Crypto Trading and Custody Inside the Bank's Existing App
A retail bank can offer spot crypto trading and custody inside the app its customers already log into, on the banking authorisation it already holds - by notification, not by a new licence.
- Maturity
- Proven
- Regime
- MiCA Art. 60
- Proven stack
- Sygnum · Boerse Stuttgart Digital · Bitpanda · Ripple Custody
- Last verified
- August 2026
Reviewed by Andrei Yurkevich, Founding Member at Protofire
observed interval from regulatory clearance to live, at both BBVA (5 Mar to 4 Jul 2025) and DZ BANK (end Dec 2025 to first co-operative bank live 5 May 2026).
Seven named institutions in production across five countries, earliest live October 2022. The licence is not the constraint - the core-banking integration is.
01. The opportunity
Retail deposit money is already leaving banks for exchanges, and much of it belongs to customers the bank never reaches through its investment products. When PostFinance launched in-app crypto, around 56 per cent of its crypto clients had never used any investment product at the bank before, according to its Head of Digital Assets in June 2025. Offering spot crypto inside the app the customer already logs into keeps that flow, and those customers, on the bank's own rails: the position is bought with money already in the account, appears in the same portfolio view as funds and securities, and carries through to the year-end statement and tax certificate, with no separate app and no separate onboarding.
The regulatory ground shifted underneath it. MiCA lets a credit institution add crypto-asset services on the authorisation it already holds, by an Article 60 notification instead of a new licence, and the transitional period for older national registrations has now closed across the EU. For the customer it is a regulated, familiar surface for assets they were otherwise buying on venues with no banking protections, and it is the entry point to the products the same infrastructure supports next, with staking (BP-3) the typical follow-on inside the first year.
02. The regulatory position
03. Who's already done this
meinKrypto inside the VR Banking App - BTC, ETH, LTC, ADA, self-directed and outside advisory. Custody by Boerse Stuttgart Digital, execution by EUWAX AG, built with Atruvia. The clearest illustration of the gap between licence and launch: the first co-operative bank went live 5 May 2026, and each of the 646 banks must activate in its own name.
Trading and custody on Sygnum's bank-to-bank platform via API, 11 assets at launch and 22 today, extended to corporate clients May 2026. The sequencing reference for the library - staking followed in January 2025 - and the clearest case of a bank reaching non-investors: around 56 per cent of crypto clients had not previously used any investment product.
BTC and ETH buy, sell and custody in the BBVA app for all adult retail customers in Spain, after a phased rollout. BBVA is custodian of record and runs Ripple Custody as its own key-custody technology. The reference case for a bank that keeps custody in-house, and evidence the Art. 60 notification route works in practice.
Crypto buying and trading inside the bank's own e-banking and app, on Sygnum; offering expanded 17 March 2025. A mid-sized regional institution rather than a household name, which makes it the more useful comparator for most readers.
BTC, ETH, SOL and LTC in the existing InLinea channel, execution and custody by Sygnum via direct API into Avaloq SaaS, assets held off-balance-sheet with no external wallet transfers. The newest deployment and the most transparent about its constraints: crypto is displayed like any other security in e-banking, statements and tax certificates.
Trading and custody embedded in the N26 app, 300+ assets, live in Austria first and subsequently across the EU and Switzerland, with Bitpanda setting pricing and holding the keys. The earliest in-channel deployment located and the clearest example of the second lawful shape - the licensed provider is the contracting counterparty and the bank supplies the channel.
wpNex places crypto beside securities in the member bank's own depot, funded from the bank account with no separate wallet. Shows the pattern delivered through a shared securities-processing utility rather than bilaterally.
04. Does this fit you?
- Yes if you hold a banking authorisation, run your own retail e-banking channel with an installed customer base, and already produce securities statements the crypto positions can join.
- Not if you have no banking authorisation, if you are a broker or venue without a banking channel, if you serve a network of member banks rather than your own customers, or if the product you want is customer-controlled self-custody.
05. The stack, layer by layer
Most of these layers can be rented from a named vendor, and usually should be. The part that matters is the one layer you have to own yourself.
