Operating a digital-asset business in France without the correct regulatory status is an exposure most operators underestimate until the consequences arrive. The Autorité des marchés financiers (AMF) – France's securities and markets regulator – administers the country's Prestataire de Services sur Actifs Numériques regime, known universally as PSAN, the framework that governed crypto service providers from its introduction under the Loi PACTE through to France's transition to MiCA (the EU Markets in Crypto-Assets Regulation). A business serving French clients from an offshore address, or building through a French entity without proper registration, faces the realistic risk of enforcement, frozen banking rails and an operating ban. This page sets out what the AMF expects, who is in scope, how the process works in practice, and what an inbound operator needs to think through before committing to a French structure.
The AMF and the PSAN Regime: The Regulatory Foundation
France's digital-asset regulatory regime is administered by the AMF, and the PSAN framework is the primary instrument through which crypto service providers are regulated. The PSAN regime – introduced under the Loi PACTE and subsequently reinforced – created two distinct tracks: a mandatory registration applicable to a defined set of activities, and a voluntary authorisation track that carried enhanced compliance obligations in exchange for a formal state endorsement. Under the mandatory registration track, custody and exchange services for digital assets against legal tender were brought within the perimeter immediately. The voluntary authorisation track covered a broader set of activities and was designed to encourage higher-standard operators to seek a fuller regulatory stamp.
France's position within the EU meant that the PSAN regime was always a transitional architecture. MiCA – which imposes a single CASP (crypto-asset service provider) authorisation regime across all EU and EEA member states – represents the successor framework. The AMF is the designated national competent authority under MiCA for France. Operators that obtained PSAN registration or authorisation will need to migrate to a MiCA CASP authorisation within the applicable transition window. For businesses evaluating France today, the practical question is whether to enter under the PSAN regime now, move directly to CASP preparation, or do both concurrently.
The AMF's approach has been more demanding in practice than the text of the PSAN regime alone might suggest. The AMF has consistently treated the registration process as substantive: applicants have faced detailed questions on governance, beneficial ownership, AML/CFT systems, IT security and market-integrity controls. In our practice advising clients through European licensing exercises, France has consistently required a higher level of pre-submission preparation than several other EU member states that historically processed VASP registrations more leniently.
For an inbound operator, the central jurisdictional fact is this: the AMF supervises any entity providing digital-asset services to clients in France, regardless of where that entity is incorporated. Substance in France – or at minimum a genuine point of establishment – is expected.
Who Needs PSAN Registration or MiCA CASP Authorisation?
Any business providing a regulated digital-asset service to French clients falls within the AMF's supervisory perimeter, and the scope is broad. The mandatory PSAN registration track covered custody of digital assets on behalf of clients, and exchange services between digital assets and legal tender. The voluntary authorisation track extended to exchange between digital assets, operation of a digital-asset trading platform, investment advice on digital assets, portfolio management over digital assets, underwriting and placing of digital assets, and order reception and transmission. Under MiCA's CASP regime, the activity list maps closely to these categories, organised by the nature of the service rather than its precise French-law label.
The threshold question operators most frequently ask is whether their activity reaches the mandatory perimeter. The answer depends on the facts of the service: a business holding client keys is clearly within custody obligations; a business matching buyer and seller orders is clearly within exchange obligations; a business structuring token issuances for distribution into France raises whitepaper and placement questions. Operators that sit at the edge – running non-custodial infrastructure, providing information rather than advice, or structuring peer-to-peer mechanisms – should not assume they are outside scope without a formal analysis. The AMF has been explicit that substance-over-form analysis applies.
The cross-border dimension is particularly acute. A business incorporated in the BVI or Cayman Islands, operating a platform accessible by French users and denominated in euros, does not escape the AMF's perimeter simply because it has no French entity. For inbound operators targeting the French market, the choice is between establishing a regulated presence and excluding French users operationally – a choice that has meaningful commercial consequences.
For businesses already registered under the PSAN regime, the MiCA transition timeline requires early planning. Operating under the PSAN registration during the transition period is permissible under the applicable grandfathering provisions, but migration to a full CASP authorisation is not automatic – it requires a new application demonstrating compliance with MiCA's requirements, which are more detailed than those of the PSAN regime in several respects.
To map whether your specific activities fall within the French regulatory perimeter – and what the MiCA transition means for your timeline – contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis materially.
How Does the PSAN Registration and Authorisation Process Work?
The PSAN registration process with the AMF is a structured, document-intensive exercise that requires a higher level of preparation than many first-time applicants expect. The AMF reviews the application file for completeness before accepting it, and incomplete files are returned rather than processed – meaning that a poorly prepared submission adds delay without advancing the position. Operators we advise routinely underestimate the AML/CFT documentation burden in particular: the AMF expects a full AML program, a written risk classification methodology, customer due diligence procedures, and evidence that the persons responsible for AML have the qualifications and authority to fulfil the role.
