The first decision concerns the Brazilian provider's actual functions. If they amount to custody and it lacks the required EU entitlement, the CASP must change the provider or remove those functions. Contractual segregation and indemnities become relevant only after the service has a lawful permission basis. (MiCA, Articles 59, 73 and 75(9).)
Executive Summary
- Custody includes safeguarding or controlling assets or their means of access. Joint signing and recovery powers require examination even where the Brazilian provider cannot transfer assets alone. A Brazilian permission supplies no MiCA entitlement. (MiCA, Articles 3(1)(17) and 75(9); Resolução BCB 520/2025, Article 9.)
- Verify the Brazilian entity, service modality and regulatory stage. An incumbent relying on transition must submit its phase-one application by 30 October 2026. Filing does not equal final authorisation. (Resolução BCB 520/2025, Article 88; Instrução Normativa BCB 704/2026, Article 9.)
- German law expressly addresses client assets in pooled custody and separately held private keys. The statutory attribution protection has an exception for authorised dispositions for the institution's or third parties' account. Exclude that permission from this custody product. (KMAG, § 45(1)–(2).)
- The German CASP retains its client duties and responsibility for outsourcing. It needs its own position records, direct information access, effective supervision and procedures for returning assets. (MiCA, Articles 73 and 75(2)–(8).)
- Brazilian court orders, recovery requirements and insolvency proceedings need their own response. A German governing-law clause cannot itself deliver access to Brazilian-controlled recovery material. (Resolução BCB 520/2025, Articles 73(3) and 76(XII), §§ 1–3; Decreto-Lei 4.657/1942, Articles 8–9.)
Identify who controls custody and recovery
Classify the assets before classifying the service. MiCA excludes financial instruments from its scope, and Brazil's virtual-asset legislation preserves the securities regime. Tokenised securities therefore need a separate analysis. The custody mandate considered here excludes lending, staking and proprietary reuse pending separate approval. (MiCA, Article 2(4)(a); Lei 14.478/2022, Articles 1 and 3.)
Start with a control-and-title map that follows the client entitlement through every operational layer. Record the client, the German contracting CASP, each wallet, every signing participant and every recovery administrator. Identify who can approve transactions, replace a signer, change a threshold, reset credentials or reconstruct access. Include emergency procedures and subcontractors. Match those powers to the person obliged to return the assets. (MiCA, Articles 3(1)(17), 73 and 75(1)–(3), (6).)
A wallet address and a key share answer different questions from legal ownership. The map should connect each address to the relevant custody contract, client position register and pool entitlement. A register showing only a balance owed to the German CASP needs an enforceable link to the underlying clients and their rights. (MiCA, Article 75(2), (7); KMAG, § 45(2).)
MiCA's custody definition covers safeguarding or controlling crypto-assets or their means of access. It does not require a provider to hold one complete private key. A Brazilian participant with an indispensable signing share or substantive recovery authority cannot be cleared as a software supplier merely because another participant must cooperate. The functions and their combined effect determine the classification. (MiCA, Article 3(1)(17).)
Where the Brazilian firm performs custody, Article 75(9) requires a provider permitted under Article 59 to perform that service. An eligible financial institution may use Article 60 within its conditions. A Brazilian licence, group relationship or contract with an EU-authorised affiliate does not extend that affiliate's permission to the Brazilian company. ESMA expressly applies this restriction to business-to-business arrangements. (MiCA, Articles 59–60 and 75(9); ESMA, Statement on the End of Transitional Periods under MiCA, 17 April 2026, p. 2.)
There are two routes to assess. The German CASP can retain custody and use the Brazilian firm for genuinely restricted technology services. Alternatively, it can appoint an eligible EU custody provider that actually performs the delegated service. If the Brazilian firm retains custody powers without the required entitlement, the proposed custody chain must stop. Licentium's EU custody licensing analysis addresses the separate decision to establish an EU custodian.
