What a Crypto-Asset Is, and Why the State Cares

1.1Crypto regulation in one paragraph

MiCA is the EU's rulebook for crypto-assets. A firm that holds or trades crypto-assets for clients needs the regulator's permission first, and then follows MiCA's rules every day. This workbook follows one such firm in its first year under MiCA. You are a junior lawyer in its legal and compliance team, and you help it keep to those rules.

1.2The firm in this workbook

Halcyon Digital Assets Limited is an Irish company with an app. Through the app, 48,000 people buy and sell crypto-assets for euro. They leave their crypto-assets with Halcyon, which holds €94,000,000 of them for its clients.

On 12 November 2025 the Central Bank of Ireland authorised Halcyon as a crypto-asset service provider, or CASP. A CASP is a firm whose business is providing crypto-asset services to clients (Article 3(1)(15)). This written permission is called authorisation, though people in the office say the licence.

Halcyon was not new to regulation. Since 2022 it had been registered under the anti-money-laundering (AML) rules, an older and narrower permission. MiCA has applied in full since 30 December 2024. Firms already registered under the AML rules were given extra time to get authorised, and Ireland's extra time ended on 30 December 2025.

A second EU law, DORA, has applied since January 2025. It sets rules on how financial firms keep their technology running. These are the people and firms you will work with:

On your desk is the Compliance Binder: the written policies the law requires Halcyon to keep. Its first paragraph says what Halcyon may do.

Some services are missing on purpose. Halcyon may not run a trading platform, which matches one client's order against another's. It may not give advice or manage portfolios either. So every new product idea is checked against the five services, and often by you.

1.3What a crypto-asset is

MiCA's definition is short, and the Binder repeats it.

Three ideas sit inside it: the ledger, the token and the key.

A distributed ledger is a shared record kept by many computers at once, and no one owns it. A new entry counts only when enough of those computers agree that it follows the rules. After that, nobody can quietly change it. A blockchain is the best-known kind of distributed ledger.

A token is an entry on that ledger: a number of units at an address. Some tokens hold value because people will take them in exchange. Others stand for a right, such as a claim or entry to a service, and MiCA covers both.

Each address is controlled by a private key, a long secret number. Whoever knows the key can move the tokens at that address, and nobody else can. There is no password reset, and the ledger cannot read a court order. A wallet is the software or device that keeps a key and signs with it.

So if a key is lost, its tokens can never be moved again. If a key is stolen, the thief can move the tokens, and the move cannot be undone. That is why crypto regulation is mostly about who holds the keys. When a custody question reaches you, first find out where the key is.

1.4What happens when a client buys through the app

Most clients never see a key. They use the app to buy, sell, keep and send crypto-assets. Each purchase involves three things: the client's euro, a record and the tokens.

First, the client sends euro from a bank account. Halcyon must place a client's euro at a credit institution (a bank) by the end of the next business day (Article 70). The account is in Halcyon's name but held for clients, apart from Halcyon's own money.

Then the client taps to buy. Halcyon either sells the client a crypto-asset from its own stock, or carries out the client's order in the market. Either way, the app now shows the client a balance.

That balance is not on the ledger. It is a line in Halcyon's own books, the register of positions, which records what each client owns (Article 75). The tokens themselves sit on the ledger, at addresses that Halcyon controls.

Holding crypto-assets or their keys for someone else is called custody. Halcyon's keys sit in hardware run by Keystone Vault, and nobody at Halcyon signs alone. Every withdrawal needs two of its operations staff.

1.5Why the custody rules matter most

The client owns a claim against Halcyon, and Halcyon holds the key that moves the tokens. So the real question is what happens to the client's tokens if Halcyon fails.

Before MiCA, there was often no good answer. A firm could mix clients' tokens with its own and spend them. Nobody outside could tell, because the ledger shows only the firm's addresses. If the firm failed, the only record of who owned what could disappear with it.

MiCA's custody rules close that gap. A CASP must:

• keep clients' crypto-assets in wallets separate from its own;
• never use them on its own account, for example to trade, lend or pledge them;
• never use one client's tokens to cover another client's withdrawal;
• keep a register of positions for each client.

If an incident on Halcyon's side loses a client's crypto-asset or its key, Halcyon is liable to the client, up to the asset's market value at the time (Article 75). Policy 4 of the Binder turns these rules into daily tasks, each with an owner, and Chapter 5 goes through them.

The safeguards cost money and slow clients down. Halcyon's head of technology will tell you that an honest firm never needed them. The answer is that clients cannot tell an honest firm from a dishonest one, so the rule applies to every firm.

1.6Why the state regulates crypto firms

A crypto-asset needs no state, because the ledger runs by itself. The EU still wrote a long regulation, for four reasons. Each reason is a problem the market had before there was a rule.

Clients lose money. Before MiCA, an app with no office could sell a token on a promise, with no document saying what it was. When the app closed, the money was gone. Now a CASP must act honestly, fairly and professionally, give clear information and warn clients of the risks (Article 66).

Criminals launder money. The ledger does not ask who you are, so a criminal with a key can move value across borders in minutes. That is why EU anti-money-laundering law treats crypto firms as obliged entities. They must check who their customers are, watch transactions and report suspicion, and this is the work Elena Stavrou leads as MLRO.

One failure can spread. When a token that many firms hold fails, everyone who trusted it loses, so MiCA is stricter with tokens that promise a stable value. It also makes every CASP keep capital of its own, called own funds, so that losses fall on the firm's owners first (Article 67). Halcyon must hold €1,600,000, and Chapter 3 shows how that figure is set.

Issuing money is the state's job. A token that promises to be worth exactly one euro works like a euro that no bank issued. MiCA calls a token pegged to one currency an electronic money token, or EMT. Only a credit institution or an electronic money institution may issue one (Article 48), and Halcyon is neither.

1.7Who bears the loss when a firm fails

The people who built the app see all this differently. The ledger enforces its own rules, and it cannot be bribed or go bust. In their view, a regulator is the middleman the technology was built to remove. The head of technology puts it in one line: the code is the law, and the code has never lost anyone's coins.

Halcyon's chair answers that the people around the code have lost plenty. The ledger did not sell the token, hold the key or go bust. A firm did those things, and its clients trusted it. So the real argument is about who bears the loss when a firm fails, and the law has decided it should not be the client.

1.8Your job

Your job is not to win that argument. It is to make sure Halcyon can show, on any day the Central Bank asks, that it does what the Binder says. The Central Bank gave its permission in writing and can withdraw it (Article 64). The Binder and the records behind it are the evidence that it should not.

• Learn the five services, and check every new product idea against them.
• When a custody question arrives, first find out where the key is.
• When a client disputes a balance, ask the operations team for that day's check.
• Make sure every rule in the Binder has an owner and a record.

Chapter 2 maps the kinds of token and the services MiCA covers.