The application file for mandatory registration covers the entity's legal and ownership structure, the beneficial owners and their fitness and propriety, the senior management team and their relevant experience, the proposed service scope, the AML/CFT framework and the IT and cybersecurity architecture. The voluntary authorisation track – and by extension the MiCA CASP authorisation – adds financial resources, organisational requirements, custody and safeguarding standards, and market-integrity controls appropriate to the activity.
The AMF conducts a substantive review of the application. Questions are raised in writing, and the response window affects overall processing time. The practical timeline from submission of a complete file to a registration decision varies based on file complexity and the AMF's current workload. We write this qualitatively because the timeline is not fixed by statute in a way that creates a guaranteed processing period – operators should plan for a process measured in months rather than weeks, with the MiCA CASP authorisation likely to involve a longer review than the PSAN mandatory registration.
A key practical point: the AMF expects the applicant entity to have genuine substance in France or the EU. A shell company with no operational presence, no resident management and no real staff does not satisfy the AMF's requirements. This expectation has hardened as the AMF has observed applications from operators attempting to obtain a French registration while conducting all real business activity outside France.
What Does the MiCA Transition Mean for France-Registered Operators?
The MiCA transition is the defining near-term planning issue for any business with a French regulatory position. MiCA creates a single, EU-wide authorisation regime for CASPs, passportable across all EU and EEA member states, administered in France by the AMF as the national competent authority. The PSAN regime does not automatically convert into a MiCA CASP authorisation – it provides transitional operating rights during the grandfathering period, but the operator must apply for and obtain a full CASP authorisation before the transition window closes.
For businesses currently operating under a PSAN registration, this creates a concrete planning imperative. The MiCA CASP authorisation process is substantively more demanding than the PSAN registration in several respects: the governance and organisational requirements are more detailed; the prudential requirements – capital, own funds, professional indemnity insurance – are calibrated by the category of service; the whitepaper obligations for token-related services are more prescriptive; and the ongoing supervisory reporting obligations are heavier. A business that meets PSAN registration standards cannot assume it automatically meets CASP authorisation standards without a gap analysis.
The strategic upside of completing the MiCA CASP authorisation through the AMF is the EU passport. A CASP authorised in France may passport its services into every other EU and EEA member state without seeking separate national authorisation in each of them. For businesses with pan-European ambitions, this is a powerful commercial argument for treating France as the EU licensing hub – provided the French substance and compliance infrastructure can support the ongoing obligations of a MiCA-authorised CASP.
In a recent licensing matter, a payments business that had obtained a PSAN mandatory registration asked us to assess its readiness for MiCA CASP authorisation. The gap analysis identified deficiencies in its organisational controls, prudential buffers and compliance reporting lines that would have resulted in a refused application. We restructured the governance framework and compliance function over several months before the CASP application was filed. The outcome was an authorisation that positioned the business to passport into five additional EU member states without further national applications.
AML/CFT and the Travel Rule: What the AMF Expects
France's AML/CFT framework for digital-asset service providers is grounded in the FATF Recommendations – specifically Recommendation 15, which brings VASPs within the scope of the international AML/CFT standards – and implemented through French transposition of EU anti-money laundering directives. The AMF and the Autorité de contrôle prudentiel et de résolution (ACPR) share supervisory responsibility for AML compliance in the digital-asset sector, with the ACPR handling AML-specific oversight and the AMF covering market-conduct matters.
The Travel Rule – the obligation to pass originator and beneficiary information with a virtual-asset transfer – applies to French-regulated operators under the EU framework. The practical implementation of the Travel Rule requires a technical solution capable of transmitting the required data fields to counterpart VASPs, identifying counterpart compliance status, and managing transfers to and from unhosted wallets. The AMF and ACPR expect to see evidence of a working Travel Rule solution as part of the authorisation and ongoing supervision process.
In our cross-border practice, Travel Rule compliance is consistently one of the areas where operators arrive underprepared. The technical solution is necessary but not sufficient: the operator also needs written policies covering what to do when a counterpart VASP cannot be identified, how to handle transfers below and above the applicable threshold, and how to document decisions. The AMF treats Travel Rule compliance as a substantive obligation, not a checkbox.
The cross-border angle on AML is particularly acute for French-based businesses serving clients across the EU. Under MiCA, the AMF-authorised CASP will be supervised on a consolidated basis by the AMF for market-conduct matters, but AML obligations in other member states may require local engagement with those states' AML authorities. Operators should not assume that French AML compliance automatically satisfies the AML expectations of every EU jurisdiction in which they operate.
How Do Banking and Tax Interact with a French Digital-Asset Licence?
Banking access is a structural challenge for French-licensed digital-asset businesses, and it does not resolve automatically upon obtaining a PSAN registration or MiCA CASP authorisation. French and EU banks have applied varying levels of appetite to crypto-related accounts: some tier-one French institutions have onboarded regulated PSANs after a due-diligence process; others have maintained blanket restrictions. The practical reality is that banking for a French-regulated digital-asset business requires active relationship management, a full compliance dossier and often engagement at relationship-director level rather than standard onboarding. Operators who assume that a licence solves the banking question are routinely surprised.
