A South African crypto business is considering custody for assets held by a fund managed from Luxembourg. This composite hypothetical concerns no actual client, authorisation or completed transaction. The company has an assumed relevant FSCA financial-services authorisation and controls its custody technology and key-management policy. Should it establish its own EU-authorised custodian, supply technology to an authorised EU provider, or postpone service? The preferred initial structure below assumes an eligible Luxembourg alternative investment fund, an authorised EU custodian with genuine operational control, and fund assets that do not pass through South Africa.
Executive Summary
- Supply technology for the first mandate if the EU provider actually performs custody and accepts responsibility. The South African company must surrender client-asset signing, recovery and transaction-policy control within that arrangement. MiCA permits outsourcing but restricts the custody chain. (Regulation (EU) 2023/1114 (MiCA), Articles 3(1)(17), 73 and 75(9).)
- Establish an autonomous EU entity when retaining the custody relationship justifies its permanent staffing, financial safeguards and supervisory obligations. An EU subsidiary cannot serve as a contracting shell for the South African parent. (MiCA, Articles 59(2), 62, 67 and 73.)
- Do not appoint the FSCA-only company as the EU custodian’s crypto sub-custodian. Article 75(9) requires the downstream provider to qualify under Article 59. An eligible financial institution using Article 60 may qualify; a South African domestic authorisation alone does not. (MiCA, Articles 59(1), 60 and 75(9).)
- Classify the asset and the fund separately. Tokenised financial instruments fall outside MiCA, while a fund depositary retains duties beyond wallet custody. Professional investors do not create a general third-country custody exemption. (MiCA, Articles 2(4)(a), 59 and 61; Directive 2014/65/EU, Article 4(1)(15); Luxembourg Law of 12 July 2013 on alternative investment fund managers, Article 19.)
- Keep fund assets and fiat settlement outside South Africa in the proposed technology model. Funding an EU subsidiary, licensing intellectual property and receiving service fees still require their own exchange-control treatment. The 2026 draft cross-border crypto manual supplies no operative permission. (Exchange Control Regulations, 1961, regulations 6 and 10; SARB, Currency and Exchanges Manual for Authorised Dealers, sections B.2(A) and B.2(C); Exchange Control Circular No. 19/2026, pp. 1–2.)
- Postpone onboarding where no eligible custodian and depositary arrangement exists, the South African firm retains custody under a technology label, or the proposed asset path lacks a lawful permission basis. A limited software contract should prohibit client-asset service until those conditions are met. (MiCA, Articles 59, 73 and 75; CSSF, Depositary, “Administrative authorisation”.)
The proposed institutional mandate
The first mandate should use an existing EU custodian, provided that the company accepts a supplier role. The commercial judgment rests on the proposed division of responsibility: the EU provider operates custody while the South African company licenses software and supplies restricted technical support. This recommendation does not assume that any provider has agreed to that division or that outsourcing costs less in every case. It avoids building a second regulated custodian solely to preserve functions that the supplier is willing to relinquish. (MiCA, Articles 59, 73 and 75.)
For this structure, assume a Luxembourg-domiciled alternative investment fund (AIF) managed by a fully authorised alternative investment fund manager (AIFM). Its constitutional and offering documents permit the proposed direct crypto exposure. Its investors satisfy the applicable fund eligibility conditions, and the actual custody client’s professional status is documented separately. The fund, or a representative with authority to bind it, enters the custody agreement. The AIFM gives investment instructions within its mandate; the custodian verifies and executes authorised movements. Individual fund investors do not become separate wallet-custody clients merely by subscribing.
Choose initially a limited inventory of transferable, fungible cryptoassets admitted to trading that fall within MiCA. Exclude securities tokens, derivatives, deposit tokens, lending, staking and rehypothecation from this first mandate. Treat asset-referenced tokens and e-money tokens as a separate expansion decision. Those exclusions are proposed contractual limits, rather than a statement that every excluded activity is prohibited. (MiCA, Articles 2–4, 59(6) and 62(2)(m), (r) and (s).)
