Registered address and genuine operations are two separate requirements
A registered address resolves legal nexus and service-of-process issues, whereas actual operations must explain who makes decisions, who understands customer risk, and who can respond swiftly when problems arise. Even if some work can be performed remotely, it is still necessary to verify whether the relevant roles can discharge their duties outside the jurisdiction. Application materials should not contain only a lease contract and an organizational chart; they should also be able to explain how day-to-day approvals, reporting, risk escalation and record access actually operate; otherwise the address itself cannot demonstrate sufficient operational capacity.
EU CASPs cannot be assessed on the basis of a single minimum provision
Article 59 of MiCA sets out the EU registration, actual management and director residency requirements for authorised CASPs. ESMA's supervisory briefing on CASP authorisation further focuses on local personnel, substantive decision-making authority and the actual performance of duties by management. Accordingly, "at least one director meets the residency condition" does not mean that all other functions may remain outside the jurisdiction, nor does it mean that every company must replicate the same headcount. The specific staffing arrangements must still be determined in light of business scale, key functions and the requirements of the competent authority.
Do not assume that a nominee responsible person has real authority
The company engages local personnel to serve as responsible persons, but all customer approvals, transaction suspensions and risk budgets are decided by an overseas headquarters, and the local personnel cannot access system records. Such an arrangement falls short of "local management" in substance. Conversely, a group may provide shared technical or administrative support, but the licensed entity should retain the corresponding professional capabilities, oversight and decision-making resources. The EU MiCA outsourcing rules make clear that outsourcing cannot transfer away the licensed entity's responsibilities to customers and regulators.
Costing based on a roles and decisions checklist
It is advisable first to list functions such as business management, compliance, risk, finance, asset control and technical security, then verify which must be performed locally, which may be part-time or outsourced, and what qualifications and backup staffing are required. Do not promise "only one employee is needed" or "no office is required" before verification. The team should also check whether actual office, employment, tax and data access arrangements are consistent; reducing resource requirements through a smaller business scope is more sustainable than maintaining a team on paper. For cross-time-zone teams, it should also be tested whether the local responsible person can promptly access records, approve emergency actions and communicate with regulators when an upstream service outage occurs; key authority must not rest solely with overseas personnel who cannot be reached.
Recommended actions
- For each role, specify the work location, time commitment, system permissions and decisions that can be made independently.
- For outsourcing and group-shared functions, review item by item the permitted scope, supervisory responsibilities and alternatives.
- Ask local advisers or the competent authority to confirm expectations for key roles before finalising long-term staffing and office budgets.
Information note: This article provides general information and does not replace legal advice based on specific facts.
References
- MiCA Article 59 — ESMA
- Supervisory Briefing on Authorisation of CASPs — ESMA
- MiCA Article 73 — Outsourcing — ESMA
