Software or hardware for a wallet in which the private keys are held exclusively by the user generally does not require an authorisation as a crypto-asset service provider, because it is not custody on behalf of clients. MiCA says so expressly in recital 83. You do need an authorisation, however, if you gain control over the crypto-assets or the means of access to them, for instance through key management or recovery, or if the application itself provides exchange, receives orders or executes transfers on behalf of users.
Since Regulation (EU) 2023/1114 (MiCA) came into operation, crypto-asset wallet developers have been asking whether they are required to obtain an authorisation as a crypto-asset service provider (CASP). The answer does not turn on whether the product is called a wallet, but on who holds access to the crypto-assets and what acts the application performs for the user.
Custody means control over access
The services requiring an authorisation are listed in Article 3(1)(16), and custody stands first among them. The Regulation defines it as follows:
‘providing custody and administration of crypto-assets on behalf of clients’ means the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys;
If the keys are generated and held solely by the user’s device and you have no access to them, you have no control over the crypto-assets. The legislature confirmed this in recital 83, according to which providers of hardware or software for non-custodial wallets should fall outside the scope of the Regulation. A recital is not a free-standing legal rule, but it serves in interpreting the definitions, so it matters that the product genuinely corresponds to it. An authorisation is required by anyone providing services to clients on a professional basis (Article 3(1)(15), Article 59(1)), which is generally the case with a commercial application.
Where the line falls
The most frequent problems do not arise with the basic wallet, but with functions added to it later:
- Key management or recovery. If the firm holds a backup of the key, or part of it, enabling it to control the crypto-assets alone or together with another party, it comes close to control over the means of access within the definition of custody. The technical arrangement must be assessed specifically, rather than by its marketing label.
- Built-in exchange. If the application concludes purchase or sale contracts for crypto-assets with users using its own capital, that is exchange under Article 3(1)(19) (for funds) or (20) (for other crypto-assets). If it receives their orders and transmits them to a third party for execution, that is the service under point (23).
- Transfers on the user’s behalf. Transferring crypto-assets from one address to another on behalf of a user is also a service (point (26)). If the user signs the transaction themselves with their own key, it is the user who executes the transfer.
Recital 22 adds that only services provided in a fully decentralised manner without any intermediary remain outside the Regulation. Connecting a wallet to third-party services, such as a licensed exchange, is common. In that case, however, it must be defined contractually and technically who provides the service and who bears the duties towards the client.
What to watch in your communications
The Regulation prohibits a person who is not a crypto-asset service provider from using a name, marketing communication or any other process suggesting that it is one, or liable to create confusion (Article 59(5)). Promises along the lines of “we will safely store your crypto” are inaccurate for a non-custodial wallet and regulatorily risky at the same time. The difference also has a proprietary consequence: clients’ crypto-assets in custody, which under the Regulation do not form part of the provider’s estate, are not subject to enforcement (Section 3(1) of Act No. 248/2024 Coll.), whereas with a non-custodial wallet the risk of losing the key lies with the user.
How to proceed
Before launching, or adding a new function, it is advisable to map the flows of crypto-assets and keys and to check whether any function meets the definition of a crypto-asset service. If it does, we assess whether to move it to a licensed partner or to apply for an authorisation, through our MiCA licence for crypto-asset services service. We prepare terms of use setting out precisely who holds the keys and what the user is responsible for, through our SaaS agreements and terms service. If the application works with stablecoins, see also when a CASP licence is not enough and a payment authorisation is also needed.
This answer provides general information on the law as at 12 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