The interaction between client money safeguarding and French banking is also a consideration. MiCA imposes segregation and safeguarding obligations on CASPs holding client funds, and those obligations require a banking relationship capable of supporting segregated client accounts. A CASP without a reliable banking partner cannot operationally comply with these safeguarding requirements. In our practice, we map the banking relationship in parallel with the licensing process rather than sequentially.
On the tax side, France's treatment of digital assets for corporate taxpayers and for the business activity of a PSAN/CASP is a distinct analysis from personal crypto taxation. Corporate tax on trading gains, VAT treatment of exchange fees, and the classification of token-related income are all fact-specific and have evolved as the French tax authority has issued guidance. We advise clients to treat the tax layer as a concurrent workstream with the licensing process – structuring decisions made at the entity level have downstream tax consequences that are difficult to unwind.
If a prior application stalled, a banking relationship was refused, or a tax position was left unresolved, a structured second review can surface the cause and the path forward. Contact OBOLUS at info@oboluslaw.com or via t.me/oboluslaw.
How Does France Compare for an Inbound Operator?
France sits in a distinctive position within the European licensing environment: it combines rigorous AMF supervision with the full benefit of MiCA passporting, a developed legal and financial infrastructure, and an active digital-asset industry in Paris and beyond. For an operator choosing a European licensing hub, France competes directly with Malta (historically a first-mover in EU crypto regulation, now transitioning its VFA framework to MiCA), Lithuania (which established a reputation as a fast EU VASP entry point under its prior regime), and to a lesser extent Ireland and Luxembourg for funds-facing structures.
The AMF's demanding approach to registration and authorisation means that France is not typically the fastest or lowest-friction EU entry point. Operators looking for the path of least short-term resistance have historically looked elsewhere. But that framing misses the strategic picture: a French MiCA CASP authorisation, once obtained, carries the full EU passport; the AMF is a credible and well-resourced regulator whose endorsement carries weight with institutional counterparties; and the Paris financial ecosystem provides access to banking, legal and technology infrastructure that smaller EU jurisdictions cannot always match.
For an operator whose core market is continental Europe – particularly France, Germany, Italy and the Benelux countries – and whose clients include institutional counterparties that weight regulatory quality heavily, the case for a French MiCA CASP authorisation is strong. For an operator whose primary market is non-EU, and who needs an EU presence mainly for passporting into a small number of member states, a lighter-touch EU licensing hub may better match the commercial reality.
A common assumption is that a single offshore licence – from a jurisdiction like the BVI, Cayman Islands or even a non-EU crypto-friendly jurisdiction – is sufficient to serve clients globally, including in France and the EU. This is not correct. The AMF takes the view that serving French clients from an offshore entity without EU authorisation places the operator in breach of the applicable French and EU regulatory requirements. The offshore licence may satisfy requirements in its home jurisdiction; it does not satisfy AMF requirements. Operators who rely on this assumption face enforcement risk, banking termination and the operational disruption of having to re-licence under regulatory pressure.
Related at OBOLUS
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we structure the licence, banking and compliance stack across jurisdictions
- Licence Renewal and Variation in Malta – the VFA-to-MiCA transition and what it means for Malta-licensed operators
- Tokenised Fund Structuring – the tax and structuring analysis for fund-adjacent digital-asset vehicles
FAQ
How long does a crypto licence take to obtain?
The timeline varies by jurisdiction, activity category and the completeness of the application file. Under the French PSAN regime, a complete mandatory registration application has typically been processed in a period of months; voluntary authorisation and MiCA CASP authorisation involve more detailed review and a longer window. Across all regimes, incomplete or underprepared files extend the timeline significantly. We build a realistic programme into every licensing engagement so the business can plan its go-live accordingly.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The optimal jurisdiction depends on your target markets, your activity type, the regulatory quality your institutional counterparties expect, and your banking requirements. France offers MiCA passporting and AMF credibility for EU-facing businesses. Other EU member states may offer faster entry. Offshore jurisdictions suit certain fund or holding structures. We advise on the full matrix – licence, banking, tax and compliance – before recommending a jurisdiction to a client.
Do I need a separate custody licence?
In most leading regimes, custody of digital assets on behalf of clients is a regulated activity that requires specific authorisation or registration – separate from exchange or trading authorisations. Under MiCA, custody and administration of crypto-assets is one of the defined CASP services and carries its own capital and organisational requirements. Whether your custody arrangements require a standalone licence or can be bundled within a broader CASP authorisation depends on the scope of your activities and the jurisdiction. This question should be resolved before launch, not after.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so that licensing decisions are made with full visibility of the banking and tax consequences. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU digital-asset licensing, PSAN/MiCA transition strategy and inbound-operator regulatory structuring across the major European hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.