Vara licence application in France (AMF/PSAN)

Operating a digital-asset business in France without the correct registration exposes the entity to enforcement by the Autorité des marchés financiers (AMF), potential loss of payment rails and the near-certain closure of French banking relationships. The French regime distinguishes between a mandatory registration and a voluntary, enhanced authorisation – a distinction that shapes what you can sell, where you can bank and how regulators in other jurisdictions will view your corporate structure. This page explains the two tracks, the application process, the cross-border interactions, and the decision a serious operator needs to make before committing capital to a French structure.

The French VASP regime: mandatory registration and optional authorisation

France regulates digital-asset service providers through a PSAN (Prestataire de Services sur Actifs Numériques) regime administered by the AMF, establishing two distinct compliance tracks for any business providing crypto-asset services to French clients. The first is mandatory registration, required for custody, purchase/sale of crypto for fiat, exchange services and payment in crypto. The second is a voluntary enhanced authorisation (agrément optionnel) that signals a higher compliance posture and opens doors with correspondent banks and institutional counterparties.

The regime sits within the French Monetary and Financial Code. It pre-dates MiCA (the EU Markets in Crypto-Assets Regulation), which is now the EU-wide framework that will eventually absorb French PSAN obligations. Until MiCA's CASP authorisation fully displaces national regimes for French-based operators, the AMF continues to supervise PSANs under the existing national rules. The transition creates a structural planning question: should an operator apply for French PSAN registration now, or build toward MiCA CASP authorisation from the outset?

In our practice, operators who have already built an EU business often ask whether a French PSAN registration adds meaningful value given MiCA passporting. The answer depends on client geography, banking relationships and the specific services offered. A business whose primary client base is French residents generally cannot defer French compliance on the basis of a future MiCA passport from another member state.

Who must register with the AMF?

Any entity providing regulated digital-asset services to persons in France must hold PSAN registration, regardless of where the entity is incorporated. The territorial reach of the AMF's regime is not limited to French-domiciled companies. A Maltese, Lithuanian or BVI entity actively soliciting French retail clients is within scope.

Regulated services include custody of digital assets on behalf of third parties, operating a platform that exchanges crypto-assets for fiat currency or for other crypto-assets, receiving and transmitting orders relating to digital assets, portfolio management of digital assets on a discretionary client-by-client basis, and underwriting or placing digital assets. The voluntary authorisation track extends to investment advice, financial analysis and payment in digital assets.

The AMF has publicised a blacklist of unregistered providers actively offering services to French residents. Appearing on that list carries reputational consequences with banks, payment processors and institutional counterparties across Europe – not only in France. We have seen operators discover this consequence months after the fact, at the point when a banking application in another EU country stalls.

CTA BRIDGE: Understanding whether your current structure triggers French registration requirements is a threshold question that needs a scoped answer before you launch or expand.

For a scoped assessment of your French regulatory exposure, including whether your entity, service mix and client base trigger mandatory AMF registration, contact OBOLUS at Map your options.

What does the mandatory PSAN registration process involve?

Mandatory PSAN registration requires the applicant to satisfy the AMF on four principal dimensions: the fitness and propriety of beneficial owners and senior management, the adequacy of AML/CFT procedures, the operational security of the technical infrastructure, and the governance framework of the entity. The AMF applies these requirements in substance, not form – a well-formatted application with thin underlying controls will not pass.

The application file is submitted to the AMF through its SIRET-registered entity in France. The file typically includes corporate documentation, UBO declarations, a detailed description of services, AML/CFT policy documentation aligned with TRACFIN reporting obligations, IT security assessments and resumes with compliance attestations for management.

The AMF has indicated that it requests consultation with the Autorité de contrôle prudentiel et de résolution (ACPR) – the French banking and insurance supervisor – for applications involving custody or payment-related services. This adds a layer of bilateral review that operators should plan for in their timeline estimates. Processing times vary depending on file completeness and the AMF's current caseload; in our experience, a well-prepared file with no gap letters can close registration in a matter of months, while deficient filings can extend the process considerably.

A common mistake at this stage is submitting an AML policy template borrowed from a different jurisdiction's filing. The AMF expects French-law-specific TRACFIN reporting procedures, references to the relevant national AML legislation and an ACPR-compatible format. Generic policies generate gap letters and delay registration by weeks or months.

