How many products a single licence can support depends first on the functions involved
Even if a checkout counter, a corporate payment back office and a mobile wallet have different names, where they are all operated by the same entity, it is still necessary to verify item by item whether their functions fall within the authorised services. Conversely, adding balance custody, currency exchange or credit functions to the same App may already go beyond the original scope. Article 59 of the EU's MiCA requires that authorisation list the services, and newly added crypto services require an application to extend it; therefore, "the same product" and "the same regulated activity" are not the same thing.
Different subsidiaries cannot simply rely on group marketing
Assume Company A holds the relevant authorisation, while Company B independently contracts with customers, quotes prices and collects customer assets, and the terms merely state that "the group holds a licence". Company B's actual role should be re-analysed, and it cannot be deemed authorised merely on the basis of brand affiliation. If Company A is in fact the entity genuinely providing the regulated services, customers should be able to identify Company A's identity, the scope of its services and the party against whom they have recourse; Company B's customer-acquisition or technical role must also comply with the applicable rules, and it is not enough simply to change the contract name to Company A.
The intra-group services exemption requires strict separation
Article 2 of MiCA excludes from scope entities that provide crypto-asset services solely to their parent undertaking, their own subsidiaries or other subsidiaries of the same parent undertaking. It addresses a specific purely intra-group relationship; it does not permit any company in a group to conduct business externally without authorisation. A group treasury centre that manages only internal assets and a structure that receives external merchant funds through a subsidiary and then processes them centrally should be assessed separately; nor may this be used to bypass payment, anti-money-laundering or other potentially applicable regimes.
Shared systems and shared responsibility are not the same thing
A group may explore shared technology, customer service or risk management, but it should clearly determine how data, assets, permissions and fees are attributed. Article 73 of MiCA indicates that outsourcing cannot transfer the licensed entity's own responsibilities, and intra-group outsourcing cannot cause it to lose its supervisory capability. In practice, it is advisable to set out clearly, for each product, the contracting entity, the customer funds account, wallet control and complaint handling, and to check whether the App, statements, emails and marketing pages are consistent; services provided across countries also require separate review of customer market access. Unified login and group-shared databases should also be able to distinguish each entity's customers, balances and authorisations, so as to avoid customers not knowing that the service provider has changed when switching products, or funds attribution being commingled in internal ledgers.
Recommended actions
- Prepare a mapping table of "product — legal entity — service function — scope of licence — customer market".
- Check whether the customer agreement, bank and wallet ownership, interface displays and customer-service commitments all point to the same genuine service provider.
- Record purely intra-group business and external customer business separately, and do not apply the intra-group exemption to external-facing platforms.
Information note: This article provides general information and does not replace legal advice based on specific facts.
References
- MiCA Article 59 — ESMA
- MiCA Article 2 — Scope — ESMA
- MiCA Article 73 — Outsourcing — ESMA