The alternative facts change the decision. A Luxembourg manager may manage a fund domiciled elsewhere; that fund’s own law and depositary requirements then need separate application. A UCITS retail investment fund, retail AIF, well-informed-investor vehicle and professional-only AIF do not have interchangeable eligibility rules. A direct institutional customer holding its own cryptoassets has no fund depositary merely because it qualifies as professional. Each branch requires a different contract and permission map. (Luxembourg Law of 12 July 2013, Article 19(3)–(6); CSSF, Communiqués of 22 February 2024 and 4 February 2026 on cryptoasset investment by UCIs.)
The decisive technical fact is whether the EU custodian can approve, sign, recover and return client assets without the South African supplier’s discretionary intervention. Hosting a signing appliance in Europe does not establish that fact if administrators in South Africa can reset credentials or reconstruct the keys. Shared-signature and multi-party-computation arrangements require examination of every normal, emergency and recovery path. A contract that calls that power “support” cannot determine its legal classification. (MiCA, Article 3(1)(17); ESMA, Supervisory Briefing on the Authorisation of CASPs under MiCA, 31 January 2025, sections 5.1–5.5.)
South African custody and financial-crime duties
Client safekeeping and administration fall within the Financial Advisory and Intermediary Services Act (FAIS) intermediary-service analysis when the assets satisfy the FSCA cryptoasset declaration. The relevant permission is an FSP authorisation for the actual service and product, subject to its conditions. It is not a transferable group credential. The FSCA and SARB expressly identify safe custody and administration among the activities addressed by FAIS. (Financial Advisory and Intermediary Services Act 37 of 2002, sections 1, 7 and 8; FSCA Declaration, GN 1350, Government Gazette 47334, 19 October 2022; SARB–FSCA Joint Communication on cryptoassets for domestic payment purposes, 28 May 2026, paragraphs 5.1–5.8.)
Apply that distinction to the two operating alternatives. If South African personnel control client keys, administer custody or act on transfer instructions, the domestic permission assessment must cover those acts. A software supplier that cannot control assets still needs its actual functions classified; a technology label supplies no blanket FAIS exemption. Investment discretion would require a different assessment from safekeeping under client instructions. The licence schedule and operating mandate must agree before either structure starts. Licentium’s South Africa CASP licensing explainer addresses the domestic authorisation process separately.
The Financial Intelligence Centre (FIC) perimeter applies independently. Schedule 1 item 22 covers a business safeguarding or administering cryptoassets, or instruments that permit control, for clients. It also covers client cryptoasset transfers. A company performing those functions is an accountable institution and must implement the applicable registration, customer and beneficial-owner checks, risk-management programme, monitoring, reporting and recordkeeping duties. An EU partner’s onboarding procedure does not discharge the South African entity’s own obligations. (Financial Intelligence Centre Act 38 of 2001, Schedule 1, item 22(c)–(d); FIC, Crypto Asset Service Providers and Compliance obligations.)
Transfer operations also engage the FIC travel rule. Directive 9 took effect on 30 April 2025; the FIC published final implementation guidance as PCC 61 on 30 March 2026. The proposed workflow must identify the ordering, intermediary and recipient institutions and allocate information collection, transmission and exception handling. Travel-rule compliance does not itself permit a cross-border capital movement. (FIC, Directive 9 of 2024, paragraphs 2–7 and 9.1; FIC, Joint Advisory of 17 April 2025; PCC 61, 30 March 2026; Exchange Control Regulations, 1961, regulation 10(1)(c).)
The cross-border asset path
The transaction must be tested under the operative exchange-control permission system, independently of FAIS. Regulation 10(1)(c) restricts transactions that directly or indirectly export capital or rights to capital without Treasury permission. SARB’s Authorised Dealer Manual administers permissions and referrals within that system. An FSCA authorisation does not make its holder an authorised foreign-exchange dealer or confer a crypto export allowance. (Exchange Control Regulations, 1961, regulation 10(1)(c); SARB, Currency and Exchanges Manual for Authorised Dealers, section A.3(xviii); SARB, Financial Surveillance FAQs, “Crypto assets”.)
