Executive Summary
- [EU] Use an authorised EU partner for the initial demand test only if that partner genuinely provides the regulated services. It must contract with EU customers and control admission, orders, custody, complaints and compliance. Dubai may supply contracted technology and support without becoming the undisclosed EU-facing provider. MiCA prohibits outsourcing that changes the provider's responsibility or authorisation conditions. (Regulation (EU) 2023/1114, Arts. 59, 73.)
- [EU] Build an EU CASP when the group requires its own EU customer contracts and service economics, and will fund competent EU management. Acquisition becomes preferable only when a specific authorised operating business offers a compatible service scope, acceptable liabilities and a viable post-close model. Buying shares does not remove continuing authorisation conditions. (MiCA, Arts. 59(4), 62–64, 83–84.)
- [France/Germany] Neither jurisdiction offers an incumbent transition for this launch in October 2026. France's transition ended on 1 July 2026; Germany's statutory continuation ended no later than 31 December 2025. A current MiCA authorisation and the applicable cross-border notification are required for the proposed independent CASP. (MiCA, Arts. 65, 143(3); French Code monétaire et financier, Art. L.54-10-4; German KMAG, § 50(2).)
- [EU] Permission must match the trading mechanism and assets. Bilateral exchange, operating a multilateral platform, executing orders and receiving and transmitting orders are different services. Financial instruments fall outside MiCA; payment functions involving e-money tokens require a separate payment-services analysis. (MiCA, Arts. 2(4), 3(1)(16)–(23), 70(4).)
- [Dubai/EU] VARA authorisation supplies no EU passport. An EU custodian cannot delegate custody to the Dubai entity solely on its VARA status. The Dubai business must also assess VARA's material-change, group and outsourcing requirements before committing resources to the expansion. (MiCA, Arts. 59, 75(9); VARA Company Rulebook, Parts II.E, IV and VIII.A.)
The route depends on control of the EU relationship
The recommended starting route is a partner-operated pilot, provided the Dubai group accepts that EU customers buy regulated services from the partner. This is a commercial recommendation drawn from the proposed demand test, rather than a claim about customer demand. The alternative requires funding a regulated business before the group has tested its proposition. The pilot is unsuitable if Dubai insists on being the customer's exchange counterparty, controlling withdrawals or making final compliance decisions. Contractual branding cannot displace the actual service provider. (MiCA, Arts. 3(1)(15)–(23), 59(1), 73(1).)
A group-owned EU CASP offers a different allocation of control. Its customer contracts and revenues sit within the group, while its managers retain the powers needed to discharge EU obligations. A Dubai parent may set lawful shareholder objectives, but cannot reserve operational vetoes that prevent those managers from protecting customers or complying with supervisory directions. A newly authorised subsidiary and an acquired CASP face the same continuing requirements. (MiCA, Arts. 59(4), 63(7)–(8), 68(1)–(6).)
“MiCA CASP license” and “crypto exchange license Europe” describe the commercial search. The legal permission examined here is MiCA CASP authorisation. MiCA grants specified service permissions to a particular provider. Its Article 60 route for designated regulated financial entities does not turn a VARA licence into an EU permission. (MiCA, Arts. 59(1), 59(6), 60.)
The launch inventory determines the applicable regime
Each proposed token must pass a rights-based classification before it enters the EU offering. A transferable, electronically stored representation of value or rights using distributed ledger technology can meet MiCA's crypto-asset definition. A fungible native token with no financial-instrument features or stabilisation reference can fall within MiCA's ordinary crypto-asset category. A token representing qualifying shares, debt securities, fund units or derivatives instead engages the financial-instrument regime. Calling a transaction “spot” does not alter the instrument's legal character. (MiCA, Arts. 2(4)(a), 3(1)(5); Directive 2014/65/EU, Art. 4(1)(15), Annex I, Section C.)
