A CASP is its own ICT stack. And squarely inside AML/KYC from day one.
A crypto-asset service provider does not have a clean line between its business and its technology, the custody stack, the matching engine, the wallet infrastructure, the chain-analytics pipeline, all of it is both at once. DORA applies from day one with no phased-in regime, and a CASP falls squarely inside AML/KYC obligations under the AMLR from the outset, given the transaction-risk profile the sector carries. Our platform runs both natively: the ICT supply chain in one register, AML/KYC casework in the same system. MiCAR itself, authorisation, white papers, custody segregation, market abuse, has no in-product surface today and is entirely advisory. We would rather say that plainly than imply otherwise.
The technology is the business, and the AML exposure starts immediately.
For most regulated firms, ICT is a support function. For a CASP, the custody infrastructure, the matching engine, the wallet stack, and the chain-analytics pipeline are the business itself. DORA applies from day one, with no phased-in simplified regime, so the ICT risk framework has to be complete from the first day of operation, not built up gradually.
AML/KYC exposure arrives just as fast. The transaction profile of crypto-asset services puts a CASP squarely inside AMLR obligations from the outset, PEP and sanctions screening, source-of-funds checks, beneficial-ownership look-through, on every counterparty, with no grace period to build the capability.
MiCAR sits on top of both, with its own authorisation process, white-paper obligations, custody-segregation duties, and market-abuse regime, none of which shares a data model with either the ICT register or the AML casework. A single suspicious-transfer event touching an ICT compromise can trigger notifications on three separate tracks at once.
One graph for the stack. One system for AML/KYC.
On the platform, every component of the technology stack, custody, wallets, nodes, chain-analytics, travel-rule transport, cloud, can be modelled as a supplier or internal-service object in one graph, whether it is built in-house or bought from a vendor. The DORA Register of Information reads directly from that graph rather than a spreadsheet assembled separately.
AML/KYC runs inside the same platform: case management, PEP and sanctions screening, source-of-funds review, and beneficial-ownership look-through under the AMLR, against the CASP's own transaction and counterparty records, behind a four-eye approval gate on every material decision.
What this does not claim: the platform does not run MiCAR authorisation, produce a white paper, or reconcile on-chain custody against segregation duties. Those stay entirely with our specialists. This is the most advisory-heavy sector we cover on the MiCAR side, and we would rather say so than imply otherwise.
DORA and AML/KYC, from day one. MiCAR is entirely advisory.
When a CASP is onboarded, the platform activates the DORA Register of Information across all fifteen RT/B tables with a submission-ready XBRL-CSV package and GLEIF/LEI verification, covering the custody stack, wallet providers, node operators, chain-analytics vendors, travel-rule transports, and cloud as supplier or internal-service objects in one graph. Supplier risk, AI-assisted and privacy assessments, and contractual arrangements sit on the same records.
AML/KYC runs fully in the platform: case management, PEP and sanctions screening, source-of-funds, and beneficial-ownership look-through, sized for the transaction-risk profile the AMLR expects of a CASP from the outset.
Beyond that, the platform does not model MiCAR. There is no white-paper workflow, no authorisation or passporting tool, no on-chain custody reconciliation against segregation duties, no market-abuse surveillance. All of it is delivered by our specialists, working from the same supplier and AML data the platform holds, with the decisions recorded against it.
MiCAR classification and authorisation stay with specialists.
Whether a token qualifies as an asset-referenced token, how a white paper should characterise a given crypto-asset, and how the custody-segregation regime applies to a specific wallet architecture are classification calls with real consequences, and they need people who have worked CASP authorisation before. Our specialists, several former AFM or DNB CASP supervisors and CASP compliance or MLRO officers, make that call.
The reasoning is recorded against the supplier or AML record it concerns, so the platform stays the single place a supervisor can be pointed to, even where the underlying regulatory work happened entirely in advisory.
You own the platform, the data as adapted to your operation, and the written record of every interpretation decision. Advisory work on MiCAR authorisation and the wider crypto-specific rulebook continues for as long as you need it.
A discovery call, not a product demo.
You describe the compliance problem consuming the most of your team's time. We walk the platform through an example close enough to your operation that you can judge whether this way of modelling compliance fits how you want to work.
Book a discovery call →