The issuer and CASP structure for an EEA stablecoin card

The product team and proposed providers should approve one funds-flow description before integrating the card. It must identify the legal owner, custodian, debtor and account at every step. Display token holdings separately from euros available for card spending. A combined purchasing-power figure must explain its conversion assumptions and cannot obscure which provider owes each balance. MiCA requires fair, clear and non-misleading client information; the Irish payment rules prescribe account and transaction disclosures. (MiCA, art. 66(2)–(3); Irish S.I. No. 6/2018, regs. 75–76.)

Conversion before spending

The recommended launch follows this sequence:

1. The customer transfers supported EMTs to a wallet controlled by the CASP. The CASP records the customer's token entitlement. Custody does not itself sell the tokens or create a fiat card balance.
2. The customer accepts the CASP's conversion quote. Acting as principal, the CASP buys the specified tokens using its own capital. The terms identify when the sale becomes binding, when token ownership changes, and the euro amount after charges.
3. The CASP pays the sale proceeds directly into the card issuer's approved collection arrangements for the named customer. The issuer credits the customer's fiat payment account when the agreed funding conditions are satisfied. The manager receives neither tokens nor customer euros.
4. The card issuer checks the available euro balance and authorises the purchase. Its processor exchanges the required messages. The issuer meets its settlement obligation through the agreed bank and network arrangements; the merchant's acquirer pays the merchant under their agreement.
5. Unspent euros remain a payment-account balance. Tokens left with the CASP remain separately recorded custody holdings. A withdrawal of euros and redemption of EMTs follow different instructions and involve different debtors.

The proprietary purchase is MiCA's exchange service. A provider instead concluding trades on the customer's behalf needs the permission for execution of orders; an intermediary receiving and transmitting orders needs that permission. The pricing document must identify the actual model. (MiCA, arts. 3(1)(19), (21) and (23), 77 and 78.)

This route reduces the number of events that must succeed during a card authorisation. Customers lose token exposure on the amount sold and must fund their euro balance in advance. Those are product choices to explain before conversion.

Conversion at card authorisation

For on-demand spending, the customer gives a defined conversion mandate. When an authorisation request arrives, the CASP reserves the necessary tokens, fixes the price and completes the sale. A separately funded corporate liquidity arrangement supplies the euro top-up before the issuer approves the card transaction. The CASP later replenishes that arrangement through its banking route.

The agreement must identify who provides this liquidity, its availability outside banking hours, and who bears failed conversion or replenishment. A pending blockchain transfer, a token reserve and an unpaid conversion receivable are different assets. None should be represented as cleared customer euros. If the sale or funding fails, decline the purchase before authorisation. A design allowing spending before sufficient funds are credited requires a separate credit assessment.

Once the issuer owes a valid card transaction, a failed token conversion does not extinguish its scheme obligation. Visa's current rules require the issuer to pay the acquirer for valid transactions. Select on-demand conversion only after the issuer accepts the documented liquidity and loss allocation. (Visa Core Rules and Visa Product and Service Rules, 24 October 2026, rule 1.7.6.1.)

Establish the token and wallet permissions

A token purporting to maintain a stable value by reference to the euro is an EMT within MiCA if it falls within that Regulation's scope. Its issuer ordinarily must be an authorised credit institution or EMI, with a notified and published white paper. Check the exact token, issuer, blockchain and permission record. If another programme participant offers the token to the public, obtain the issuer's written consent and apply the associated requirements. The EU stablecoin issuance guide explains the separate issuer decision. (MiCA, arts. 2, 3(1)(7) and 48(1)–(3).)

The CASP's authorisation must cover the services actually delivered. In this programme, those are custody, exchange for funds and transfers where performed on customers' behalf. A wallet label cannot decide custody: control of tokens or their means of access is the relevant fact. An EMI's MiCA notification route covers custody and transfers of EMTs it issues itself. It does not provide general permission to exchange or hold another issuer's tokens. (MiCA, arts. 3(1)(17), 59(6), 60(4) and 75.)