Three asset paths require different answers. In the recommended path, the non-resident fund already owns assets acquired and held outside South Africa. It transfers them directly between approved external addresses into the EU custodian’s controlled arrangement. South African staff neither receive the assets nor direct their movement. This design avoids making a South African purchase, custody account or outbound client transfer part of the service. It does not establish a universal legal situs rule for distributed-ledger assets.
A second path would use rand or South African-held crypto to fund an offshore wallet or exchange. SARB’s published position prohibits using cryptoassets to externalise capital through circumvention of exchange controls. The individual allowances mentioned in its FAQs are not a corporate customer-transfer permission and cannot be pooled through other persons. The proposed institutional service should exclude that path unless its particular transaction has a lawful permission basis. (SARB, Financial Surveillance FAQs, “Crypto assets”; Exchange Control Regulations, 1961, regulations 10(1)(c) and 22.)
A third path would introduce a non-resident fund’s crypto into South Africa, sell it locally and remit the fiat proceeds abroad. SARB’s FAQs expressly state that a non-resident who introduces cryptoassets for local sale cannot transfer those sale proceeds abroad under that arrangement. The company should not promise free repatriation merely because the beneficial owner is foreign. The recommended model avoids this inward-sale-outward-remittance sequence. (SARB, Financial Surveillance FAQs, “Crypto assets”, referring to the Authorised Dealer Manual, section G.(C)(i).)
The strongest contrary argument challenges whether Bitcoin falls within the existing regulations’ concepts of money or capital. The High Court decisions have diverged. In its leave decision of 20 July 2026, the court recorded its departure from Standard Bank and granted leave to appeal against the whole of its 1 June judgment. That disagreement prevents treating the narrower interpretation as an uncontested operating entitlement. The recommendation rests on a structure that does not require an unapproved South African crypto export. (Mangundhla and Another v South African Reserve Bank, [2026] ZAGPJHC 803, 20 July 2026, pp. 1–3, discussing Standard Bank of South Africa Ltd v South African Reserve Bank, 2025 (5) SA 289 (GP).)
The 2026 consultation does not supply an alternative permission. SARB and Treasury released a draft Crypto Assets Manual for Cross-border Activities, with comments due on 30 September 2026. Circular 19/2026 expressly makes final implementation contingent on promulgation of the new Capital Flow Management Regulations. Publication of the draft, or expiry of its comment period, does not activate the proposed “Authorised CASP” channel. (Exchange Control Circular No. 19/2026, 31 July 2026, pp. 1–2; SARB–National Treasury, joint media statement, 3 August 2026.)
Technology exports require separate treatment even when client crypto never enters South Africa. The proposed contracts must distinguish service fees, software licences, assignment of intellectual property, shareholder funding and guarantees. Regulation 10(4) expressly addresses intellectual-property rights; the Manual distinguishes intellectual-property transactions and outward direct investment. Submit the actual contracts and payment diagram through the authorised dealer, with Financial Surveillance referral where required. Do not fund an EU subsidiary by substituting a crypto transfer for the approved banking route. (Exchange Control Regulations, 1961, regulations 6 and 10(4); Authorised Dealer Manual, sections B.2(A) and B.2(C).)
MiCA custody and third-country access
MiCA custody includes safekeeping or controlling cryptoassets or their means of access on behalf of clients. Control of private keys can therefore make the company a custodian without legal ownership of the tokens. Operating transfers between addresses may also require the transfer-service permission. The service inventory should separate custody movements from any independently offered transfer, execution or exchange service. (MiCA, Article 3(1)(16), (17) and (26), and Article 59(6).)
Financial instruments fall outside MiCA even when issued on a distributed ledger. Tokenised shares, bonds, fund units and derivatives require classification under the financial-instrument rules and the applicable custody, investment-services and fund laws. A MiCA custody authorisation cannot substitute for the securities permissions that the actual activities require. The same perimeter exercise must distinguish deposits, e-money tokens and genuinely unique non-fungible assets. (MiCA, Article 2(3)–(4); Directive 2014/65/EU (MiFID II), Article 4(1)(15); CSSF, FAQ Tokenisation, 2 October 2026, Introduction and Question 1.)