The token review must examine issuer obligations, holder rights, transferability, redemption and economic features. ESMA's classification guidelines require a technology-neutral assessment; they provide supervisory interpretation rather than a legislative exemption. Genuine unique, non-fungible assets are excluded under Article 2(3), but attaching an NFT label does not establish that exclusion. Deposits and other excluded products require their own analysis. The proposed pilot should admit only assets whose classification and offer or admission conditions fit its permissions. (MiCA, Arts. 2(3)–(4), 4–5, 76(2); ESMA, Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments, ESMA75453128700-1323, 19 March 2025, Guidelines 1–2.)
Stablecoins need a separate decision. A crypto-asset purporting to maintain stable value by reference to one official currency is an e-money token. A qualifying stable-value reference to other values or a combination can make an asset-referenced token, where it is not an e-money token. The reference currency need not be the euro. CASP authorisation does not authorise the exchange to issue either category, or establish that every token can lawfully be offered or admitted to trading. The listing review must address the issuer and the applicable Title III or IV conditions. (MiCA, Arts. 3(1)(6)–(7), 16, 48.) ESMA's 8 October 2026 opinion sets supervisory expectations for all services concerning non-compliant asset-referenced and e-money tokens, including custody. It treats their provision as presumptively incompatible with Article 66(1), without classifying every service as a public offer. The pilot should therefore exclude those tokens. The opinion's limited, supervised legacy wind-down arrangements do not authorise a new launch or new acquisitions. (MiCA, Art. 66(1); ESMA, Opinion ESMA75-113276571-1742, 8 October 2026, paras. 7, 12–14, 21–27.)
Fiat payment services and payment functions involving e-money tokens require scrutiny beyond CASP status. MiCA expressly requires an appropriately authorised payment-service provider where payment services accompany crypto-asset services. EBA's initial supervisory transition concerning the PSD2/MiCA overlap ended on 2 March 2026. Its February 2026 opinion addresses conditional supervisory treatment, not a general exemption for a new entrant. A pilot involving those functions should use a provider with the necessary payment permission or remove the payment functionality from its proposed scope. Pure exchange and payment services must be classified separately. (MiCA, Art. 70(4); EBA, Opinions on the interplay between PSD2 and MiCA, 2 June 2025 (published 10 June 2025), and on the end of the No-Action Letter transition period, 12 February 2026.)
The trading mechanism determines the service permissions
A dealer concluding purchases and sales with customers using proprietary capital needs exchange permission for crypto-assets against funds, other crypto-assets, or both. A system bringing together multiple third-party buying and selling interests under its rules can constitute a trading platform. An intermediary concluding transactions for customers needs execution permission; receiving orders and passing them to another person can constitute reception and transmission. The same website can combine several services. The programme of operations must map each transaction leg. (MiCA, Art. 3(1)(16), (18)–(23).)
Custody includes safeguarding or controlling customers' crypto-assets or their means of access. The classification therefore reaches actual key and withdrawal authority, including relevant shared-key arrangements. Transfers on behalf of customers between ledger addresses or accounts require a separate Article 82 assessment. The initial service map should identify deposits, internal movements, withdrawals and settlement, rather than assume that a custody permission covers every transfer function. (MiCA, Arts. 3(1)(17), 3(1)(26), 75, 82.)
France and Germany require a current EU entry route
Active campaigns directed at French or German customers prevent reliance on those customers' exclusive initiative. The third-country exception in Article 61 is narrow. Solicitation through an affiliate or another person acting on the Dubai firm's behalf also counts. A disclaimer or customer declaration cannot convert solicited business into reverse solicitation. The planned advertising must therefore direct customers to the authorised EU provider and accurately identify its role. (MiCA, Arts. 59(5), 61; ESMA, Guidelines on reverse solicitation under MiCA, ESMA35-1872330276-2030, 26 February 2025, §§ 5.1–5.3.)