EMTs are also electronic money and therefore funds for PSD2. The EBA advises supervisors to treat customer EMT transfers as payment services, and qualifying custodial wallets as payment accounts. Its exchange-only treatment does not exempt the surrounding transfer and wallet services. A transfer back to the same customer can require payment permission even where the wallet is not a payment account. (MiCA, arts. 48(2) and 70(4); PSD2, art. 4(25); EBA/Op/2025/08, paras. 21 and 23; EBA/OP/2026/01, para. 15.)

Select a CASP holding the necessary payment permissions, or establish a documented arrangement with an appropriately authorised payment provider. Payment agency is one possible arrangement, subject to registration. The partner's own crypto activities must also be checked under MiCA. The EBA opinions are supervisory guidance; they do not amend the legislation. (EBA/OP/2026/01, paras. 8 and 14.)

The general EBA transition ended on 2 March 2026. Its limited continuation advice for qualifying pending applicants does not support a new customer launch: the relevant restrictions include no new clients and no marketing. The temporary exception for certain MiCA grandfathered firms has also expired. Ireland's MiCA transition ended on 30 December 2025. Obtain effective permissions before enabling the services. (EBA/OP/2026/01, paras. 9–13; MiCA, art. 143(3); Irish S.I. No. 607/2024, reg. 20.)

Classify the fiat account separately

The Irish card issuer needs permission for the relevant payment services, including card issuance and execution. A payment institution can maintain an account used exclusively for payment transactions. The selected fiat account does not involve issuing a separate monetary asset accepted by third parties. (PSD2, art. 18(2)–(3) and Annex I, points 3 and 5; Irish S.I. No. 6/2018, reg. 29.)

Prefunding alone does not turn that account into e-money. In ABC Projektai, the Court rejected automatic reclassification merely because money remained pending future orders. The Commission's answer in EBA Q&A 2022_6336 also distinguishes merchants accepting e-money from merchants receiving ordinary bank money through card settlement. It is nonbinding interpretative guidance. If the product actually issues a separate monetary asset accepted by others, use an eligible e-money issuer and revise issuance, safeguarding and redemption terms accordingly. (Directive 2009/110/EC, arts. 2(2), 7, 10 and 11; ABC Projektai, paras. 43–49 and 52; EBA Q&A 2022_6336, final answer, 17 January 2025.)

Limit the programme manager's operating powers

The UK manager can supply software, collect information for provider-controlled onboarding and administer first-line support under written outsourcing arrangements. The regulated providers retain customer acceptance, custody, conversion and payment decisions. A technical exclusion requires more than avoiding possession of money: payment initiation and account information services are expressly outside that exclusion. (PSD2, art. 3(j); Irish S.I. No. 6/2018, regs. 4(1)(j) and 30–31; UK S.I. 2017/752, sch. 1, para. 2(j).)

If the manager supplies payment services as an agent, the principal must obtain the required register entry before those services start. A scheme's third-party registration is a separate requirement. MiCA outsourcing does not create a general CASP-agent exemption. Functions which amount to the manager providing its own crypto service need a fresh permission assessment. The principal-and-agent launch service addresses role selection and programme terms. (Irish S.I. No. 6/2018, reg. 30; MiCA, arts. 59 and 73.)

The UK origin assessment must examine where staff act and whose service they provide. UK anti-money-laundering rules include arranging crypto exchange, even without custody. If the manager's orchestration falls within that business, resolve FCA registration or remove the activity before launch. EEA customers alone do not eliminate the UK question. The wider UK crypto authorisation regime starts on 25 October 2027; it does not replace today's perimeter assessment. Assess UK-origin marketing separately under the financial-promotion rules, including the conditions of any overseas-recipient exemption. (Financial Services and Markets Act 2000, s. 21; Financial Services and Markets Act 2000 (Financial Promotion) Order 2005, S.I. 2005/1529, art. 12; UK S.I. 2017/692, regs. 8, 9(3), 9(5)(b), 14A and 56; Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, S.I. 2026/102, reg. 1(2)–(3).)

