First, answer with whom the user is actually transacting
The fact that a user submits identity information within a wallet does not necessarily mean the wallet is a deposit and withdrawal service provider. It is necessary to examine who accepts the user, provides exchange quotes, signs contracts, collects payment and promises delivery. If these are all carried out by a third party in its own name, the wallet may primarily provide an entry point; if the wallet itself sells a complete service to the user and then delegates the operations to a third party, that is closer to outsourcing of its own business. As for the agency model, it is separately necessary to check whether local law permits it and what registration is required.
Three types of cooperative relationships cannot be governed by a single template
The UK FCA's payment guidance indicates that payment institutions providing services through agents are subject to corresponding registration and supervision arrangements, and that e-money distributors are also distinct from payment agents. Article 73 of the EU's MiCA, in turn, provides that a crypto-asset service provider outsourcing operational functions does not thereby exempt itself from its own obligations. The two point to boundaries of responsibility under different regimes, and "third-party licensing" cannot be uniformly understood to mean that any white-label arrangement or referral is lawful.
A scenario in which the user directly accepts the terms of a deposit and withdrawal institution and the wallet merely displays a clearly identified entry point is factually different from one in which the wallet promises the user a fixed exchange rate and fixed arrival, and handles the entire balance itself. The latter model cannot suddenly claim in a dispute that it is merely an advertising platform, and the former should likewise not imply in its marketing that the wallet is a regulated funds provider.
Cooperation due diligence must be verifiable down to the specific product
It is not enough to keep a screenshot of a license. It is advisable to verify the contracting entity, scope of services and status in the official register, and to require the counterparty to confirm in writing the countries accepted, customer types, currencies and networks. As for outsourcing layers, it should also be asked clearly whether actual custody, exchange and disbursement are further delegated to other institutions, and what information the wallet can obtain if funds are frozen or the counterparty becomes unreachable.
Who collects customer data, why it is shared, and who responds to inquiries should be arranged separately. Do not hide the authorization and the service provider merely to save the user one click; nor should a broad consent box be used to treat all future uses by the counterparty as already authorized. Specific data rules need to be reviewed according to the user and the place of processing.
Allocation of responsibility must be written down for the day a problem occurs
It is advisable to set out in the cooperation table who takes the lead, who provides evidence and who explains to the user in respect of account-opening refusal, failure to purchase coins after deduction, refunds, fraud, complaints, investigations and service suspension respectively. Termination of the cooperation should also be rehearsed: whether customers can contact the service provider directly, how records are exported, and how balances are handled. Good integration is not only about successfully converting a user, but also about being able to explain the subsequent path clearly when the product ceases cooperation.
Recommended actions
- Determine whether the arrangement is an independent introduction, agency or outsourcing, and review the contract according to the actual model.
- Verify the official licensed entity, the scope of services and written approval for the target market.
- Assign account opening, refunds, complaints, data and investigation responsibilities to specific contacts.
- Conduct drills on service suspension and exit, and on the path for users to contact regulated service providers directly.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- Payment Services and Electronic Money – Our Approach, Chapter 5 — UK Financial Conduct Authority (FCA)
- MiCA Article 73: Outsourcing — EU regulations / ESMA official rulebook