Is the voluntary enhanced authorisation worth pursuing?

The voluntary agrément optionnel provides a materially stronger compliance signal than mandatory registration, and in our cross-border practice we regularly advise clients that the enhanced authorisation changes the banking conversation dramatically. French and European banks that will not open accounts for a registered PSAN will sometimes engage with an authorised one – because authorisation requires the AMF to conduct a fuller merits review of the business model, not merely a fitness and AML check.

The authorisation route requires capital adequacy documentation, a professional indemnity insurance policy, a formal organisational separation between client assets and proprietary assets, a complaints-handling procedure and a conflict-of-interest framework. The capital requirements are set by the applicable AMF rules and vary by service category – they are not nominal, and operators should obtain a current figure from the AMF's published guidance before budgeting.

Operators planning to scale to institutional clients, access French public-offer mechanisms for token issuance (the ICO visa framework the AMF administers), or engage with French asset managers as counterparties should treat the voluntary authorisation as effectively mandatory from a commercial standpoint. It also positions the entity more favourably for MiCA CASP authorisation when France's transposition is complete.

In a recent matter, a European exchange operator approached us after its mandatory PSAN registration was obtained but its French banking applications were rejected. We reviewed the structure and identified that the entity's governance documentation did not meet the expectations of authorised PSANs – even though it had not applied for authorisation. We restructured the compliance and governance layer, supported a supplementary AMF filing and the operator subsequently secured a French banking relationship. The lesson: banks assess PSAN operators against authorisation-level standards, even when they are not required to hold authorisation.

How does French PSAN registration interact with EU passporting and cross-border structure?

The PSAN regime is a national French regime and does not generate an EU passport. A French PSAN registration permits the entity to operate in France; it does not entitle that entity to provide regulated crypto-asset services in Germany, Spain or the Netherlands without complying with those countries' national requirements. This is the fundamental structural risk that operators underestimate when they treat a French registration as a continental entry ticket.

MiCA changes this calculus significantly once fully in force. A CASP authorised under MiCA in any EU member state – including France – may passport its services to other member states on the basis of the single authorisation. The AMF is the relevant competent authority for French CASP authorisations under MiCA. Operators who build their French entity now with MiCA CASP requirements in mind will avoid a costly re-application process when the regime matures.

For an operator sitting between France and a non-EU hub – for example, a group with custody infrastructure in Switzerland under FINMA supervision or an exchange licensed under VARA in Dubai – the French entity serves a different function. It is the EU-facing regulated subsidiary, not the global operating entity. Banking for such a structure often requires a French or German account for Euro settlement, a separate account for non-EU flow and a clear contractual boundary between the entities. We structure these arrangements regularly, coordinating with allied counsel in the relevant jurisdictions on local-law requirements.

Tax interactions also deserve early attention. A French entity that is a PSAN will be subject to French corporate tax on profits attributed to French operations. The question of how fees, trading gains and custody revenues are allocated between a French subsidiary and non-EU affiliates requires a transfer-pricing analysis. Operators who defer this question until after they are registered often face retrospective exposure.

If a prior application stalled or a banking relationship closed after a French registration, a second read of the structure can surface the underlying cause and the path back. Contact OBOLUS at Map your options.

What does the MiCA transition mean for existing and new French PSANs?

Existing French PSANs will need to transition to MiCA CASP authorisation once the French transposition period closes – the precise grandfathering timeline is set by national legislation implementing MiCA and by the AMF's published transition guidance, which operators should monitor on the AMF's website. The transition is not automatic: a registered PSAN that does not apply for CASP authorisation within the relevant window will lose its ability to operate legally under the new regime.

New entrants face a strategic choice. Applying for PSAN registration now provides an immediate legal basis to operate in France while the transition plays out. Applying for MiCA CASP authorisation directly – through the AMF as the competent authority – positions the entity for passported EU operations from the outset but requires meeting the fuller MiCA organisational and capital requirements on day one. The right path depends on the operator's timeline, capital position and geographic ambitions.

We advise clients in both scenarios. For operators with a short-to-medium launch window, PSAN registration with a documented MiCA upgrade roadmap is typically the more pragmatic approach. For operators building for scale from inception, particularly those with institutional funding, MiCA CASP authorisation from the outset avoids a second filing cycle and signals market credibility earlier.