The authorisation, the channel and the client record
The banking authorisation and with it the Art. 60 route; the customer relationship, identity record and the account the money comes from; the e-banking channel with its authentication and design system; securities custody, statement production and tax reporting; and the compliance, risk and complaints functions the regime assumes.
Custody, liquidity and chain connectivity
Custody infrastructure or key-management software, liquidity, pricing and settlement, and chain connectivity with Travel Rule messaging. Explicitly not included: no core-banking connector, no statement or tax output, no customer channel and no complaints handling.
The core-banking seam and the governance pack
The core-banking-to-custodian seam - position mirroring, posting, end-of-day reconciliation and break handling; statement and tax plumbing per jurisdiction; the channel surface inside the existing app; the Art. 60(7) notification pack, custody policy and Art. 74 wind-down plan; and monitoring, decision thresholds, rehearsed runbooks and out-of-hours cover.
06. Why this stack
- The bank does not need a new licence or a new legal entity. A credit institution notifies its home authority 40 working days ahead under MiCA Article 60, and the authority's review is a completeness check rather than an approval it can withhold on the merits.
- "Renting a CASP passport" is not a lawful structure. MiCA has no agent concept, the passport is not transferable, and Article 75(9) restricts custody sub-delegation to authorised providers. Two shapes work: the bank is the provider, or a licensed provider is the disclosed counterparty.
- The demanding part is the integration between the core banking system and the custodian - position mirroring, reconciliation, statements and tax - and no off-the-shelf connector to a licensed European custodian exists.
- Swiss banks sit outside MiCA entirely, under their banking licence with DLT-Act bankruptcy segregation, which FINMA restated in guidance on 12 January 2026.
07. What we don't claim
There is no published decision-to-live timeline for this pattern anywhere. Two clearance-to-live intervals are observable and both are about four months, but they measure only the last stretch. Payment for order flow is prohibited, principal inventory is capital-expensive under CRR3, and several live deployments allow no external wallet transfers at all, so a customer can sell the position but cannot move it to a self-custodied wallet.
Request the full blueprint
This is the short version. The full blueprint is a single document your counsel and board can read cold, and a third-party-risk function can lift wholesale. Leave your work email and your personal link arrives in your inbox.
- The regulatory position, stated article by article
- Proven options at each layer, with the vendors that hold up
- The risk table with a named owner for each risk
- The division of labour: what is rented, built, and operated
- The third-party-risk pack a DORA governance function can lift
- The delivery path, step by step, with the monitoring and incident model
FAQ
What authorisation does a bank need to add crypto trading and custody inside its existing app?
Under the Crypto Trading and Custody Inside the Bank's Existing App pattern, a retail bank uses its existing banking authorisation and the MiCA Art. 60 credit-institution notification, which runs 40 working days as a completeness check with no power to refuse on the merits, so no new licence is required. DORA and the Transfer of Funds Regulation also apply, and MiFID II does not. Swiss banks operate outside MiCA under their banking licence with DLT-Act segregation.
Which banks already offer spot crypto trading and custody in their own app?
BBVA registered with the CNMV as a credit institution for custody, execution and transfer on 5 March 2025 via the Art. 60 route and went live on 4 July 2025 with BTC and ETH in the BBVA app, running Ripple Custody as its own key-custody technology. DZ BANK received its BaFin MiCAR authorisation in late December 2025 and launched meinKrypto inside the VR Banking App, with custody by Boerse Stuttgart Digital and execution by EUWAX AG. PostFinance has run trading and custody on Sygnum since February 2024.
In this pattern, what does the bank build and what does it rent?
The bank owns the parts that already exist: the banking authorisation and Art. 60 route, the customer relationship and account, the e-banking channel, and securities custody with statement and tax reporting. It rents custody infrastructure, liquidity, pricing, settlement and chain connectivity with Travel Rule messaging from providers such as Sygnum, Boerse Stuttgart Digital, EUWAX, Bitpanda Asset Management or Ripple Custody. What gets built is the core-banking-to-custodian seam, the statement and tax plumbing, the channel surface, and the Art. 60(7) notification pack with an Art. 74 wind-down plan.
Already evaluating this for your institution?
When you are ready, we scope a business case on your own numbers: the costed build, the controls, the SLA and the ROI your board needs to approve it. Or talk it through first.
Run this pattern in production, or tried to and stopped? .