Check Brazilian permission and local client rights
Brazil regulates services performed for others that include custody or administration of virtual assets or instruments permitting control. Resolução BCB 520 distinguishes intermediaries, custodians and brokers combining those activities. Its custody provisions cover control instruments, position reconciliation, client instructions, relevant events and data administration, individually or cumulatively. The permission must match the functions the Brazilian entity actually performs. (Lei 14.478/2022, Articles 2–5; Resolução BCB 520/2025, Articles 4 and 7–10.)
The BCB authorisation and operating regulations took effect on 2 February 2026, with a distinct adaptation process for existing providers. Timely applicants can continue their existing modality while their application is decided. Their adaptation period ends when the BCB addresses phase one; full substantive compliance then applies even before final authorisation. Obtain the filing, the phase-one decision and any conditions. A newly established provider cannot rely on another firm's incumbency. (Resolução BCB 520/2025, Articles 88 and 92; Resolução BCB 519/2025, Article 26; Instrução Normativa BCB 704/2026, Article 9.)
For a custodian subject to the full regime, the contract must describe wallets, control methods, instructions, third parties, applicable laws, audits and custody transfers. Brazil requires client records and segregation, but permits limited proprietary liquidity in client wallets under specified conditions, including a 5% quantity cap. The proposed German custody product should prohibit this mixing. MiCA separately requires client and proprietary holdings to be separated on the ledger. (Resolução BCB 520/2025, Articles 30, 73 and 77–78; MiCA, Article 75(7).)
The Brazilian prohibition on using client assets for proprietary operations also has exceptions, including specified staking and expressly consented operations for qualified or professional investors. Those exceptions do not establish compliance with MiCA or determine whether German asset-attribution protection remains available. Keep lending, staking, title transfer and proprietary reuse outside the proposed mandate unless separately analysed and documented. (Resolução BCB 520/2025, Article 31; MiCA, Article 70(1); KMAG, § 45(1).)
Funding, sweeps and withdrawals require an additional Brazilian foreign-exchange classification. Certain international virtual-asset transfers fall within that regime. Operations involving third-party interests face a specific restriction, with an exception for services to an institution authorised by the BCB to operate in foreign exchange and acting for its clients. A German CASP's MiCA status does not itself establish that permission. Map each asset movement before agreeing to execute it. (Resolução BCB 277/2022, Articles 29–30 and 76-A–76-B.)
Another restriction applies from 6 November 2026. Revised Article 91 prohibits BCB-authorised institutions from conducting or enabling virtual-asset operations with provider counterparties lacking BCB authorisation to operate in Brazil, except through expressly permitted arrangements. Read that restriction with the transition permissions, including qualifying incumbents' continuation while timely applications are decided. Establish its application to the parties' actual roles before affected operations proceed. Article 83 addresses a Brazilian provider hiring a foreign custodian; it cannot simply be reversed to authorise a German CASP hiring a Brazilian custodian. (Resolução BCB 520/2025, Articles 83, 88 and 91; Resolução BCB 589/2026, Articles 1–2; BCB Voto 108/2026, paragraphs 7–8.)
Preserve the German CASP's duties and client entitlements
Outsourcing leaves the German CASP responsible for its MiCA obligations. It must retain expertise and resources, supervise the service, obtain relevant information directly and preserve BaFin's access. The client agreement must identify the service, custody policy, communications, security arrangements, charges and applicable law. Actual subcustody must be disclosed to clients. (MiCA, Articles 73 and 75(1), (9).)
Maintain a position register in each client's name and evidence every movement. Provide statements at least every three months and on request. Keep the means of access identifiable, separate client assets from proprietary holdings, and maintain procedures for returning assets as soon as possible. A Brazilian dashboard cannot replace the CASP's ability to reconstruct and evidence each client's entitlement. (MiCA, Article 75(2)–(7).)
