ManimamaBot and we will respond to your request.
Join our Telegram to receive news in a convenient way: Manimama Legal Channel.
Disclaimer: The information provided in this article is intended for general informational purposes only and should not be considered as individual legal advice. For legal assistance tailored to specific circumstances, it is recommended to seek professional legal counsel.
