Operating a digital-asset business in France without the right authorisation is not a grey area. The Autorité des marchés financiers (AMF) enforces the PSAN (Prestataire de Services sur Actifs Numériques) regime – France's national VASP licensing and registration framework – and the consequences of non-compliance range from formal enforcement and public blacklisting to severed banking relationships and criminal exposure for senior managers. With the EU's MiCA (Markets in Crypto-Assets Regulation) now in force and the PSAN regime bridging toward CASP authorisation across the EU, the window to structure correctly is narrowing. This page sets out what France requires, how the inbound application process works, where the cross-border complications arise, and how an operator should position itself for the transition ahead.
The direct answer: any business providing digital-asset services to clients in France – including exchange, custody, portfolio management or payment services over crypto assets – must either hold a PSAN registration or authorisation from the AMF, or be prepared to demonstrate it is not in scope. Neither an offshore registration alone nor an EU passport from another member state currently displaces the French PSAN obligation for onshore activity. Under MiCA, a CASP authorisation granted in any EU member state will eventually passport, but that transition creates its own timing risk that operators must manage now.
This page follows the legal basis, the application process, the cross-border realities, a decision point for inbound operators, and the path ahead under MiCA.
What Activities Trigger the PSAN Obligation in France?
The PSAN regime covers a defined list of digital-asset services, and the obligation to register or seek authorisation applies to any provider delivering those services to clients located in France – regardless of where the legal entity is incorporated. The AMF takes an effects-based approach: if French users are actively solicited or onboarded, the regime applies.
The regulated activities span custody of digital assets on behalf of third parties, the purchase and sale of digital assets against legal tender or other digital assets, the operation of a trading platform, portfolio management over digital assets, advice on digital assets, and certain payment services involving crypto assets. Custody and exchange services are the most commonly triggered categories for inbound operators.
The PSAN framework establishes two tiers. The first is a mandatory registration requirement, applying to custody and exchange services; this is the baseline any operator must clear before going live in France. The second is a voluntary authorisation (agrément), which carries a higher compliance burden but confers enhanced credibility with French institutional counterparties and banks. Under the trajectory toward MiCA's CASP regime, the voluntary authorisation track is increasingly the commercially rational choice for operators building a durable EU presence.
Critically, the AMF publishes a public register of approved PSANs and a blacklist of non-compliant providers. Appearing on the blacklist triggers bank account closures, payment processor terminations and cross-border enforcement alerts through ESMA coordination channels. In our practice, we have seen operators delay registration on the assumption that offshore structuring insulates them – only to find French banking relationships suspended within weeks of an AMF alert.
Registration vs. Authorisation: Which Track Does Your Business Need?
The choice between PSAN registration and voluntary authorisation is not merely a compliance formality – it shapes banking access, institutional counterparty relationships and the eventual MiCA transition path.
PSAN registration is mandatory for custody and buy/sell services. The AMF assesses the fitness and propriety of directors and beneficial owners, reviews AML/CFT systems, and checks that the entity meets the applicable financial crime prevention standards drawn from FATF Recommendation 15 on virtual assets. The registration process is designed to be achievable for lean operators, but the AMF has shown a willingness to reject applications where AML programmes are superficial or where beneficial ownership structures are opaque.
The voluntary authorisation (agrément) goes further. It requires a more detailed review of operational resilience, capital adequacy, custody safeguarding arrangements, and conflict-of-interest policies. Authorised PSANs may market to French retail and institutional clients more broadly and have historically had better access to French banking. For a business planning a multi-jurisdiction EU strategy, the authorisation also positions the entity more favourably in the CASP transition queue under MiCA.
Operators targeting only institutional or professional clients in France sometimes ask whether they can rely on an exemption or a lighter-touch regime. The short answer is that the thresholds for full registration are low, and the AMF has not carved out a broad professional-client exemption from the PSAN obligation. Any structure designed to avoid registration while serving French clients should be stress-tested carefully against the AMF's published guidance before go-live.
For a scoped assessment of your France entry structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
How Does the PSAN Application Process Work?
The PSAN registration application is submitted to the AMF and progresses through a sequential review that covers AML/CFT compliance, fitness and propriety of management, and the adequacy of internal controls. The AMF's review timeline varies by application quality and backlog, but operators should plan for a process measured in months rather than weeks for a clean, well-prepared file.
The core application file includes: a detailed description of the services to be offered and the business model; the legal structure of the entity and its group, including a full beneficial ownership map; AML/CFT policies and procedures aligned to French TRACFIN (the national financial intelligence unit) reporting obligations; fitness and propriety documentation for each director and beneficial owner above the applicable threshold; IT and security architecture documentation; and, for the authorisation track, evidence of financial resources and operational resilience arrangements.
French law imposes a local-entity requirement for PSANs: the applicant must be a legal entity incorporated in France or, for EU-based entities post-MiCA, able to demonstrate a qualifying EU authorisation. A branch or representative office of a foreign entity generally does not satisfy the requirement without a separately incorporated French entity. This is a common structural mistake that delays applications significantly.
