What Has ESMA Clarified About Client Fund Safeguarding?
On October 16, 2026, the European Securities and Markets Authority (ESMA) published guidance concerning how crypto-asset service providers manage client funds. The guidance, Q&A 2949, explains the requirements under Articles 70(2) and 70(3) of the Markets in Crypto-Assets Regulation (MiCA).
Under the clarification, an authorised crypto-asset service provider (CASP) may temporarily hold client funds in a payment account provided by a non-bank payment service provider, such as an electronic money institution or a payment institution. During this temporary period, the CASP must continue to comply with the applicable client fund safeguarding requirements.
The key deadline is that client funds covered by Article 70(3), other than e-money tokens, must be placed in an account held with a credit institution or a central bank no later than the end of the business day following receipt. This requirement is designed to strengthen client protection and reduce risks associated with funds remaining within payment intermediaries for extended periods.
ESMA also clarified that the qualifying account must be opened and maintained directly in the CASP's own name or otherwise comply with the applicable legal asset segregation arrangement. A bank account held in the name of a non-bank payment service provider does not satisfy Article 70(3) merely because it was established specifically for the CASP and is technically segregated from other accounts.
Why Do Account Ownership and Legal Rights Matter?
Technical segregation is not necessarily equivalent to sufficient legal protection for client funds. ESMA explained that where a bank account is held by a non-bank payment service provider, the CASP may have a claim against that provider rather than holding the account directly with the bank.
This distinction can become particularly important if the payment intermediary experiences financial distress, operational disruption, or a legal dispute. Even if internal ledgers accurately identify the client funds attributable to each crypto platform, the platform's legal rights may differ from those it would have as the direct bank account holder.
Compliance reviews should therefore go beyond checking whether an account has a separate reference number, uses virtual subaccounts, or is labelled as a client money account in an internal system. Firms should verify the legal account holder, where the funds are actually held, the contractual arrangements, and how client assets would be protected if a third-party provider encountered difficulties.
The clarification is especially relevant to crypto platforms that rely on electronic money institutions, payment institutions, or fintech providers to process fiat deposits and withdrawals. These firms need to examine the entire funds flow, not just their own internal accounting records.
How Should CASPs Implement MiCA Client Fund Safeguards?
The first step is to map the complete client money flow, from the customer's payment and processing by a third-party payment provider to the final placement of funds in an account held with a credit institution or central bank. Firms should document each account holder, account type, actual fund location, and applicable deadline, while identifying any funds that could remain in third-party payment accounts beyond the permitted period.
The second step is to review contractual and banking arrangements. Compliance teams should work with legal, finance, and payment operations teams to confirm whether accounts are held in the CASP's own name or comply with the applicable legal segregation arrangement. Firms relying on third-party-held accounts should assess whether changes to bank onboarding, fund-sweeping processes, or commercial agreements are necessary.
The third step is to establish auditable controls, including daily reconciliations, deadline alerts, investigations of unusual fund movements, and periodic compliance reviews. Records of transfer times, account details, reconciliation results, and remediation actions should be retained to demonstrate how client funds are safeguarded.
KYT tools primarily identify on-chain transaction risks. Safeguarding fiat client funds under MiCA Article 70 also requires appropriate bank account arrangements, legal review, and internal treasury controls. These measures complement one another but cannot replace one another.
ESMA's clarification highlights that client fund protection depends not only on whether funds are separately recorded, but also on whether the account structure and placement arrangements satisfy applicable legal requirements. For crypto platforms operating in the EU, reviewing account ownership, transfer deadlines, and third-party payment arrangements is an important step toward stronger MiCA compliance.