France's PSAN/CASP regime is the entry point for any exchange targeting French users or operating from French territory
Any business that wants to operate a crypto asset exchange in France, or actively market to French retail clients, falls under the supervision of the Autorité des marchés financiers (AMF) – France's securities and markets regulator. The applicable regime is the PSAN (Prestataires de Services sur Actifs Numériques) framework, now in transition toward the EU-wide CASP authorisation introduced by MiCA (Markets in Crypto-Assets Regulation). For an inbound operator, France's position inside the EU passport area makes it a high-value licensing target – and a high-enforcement-risk territory if you trade there without the right standing.
Operating without proper registration exposes an exchange to AMF enforcement action, withdrawal of payment rails, and criminal liability for directors. France has pursued unregistered operators; the AMF maintains a public blacklist of entities it considers to be acting unlawfully. The transition to MiCA has not paused AMF scrutiny – if anything, the regulator is sharpening its posture as the new EU regime beds in. This page sets out the regulated basis for a French crypto exchange, the registration and authorisation process, the cross-border interaction with banking and tax, and the decision points a business must work through before it commits to a French structure.
Who needs PSAN registration – and who already does under MiCA?
Any entity providing digital-asset services to persons in France – whether seated in France or abroad – must hold at minimum a PSAN registration with the AMF, unless it falls within a narrow exemption. The AMF has consistently treated the geographic reach of the obligation broadly: serving French users from a foreign server does not create a clean exemption.
The PSAN framework covers a defined list of activities. These include custody of digital assets on behalf of clients, buying or selling digital assets against legal tender, exchanging digital assets for other digital assets, operating a digital-asset trading platform, and reception and transmission of orders. An exchange doing all of the above needs to cover each activity – registration is activity-specific, not entity-level in the way a banking licence is.
Under MiCA, France's national competent authority role transitions to ESMA's passporting regime. An entity authorised as a CASP (Crypto-Asset Service Provider) in any EU member state will eventually passport into France. Businesses that obtained PSAN registration under the prior French regime will need to complete the MiCA authorisation process within the transitional window set by ESMA and the relevant NCAs. The precise timing of that window is subject to regulatory guidance – operators should not assume PSAN registration provides permanent shelter.
In our practice, we see founders frequently underestimate the activity scope. A business that launches with spot trading but later adds staking, lending or custody must assess whether each new activity triggers a fresh notification or authorisation obligation with the AMF.
The AMF's public list of authorised and blacklisted entities is publicly searchable and is actively monitored by French banks and payment processors. Appearing on the wrong list is an operational event, not merely a compliance formality.
What does the PSAN registration and authorisation process actually involve?
The PSAN framework distinguishes between registration (mandatory, the baseline AML/CFT gate) and optional authorisation (a more demanding standard that signals enhanced regulatory standing). Both routes are AMF-led, with input from the Autorité de contrôle prudentiel et de résolution (ACPR) – the French prudential supervisor – on AML/CFT matters.
Registration requires demonstrating that the entity, its beneficial owners and its management team meet fit-and-proper standards. The AML/CFT framework must be documented and operational: a risk-based approach to customer due diligence, a transaction monitoring programme, and internal controls. The AMF will assess the entity's IT security posture and its ability to safeguard client assets. A French legal presence – typically a société par actions simplifiée (SAS) or a société anonyme (SA) – is a practical prerequisite for most inbound operators.
Optional authorisation imposes a higher bar. The AMF requires a detailed business plan, financial projections, insurance cover for operational risks, more detailed AML controls, and governance documentation covering conflicts of interest, outsourcing arrangements and custody segregation. Authorisation also triggers ongoing prudential obligations – capital adequacy expectations, periodic reporting and cooperation with ACPR examinations.
In timeline terms, registration typically takes a matter of months from a complete file; authorisation is a longer process. Both timelines depend heavily on the quality of the submission. An incomplete file – missing a fit-and-proper dossier for a key controller, or an AML policy that reads as a template rather than a business-specific document – resets the clock. We have seen applications that were ready in weeks when the preparation was thorough, and others that stalled for the better part of a year because the foundational documents had to be rebuilt after an initial submission.
The fit-and-proper assessment covers beneficial owners and management jointly. A controller with adverse regulatory history in another jurisdiction will be reviewed by the AMF. Early disclosure and a clear narrative is consistently preferable to an omission that surfaces during the vetting process.