The Article 4(5) custody-and-transfer exemption has its own limits. It concerns specified exempt offers under Article 4(3), and fails where the asset is admitted to trading or another public offer of the same asset does not benefit from that exemption. The proposed traded-asset mandate therefore cannot rely on that provision. A qualified-investor offering exemption is not a general exemption from CASP authorisation. (MiCA, Article 4(2)–(5).)
A South African company cannot solicit an EU custody business merely because its customers are professional. Article 59 requires the relevant EU authorisation route. Article 61 allows a third-country service at the EU client’s own exclusive initiative, including the relationship specifically connected with that service. Solicitation by the provider, its agents or closely linked persons defeats that exception; contractual declarations cannot reverse the facts. The exception also does not authorise marketing new types of services or assets. (MiCA, Articles 59 and 61.)
An independently initiated approach by the Luxembourg manager could support an Article 61 assessment for a defined direct service. It cannot be assumed from the statement that the manager “wants safekeeping”. Nor does Article 61 remove an EU custodian’s separate restriction on appointing sub-custodians under Article 75(9). A repeatable business involving introductions, targeted campaigns or referrals should use an authorised EU provider rather than depend on reverse solicitation. (MiCA, Articles 61 and 75(9).)
Public-facing material should identify the EU entity that provides custody and the South African company’s limited supplier role. MiCA requires fair, clear and non-misleading client information, including identifiable marketing communications. The supplier should not present the partner’s authorisation as its own or advertise services outside the agreed permission. The first mandate excludes distribution of fund units by the supplier. (MiCA, Articles 59(5)–(6) and 66(1)–(3).)
Luxembourg’s former VASP registration is not a substitute for the required permission. The CSSF confirmed that the transition ended on 1 July 2026. For a Luxembourg applicant, the CSSF is the relevant authorising authority. An appropriately authorised CASP established elsewhere in the EU may use MiCA’s cross-border procedure; the fund manager’s Luxembourg location does not force the custodian’s incorporation there. (MiCA, Articles 59(7) and 65; CSSF, “MiCA: Transition period for virtual asset service providers ended on 1 July 2026”, 2 July 2026.)
Fund eligibility and the separate depositary
Select the fund’s permissible exposure before selecting its wallet provider. The CSSF’s 4 February 2026 communication permits qualifying indirect UCITS crypto exposure up to 10% of net asset value. The current FAQ limits this route to eligible transferable securities without embedded derivatives and requires timely notice to the CSSF. It also permits up to 10% exposure for retail AIFs outside the well-informed-investor category, subject to the relevant conditions. Those permissions cannot be converted into approval of a UCITS holding a direct Bitcoin custody mandate. The proposed professional AIF must satisfy its own product and investment conditions. (CSSF, Communiqués of 22 February 2024 and 4 February 2026 on cryptoasset investment by UCIs; CSSF, FAQ Crypto-assets – Undertakings for collective investment, version 8, 24 April 2026, Q1–Q2.)
The CSSF also requires an authorised AIFM intending to manage an AIF investing more than 10% of net asset value in cryptoassets to obtain prior authorisation for the cryptoasset strategy. The cryptoasset-strategy application is not required for exposure through target funds; fund-of-funds authorisation applies above 20% of net asset value in target funds. Each AIF initiator should present its project to the CSSF beforehand. “Well-informed investor” eligibility and MiFID professional-client status answer different questions. The selection of a professional-only fund does not waive the AIFM’s strategy, risk-management or depositary obligations. (CSSF, communiqué of 4 February 2026 and FAQ Crypto-assets – Undertakings for collective investment, version 8, Q3 and Q3(a); Luxembourg Law of 12 July 2013, Articles 14 and 19.)