For expansion, the issuer and CASP need separate passport workstreams. Complete the relevant payment notifications and MiCA Article 65 process, then check destination consumer and marketing requirements. MiCA has been incorporated into the EEA Agreement; Irish national rules still cannot be assumed to govern every EEA customer. A UK permission gives no EEA passport. An actively marketed programme cannot rely on MiCA's exclusive-client-initiative exception. (PSD2, arts. 28–29; MiCA, arts. 61 and 65; EEA Joint Committee Decision No. 41/2025.)

Each provider should approve a balance-protection schedule identifying the asset, legal entitlement, account, reconciliation and failure treatment.

The CASP must segregate customer tokens from its own holdings, maintain individual position records and protect custody assets from its creditors under applicable law. Those duties do not guarantee the token's value or instant recovery. The EMT issuer separately owes redemption and protects issuance funds. For EMTs outside Article 58's enhanced reserve regime, MiCA requires at least 30% of the safeguarded issuance funds in separate credit-institution accounts; the balance follows its prescribed investment conditions. (MiCA, arts. 49, 54, 58, 70(1) and 75(2), (6)–(8).)

Conversion introduces a distinct exposure. Once the CASP buys the tokens, the customer may hold a purchase-price claim until euros reach the payment provider. Specify title transfer and the moment proceeds become customer funds. Where a CASP holds client fiat, MiCA imposes protection and next-business-day placement requirements, subject to Article 70(5)'s exception for regulated payment and banking institutions. It does not transform every unpaid purchase-price debt into safeguarded cash. (MiCA, art. 70(2)–(5).)

For the Irish fiat account, apply the payment safeguarding rules. Under the segregation route, customer funds must remain separate, with qualifying placement by the statutory deadline. Irish law restricts insolvency-officeholder and creditor recourse until the protected customer claims are met. The alternative is qualifying insurance or a comparable guarantee. Reconcile the customer ledger to the actual safeguarding arrangements; a ledger entry alone supplies no protection. (Irish S.I. No. 6/2018, reg. 17, as amended by S.I. No. 169/2025, reg. 4.)

Keep corporate conversion liquidity and scheme collateral separate from safeguarded customer funds. The recommended contracts prohibit using other customers' balances to cover a conversion shortfall, chargeback reserve or provider's general settlement deficit. The legal protections depend on the relevant asset and arrangement; neither the payment-account claim nor the EMT is an insured bank deposit merely because a bank holds backing funds. (MiCA, art. 51(4); PSD2, art. 18(3).)

Before onboarding, the CASP and payment provider must allocate identity checks, sanctions screening, transaction monitoring and transfer data. The Transfer of Funds Regulation treats EMTs as crypto-assets. Its narrow card-purchase exclusion does not automatically cover token deposits or withdrawals. For relevant self-hosted transfers, the information duties apply whatever the amount; transfers exceeding €1,000 add an ownership or control assessment. (Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, ss. 25, 33, 35 and 41–42, as amended; Regulation (EU) 2023/1113, arts. 2(3)–(4), 14(5), 16(2) and 23.)

The responsibility schedule should distinguish five events.

1. A declined or reversed authorisation releases the card hold through the issuer and processor. If tokens were already sold, a card reversal does not automatically reverse that sale. Leave the released amount in euros unless the customer separately authorises a fresh conversion. Where the card amount was unknown, Irish law requires consent to the exact amount blocked and timely release. (Irish S.I. No. 6/2018, reg. 99.)
2. A merchant refund follows the card route into the customer's fiat account. The issuer processes it; the CASP handles any separately requested token repurchase. Terms should state the currency, applicable fees and new conversion price. The customer should not be promised the original token quantity after a completed sale.
3. An unauthorised card payment invokes the issuer's statutory duties. Refund is normally immediate and no later than the next business day's end after discovery or notification. The suspected-fraud exception requires reasonable grounds and written communication to the relevant authority. Customer notice and loss-allocation rules also apply; authentication alone does not establish authorisation or gross negligence. A network chargeback cannot postpone a statutory refund. (Irish S.I. No. 6/2018, regs. 95–98.)
4. A failed or late payment requires the responsible payment provider to investigate and apply the statutory execution and refund rules. The issuer handles the customer-facing card claim and pursues contractual recovery from the responsible provider. Scheme disputes have their own evidence and time limits. Allocate claim submission and record access before launch. (Irish S.I. No. 6/2018, regs. 112–116; Visa Core Rules and Visa Product and Service Rules, 24 October 2026, section 11.)
5. A token withdrawal or issuer redemption belongs to the crypto route. The CASP returns custody assets under its agreement; the EMT issuer must ordinarily redeem at par, on request, in funds other than electronic money. A secondary-market sale is a different service and can involve a spread. Ordinary EMT redemption is fee-free, subject to MiCA's recovery provisions. (MiCA, arts. 49 and 75(6).)