Germany's KMAG § 45 treats crypto-assets held in custody for a client as belonging to that client. It extends this attribution to the client's share of pooled assets and to separately held private cryptographic keys. The protection does not establish that every client owns every asset in a pool. Records must identify each share, and assets must remain available to satisfy it. (KMAG, § 45(1)–(2).)
The exception is material: the statutory attribution does not apply where the client consents to dispositions for the institution's or a third party's account. Remove permissions for proprietary use from client terms and downstream agreements. Obtain an express prohibition on liens, security, set-off and retention over client assets and access material, to the extent legally effective. Treat those protections as contract requirements to support return, rather than assuming that a clause overrides mandatory insolvency law. (KMAG, § 45(1); MiCA, Articles 70(1) and 75(6)–(7).)
An omnibus client wallet can be assessed if the legal allocation, client records and operational separation work together. Keep it separate from proprietary wallets and, as a proposed control, from other custody chains and group treasury balances. ESMA's published guidance identifies conflicts where group companies share client wallets. Use separately identified wallets where the provider cannot demonstrate a reliable pool allocation. (MiCA, Articles 72 and 75(7); ESMA Q&A 2578, answer of 17 June 2025.)
Plan for failure in both jurisdictions
If the German CASP becomes insolvent, KMAG § 45 supports the client's claim that the attributed assets fall outside the CASP's estate. Insolvency Code § 47 governs separation claims based on rights establishing that an asset is not part of the estate. This protection still requires proof of entitlement and access to the asset. It cannot restore a missing key or supply a shortfall. Section 45(3) also addresses costs where a client refuses a qualifying transfer of the custody pool, subject to its exception for unreasonable continuation terms. (KMAG, § 45; Insolvenzordnung, § 47.)
If the Brazilian provider fails, first identify its regulatory and legal status and applicable failure regime. Ordinary corporate bankruptcy and a regulated financial institution's special liquidation cannot be treated interchangeably. Where Lei 11.101 applies, an owner can seek restitution of qualifying property held by the debtor; the claim must identify its object and grounds. Client labels in an internal ledger do not settle an administrator's or court's assessment. (Lei 11.101/2005, Articles 2, 85 and 87; Lei 6.024/1974, Articles 1 and 51–52.)
A German insolvency appointment does not itself establish a right to take assets or recovery material in Brazil. Where Brazil's cross-border insolvency provisions apply, recognition and local relief have their own requirements. Recognition does not decide the underlying clients' ownership. (Lei 11.101/2005, Articles 167-H, 167-J and 167-N–167-O.)
Avoid terms that convert custody into an obligation to repay equivalent assets after the provider has used them. Brazilian rules on a fungible deposit repayable by equivalent quantity and quality refer to loan rules, under which ownership passes to the borrower. Their application depends on the legal classification of the actual assets and agreement. Pooling alone does not establish that classification. Obtain a Brazilian opinion on the particular return claim, asset identification, retention rights and applicable insolvency regime. (Código Civil, Articles 587, 644–645.)
A Brazilian access restriction can occur without insolvency. The full BCB custody regime requires recovery redundancy administered under Brazilian law by an entity constituted in Brazil, with BCB access. It also prohibits custody mechanisms obstructing applicable court or authority demands. A contract promising that German instructions always prevail would conflict with those obligations. Recovery procedures must address lawful orders and applications for clarification or release. (Resolução BCB 520/2025, Articles 73(3) and 76(XII), §§ 1–3.)
Key loss and conflicting records need separate responses. Preserve logs, suspend movements from affected wallets where necessary, reconcile both providers' records against client instructions and ledger history, and establish each entitlement before releasing disputed assets. Test recovery without relying on the failed supplier's discretionary cooperation. An independent recovery path addresses outages; it does not authorise evasion of an applicable freeze. (MiCA, Articles 73(2) and 75(2), (3), (6); Resolução BCB 520/2025, Articles 73(3) and 76–77.)