For the proposed Luxembourg AIF under a full-scope AIFM, retain an eligible depositary under a separate written appointment. The depositary performs cash-flow monitoring and oversight, alongside safekeeping. For assets falling within Article 19(8)(b), it verifies ownership and maintains records; financial instruments capable of custody follow Article 19(8)(a). An asset’s classification determines that treatment. A MiCA custodian’s private-key service does not by itself fulfil the depositary appointment. (Luxembourg Law of 12 July 2013, Article 19(1)–(3), (7)–(9).)
The proposed depositary can verify ownership using contracts, independent custody records and reconciled ledger information without necessarily controlling private keys. Where the depositary supplies no MiCA custody, the fund or its manager contracts directly with the CASP. The depositary must notify the CSSF beforehand of a direct-crypto fund appointment. If it itself provides MiCA custody, its relevant Article 59 or Article 60 entitlement must cover that activity. A banking or fund-depositary approval cannot be treated as an unrestricted crypto permission. Conversely, a standalone CASP does not become an eligible Luxembourg fund depositary solely through MiCA authorisation. (MiCA, Articles 59–60; Luxembourg Law of 12 July 2013, Article 19(3) and (8); CSSF, Depositary, “Administrative authorisation”; CSSF, FAQ Crypto-assets – Undertakings for collective investment, version 8, Q5.)
Delegation must satisfy the depositary regime as well as MiCA where both apply. The depositary must justify and supervise safekeeping delegation, and cannot delegate its substantive cash-monitoring and oversight duties as though they were custody. Its financial-instrument loss liability differs from liability for negligent or intentional failures concerning other assets. Any permitted discharge of AIF depositary liability has specific statutory conditions. Neither a general supplier indemnity nor a MiCA liability clause resolves those separate duties. (Luxembourg Law of 12 July 2013, Article 19(11)–(14); CSSF, Depositary, “Application in case of outsourcing of UCI depositary tasks”.)
If South African operations extend into delegated AIFM functions, Article 18 applies independently of the custody outsourcing contract. Portfolio or risk-management delegation to a third-country firm requires an eligible delegate or prescribed CSSF approval, plus supervisory cooperation. The AIFM must retain effective supervision and cannot become a letterbox entity. The proposed technical-support mandate excludes those functions. (Luxembourg Law of 12 July 2013, Article 18(1)–(3bis).)
A competing structure could use a third-country delegate for qualifying financial instruments under the fund rules. It would require the relevant prudential, segregation, due-diligence and audit conditions; the local-law exception has further limits. Those provisions do not grant the FSCA-only firm an EU custody permission for MiCA cryptoassets. The company must not import a securities-delegation exception into Article 75(9). (Luxembourg Law of 12 July 2013, Article 19(11); MiCA, Articles 2(4)(a) and 75(9).)
Own EU-authorised custody entity
Choose an owned EU entity when the business intends to retain the custody contract and can support an autonomous regulated operation. The fund or its authorised representative contracts with that entity. Its management controls custody policy, signing authorities, recovery and withdrawals. The AIFM instructs investment transactions, while the EU custodian validates those instructions and safeguards the assets. The South African parent may supply technology under a separately supervised contract. (MiCA, Articles 59(2), 68, 73 and 75.)
A standalone crypto-asset service provider (CASP) applicant seeks authorisation under Articles 62–63 for the exact services. Article 60 instead permits specified existing financial institutions to provide equivalent services after the required notification. A bank can use that route within its conditions; an AIFM’s existing status does not automatically authorise client crypto custody. Creating a bank or investment firm solely to avoid the CASP application would introduce a different regulated business, whose permissions must independently fit the model. (MiCA, Articles 59–60; CSSF, Legal requirements and autorisation procedure for CASPs, “Types of applications”.)
An Article 63-authorised entity needs an EU registered office where it carries out at least part of its services, effective EU management and an EU-resident director. Those minimum conditions do not authorise a shell dependent on South African decision-makers. A standalone custody CASP’s prudential safeguards must equal at least the higher of €125,000 and one quarter of the relevant fixed overheads. Eligible own funds, qualifying insurance or their permitted combination may meet the requirement. These safeguards are separate from the operating budget. (MiCA, Articles 59(2) and 67, and Annex IV; ESMA, Supervisory Briefing, sections 4–5.)
