What a Crypto-Asset Is, and Why the State Cares

1.1Your seat

You joined Halcyon Digital Assets Limited on 12 January 2026 as a junior lawyer, the third member of its Legal & Compliance team. You report to Maeve Ó Riain, the Head of Legal, and work every day with Elena Stavrou, the Head of Compliance. Halcyon is a private company limited by shares, incorporated in Ireland on 9 June 2021. Its registered office is at 22 Windmill Lane, Dublin 2. It has 62 staff and an app.

On 12 November 2025, two months before you arrived, the Central Bank of Ireland authorised Halcyon as a crypto-asset service provider, a "CASP". A CASP is a company whose business is holding or trading crypto-assets for other people (Article 3(1)(15)). The Central Bank of Ireland — "the Central Bank" from here on — is the authority Ireland has named to supervise them. Authorisation is its written permission to be one. Everyone in the office calls it the licence; MiCA, the EU's rulebook for crypto-assets, calls it authorisation. Halcyon was already registered with the Central Bank under the anti-money-laundering (AML) rules, the law against moving criminal money through financial firms.

On your desk is the Compliance Binder: the written policies Halcyon keeps because the law requires them, approved by the Board on the day of authorisation. Its first numbered paragraph says what Halcyon may do.

Five services, in words that will mean something by the end of this chapter. Halcyon may not run a trading platform, an order book matching one client's order against another's, nor give advice or manage portfolios. The company in figures:

€94,000,000 of crypto-assets belong to clients, and Halcyon holds them. To understand what "holds" means, you need to know what a crypto-asset is.

1.2What a crypto-asset is

MiCA's definition is short, and the Binder repeats it.

Take it in three pieces: the ledger, the token and the key.

A distributed ledger is a shared record kept at the same time by many computers that do not trust each other. It has no owner and no head office. A new entry is accepted only when enough of those computers agree it follows the rules, and nobody can quietly alter yesterday's entries. That is the whole trick. The best-known kind is a blockchain; MiCA says "or similar technology" to cover the next invention.

A token is an entry on that ledger: so many units, sitting at such-and-such an address. "A value" means a token people treat as worth something, because others will take it in exchange. "A right" means a token that stands for something else: a claim, a vote, entry to a service. MiCA covers both.

Each address is controlled by a private key, a long secret number. Whoever knows the key can sign an instruction moving the tokens at that address, and the ledger will obey. Nobody else can. There is no password reset, no branch to visit, and no court order the ledger can read. Lose the key, and the tokens sit there forever. Let someone else learn it, and they can move the tokens, irreversibly. A wallet is simply the software or the device that keeps a key and signs with it.

So a crypto-asset is three things at once: a record on a shared ledger, the value or right it stands for, and the key that controls it. Hold that picture. The regulation of crypto-assets is, very largely, the regulation of who holds the keys.

1.3What an exchange does with your money and your keys

Most of Halcyon's clients will never see a key. They open the app, which lets them buy and sell crypto-assets for euro, swap one for another, keep them, and send them to other wallets. Here is what happens when one of them uses it.

The client sends euro from a bank account. It does not stay with Halcyon. The rule says a CASP must place client funds — a client's euro — at a credit institution, the law's word for a bank. It must do so by the end of the next business day (Article 70). The account is in Halcyon's name, held for clients, apart from Halcyon's own money. At 30 September 2025 it held €6,200,000.

The client presses Buy. Halcyon sells the client a crypto-asset from its own stock — that is the exchange service — or carries out the client's order in the market, which is execution of orders. Either way, the app shows a balance. That balance is not on the distributed ledger. It is a line in Halcyon's own books, the register of positions: the record of what each client owns, which MiCA requires a custodian to keep (Article 75). The tokens themselves sit on the ledger at addresses Halcyon controls, in wallets kept for clients.

Those wallets are custody: holding crypto-assets, or the keys to them, for someone else. Halcyon's keys sit in hardware run by Keystone Vault Technologies BV of Amsterdam, its custody technology provider. Nobody signs alone: a withdrawal needs two of Halcyon's operations staff. When a client sends tokens to another wallet, those two staff instruct the signing service, the service signs with the key, and the ledger moves the tokens.

Notice where the client's name appears: on the left, and nowhere else. The ledger shows Halcyon's addresses; it does not know that 48,000 people own pieces of what sits at them. Only the register of positions knows that.

1.4Custody is the whole game

Put the pieces together. The client owns a value or a right. The ledger obeys a key. Halcyon holds the key. So whether the client really owns anything comes down to one question: what happens to those tokens if Halcyon goes wrong?

Before there was a rule, there was no answer. A firm could hold clients' tokens in the same wallet as its own. It could lend them, trade with them, or use one client's tokens to pay another's withdrawal. Nobody outside would know, because the ledger shows only the firm's address. If the firm failed, its clients stood in the queue of an empty company, and the only record saying the tokens were theirs had gone with it.