The AMF may request supplementary information at any stage, and the clock on the formal review period does not start until the file is deemed complete. In our practice, we routinely advise clients to run an internal completeness audit against the AMF's published checklist before formal submission. A single gap in beneficial ownership documentation – a missing KYC certificate for a holding-company shareholder, for example – is sufficient to suspend the review clock.
TRACFIN reporting obligations are active from the date of PSAN registration, not from the date of first transaction. Operators must appoint a dedicated compliance officer and establish a reporting chain before the registration is granted, because the AMF will verify this as part of the application.
Cross-Border Reality: Tax, Banking and the Multi-Jurisdiction Stack
For most inbound operators, the PSAN registration is the entry ticket – but it is not the whole compliance picture. The cross-border realities of tax, banking and the interaction with other EU and non-EU regimes determine whether the French entity is commercially viable.
On tax, France taxes digital-asset gains for businesses under the standard corporate income tax regime, with specific rules governing the treatment of staking rewards, mining income and token issuances. The VAT treatment of crypto-asset exchange services broadly follows the EU VAT Directive framework, which treats exchange services as VAT-exempt financial transactions – but the edges, particularly around utility tokens and NFTs, are jurisdiction-specific and require careful structuring. For cross-border operators running a group structure through, say, a Malta or Luxembourg holding entity, the French transfer-pricing rules and the interaction with the entity's home jurisdiction tax treaty are non-trivial.
On banking, the relationship between PSAN status and French banking access is improving but not resolved. French banks are not required to serve PSANs, and in practice access depends on the bank's own risk appetite, the operator's business model and the strength of the AML/CFT file. Authorised PSANs (agrément) consistently report better banking access than registered-only operators. Operators we advise routinely build a parallel banking strategy across two or three jurisdictions – France, Lithuania and a non-EU hub – to ensure continuity if one relationship breaks down.
The Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer, drawn from FATF standards and implemented in French law) applies to PSAN-registered and authorised entities. Compliance requires a technical solution capable of exchanging Travel Rule data with counterparty VASPs, which in turn raises the question of counterparty due diligence: operators must have policies for transfers to or from unhosted wallets and to VASPs in jurisdictions with weaker Travel Rule implementation.
For an operator already licensed in Singapore (under the MAS Payment Services Act), the UAE (under VARA), or the UK (under FCA MLR registration), the French PSAN requirement is additive. There is no mutual recognition between these regimes at present. Each jurisdiction requires its own regulatory posture, and the practical question is whether a single EU entity – once the MiCA CASP authorisation is in place – can passport across the 27 member states and reduce the number of individual country engagements.
What Does the MiCA Transition Mean for Existing and Prospective PSANs?
MiCA's CASP authorisation regime is now in force across the EU, and the transition from PSAN to CASP is the defining strategic question for any operator with a French digital-asset presence.
Under MiCA, a CASP (Crypto-Asset Service Provider) authorisation granted by any EU national competent authority confers an EU-wide passport. For operators currently registered as PSANs, the French AMF is the natural CASP authorisation home – and the AMF has signalled that it will operate a structured transition process, allowing existing PSANs to migrate to CASP status without starting from scratch. The extent to which prior PSAN work translates to CASP credit is still being clarified through the AMF's published guidance and ESMA's regulatory technical standards.
For new operators entering France now, the strategic question is whether to invest in a PSAN registration as a short-term bridge or to pursue CASP authorisation directly. The answer depends on the business timeline. An operator planning to serve EU clients in six months cannot wait for a CASP authorisation process that may take considerably longer than a PSAN registration. An operator with a 12-to-18-month build runway may find it more efficient to pursue the authorisation track from the outset, avoiding a double compliance cycle.
ESMA has published technical standards under MiCA covering disclosure, reporting and passporting procedures. The content of those standards determines how much of a French PSAN's existing documentation translates directly into a CASP authorisation file. Operators should not assume that a clean PSAN registration automatically accelerates a CASP application – the two regimes have structural differences that require deliberate mapping.
One additional consideration: MiCA introduces specific rules for stablecoin issuers. Operators issuing an asset-referenced token (ART) or e-money token (EMT) in or from France face authorisation requirements that sit alongside – and in some respects above – the CASP regime. These are distinct applications with distinct capital and reserve requirements. An exchange that also issues a stablecoin must manage both tracks simultaneously.
Decision Matrix: Which Profile Should Choose Which Path?
The right entry path depends on the operator's profile, timeline and target market. What follows is a practical guide – not a guarantee of outcome, but a structured way to frame the decision before engaging the AMF.
Profile A – Early-stage exchange, EU-only user base, 3-to-6-month go-live: The mandatory PSAN registration is the minimum viable path. Pursue a clean, well-documented registration file, appoint a French compliance officer before submission, and plan a CASP transition within 18 months. Key risk: underestimating the AML/CFT documentation depth the AMF expects, which delays the clock-start. Key banking note: open parallel accounts in a second EU jurisdiction before the French account is confirmed.