The EU custodian directs incident response and manages the client relationship. It must reconcile positions, segregate client assets, preserve return procedures and bear MiCA’s liability for attributable custody losses. The liability cap is the lost asset’s market value when the loss occurred. The provider can establish non-attribution by demonstrating that the event occurred independently of the relevant service or its operations. A parent indemnity may allocate economic loss internally but cannot replace the custodian’s client duties. (MiCA, Article 75(2)–(8).)
Client-asset segregation must operate in the records, on-chain holdings and applicable insolvency law. The custody contract should state the governing law and return arrangements, with enforceability assessed across the actual custody chain. The proposed EU key-control arrangement is a design condition; MiCA’s EU management requirements do not themselves locate every cryptographic component. (MiCA, Articles 59(2), 73 and 75(1), (6)–(7).)
An application should follow the custody architecture rather than precede it. The CSSF requests wallet and account diagrams, service descriptions and partner contracts. The authorisation dossier must address the applicable technical standards, including Regulations 2025/305 and 2025/306. Licentium’s general MiCA authorisation guide addresses that filing process. The decision here is whether the owned entity will actually perform the proposed institutional service. (MiCA, Article 62; CSSF, Legal requirements and autorisation procedure for CASPs, “Initial contact” and “Formal application or notification file”.)
Technology supply and lawful sub-custody
Under the preferred technology arrangement, the EU custodian signs the fund custody agreement and contracts separately with the South African supplier. The EU custodian controls usable key material, signing thresholds, transaction approval and recovery. The supplier develops software, performs approved maintenance and supplies restricted onboarding support. It receives no general authority to move, release, freeze or recover client assets. Customer acceptance and suspicious-activity decisions remain with the regulated institutions responsible for them. (MiCA, Articles 3(1)(17), 73 and 75.)
Give the supplier only the access necessary for those tasks. The EU provider must be able to inspect code changes, revoke access and continue custody if the supplier fails. A retained emergency recovery key, an indispensable signing share or power to change withdrawal policy requires renewed custody classification. Lack of unilateral transfer power alone does not establish that a participant performs no custody. The actual combination of powers must remain consistent with the claimed supplier role. (MiCA, Articles 3(1)(17) and 73; ESMA, Supervisory Briefing, sections 5.1–5.5.)
A genuine sub-custody contract is a different arrangement. The EU custodian may entrust custody only to an Article 59-qualified provider and must inform clients. If the South African group later establishes its own appropriately authorised EU entity, that entity could be the downstream custodian. The FSCA-only parent cannot occupy that position on the strength of its domestic licence. Intra-group contracting does not remove the upstream custodian’s Article 75(9) obligation. (MiCA, Articles 2(2)(a), 59 and 75(9).)
The EU custodian remains responsible under MiCA when it outsources. The supplier must investigate defects, preserve evidence and notify the EU provider under the service agreement. The regulated entity directs containment, client communication, withdrawal restrictions and regulatory reporting; the depositary retains its own duties. Contracts should grant direct audit and supervisory access, control subcontracting, define recovery cooperation and provide a tested exit. (MiCA, Article 73(1)–(4); CSSF, ICT and cyber risk for DORA entities, “Managing ICT third-party risk” and “ICT-related incident management, classification and reporting”.)
The strongest commercial objection is dependence on the partner’s fees, asset coverage, risk appetite and willingness to maintain the service. The company gives up direct custody revenue and control over the client relationship. An owned EU operation becomes preferable when funded demand supports those retained functions and the group can staff them independently. If the supplier cannot surrender custody powers, the recommended technology arrangement fails on its own stated condition. (MiCA, Articles 59(2), 73 and 75.)
Postponement and implementation conditions
Postponement is the correct route when neither lawful structure can operate. During postponement, no entity accepts assets under the deferred mandate in reliance on an expected future permission. The fund retains its existing lawful arrangements; the South African company can continue product development with synthetic data and assets it is entitled to use. Any development agreement should exclude live custody and transfers, allocate test incidents and prohibit claims of EU authorisation. (MiCA, Article 59(1), (5) and (6).)