MiCA Article 75(8) makes the CASP liable for losses of assets or means of access caused by an attributable incident. That statutory custody-loss liability is capped at the lost asset's market value when the loss occurred. The CASP must demonstrate the independence of an event it treats as non-attributable. Resolução BCB 520, Article 81, imposes custody liability for loss and damage caused by negligence, lack of skill, imprudence or intentional misconduct, including impaired access. A foreign order or supplier failure therefore requires an attribution assessment; a blanket contractual exclusion is insufficient. (MiCA, Articles 73(1) and 75(8); Resolução BCB 520/2025, Article 81.)
Change the contracts and operating model before launch
The CASP's legal and operations teams should approve the following documents together. Their purpose is to establish the lawful service and prove that the stated rights can be exercised.
- A permission and role schedule should name every contracting entity, its services and the permission or transitional basis relied on. Attach the control map. Remove Brazilian custody powers or appoint an eligible custody provider before live use. Include a separate decision on Brazilian foreign-exchange activity and Article 91. (MiCA, Articles 59 and 75(9); Resolução BCB 520/2025, Articles 4, 9, 88 and 91.)
- An asset and records schedule should identify permitted tokens, networks, wallets, client entitlements and reconciliation procedures. Exclude proprietary mixing and reuse from this mandate. Require accessible records linking each client to the relevant pool and return claim. Resolve inconsistent records before authorising affected withdrawals. (MiCA, Article 75(2), (6)–(7); KMAG, § 45; Resolução BCB 520/2025, Articles 77–78.)
- Audit and access terms should permit the CASP, its auditors and relevant authorities to obtain the information needed for their functions. Identify subcontractors and require review before changes to keys, recovery, storage locations or control. Obtain applicable custody audits and stress-test records; contractual rights must be executable under Brazilian law. (MiCA, Article 73; Resolução BCB 520/2025, Articles 73(4)–(5) and 82.)
- A recovery and exit schedule should allocate incident decisions, evidence preservation, client communications, lawful-order handling and migration. Test loss of a share, unavailable personnel, provider insolvency and disputed records. Define transfer and response periods that satisfy the applicable return duties, and provide cooperation after termination. (MiCA, Articles 73(2)–(3) and 75(6); Resolução BCB 520/2025, Articles 73 and 76.)
- Liability terms should preserve the CASP's client obligations and provide recourse against the responsible supplier. Negotiate treatment of client-asset losses separately from an ordinary service-fee cap, and assess the provider's resources and insurance exclusions. These are proposed commercial protections; an indemnity cannot repair an ineligible custody appointment. (MiCA, Articles 73(1) and 75(8)–(9); Resolução BCB 520/2025, Article 81.)
For genuine ICT services, classify the function under DORA and apply the relevant third-party requirements. Critical or important functions require analysis of foreign insolvency law, urgent data recovery, enforcement and exit. Regulated financial services with connected ICT require a separate classification; DORA's ICT contract rules do not automatically attach to every custody contract. (Regulation (EU) 2022/2554, Articles 28–30; European Commission, DORA Q&A DORA030, Question 2999.)
Where records contain personal data, allocate processing, security and onward-transfer responsibilities. The EU's Brazil adequacy decision covers transfers to controllers and processors subject to Brazil's LGPD; it does not authorise custody or remove the CASP's outsourcing data-protection duties. (Commission Implementing Decision (EU) 2026/179, Article 1; MiCA, Article 73(1)(g).)
Launch requires the CASP's approval of the permission analysis, consistent agreements, tested recovery and enforceable access. If those conditions cannot be met, retain custody within the CASP or an eligible provider and restrict the Brazilian role accordingly. Separate transfers also need the information controls addressed in Licentium's Brazil–EU crypto transfer analysis.
Review a subcustody agreement
Ask Licentium to review the proposed agreement, wallet and recovery map, permissions and client-asset records. The review can identify required contract changes, unresolved local-law questions and conditions for proceeding. Review a subcustody agreement.