For a French independent CASP, the Autorité des marchés financiers (AMF) leads authorisation. The Autorité de contrôle prudentiel et de résolution (ACPR) supplies a binding opinion on the specified anti-money-laundering (AML) controls and a non-binding opinion on specified management and shareholder matters. The AMF may consult the ACPR on a proposed qualifying acquisition. Germany designates its Federal Financial Supervisory Authority (BaFin) as its MiCA competent authority. Its national notification rules include submissions to BaFin and the responsible Bundesbank office, subject to the applicable electronic arrangements. (Code monétaire et financier, Art. L.54-10-7(I); Règlement général de l'AMF, Art. 721-2; KMAG, §§ 3, 21, 25; KMAnzV, §§ 1–2.)
The EU provider needs one home-state authorisation covering its actual services. Before cross-border provision, it submits the host states, services, intended start date and other activities to its home authority. That authority has ten working days to transmit the information. Services may start when the provider receives notice of transmission, or on the fifteenth calendar day after submission, whichever occurs first. This is a notification procedure, not a second authorisation in each destination. MiCA does not require a physical presence in every host state. (MiCA, Arts. 59(7), 65(1)–(4).)
France's incumbent continuation ended on 1 July 2026. Germany's shorter continuation ended no later than 31 December 2025, with earlier termination events under its statute. MiCA's simplified application provision also concerned specified incumbents and a time-limited application window. A new Dubai entrant cannot obtain trading rights by purchasing a lapsed national registration or relying on an uncompleted application. A French PSAN registration and an old German permission must be distinguished from an effective MiCA permission. (MiCA, Art. 143(3), (6); Ordonnance n° 2024-936, Arts. 32, 49(II); Code monétaire et financier, Art. L.54-10-4; KMAG, § 50(2).)
Each route must use the same service map
For the build route, the legal provider is the newly authorised EU subsidiary. Under a share acquisition, it is the acquired authorised entity. During a partner pilot, it is the independent EU partner. The same allocation applies to each provider; ownership changes the group's commercial position, but does not change the statutory duties. A service supplied by another regulated entity must have its own identified provider and permission. (MiCA, Arts. 59(1), 59(6), 73.)
Onboarding, customer terms and complaints
Onboarding must occur under the EU provider's admission and AML policies. Dubai staff may perform documented processing tasks within an outsourcing arrangement, but the EU business needs authority and resources to supervise them, reject customers and resolve escalations. A purchase of the target does not validate inherited customer files. The acquisition review should sample beneficial-ownership evidence, risk ratings, screening and unresolved alerts before relying on those records. (MiCA, Arts. 62(2)(i), 68(8), 73(1).)
Customer terms must identify the EU entity supplying each service. Custody terms must address the service, instructions, security, fees and applicable law. With a build, the subsidiary enters new EU contracts. With a share purchase, the same target can remain the contracting entity; proposed changes to provider, custody or execution require their own contractual treatment. Under a partner route, Dubai's logo cannot make it the customer's regulated counterparty. (MiCA, Arts. 59(5), 66(2), 75(1).)
The EU provider owns the complaints process in all three models. Dubai can receive support tickets under agreed procedures, while trained staff and escalation rules preserve the provider's responsibility. An acquired business also carries its unresolved complaint population; a pilot needs an enforceable route for complaints that arrive through Dubai-branded channels. Customers must not be sent between entities without an accountable handler. (MiCA, Arts. 71, 73(1)–(2).)
Orders and execution
The EU provider must control how customers submit orders and which entity accepts, prices or executes them. Dubai may supply the software, but an API label does not resolve whether it actually receives and transmits orders or executes them professionally. Those functions require classification under Article 3 and permission under Article 59. The build must implement the allocation; an acquisition must preserve or validly change it; the partner contract must prohibit Dubai from taking over those regulated functions. (MiCA, Arts. 3(1)(21), (23), 59, 73.)