That is the problem MiCA's custody rules solve. A CASP must keep clients' crypto-assets in wallets separate from its own. It must not use them on its own account: not to trade, lend, pledge or borrow against them, and not to cover another client's withdrawal (Article 70). It must keep the register of positions for each client. And if something on the firm's side loses a crypto-asset, or the key to it, the firm owes the client its market value at the time (Article 75). Policy 4 of the Binder turns those two articles into instructions with an owner and a daily check. At 30 September 2025 those instructions stood between 48,000 clients and €94,000,000.

The objection is real, and you will hear it in the office. Separate wallets, two signatures on every withdrawal and a reconciliation every morning cost engineers and slow every client down. A firm that kept its keys safe and its promises honest never needed a rule to say so. The rule exists because of the firms that did neither, and it charges the honest ones for them.

1.5Why the state cares

A crypto-asset needs no state; the ledger runs without one. So why did the EU write a regulation that runs to Article 149? Four reasons. Each was a problem before it was a rule, and each rule has people who resent paying for it.

People lose money. Before MiCA, a person could be sold a token by an app with no office, on a promise, with no document saying what the token was. When the app closed, the money was gone. MiCA's answer is a duty to act honestly, fairly and professionally, to give information that is clear, fair and not misleading, and to warn clients of the risks (Article 66). The objection: adults may take risks with their own money, and a warning on every screen treats them as children. The answer: 48,000 people at once are not a private matter.

Money is laundered. The ledger does not ask who you are. A criminal with a key can move value across a border in minutes, with no bank in the way. So before MiCA, the EU stretched its AML law to reach crypto firms. Directive (EU) 2018/843 made them obliged entities: businesses the law requires to check who their customers are, watch their transactions and report suspicion. Each must appoint a Money Laundering Reporting Officer (MLRO) to do the reporting. Under that older law a firm like Halcyon was a virtual asset service provider, a VASP; Halcyon registered as one on 17 March 2022, and Elena Stavrou is its MLRO. The objection is privacy: the ledger's virtue was that it did not ask, and the rule makes Halcyon ask all 48,000 to catch the few.

A failure spreads. One exchange failing hurts its clients. A token that many firms hold, or that claims to be as good as euro, failing hurts everyone who trusted it. So MiCA treats tokens that promise a stable value more strictly than the rest. And it makes every CASP hold capital of its own, own funds, so that a loss lands on the firm's owners and not on its clients (Article 67). Halcyon's requirement is €1,600,000; at 31 December 2025 it held €2,100,000. The objection: a company of 62 people is not a bank, and €1,600,000 kept idle is €1,600,000 not spent on the product.

Money belongs to the state. A token that promises to be worth exactly one euro is, to the person holding it, a euro that no bank issued. If enough people hold it, whoever issues it is issuing money, and states guard that power. So MiCA says a token pegged to one currency, an electronic money token or EMT, may be issued only by a credit institution or an electronic money institution (Article 48). The second is a firm licensed to hold people's euro as prepaid balances; both are already supervised for exactly that. Halcyon is neither. The objection: this is the incumbents' rule, handing the euro token to the banks and keeping the builders out.

1.6"Code is law", and the other view

The objections add up to a philosophy the people who built the app hold. The ledger enforces its own rules. It cannot be bribed, cannot freeze an account, cannot go bust. A key is a key. In that world a regulator is the middleman the technology was invented to remove, and every policy in the Binder is a cost the old system charges the new one. Rhys Calloway, the Chief Technology Officer, puts it in one sentence: the code is the law, and the code has never lost anyone's coins.

Fionnuala Bracken, the independent chair of the Board, answers in one sentence too: the code has never lost anyone's coins, and the people around the code have lost plenty. The ledger did not sell the token, hold the key, write the app or go bust. Halcyon did all of those, and 48,000 people trusted it to. When a firm holding €94,000,000 of other people's savings fails, the state will not let it fail quietly. It is not an argument about technology but about who bears the loss, and the state has decided the answer is not the client.

Regulation is the state choosing that answer and charging the firm for it. MiCA has applied in full since 30 December 2024 (Article 149). DORA, the EU law on technology resilience, has applied since 17 January 2025 and treats a CASP as a financial entity, like a bank (Article 2(1)(f)). A company whose business is crypto-asset services now needs authorisation to provide them in the EU (Article 59). Firms already registered under the AML rules were given time to get it; at the time of writing (2026), Ireland's time ran out on 30 December 2025. Halcyon was authorised on 12 November, with seven weeks to spare. Firms that were not had to stop.

1.7What you are here to do

Your job is not to pick a side. It is to make sure Halcyon can show, on any day the Central Bank asks, that it does what the Binder says. Keys where the register says; clients' euro at the bank; every rule with an owner and a record. That is life under authorisation. The Central Bank gave the permission in writing, and it can take it back (Article 64). The Binder is the evidence that it should not.

Chapter 2 is the map of MiCA: the three families of token, the ten services, and why the five Halcyon holds are the five that matter.