For frozen tokens, record whether the restriction comes from law, issuer controls or a provider decision. Identify who can lift it and what can be communicated. Suspend affected new conversions where funding is unavailable. Preserve customer entitlements and fund existing card obligations through the agreed corporate arrangements.

For provider failure, distinguish custody assets, safeguarded fiat, unpaid conversion proceeds and corporate reserves. The exit plan must identify who can access records and keys, submit redemption claims, complete pending payments and return balances. A replacement provider needs the relevant permissions and a lawful customer-transfer route. Outsourcing contracts must support continuity and exit; for covered ICT services, DORA adds contractual requirements. (MiCA, arts. 73–75; Regulation (EU) 2022/2554, arts. 28–30.)

The manager may triage complaints, but the terms must identify the responsible regulated provider. Irish payment complaints generally require a substantive reply within 15 business days, with the prescribed exceptional extension to 35. CASP complaints need their own compliant process. (Irish S.I. No. 6/2018, reg. 124; MiCA, art. 71.)

The programme manager should coordinate a launch pack with a named owner for each dependency:

• The legal lead and providers approve the activity map, token classification, fiat-account classification and country scope. Register evidence must match each entity, service and restriction. Any agency or passport step must be effective before the relevant activity starts.
• The CASP finalises custody, exchange and transfer terms. They identify the service provider, quote acceptance, title transfer, pricing, transfer finality, withdrawal rights and complaints. The EMT issuer's redemption terms remain accessible. (MiCA, arts. 75, 77 and 82.)
• The card issuer approves the account and card agreement, fees, consent process, holds, refunds, security controls and complaints. The interface must identify the issuer before the customer accepts the contract. Apply the current distance-contract information, explanation and cancellation requirements, including an online cancellation function where the customer has that right. (Irish S.I. No. 6/2018, regs. 63(2), 75–76, 88, 99, 120 and 124; Consumer Rights Act 2022, ss. 115A and 125C–125I, as inserted by S.I. No. 309/2026, regs. 6–7; S.I. No. 309/2026, reg. 19.)
• Treasury and the providers sign the conversion and settlement arrangements. Record funding cut-offs, liquidity ownership, replenishment, reconciliation, shortfall allocation, collateral and suspension powers. Test delayed conversion, bank closure, duplicate messages, partial capture, reversals, refunds and provider failure before admitting customers.
• The regulated providers complete outsourcing and data arrangements, including supervision, subcontracting, incident support, record access and exit. An Irish payment institution must notify proposed operational outsourcing at least 30 days beforehand. Apply DORA's additional terms where relevant. (Irish S.I. No. 6/2018, regs. 30(7)–(10) and 31; DORA, arts. 28–30.)
• The issuer obtains the applicable scheme and programme approvals, processor certification and third-party registrations. Visa's public programme materials require express written approval for the relevant debit or credit programme. The executed issuer and scheme documents must cover the actual token-funded product and territories. (Visa, Core Product Program Information Form, approval requirements; Visa Core Rules and Visa Product and Service Rules, 24 October 2026, rules 1.9.8.5–1.9.8.6.)

Enable customer funding and card issuance only after their respective legal and operational conditions are satisfied. The authorisation and contract work must address the law applying at launch. PSD3 and the proposed Payment Services Regulation remain a separate change-management workstream; their legislative progress does not remove current PSD2 duties. (Council of the European Union, documents ST 14794/26 and ST 14798/26, 23 October 2026, paras. 6–8.)