Execution rules depend on the service. A bilateral exchanger must publish its firm price or pricing method and execute at the displayed price when an order becomes final. A provider executing on behalf of clients instead needs an execution policy and the Article 78 best-result arrangements, subject to the specific-instruction exception. Execution outside a MiCA-authorised trading platform requires the prescribed disclosure and prior express consent. A platform operator must meet Article 76's separate market-operation requirements. (MiCA, Arts. 76–78; ESMA, Q&A 2711, answer of 8 December 2025.)
Routing EU business to an affiliated Dubai venue deserves scrutiny under every route. ESMA's broker-model opinion identifies systematic offshore routing, weak EU decision-making and confusing group branding as circumvention indicators. It does not impose a blanket prohibition on third-country execution. A defensible arrangement needs a service-specific assessment of execution quality, conflicts, oversight and custody. Customer consent alone does not establish that the model meets those duties. ESMA separately rejects a shared order book that pools EU and non-EU client orders where the EU CASP and an offshore entity without MiCA authorisation both operate the same multilateral system. Client consent does not cure that model. (MiCA, Arts. 61, 72, 78; ESMA, Opinion to support the convergent application of MiCA, ESMA75-453128700-1048, 31 July 2024, paras. 19–40; ESMA, Q&A 2579, answer of 20 June 2025.)
Custody and client-asset control
The EU provider must maintain the custody agreement, position records and required statements, segregate client assets and arrange their return. MiCA imposes liability for attributable losses within Article 75(8)'s terms. Build and acquisition give the group an EU custodian only if that entity has the required permission and actual capabilities. In a pilot, the authorised partner or its permitted subcustodian must perform this role. (MiCA, Arts. 70(1), 75(1)–(8).)
Delegated custody is restricted to providers authorised under Article 59. The Dubai entity's VARA status is insufficient for that delegation. A wallet diagram should identify who can sign, approve, block, recover or initiate transfers. Dubai-held powers amounting to custody cannot be recast as technical support. ESMA distinguishes possession for a specific settlement purpose from surrendering custody obligations to a third-country venue; that narrow distinction does not authorise offshore subcustody. (MiCA, Arts. 3(1)(17), 75(9); ESMA Opinion ESMA75-453128700-1048, paras. 39–40 and footnote 10.)
Client-asset control must extend beyond key storage. The EU business needs reliable reconciliations, segregation records, withdrawal controls and access during an outage or group dispute. Client money requires the Article 70 safeguards, including separately identifiable bank or central-bank accounts where paragraph 3 applies. A consolidated group treasury must not defeat customers' ownership rights. These controls need operational testing before a launch or migration. (MiCA, Arts. 68(7)–(8), 70, 75(2), (6)–(7).)
AML, outsourcing and data access
The EU provider remains responsible for AML controls and compliance with the applicable national law. Dubai's existing know-your-customer process supplies material to assess, rather than automatic compliance equivalence. A French entity must address the Code monétaire et financier; a German entity must address the Geldwäschegesetz. Transfers also require the applicable originator and beneficiary information controls under the EU transfer regulation. Outsourcing internal AML safeguards under Germany's Geldwäschegesetz requires prior notification to the supervisor; the obliged entity remains responsible. The provider must retain accountable escalation and reporting functions despite group support. (MiCA, Arts. 68(8), 73; Code monétaire et financier, Art. L.561-2; Geldwäschegesetz, §§ 2, 6(7); Regulation (EU) 2023/1113, Arts. 14–22.)
Outsourcing must preserve supervision, information access, internal controls and the provider's expertise. Contracts need enforceable duties, termination rights and contingency arrangements. The new subsidiary must build those arrangements; an acquirer must inspect and amend inherited contracts; a pilot partner must be able to supervise Dubai as its supplier. ICT arrangements also require the operational resilience demanded by MiCA and DORA. A group service agreement cannot leave EU managers dependent on informal cooperation. (MiCA, Arts. 68(7), 73; Regulation (EU) 2022/2554.)