For a scoped assessment of your PSAN registration readiness, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your entity structure, shareholder profile and activity scope change the analysis materially. Map your options before you file.
How do AMF/ACPR AML requirements interact with FATF's Travel Rule?
France has implemented FATF Recommendation 15 – the virtual asset provisions – and the associated Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) through its national AML/CFT legislation. The ACPR supervises AML/CFT compliance for PSANs and expects a programme that goes beyond a box-ticking exercise.
For an exchange, the Travel Rule obligation applies to transfers above the applicable threshold. The specific threshold is set under French and EU law and should be confirmed against current legislation, as the MiCA transition brings EU-level harmonisation of the threshold and the data fields required. Practically, an exchange must have a technical solution in place before it goes live – the ACPR does not accept a policy document as a substitute for operational capability.
The cross-border dimension matters. A French-registered PSAN receiving funds from a counterparty VASP in Singapore must apply its Travel Rule obligations on the inbound leg, regardless of whether the sending jurisdiction has equivalent rules. Operators we advise routinely underestimate the bilateral complexity when transfers originate in jurisdictions with lower FATF compliance ratings.
The AML risk assessment for a French exchange also needs to address the specific risks of operating in France: the client base, the asset types listed, the funding sources accepted. The ACPR's examination approach is risk-based – a business listing high-volatility tokens with anonymous wallet funding will attract a different level of scrutiny than a stablecoin-only institutional platform.
What is the cross-border banking and tax position for a French crypto exchange?
Banking access is the hidden constraint in French PSAN applications. French retail banks remain cautious toward digital-asset businesses, and EMI (electronic money institution) accounts – licensed under a separate EU framework – are often the initial solution. The MiCA transition is expected to improve banking access over time, as the CASP regime provides a clearer regulatory basis that banks can underwrite. For now, an inbound operator needs a realistic banking strategy before, not after, its PSAN registration is filed.
For a group with entities in multiple jurisdictions – a common structure where the French PSAN sits inside a holding architecture with entities in a lower-tax or lighter-touch jurisdiction – the interaction between French corporate tax law and the group's token flows requires careful mapping. France taxes corporate profits on a worldwide basis for French-resident entities. The characterisation of token income – trading profit, financial income, or fee revenue – affects the applicable rate and the VAT treatment.
VAT on crypto-to-fiat exchange services follows EU case law principles. The general position is that exchange services attract an exemption, but the analysis is fact-specific and the ACPR and tax authority positions are not always aligned. Staking rewards, DeFi yields and token issuance proceeds each raise separate characterisation questions under French tax law that the entity needs to resolve before it goes live.
The EU's DAC8 directive – the data-sharing regime for crypto-asset transactions that applies across EU member states – adds a reporting layer. A French PSAN must report certain transaction data to the French tax authority under DAC8. This is not optional, and the compliance cost needs to be budgeted before the business model is locked.
If your banking or tax structure is not resolved before your PSAN file goes in, message us via t.me/oboluslaw. A prior application that stalled, or an account that was closed, often has a structural explanation that a second read surfaces. Map your options before the next submission.
How does the MiCA transition affect a France-first licensing strategy?
MiCA is now the dominant factor in any EU licensing decision, and France is no exception. ESMA and the national competent authorities, including the AMF, are implementing the MiCA CASP authorisation process in parallel with the existing PSAN framework during the transitional period. An entity that obtains PSAN registration now is not insulated from the obligation to complete a full CASP authorisation under MiCA within the applicable window.
For an inbound operator evaluating France against other EU member states – Lithuania, Malta, Germany or Ireland are the common comparators – the analysis turns on more than the licence timeline. It turns on: the regulator's supervisory style and examination intensity; the depth of the local banking market for crypto businesses; the corporate tax rate and treaty network; the availability of local talent; and the practical support the regulator offers to first-time applicants. France scores well on talent and on market size. Its regulatory style is more demanding than Lithuania's, and its banking market more selective.
For a business planning to serve the EU broadly, a France-first strategy makes sense if the primary customer base is French or if the group's European holding structure is already Paris-anchored. For a business that wants the fastest EU entry and will build toward France, a Lithuania or Malta CASP application followed by a French branch notification can be the more efficient path.
In our cross-border practice, we advise operators to treat the EU licensing question as a three-part decision: where the entity sits, where its users are concentrated, and where its banking lives. Getting one of those three wrong – for example, holding a Lithuanian CASP but banking only in France, or registering in France but serving users from an offshore entity – creates the gap that a regulator or a bank will find.