Profile B – Established operator from Singapore or the UAE, seeking EU market access: The French PSAN is the fastest EU entry point if the operator already has strong AML infrastructure. However, the local-entity requirement means incorporating a French SAS or SA before applying. The longer-term strategy is typically to use the French entity as the CASP authorisation anchor and passport into other EU member states, reducing the need for individual country registrations. Key risk: assuming that VARA or MAS authorisation carries weight with the AMF – it does not directly, but it supports the fitness-and-propriety narrative for management.
Profile C – Custody-focused institutional operator building a European offering: The voluntary authorisation (agrément) is the commercially correct choice. French institutional counterparties – asset managers, banks, family offices – expect authorised-PSAN status as a baseline for custody mandates. The higher compliance burden is offset by materially better banking access and the ability to sign institutional master agreements. Key risk: underestimating the operational resilience documentation the AMF requires at the authorisation stage.
In a recent licensing matter, a payments company preparing its French PSAN registration discovered mid-process that its group holding structure included a dormant entity with an undisclosed beneficial owner – a UBO that the operator had not flagged because the entity held below the legal threshold in another jurisdiction. We worked through the restructuring before the AMF file was submitted, avoiding a formal request for supplementary information that would have added several months to the timeline. The registration was granted in the next review cycle.
If a prior application stalled or banking access was refused, a second read can surface the structural reason and the route back. Write to OBOLUS at info@oboluslaw.com. Map your options.
What Are the Most Common PSAN Application Mistakes?
Across the PSAN applications we have supported, a small number of structural and documentary mistakes account for the majority of delays and rejections. Understanding them before submission is the most effective way to manage timeline risk.
The first is an incomplete beneficial ownership map. The AMF requires full transparency on every person or entity that directly or indirectly holds a qualifying interest in the applicant, including through complex group structures or nominee arrangements. A single missing layer – a trustee entity, an offshore holding company, or an undisclosed UBO below a threshold in another regime – is sufficient for the AMF to return the file as incomplete. The review clock stops until the gap is resolved.
The second is an AML/CFT programme that is policy-heavy but procedurally thin. The AMF expects to see not just written policies but evidence that those policies are embedded in operational workflows: who screens customers, how often, against which sanctions lists, and what the escalation path looks like when a suspicious transaction report is triggered. TRACFIN reporting obligations are assessed in detail. Operators that copy a template AML policy without adapting it to their specific business model and customer base consistently face follow-up questions.
The third is the absence of a local compliance officer before submission. The AMF treats the compliance officer appointment as a prerequisite, not a post-approval step. Operators that list a compliance officer located outside France risk a material objection to the application.
A common assumption is that the PSAN process is a simple registration akin to a company filing – a form, a fee, and a three-week wait. In practice, the AMF's review is substantive. It resembles a licensing process more than an administrative registration. Operators that approach it as the former consistently underestimate the preparation timeline and the quality of documentation required.
Related at OBOLUS
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full OBOLUS approach to multi-jurisdiction VASP and CASP authorisation strategy
- Digital-asset custody licensing for institutional clients – custody-specific authorisation, safeguarding and operational resilience requirements
- NFT project legal structuring in Czech Republic – an adjacent EU structuring analysis for token-based projects in Central Europe
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction, licence category and the quality of the application file. Under the French PSAN regime, a complete, well-prepared registration file typically progresses over a period measured in several months. Applications returned for supplementary information restart the review clock. The voluntary authorisation (agrément) track takes longer than basic registration. Under MiCA's CASP regime, timelines will depend on the national competent authority and the complexity of the applicant's business model. Building in adequate preparation time – ideally three to six months before target go-live – is essential.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on your user base, business model, banking requirements, tax position and growth timeline. France offers direct access to the French market and, through MiCA's CASP passport, a route to the wider EU. Other operators favour Lithuania, Malta or the ADGM in Abu Dhabi for different strategic reasons. An offshore registration alone does not allow you to serve clients in regulated markets – including France – without meeting local requirements. We map the licence stack across operating, custody and payment layers before you commit to a structure.
Do I need a separate custody licence?
Under the French PSAN regime, custody of digital assets on behalf of third parties is a separately regulated service that requires its own registration. If your business both operates an exchange and holds client assets, both activities must be covered by your PSAN registration or authorisation. Under MiCA, custody services similarly require explicit CASP authorisation for that activity. Operators sometimes assume that an exchange authorisation implicitly covers custody – it does not. Each regulated activity must be specifically included in the scope of the application and reviewed by the AMF or the relevant national competent authority.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and when a prior application has stalled, we identify the structural reason and the route back. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU and cross-border VASP and CASP authorisation strategy, with a focus on AMF, ESMA and MiCA transition structuring for inbound operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.