Data access must follow actual controller and processor roles. Dubai's ownership of the brand, or later ownership of the CASP, does not grant unrestricted use of EU customer records. The contracts should specify processing purposes, access permissions, retention, audit access and exit delivery. Disclosure to Dubai needs the applicable GDPR transfer safeguards; the Commission's adequacy list does not include the UAE. Processor instructions and a transfer mechanism do not authorise unrelated Dubai marketing. (Regulation (EU) 2016/679, Arts. 5–6, 28, 44–49; European Commission, Adequacy decisions; CNIL, Practical guide on transfer impact assessments, January 2025, pp. 5–9.)
Marketing
Marketing must identify the authorised provider and describe only the services it can supply. In the build model, campaigns begin for the authorised subsidiary after the applicable entry conditions. An acquired business must review new branding against its permissions and operating model. During a pilot, Dubai may prepare or distribute partner-approved communications that identify the partner, within applicable marketing law. It cannot promote its own exchange or custody services to EU customers under the partner's authorisation. The content, account-opening links and customer journey must keep that distinction clear. The partner should approve communications and maintain the supporting records. (MiCA, Arts. 59(5)–(6), 65, 66(2), 68(9).)
France's financial-solicitation rules require separate treatment: Article L.341-3(8°) identifies providers authorised under MiCA Article 59 among the eligible persons. Germany's UWG generally requires prior express consent for consumer telephone advertising and electronic mail. Its existing-customer email exception has cumulative conditions. A MiCA passport does not displace these channel-specific restrictions. The pilot should prohibit unsolicited campaigns until the provider has cleared the channel, sender and recipient permissions. (Code monétaire et financier, Art. L.341-3(8°); Gesetz gegen den unlauteren Wettbewerb, § 7(2)–(3).)
A new EU CASP requires a functioning EU business
Build when control of the EU customer relationship justifies establishing the regulated business. A legal entity must have its registered office in a Member State where it performs at least some crypto-asset services. Effective management must be in the EU, with at least one EU-resident director. A branch of the Dubai entity does not relocate that entity's registered office to the EU. The application must demonstrate suitable managers, adequate staff, controls, custody arrangements and supervisory access across the group. Hiring a nominal director while Dubai makes every decision fails that operating test. (MiCA, Arts. 59(2), 62(2)–(3), 63(7)–(10), 68.)
Home-state selection should follow the intended management, personnel, banking and custody arrangements, and the group's ability to work with the authority. ESMA's supervisory briefing expects substance and effective local decision-making. For a French or German home, this includes sufficient in-country personnel and at least one executive management board member based there. Those supervisory expectations should not be confused with a statutory rule requiring every director to reside in the home state. France or Germany can be suitable where the business will actually operate there; an alternative EU home must satisfy the same establishment test and passport to the destinations. (MiCA, Arts. 59(2), 65; ESMA, Supervisory Briefing on Authorisation of CASPs, ESMA75-453128700-1263, 31 January 2025, §§ 4–5.)
For custody and bilateral exchange, Annex IV's class 2 floor is EUR 125,000. Operating a trading platform raises the class 3 floor to EUR 150,000. Article 67 requires the higher of the applicable floor and one quarter of annual fixed overheads, using projections where required for a new provider. Qualifying own funds, insurance or a permitted combination may satisfy the safeguards. These amounts do not fund the entire operating plan, remediation programme or wind-down. (MiCA, Art. 67(1)–(6), Annex IV.)
The application must use the operative information requirements and forms under Regulations 2025/305 and 2025/306. MiCA separates completeness assessment from substantive assessment: the latter's forty-working-day clock begins after completeness, with a permitted suspension for further information. It does not promise an end-to-end launch date. A well-prepared application still needs functioning contracts, staff, systems and the cross-border notification before the proposed services start. (MiCA, Arts. 62–63, 65; Commission Delegated Regulation (EU) 2025/305; Commission Implementing Regulation (EU) 2025/306.)