A cross-border exchange structure resolved: a worked example
In a recent matter, a payments and digital-asset exchange business seated in Asia sought to establish a French PSAN to serve European institutional clients. The initial structure proposed by the founders had the French entity receiving client funds but passing execution to an offshore affiliate – a configuration the ACPR would have scrutinised as regulatory arbitrage. We restructured the arrangement so that the French entity held the PSAN for the regulated activities it actually performed, with documented outsourcing agreements to the affiliate for technology services only. The fit-and-proper dossier was rebuilt to address the foreign-national beneficial owners. The file was submitted in a single clean tranche. Registration was confirmed within the standard window, and the entity's French banking relationship was established in parallel using the PSAN registration as the regulatory anchor. The client now operates with a compliant EU presence and a clear pathway to MiCA CASP authorisation.
Which operator profile is best suited to a French PSAN?
France suits a specific set of operator profiles. The regime is not the simplest EU entry, but it offers access to one of the largest retail and institutional digital-asset markets in Europe and the full EU passport once MiCA CASP authorisation is in place.
Profile A – EU-first exchange with French retail focus. An exchange targeting French retail and institutional clients directly should register a French legal entity, obtain PSAN registration, and plan immediately for MiCA CASP authorisation. The process is demanding; timeline is a matter of months for registration, longer for full authorisation. The principal risk is an underprepared AML file or a fit-and-proper gap that triggers a query cycle.
Profile B – Global exchange adding EU regulatory cover. A business already licensed in Singapore or the UAE that wants EU market access may use a French PSAN as its European anchor, passport the service across the EU under MiCA, and run the French entity as a lean regulated subsidiary. The key risk here is transfer pricing and the characterisation of intercompany arrangements – the French tax authority will scrutinise profit allocation between the French entity and the broader group.
Profile C – Early-stage exchange testing EU demand before full commitment. A startup without an established customer base should assess whether the compliance cost of a French PSAN is proportionate at its stage. A BVI or Cayman holding vehicle with a later French application may be the right sequencing. Alternatively, a Lithuanian or Maltese CASP first, with a French branch notification once revenues justify it, provides a faster EU entry with lower initial regulatory overhead.
A common assumption is that a single offshore licence – in the BVI, Cayman or a similar jurisdiction – is sufficient to serve French or EU clients globally. It is not. The AMF asserts jurisdiction over any entity actively marketing to French persons, regardless of where that entity is incorporated. Operating under an offshore registration while directing sales at French users is one of the fact patterns that triggers AMF blacklisting and correspondent bank termination.
Related at OBOLUS
- Digital-asset licensing and registration practice – our full-scope licensing mandate across 70+ jurisdictions, from registration through to ongoing compliance.
- EMI licensing for crypto firms in Hong Kong – how the Hong Kong EMI and VASP regimes interact for exchange and payment businesses.
- VASP business risk assessment for early-stage founders – a scoped review of your licence, AML and banking stack before you commit capital.
FAQ
How long does a crypto licence take to obtain?
In France, PSAN registration typically takes a matter of months from the submission of a complete file. The timeline depends heavily on file quality – an incomplete AML programme or a fit-and-proper gap can reset the clock significantly. Optional authorisation, which unlocks a stronger regulatory standing, is a longer process. Under MiCA, the CASP authorisation timeline across EU member states is subject to ESMA guidance and varies by regulator. A well-prepared submission is the single biggest driver of timeline reduction.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are, where your entity sits, and where your banking lives. France suits operators with a genuine EU market focus. For faster EU entry, Lithuania or Malta may offer a lower initial compliance overhead with the same MiCA passport once authorised. For operators primarily serving Asia-Pacific, Singapore or Hong Kong may be the better anchor. We map the full stack – licence, banking and tax – before recommending a structure.
Do I need a separate custody licence?
Under the French PSAN framework, custody of digital assets on behalf of clients is a distinct regulated activity. If your exchange holds client assets – even temporarily in the settlement process – the custody activity must be covered by your PSAN registration or authorisation. Under MiCA, custody and administration of crypto-assets for clients is similarly a separate CASP service category. An exchange that also custodies assets must ensure both activities are within scope of its regulatory standing. Not all exchanges custody assets; business model analysis determines whether the obligation applies.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams – mapping the licence stack across operating, custody and payment layers before you commit. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU and cross-border VASP registration, CASP authorisation under MiCA, and inbound structuring for exchanges entering the French and broader European market.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.