MiCA Migration Engineering for CASPs

We build a migration funnel beside ordinary sign-up and hold it to the same standard. ESMA's statement of 23 June 2026 expects the receiving CASP to onboard each transferred client in full, with customer due diligence and every other AML/CFT check. The funnel has invitation links tied to the old record, documents through your existing identity vendor, queues with service levels and escalation to your compliance team. It is sized for the peak, from identity-vendor rate limits to analyst capacity, with drop-off reported daily.

Revolut asked customers moving to its Cyprus CASP to answer economic profile questions. Reliance on the old firm's checks is a legal question, so the funnel follows the policy your AML compliance officer signs.

At cut-off we snapshot each client's balance per asset and chain and reconcile it three ways. The snapshot is checked against the leaving firm's ledger, against its wallets onchain and, after credit, against the receiving CASP's register of positions, which MiCA Article 75(2) requires for each client and which feeds the statements of position due at least every three months (Article 75(5)). Every break gets an owner and a reason code before the next wave opens.

Coinbase Prime told trading clients to expect asset parity except for stablecoins that were not MiCA compliant. Wherever the receiving side will not support an asset, we give each holder a dated choice to sell or withdraw it before the move. The onchain leg reads an index of all addresses on both sides, built with our blockchain data indexing tooling.

We build the sweeps as batched transfers per asset and chain, under multisig or MPC approval. They leave the old wallets under Safe multisig approval with separated signer roles, or under the policy engine of MPC custody such as Fireblocks, with fees planned per chain. Client assets stay segregated on the ledger from the CASP's own, as MiCA Article 75(7) requires.

Each client gets new deposit addresses in the receiving custody, and old addresses retire on a published date: Kraken stopped showing German clients their DLT Finance deposit addresses by mid-August 2025 and prompted them to generate new ones. After cut-over we watch the old addresses and route late deposits to a return or credit path your operations team has approved.

We build an inventory of open states per client, a record of each cancellation and an opt-in replay that re-creates orders and recurring plans after cut-over. Coinbase canceled open orders on each country's effective date and kept recurring buys running for clients who accepted within 60 days. OKX cancels open orders when an account's country of residence changes to one in the EEA and redeems active Earn products before the update.

Payment rails change too: OKX assigns a new SEPA deposit account and refunds deposits sent to the old one, and Coinbase's institutional exchange, now Prime DMA, moved API clients to new REST, FIX and WebSocket endpoints.

We carry Travel Rule data on every transfer of the move and re-register directory entries on a dated schedule. Every transfer carries originator and beneficiary information under the Transfer of Funds Regulation (EU) 2023/1113, with no value threshold (Article 14). A client's move from the old provider to the new CASP is a transfer of crypto-assets under the Travel Rule, even when the same person sits on both ends. Article 3(10) applies "irrespective of whether the originator and the beneficiary are the same person".

Incoming deposits also have to be classified. Addresses linked to a CASP-like entity outside the EU are not self-hosted (Article 3(20)), and the treatment of deposits from a winding-down EU provider without authorization has no settled answer, so your compliance and legal teams set that policy before the first deposit arrives.

In Notabene's network, an address claimed by VASPs that do not belong to the same group returns a 404 error and does not resolve. Under EBA/GL/2024/11 (paragraph 86), a CASP fully satisfied that a client controls a self-hosted address may record it, with controls to remove it, and skip the check on later transfers; we carry such entries across where the receiving CASP's policy accepts them and test messaging with the main counterparties before cut-over.

The Travel Rule networks and vendors themselves are compared in our EU Travel Rule guide. How those networks and vendors compare is covered in our EU Travel Rule guide.

We move large books in waves, by country or client segment, each on one runbook. The runbook sets freeze points for deposits, withdrawals and trading, the snapshot, sweeps and credits, reconciliation sign-off, reopening, and a rollback path if a check fails. Coinbase moved countries in six waves between 18 August and 23 October 2025, each announced by email about a month ahead.

Downtime is planned and announced, as when Coinbase Prime scheduled up to several hours with crypto transfers disabled. We rehearse each wave in test against a copy of the book, with go and no-go criteria signed by the operations owners on both sides, before the wave's notices go out.

We build the exit-only switch, withdrawal flows to an authorized CASP or a self-hosted wallet, scheduled notices, the close-out at the deadline and a ledger of residual balances. For a provider without authorization, ESMA's 23 June 2026 statement sets out what it expects of the exit: onboarding and marketing stop, services shrink to selling, transferring, reallocating or closing positions, and custody lasts only for the period strictly necessary. Clients are told "clearly, promptly and repeatedly", with "a deadline by which any residual positions would be closed automatically".

An authorized CASP needs the same machinery for its client-transfer procedures (MiCA Article 64(8)) and, where Article 74 applies, its wind-down plan, so the migration tooling can stay in place as the tested part of both. A firm that serves clients on a partner's authorization also needs a planned way out of that partnership, and on the CASP's side MiCA Article 73 keeps it fully responsible for any function it outsources and asks for exit strategies in its outsourcing policy.

In Episode 5 of The Protocol Roundtable, Protofire's Lead Product Manager Rado Patus named the first question he would put to a chain or product provider: "can you show me your reconciliation and the exit? What will happen if either you guys disappear, or we want to leave your chain in five years, or your product? What's the thing that we will keep, and what we will lose?"

The same question applies to a partner's authorization: the book profile lists what would move, and a rehearsed cut-over runbook shows how, on either side of the partnership.