AML obligations, TRACFIN reporting and the Travel Rule in France

French PSANs are subject to the full weight of France's AML/CFT regime, administered jointly by the AMF and the ACPR. The Travel Rule – the obligation under FATF Recommendation 15 to pass originator and beneficiary data with virtual-asset transfers – applies to French PSANs. The applicable threshold for Travel Rule data transmission, and the specific technical requirements, are set by the French implementation of the FATF standards and the relevant EU directives; operators should confirm current thresholds directly with French legal counsel before building compliance infrastructure.

TRACFIN is France's financial intelligence unit. PSANs are declarants to TRACFIN under French AML law and must file suspicious transaction reports in the prescribed format. Failure to file, or filing in an incorrect format, is a regulatory infringement that can trigger ACPR enforcement independent of any AMF action. In our practice, we have seen operators treat TRACFIN reporting as a back-office formality; it is not. The quality of suspicious-transaction reporting is an active supervisory metric.

KYC requirements for French PSANs align with the applicable EU AML directives. French-specific implementation includes identity verification, UBO disclosure for corporate clients, ongoing monitoring obligations and enhanced due diligence for high-risk clients and politically exposed persons. The AMF's on-site and off-site inspection teams review KYC files as part of their supervisory programme.

Self-assessment: is your business ready for a French PSAN application?

Before instructing counsel on a French PSAN application, an operator should be able to answer the following questions affirmatively. Each represents a common gap that, if unaddressed at filing, generates a gap letter and extends the timeline.

• Does the entity have a registered presence in France with a valid SIRET number, or is it applying as a foreign entity with French clients?
• Has the management team completed the AMF's fit-and-proper questionnaire in draft, and is there documented evidence of relevant professional experience?
• Is an AML/CFT policy in place that specifically addresses TRACFIN reporting, French UBO disclosure requirements and the Travel Rule?
• Has the IT security infrastructure been assessed against the AMF's published technical requirements, with a written report available?
• Is a compliance officer identified, and does that person have direct reporting access to the board?
• For voluntary authorisation: is capital adequacy documentation prepared, and is professional indemnity insurance in place?
• Has the entity's cross-border structure been reviewed for the AMF's expectations regarding intragroup transactions and affiliate controls?

Operators who cannot answer each of these affirmatively should treat the gap as a pre-filing workstream, not a post-submission clarification item.

Related at OBOLUS

• Digital Asset Licensing and Registration – our full-service licensing practice across 70+ jurisdictions, from initial scoping to post-authorisation compliance.
• CASP Authorisation under MiCA for Established Operators – how MiCA changes the compliance map for operators already holding national licences across the EU.
• Crypto Fraud and Asset Recovery in Kazakhstan (AIFC) – cross-border recovery through the AIFC common-law forum for operators with Central Asian exposure.

FAQ

How long does a crypto licence take to obtain?

In France, the AMF does not publish a fixed statutory decision period for PSAN registration, and actual timelines vary with file quality and the authority's caseload. A complete, well-prepared file with no gap letters typically closes in a matter of months. Deficient filings, gap-letter exchanges and ACPR consultations can extend the process significantly. In other EU jurisdictions under MiCA, competent authorities generally have a defined review period following a complete application – operators should confirm the current AMF timetable directly.

Which jurisdiction is best for licensing my crypto business?

There is no universal answer. The right jurisdiction depends on where your clients are, what services you provide, what your banking requirements are and what your capital position supports. France is a strong choice for operators targeting EU retail or institutional clients who need a credible EU regulated entity. Operators seeking faster timelines or lower initial capital thresholds may look at other EU member states or offshore jurisdictions. The correct approach maps the licence, banking and tax stack together before committing to a domicile.

Do I need a separate custody licence?

Under the French PSAN regime, custody of digital assets on behalf of third parties is a regulated service that requires its own registration with the AMF. If you intend to hold client assets alongside providing exchange or brokerage services, your registration must cover custody specifically. Under MiCA, custody is similarly a distinct regulated activity. Operators who provide custody incidentally – for example, a DeFi protocol holding keys in a non-custodial model – should obtain a legal opinion on whether their arrangement constitutes regulated custody before assuming no registration is needed.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around every structure. We map the licence stack across operating, custody and payment layers before you commit – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU and cross-border VASP registration strategies, with a focus on the AMF/PSAN regime and the transition to MiCA CASP authorisation.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.