Acquisition requires permission and operating-model diligence
Acquisition is viable when a specific authorised business fits the proposed service map. The buyer should reconcile the legal entity and its permission schedule against the home authority's decision, ESMA's register and the relevant national register. The review must examine restrictions, withdrawals, passported services and unresolved supervisory correspondence. An authorisation for advice or order transmission does not cover exchange and custody. Adding services requires an extension under Article 59(8). (MiCA, Arts. 59(6), 59(8), 64, 109.)
The purchaser must give prior written notice when acquiring a qualifying holding, including direct or indirect ownership of at least 10% of capital or voting rights, or significant influence. Further thresholds include 20%, 30% and 50%, or making the CASP a subsidiary. The authority examines the acquirer's reputation, proposed managers, financial soundness, continued compliance and money-laundering risk. The acquisition information requirements include Regulation 2025/414. Closing should depend on the required non-opposition or deemed approval, together with any other applicable transaction approvals. (MiCA, Arts. 3(1)(36), 83–84; Commission Delegated Regulation (EU) 2025/414.)
The statutory assessment normally runs for sixty working days from the written acknowledgement under Article 83. Information requests can suspend it, and the provision permits an extended suspension for a non-EU acquirer. A Dubai purchaser should therefore avoid promising completion on an unqualified sixty-day timetable. The AMF may consult the ACPR on a French acquisition; German applicants must also address the KMAG's supplementary acquisition provisions. (MiCA, Art. 83(3)–(8); Code monétaire et financier, Art. L.54-10-7(I); KMAG, § 25.)
A share purchase keeps the authorised legal entity in place and leaves its existing obligations within that entity. Existing authorisation can continue when the acquisition clears the required process and the target continues to meet its permission conditions. Due diligence should test historic safeguarding shortfalls, AML remediation, complaints, tax exposures, cybersecurity incidents, outsourcing defects and regulatory representations. Price adjustments, indemnities, escrow and remediation conditions can allocate economic risk between buyer and seller. They do not discharge the CASP's duties to customers or its supervisor. A purchase of assets instead needs a separate permission analysis for the receiving entity. (MiCA, Arts. 59(1), 59(4), 64, 68, 75, 84(1)(d)–(e).)
The planned post-close business must be assessed before signing. Replacing EU managers, moving decision-making to Dubai, changing the matching engine or transferring keys can destroy the conditions on which the target operates. Authorisation must remain valid throughout the change; Article 64 requires withdrawal where its specified grounds apply, including an unremedied failure to meet authorisation conditions. A dormant “licence for sale” also raises withdrawal grounds for authorisation unused within twelve months of grant or services ceased for nine consecutive months. The buyer should price an operating business with a tested migration plan, rather than assume the permission survives its removal. (MiCA, Arts. 59(4), 64(1), 68, 73–75.)
The partner route must preserve an independent EU provider
A partner can reduce the group's initial need to build regulated functions because the partner already supplies them within its authorised scope. That advantage depends on the actual contract and delivery model. Commercial diligence must cover fees, termination, service levels, complaints, asset return, record access and migration assistance. Dubai should accept that the partner can refuse a customer, token, campaign or transaction that conflicts with its obligations. A contract that removes those powers defeats the premise of the pilot. (MiCA, Arts. 59(4), 66, 68, 73, 75.)
Dubai's permitted contribution should be specified function by function: software development, licensed brand assets, technical infrastructure and supervised administrative support. No general “white-label” exemption authorises Dubai to perform regulated services for EU customers. Where Dubai's involvement itself constitutes professional order reception, execution or custody, the parties must address the corresponding permission requirement. The European Commission's published interpretation confirms that MiCA has no tied-agent route for unlicensed persons to receive and transmit customer orders. That interpretation explains Article 59 and does not create an exemption. (MiCA, Arts. 3(1)(15)–(23), 59, 73; European Commission, answer in ESMA Q&A 2143, 12 September 2024.)