Implementation should begin with a signed transaction specification. Identify the fund domicile and form, its manager and depositary, the actual custody client and every signatory’s authority. Classify each token, investment strategy and service. Record marketing channels, client residence, beneficial ownership, fiat providers and every address-to-address movement. A Luxembourg manager’s request is insufficient to settle those questions. (MiCA, Articles 62(2) and 75(1); Luxembourg Law of 12 July 2013, Article 19.)
Next, approve the permission and asset-path memorandum. Match the South African licence schedule and FIC registration to the functions performed there. Obtain the authorised dealer’s documented treatment of funding, intellectual property and fees, with any necessary Financial Surveillance permission. Reject an unapproved South African purchase, export or repatriation leg. Confirm the fund’s eligible exposure, AIFM strategy permission and depositary appointment before choosing a custodian. (FAIS Act, sections 7–8; FIC Act, Schedule 1, item 22; Authorised Dealer Manual, sections B.2(A) and B.2(C); CSSF, communiqué of 4 February 2026.)
Then select the contracting route and verify the actual provider’s official permission for custody and any additional services. Complete relevant EU cross-border notifications. For an owned Luxembourg entity, take the operating diagrams to the CSSF before finalising the application. For a partner arrangement, agree the fund, custodian, depositary and supplier contracts together so that ownership records, reporting access and termination provisions do not conflict. (MiCA, Articles 59(6), 62, 65, 73 and 75; CSSF, CASP authorisation procedure.) For a Luxembourg CASP, notify the CSSF at least three months before a contract for ICT services supporting critical or important functions takes effect. The one-month period for specified Luxembourg support PFS does not cover the South African supplier. Chapter 2 excludes Luxembourg branches of entities headquartered in another EU Member State and ECB-supervised significant credit institutions; their competent authority’s requirements need separate application. (Circular CSSF 25/882, as amended by Circular CSSF 26/915, points 1(c), 3–4 and 11–15.)
Put fiat with a bank or appropriately authorised payment provider under explicit settlement arrangements. MiCA requires separate treatment of client funds and authorisation for related payment services. Stablecoin functionality must not be used to bypass that assessment. The proposed initial mandate excludes stablecoin payment services; adding them requires a new asset and payments decision. (MiCA, Articles 3(1)(6)–(7), 60(4) and 70.)
Before South African onboarding support receives personal data, settle controller and processor roles, access restrictions and the international-transfer basis. South Africa is absent from the Commission’s adequacy list. Use an applicable transfer safeguard and assess the protection actually delivered, rather than treating FSCA supervision as data adequacy. The EU custodian must also preserve compliance with Union data-protection law in its outsourcing arrangements. Applicable Luxembourg professional-secrecy duties impose a separate access check. (MiCA, Article 73(1)(g); European Commission, Adequacy decisions; EDPB, International data transfers, “Standard contractual clauses”; Circular CSSF 25/882, as amended by Circular CSSF 26/915, points 5–7.)
Test the complete transaction and incident workflow before accepting assets. That test should cover authority checks, sanctions screening, transfer information, rejected transfers, reconciliation, key compromise, recovery and client exit. Luxembourg’s travel-rule arrangements and South Africa’s Directive 9 must be applied to the institutions and transfers within their respective scope. The EU entity must implement incident classification and reporting under the Digital Operational Resilience Act (DORA), with supplier escalation fast enough to meet its obligations. (Circular CSSF 25/879, sections 1–3 and annex, paragraphs 12–15; FIC, Directive 9; CSSF, ICT and cyber risk for DORA entities; MiCA, Articles 73 and 75.)
The final launch decision should require evidence that the EU custodian can return assets without the South African supplier’s custody intervention. The fund board or authorised manager should approve the investment and contractual arrangement; the custodian should approve the live controls; the depositary should accept its evidential access and duties. If any prerequisite fails, preserve the development-only arrangement until an owned authorised entity or a lawful partner structure is operational. (MiCA, Articles 59, 73 and 75(6); Luxembourg Law of 12 July 2013, Article 19.)