A partner remains viable while the group values a demand test more than direct ownership of the regulated relationship. It ceases to fit when the commercial plan requires the group itself to hold EU contracts and control the authorised business. That change supports build or acquisition, provided the group funds the corresponding EU responsibilities. It does not justify allowing Dubai to assume them before the replacement provider is ready. (MiCA, Arts. 59, 65, 73.)
VARA obligations continue during the expansion
The UAE activity labels need separate treatment. VARA subjects VASPs to rules on storage and custody of client assets, while a standalone Custody Services permission generally requires a separate legal entity from other VA activities. The Custody Services Rulebook contains a limited transfer-and-settlement exception. Safekeeping exchange customers' assets should therefore not be equated with a standalone custody licence in the same company. MiCA's own custody definition determines the EU permission. (VARA Virtual Assets and Related Activities Regulations 2023, Schedule 1, definition of Custody Services; Custody Services Rulebook, Introduction and Part III.B; MiCA, Art. 3(1)(17).)
VARA's Company Rulebook requires prior written approval for specified material changes and entry into business outside the licensed-date business perimeter. Its group rules require defined subsidiary responsibilities. The Dubai VASP must assess the EU investment, group arrangements and operational changes against those provisions before implementation. An EU acquisition is not automatically a change in control of the Dubai VASP; the actual ownership and business changes determine the applicable VARA procedure. (VARA Company Rulebook, Parts I.A.5, II.E and VIII.A, C–D.)
VARA's outsourcing rules cover a VASP's outsourced functions, including intragroup and cross-border arrangements. Part IV.H states that VASPs should notify VARA in advance of new material outsourcing or material variations; VARA may object. This differs from the prior-approval rule for specified material business changes. Dubai supplying services to an EU CASP must be distinguished from Dubai outsourcing its own regulated functions. A reciprocal arrangement can require analysis on each side. (VARA Company Rulebook, Part IV.A, F–H.)
VARA also requires entities in Dubai to comply with the laws of the foreign jurisdiction where they market. The EU campaigns must therefore satisfy destination-country requirements even when staff prepare them in Dubai. VARA may cooperate with the relevant foreign authority over a breach. (VARA Regulations on the Marketing of Virtual Assets and Related Activities 2024, Part I.G.)
The pilot should have defined investment and migration gates
Before launch, the parties should approve the service map, eligible asset inventory, permission evidence, passport notification and customer documentation. They should test onboarding, complaints, order handling, reconciliations, withdrawals, incident recovery and supervisory access. A successful marketing test cannot cure a service delivered by the wrong legal entity. The contract should permit suspension when those controls fail. (MiCA, Arts. 59, 65, 68, 71, 73, 75.)
The investment gate should use observed funded-customer activity, retention and contribution after partner, custody, acquisition and support costs. The board should set thresholds before collecting results. Build becomes justified when those results, or a separately approved strategic commitment, support the cost of EU personnel, prudential safeguards and ongoing controls. Acquisition should replace build only after an identified target passes permission, liability and post-close operating-model diligence. These are investment criteria, not statutory customer-volume thresholds. (MiCA, Arts. 62(2), 67–68, 83–84.)
Migration requires a ready receiving provider with the necessary permissions and cross-border arrangements. The plan must address contract replacement or transfer under the applicable terms and law, custody instructions, data disclosures, record retention and withdrawal continuity. A share acquisition that leaves the provider unchanged differs from moving customers into another entity. The partner agreement should secure lawful access and assistance, without treating customers or their personal data as automatically transferable property. The group should move only after the receiving entity can perform every regulated function allocated to it. (MiCA, Arts. 59, 65, 68(9), 73(2)–(3), 75; Regulation (EU) 2016/679, Arts. 5–6, 28, 44–49.)